Merge Candidate caller authorization hardening

security: authorize candidate owner signer callers
Merge Candidate owner signer separation into dormant integration
2026-07-26 00:24:55 +08:00 · 2026-07-26 00:23:48 +08:00 · 2026-07-25 23:09:34 +08:00 · 2026-07-25 23:07:22 +08:00 · 2026-07-25 19:52:56 +08:00 · 2026-07-25 19:44:09 +08:00
544 changed files with 30565 additions and 68735 deletions
@@ -0,0 +1,3 @@
+d23bb1ec24a7f49359314e04cd2c04c8f38876e45f25a701506499d1b34f270f  MANIFEST-AIOS-V2R1-HERMES-LIFECYCLE-20260721.json
+5ce2894fdf8a22622954a1a10fb09fbab74af04f0260b249615c70236ff31731  RESULT-AIOS-V2R1-HERMES-LIFECYCLE-20260721.md
+ca2ab3c22c2b2b33bbc03e59f1206b999ad1271de3e1938fd3a0b4234c613eef  ../../../docs/aios-v2/AIOS-V2R1-HARDENING-GATE-A-REPORT.md
@@ -0,0 +1,44 @@
+{
+  "schema_version": "aios.evidence.manifest.v1",
+  "generated_at": "2026-07-21T05:50:00Z",
+  "branch": "patch/chatgpt/AIOS-V2R1-HERMES-LIFECYCLE-20260721",
+  "validated_oid": "95d2e52cb55c7b913e89bc6bed2bcdacf67512d4",
+  "evidence_root": "/var/lib/aios-gitops/acceptance/aios-v2r1-hermes-lifecycle-20260721T054205Z",
+  "evidence_hashes": {
+    "steps.tsv": "b2ad20585ba7f576e85657827a0b1db6f252887bbd73bcd718df38623e9d95cf",
+    "final-live-gate.log": "82040c674759dacf587658c5e936c313a1f50e8e2425be48ad891927befdf4fa",
+    "16R.log": "641246927a372ebaa9e6dde8b018b88275b2ba15a442473759b23fb1f215d9cf",
+    "15.log": "b0a474e2a74164f560c4f7572091911f32011c75faccd37a3c7315046275011e",
+    "13.log": "b9f637cca6e97ed893bf38530e05cd33b78e324c5e8865d4c602dfeac22a7710",
+    "12R2.log": "0c431f5f5f1c1b17acda160c917b08c7f4036485016c23e1236b9b6f4a78de67"
+  },
+  "validation": {
+    "candidate_tests": {"passed": 49, "failed": 0},
+    "hermes_lifecycle": {"passed": 17, "failed": 0},
+    "gate_b": {"passed": 10, "failed": 0},
+    "offline_acceptance": {"passed": 8, "failed": 0, "expected_warnings": 1},
+    "openclaw_real_http": "PASS",
+    "restart_recovery": "PASS",
+    "rollback_forward": "PASS",
+    "state_preservation": "PASS",
+    "final_health_corrected_16R": "PASS"
+  },
+  "git_gate": {
+    "oid_match": true,
+    "candidate_clean": true,
+    "active_controller_clean": true,
+    "locked": 0,
+    "prunable": 0,
+    "worktree_total": 88,
+    "worktree_dirty": 10,
+    "global_worktree_clean": false
+  },
+  "resolved_blockers": [],
+  "active_blockers": [
+    "BLK-LIVE-HERMES-FULL-LIFECYCLE-EVIDENCE-MISSING",
+    "BLK-GLOBAL-WORKTREE-CLEANLINESS"
+  ],
+  "overall": "PARTIAL / BLOCKED_GLOBAL_WORKTREE_CLEANLINESS",
+  "release_decision": "STOP_PREPRODUCTION",
+  "secrets_recorded": false
+}
@@ -0,0 +1,16 @@
+# AIOS V2R1 Hermes Lifecycle Result
+
+- Branch: `patch/chatgpt/AIOS-V2R1-HERMES-LIFECYCLE-20260721`
+- Validated OID: `95d2e52cb55c7b913e89bc6bed2bcdacf67512d4`
+- Evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1-hermes-lifecycle-20260721T054205Z`
+- Hermes blocker: `EVIDENCE_COMPLETE / FORMAL_CLOSURE_BLOCKED`
+- Overall: `PARTIAL / BLOCKED_GLOBAL_WORKTREE_CLEANLINESS`
+- Release decision: `STOP_PREPRODUCTION`
+
+Hermes lifecycle `17/17`, candidate `49/49`, Gate B `10/10`, offline acceptance `8/0/1`, OpenClaw real HTTP, restart recovery, rollback/forward, state preservation and corrected final health all passed at the validated OID. The Owner acceptance contract nevertheless forbids formally closing the Hermes blocker until every global gate also passes.
+
+The candidate worktree and active Controller worktree are clean; local, worktree and Gitea OIDs match; locked/prunable are zero. The global authority currently has 10 dirty worktrees out of 88, so the Owner hard gate requiring every worktree to be clean fails.
+
+No RC, Tag Approval Request, Tag, main mutation, force push, production traffic switch or secret disclosure was performed.
+
+See `MANIFEST-AIOS-V2R1-HERMES-LIFECYCLE-20260721.json` and `docs/aios-v2/AIOS-V2R1-HARDENING-GATE-A-REPORT.md`.
@@ -0,0 +1,12 @@
+# V2R1C1 Cleanup Closure
+
+- `CLEANUP_REVIEW=PASS`
+- `ARCHIVE_VALIDATION=PASS`
+- `GLOBAL_WORKTREE_CLEAN=true`
+- `global_dirty_count=0`
+- `locked=0`
+- `prunable=0`
+- Portal Archive OID: `99671cc14d2631f989e0763dc882e4001c50a1ea`
+- Spark Archive OID: `d97cd3642528bd3373fe4cf5161a5d99c0b9285f`
+
+Closure evidence: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-blocker-clear-20260721T075647Z`.
@@ -0,0 +1,57 @@
+{
+  "schema_version": "aios.v2r1c1.deployment-manifest.v1",
+  "vrc": "V2R1C1",
+  "release_branch": "release/AIOS-V2R1C1-20260721",
+  "old_release_oid": "80c4cbde03a82c30648a09b817bc2f03d5402936",
+  "validated_release_parent_oid": "0778a31ec073e7c90003ef091f1d093c16bf22e5",
+  "product_baseline_oid": "fb739f6e8ff9c031d319221ace68dce157694086",
+  "companion": {
+    "branch": "patch/openclaw/AIOS-V2R1C1-COMMAND-V2-COMPANION-20260721",
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
+    "plugin_version": "2.1.0-rc.4",
+    "contract_version": "aios.openclaw.command.v2",
+    "signature_algorithm": "Ed25519",
+    "verification_key_id": "openclaw-v2r1-candidate-ed25519",
+    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671"
+  },
+  "isolated_validation": {
+    "service": "aios-v2r1c1-openclaw-companion.service",
+    "account": "aios-v2r1c1-openclaw",
+    "listen": "127.0.0.1:28789",
+    "accept_v2": true,
+    "accept_v1": false,
+    "public_key_only": true,
+    "production_traffic_switched": false,
+    "result": "PASS"
+  },
+  "previous_plugin": {
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "plugin_version": "2.1.0-rc.3",
+    "artifact_sha256": "d0fd11be4aec03eee9ca24bf1585d9ef3597254ad4b1db0d0137eab4456b5737"
+  },
+  "rollback": {
+    "production_plugin_unchanged": true,
+    "failed_isolated_attempts_rolled_back": true,
+    "previous_plugin_evidence": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z/00-baseline",
+    "previous_oid": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a",
+    "isolated_rollback_forward": "PASS",
+    "production_symlink_modified": false
+  },
+  "release_validation": {
+    "gate_a": "PASS",
+    "gate_b": "PASS",
+    "openclaw_v2_live": "PASS",
+    "openclaw_negative_live": "PASS",
+    "hermes_live": "PASS",
+    "restart_recovery": "PASS",
+    "rollback_forward": "PASS",
+    "final_health": "PASS",
+    "secret_violations": 0,
+    "global_dirty_count": 0,
+    "sync_status": "fully_synced"
+  },
+  "tag_status": "ABSENT",
+  "preproduction_status": "NOT_STARTED",
+  "production_status": "NOT_STARTED"
+}
@@ -0,0 +1,55 @@
+{
+  "schema_version": "aios.v2r1c1.release-evidence.v2",
+  "vrc": "V2R1C1",
+  "semver": "2.1.0-rc.1",
+  "product_baseline_oid": "fb739f6e8ff9c031d319221ace68dce157694086",
+  "old_release_oid": "80c4cbde03a82c30648a09b817bc2f03d5402936",
+  "validated_release_parent_oid": "0778a31ec073e7c90003ef091f1d093c16bf22e5",
+  "release_branch": "release/AIOS-V2R1C1-20260721",
+  "release_evidence_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-release-20260721",
+  "companion_evidence_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
+  "openclaw_companion": {
+    "branch": "patch/openclaw/AIOS-V2R1C1-COMMAND-V2-COMPANION-20260721",
+    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
+    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
+    "plugin_version": "2.1.0-rc.4",
+    "contract_version": "aios.openclaw.command.v2",
+    "signature_algorithm": "Ed25519",
+    "verification_key_id": "openclaw-v2r1-candidate-ed25519",
+    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671"
+  },
+  "step13": {
+    "original_result": "FAIL_HTTP_401",
+    "original_diagnosis_manifest_sha256": "320017cbfc0f31392b4d0fb5996d0e32709982a967d102592ac45efdbdaad91f",
+    "remediated_result": "PASS",
+    "online_negative_evidence_sha256": "57ab8efd19d3bf659a65cbeda830785f6cea9172925a3cac9e027b9b842e644f",
+    "remediated_evidence_sha256": "5db59096c0586fcc0a51851d9a25d0a0b94f2bade45063fab16cc2a729f23130",
+    "task_state": "COMPLETED",
+    "dispatch_state": "COMPLETED",
+    "task_dispatch_audit_consistency": "PASS"
+  },
+  "release_validation": {
+    "static_revalidation": "PASS",
+    "static_evidence_sha256": "c33ffaf9a0f509d6e78bdfdc0848940c166b8a800940e259b7196adab04ec604",
+    "gate_a": "PASS",
+    "gate_b": "PASS",
+    "documentation_sync": "PASS",
+    "secret_scan_violations": 0,
+    "release_metadata": "PASS",
+    "hermes_live": "PASS",
+    "hermes_evidence_sha256": "e6553c99db55c3cdf9e16a4c1e6712064e00c41dc9965d0d179b6b1a2a1ad3ac",
+    "restart_recovery": "PASS",
+    "restart_evidence_sha256": "6031c92cd890dffd1de28ba75d81bed908e7da11a24aa129bcfde8efb23f0149",
+    "rollback_forward": "PASS",
+    "rollback_evidence_sha256": "f3d49c54e3f722facf68df2da3d82a9c82eb576f2c7c8dacb0f62c424d25737c",
+    "final_health": "PASS",
+    "final_health_evidence_sha256": "121cd52c0a4852b818e06be69211ae18b9fcccf976fa064e2a09c54eb8a01300",
+    "global_dirty_count": 0,
+    "sync_status": "fully_synced"
+  },
+  "validation_status": "PASS",
+  "tag_status": "ABSENT",
+  "preproduction_status": "NOT_STARTED",
+  "production_status": "NOT_STARTED",
+  "secrets_recorded": false
+}
@@ -0,0 +1,52 @@
+# V2R1C1 Validation Result
+
+Status: `RELEASE_VALIDATION_PASS / FINAL_METADATA_COMMIT_REVALIDATION_REQUIRED`
+
+Release decision: `STOP_PREPRODUCTION`
+
+## OpenClaw Command v2 Companion
+
+- Source OID: `83f8f878c7da5dd8263f2af2efa80750492e5cb3`
+- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`
+- Plugin version: `2.1.0-rc.4`
+- Contract: `aios.openclaw.command.v2`
+- Signature: `Ed25519`
+- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`
+- Companion unit/contract tests: `PASS`
+- V1 fallback: `REJECTED`
+- Isolated Gateway health: `PASS`
+- Online positive/negative contract: `PASS`
+- AIOS -> OpenClaw real HTTP: `PASS`
+- Task state: `COMPLETED`
+- Dispatch state: `COMPLETED`
+- Task/Dispatch/Audit consistency: `PASS`
+
+## Evidence linkage
+
+- Original failed Release OID: `80c4cbde03a82c30648a09b817bc2f03d5402936`
+- Original HTTP 401 diagnosis: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-release-20260721/pass1-80c4cbde/13-diagnosis`
+- Original manifest SHA256: `320017cbfc0f31392b4d0fb5996d0e32709982a967d102592ac45efdbdaad91f`
+- Companion evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`
+- Validated Release parent OID: `0778a31ec073e7c90003ef091f1d093c16bf22e5`
+- Online negative evidence SHA256: `57ab8efd19d3bf659a65cbeda830785f6cea9172925a3cac9e027b9b842e644f`
+- Remediated Step 13 evidence SHA256: `5db59096c0586fcc0a51851d9a25d0a0b94f2bade45063fab16cc2a729f23130`
+
+## Release validation closure
+
+- Gate A: `PASS`
+- Gate B: `PASS`
+- Documentation sync: `PASS`
+- Secret violations: `0`
+- Release Metadata: `PASS`
+- Hermes live: `PASS`
+- Restart recovery: `PASS`
+- Previous ↔ V2R1C1 isolated rollback/forward: `PASS`
+- Final health: `PASS`
+- Global dirty / locked / prunable: `0 / 0 / 0`
+- OID sync: `fully_synced`
+- Production traffic switched: `false`
+- Tag: `ABSENT`
+
+## Remaining mandatory validation
+
+本次最终元数据闭环提交将形成新的 Release OID。必须针对该最终 OID 再次复验 Gate A、Gate B、文档同步、Secret Scan、Release Metadata 和 OpenClaw 第 13 步正向/负向验证。复验通过前不得创建 Tag 或部署预生产/生产。
@@ -1,486 +0,0 @@
-# Agent Production Deployment Requirements
-
-## Status entering deployment
-
-```yaml
-code_development: COMPLETED
-repository_commit: NOT_CREATED
-production_deployment: NOT_STARTED
-reason_repository_commit_missing:
-  current ChatGPT GitOps runtime has AIOS_GITOPS_WRITES_ENABLED=false
-```
-
-The code bundle is an input artifact. The Agent must place it on a non-main
-integration branch, review it, run acceptance tests, merge it through protected
-main and deploy the API adapter. The Agent must not regenerate or materially
-rewrite the supplied implementation without recording the new diff and tests.
-
-## Frozen production state
-
-Before any change, verify:
-
-```yaml
-main_oid: 875d41c3101093149414292067fd700dc214d4d3
-
-V2R1C5:
-  tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-  peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-  baseline_version: V2R1C5
-  baseline_status: PRODUCTION_DEPLOYED
-  target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-  evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
-```
-
-If authoritative `main` no longer equals the approved base OID, stop with
-`MANUAL_OWNER_REVIEW_REQUIRED / AUTHORIZED_BASE_OID_DRIFT`. Do not silently
-rebase the bundle onto a different base.
-
-## Bootstrap sequence — no additional Owner interaction
-
-Use the following order so that the approved V2R1C6 base OID remains valid and
-the bridge does not create its own authorization deadlock:
-
-1. Verify the supplied archive/patch SHA-256.
-2. Install the bundle into a temporary root-owned staging directory outside the
-   Git worktrees.
-3. Start a localhost-only temporary instance of
-   `aios_authorized_task_writer_api.py` on a dedicated port or Unix socket.
-4. Bind it to the existing authenticated Owner registry and the exact
-   `writer:provision` scope. Do not expose it through the public gateway.
-5. Execute the live V2R1C6 provisioning request while `main` still equals
-   `875d41c3101093149414292067fd700dc214d4d3`.
-6. Verify `READY_FOR_CODE_AUTHORING`, the exact branch OID, writer scope and
-   negative policy tests.
-7. Use the newly created scoped writer to commit this reviewed bundle onto:
-   `agent/v2r1c6-mainline-reconciliation-20260805`.
-8. Stop and remove the temporary bootstrap service and revoke its temporary
-   runtime credential. Preserve its signed grant receipt and audit logs.
-9. Open a protected PR from the V2R1C6 branch. Deploy the permanent bridge only
-   from the reviewed merge commit.
-
-The temporary service is a control-plane bootstrap, not a production release.
-It must retain:
-
-```yaml
-listen_scope: localhost_only
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-This order avoids asking the Owner to approve a second base OID merely because
-the bridge implementation itself advanced `main`.
-
-### Alternative platform-maintenance path
-
-If policy prohibits a temporary localhost bootstrap service, use an existing
-Owner-approved platform-maintenance executor to create:
-
-```yaml
-branch: patch/owner-authorization-writer-bridge-20260806
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-direct_main_push: false
-force_push: false
-tag_write: false
-baseline_write: false
-production_deploy_during_integration: false
-```
-
-Merging that branch before V2R1C6 provisioning changes the authoritative base
-OID. In that alternative only, a new exact Owner base-OID amendment is required.
-The Agent must never substitute the newer `main` OID automatically.
-
-## Files to install on the branch
-
-Copy with the same relative paths:
-
-```text
-active-runtime/app/authorized_task_writer_provisioning.py
-active-runtime/app/aios_authorized_task_writer_api.py
-docs/gitops/authorized-task-writer-provisioning.md
-docs/gitops/openapi-authorized-task-writer-fragment.yaml
-deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
-scripts/smoke_authorized_task_writer_provisioning.py
-tests/test_authorized_task_writer_provisioning.py
-```
-
-Merge the OpenAPI fragment into:
-
-```text
-docs/gitops/openapi-chatgpt-actions.yaml
-```
-
-The final schema must expose:
-
-```yaml
-operationId: provisionAuthorizedTaskWriter
-path: POST /api/task-writer/provision-authorized
-x-openai-isConsequential: true
-```
-
-Do not deploy the fragment as a second standalone OpenAPI document.
-
-## Required review of existing API integration
-
-The adapter expects the existing API handler to provide:
-
-```python
-handler.need(scope)
-handler.body()
-handler.sendj(value, status=200)
-api.H.do_POST
-api.main()
-```
-
-Confirm these contracts against the branch before merge. If the live API has a
-different authentication object shape, make the smallest adapter-only change
-and rerun every test. The core provisioning policy must remain unchanged.
-
-The API authorization registry must grant `writer:provision` only to the
-authenticated Owner role. Agents and ordinary writer tokens must not receive
-this scope.
-
-## Privilege boundary
-
-The API service must remain non-root.
-
-Install a root-owned sudoers rule that allows the API service identity to run
-only these exact commands with `sudo -n --`:
-
-```text
-/usr/local/libexec/aios-grant-signer-adapter
-/usr/local/libexec/aios-grant-validator
-/usr/local/libexec/aios-task-writer-provisioner
-```
-
-Do not allow:
-
-```text
-/bin/sh
-/bin/bash
-/usr/bin/env
-/usr/bin/git
-wildcard executable paths
-SETENV
-arbitrary environment preservation
-```
-
-The governed tools themselves must validate their `--grant-dir` and
-`--result-json` paths. Their binaries must be root-owned, non-symlink, regular,
-executable and not group/world writable.
-
-The signer must access its private signing material only through a runtime
-secret reference. No signing key or token may enter Git, API output, the
-provisioning receipt or systemd environment text.
-
-## Runtime paths and permissions
-
-Create:
-
-```text
-/var/lib/aios-gitops/authorized-writer-bridge
-/var/lib/aios-gitops/authorized-writer-bridge/receipts
-/var/lib/aios-gitops/authorized-writer-bridge/locks
-```
-
-Required properties:
-
-```yaml
-owner: API service identity
-mode: "0700"
-symlink: false
-persistent: true
-```
-
-The directory contains redacted receipts only. Temporary signed grant
-directories are deleted after success or failure.
-
-## Required staging environment
-
-Configure the API service:
-
-```text
-AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
-AIOS_GITOPS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
-AIOS_GITOPS_AUTHORIZED_WRITER_STATE_ROOT=/var/lib/aios-gitops/authorized-writer-bridge
-AIOS_GITOPS_GRANT_SIGNER_ADAPTER=/usr/local/libexec/aios-grant-signer-adapter
-AIOS_GITOPS_GRANT_VALIDATOR=/usr/local/libexec/aios-grant-validator
-AIOS_GITOPS_TASK_WRITER_PROVISIONER=/usr/local/libexec/aios-task-writer-provisioner
-AIOS_GITOPS_OWNER_PROVISION_SCOPE=writer:provision
-AIOS_GITOPS_GOVERNED_USE_SUDO=true
-AIOS_GITOPS_SUDO_PATH=/usr/bin/sudo
-```
-
-Use `aios_authorized_task_writer_api.py` as the API entrypoint. It delegates
-all pre-existing routes and adds only the new endpoint.
-
-## Pre-merge tests
-
-Run from the repository root:
-
-```bash
-python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/aios_authorized_task_writer_api.py
-```
-
-Required result:
-
-```yaml
-unit_tests:
-  total: 9
-  failures: 0
-  errors: 0
-smoke: PASS
-py_compile: PASS
-```
-
-Also run all existing GitOps API and isolated writer tests affected by:
-
-```text
-aios_chatgpt_actions_api
-aios_isolated_writer_api
-isolated_writer_authz
-isolated_writer_token_registry
-single_owner_governance
-OpenAPI schema validation
-```
-
-Any regression blocks merge.
-
-## Staging API acceptance
-
-### Negative authentication
-
-An Agent or non-Owner credential calling the endpoint must receive:
-
-```yaml
-http_status: 403
-error: OWNER_AUTHORIZATION_REQUIRED
-```
-
-### Negative scope tests
-
-Requests enabling any of the following must be denied before signer execution:
-
-```text
-production_change_authorized=true
-tag_change_authorized=true
-baseline_change_authorized=true
-main_write_authorized=true
-allowed_operations containing tag/main/baseline/admin operations
-missing required denied operation
-one_time_use=false
-expiry over 1800 seconds
-```
-
-### Drift and conflict tests
-
-Verify:
-
-```yaml
-wrong_base_oid:
-  http_status: 409
-  error: AUTHORIZED_BASE_OID_DRIFT
-
-existing_unreceipted_target_branch:
-  http_status: 409
-  error: EXISTING_BRANCH_OID_CONFLICT
-```
-
-### Governed tool failures
-
-Independently inject and verify fail-closed behavior for:
-
-```text
-signer unavailable
-signer signature absent
-validator signature_valid=false
-validator signer_trusted=false
-validator plan expired
-provisioner grant_consumed=false
-provisioner writer scope enables main/tag/baseline/force push
-any required negative policy test false
-```
-
-None may create or modify a Git ref.
-
-## Live V2R1C6 provisioning request
-
-After protected merge and API deployment, authenticate as the Owner and submit
-exactly:
-
-```json
-{
-  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
-  "repository": "aios/aios",
-  "base_ref": "refs/heads/main",
-  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
-  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
-  "owner_authorization_reference": "chat-owner-authorization:v2r1c6:20260806",
-  "one_time_use": true,
-  "expires_in_seconds": 900,
-  "production_change_authorized": false,
-  "tag_change_authorized": false,
-  "baseline_change_authorized": false,
-  "main_write_authorized": false,
-  "allowed_operations": [
-    "create_worktree",
-    "create_target_branch_if_absent",
-    "commit_to_target_branch",
-    "push_target_branch"
-  ],
-  "denied_operations": [
-    "direct_main_push",
-    "force_push",
-    "tag_create",
-    "tag_update",
-    "tag_delete",
-    "branch_delete",
-    "repository_admin",
-    "baseline_write",
-    "production_deploy",
-    "production_marker_write",
-    "history_rewrite"
-  ]
-}
-```
-
-This request must be executed by the localhost-only bootstrap instance before
-the bridge code advances `main`. The endpoint must never infer “current main”.
-
-If the Agent chooses the alternative merge-first path, it must stop after the
-merge and obtain an exact Owner amendment for the new merge OID. It must not
-silently replace the approved OID.
-
-## Success response
-
-Require:
-
-```yaml
-status: READY_FOR_CODE_AUTHORING
-grant_consumed: true
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-branch_oid: <exact amended authorized base OID>
-base_oid: <same exact OID>
-main_unchanged: true
-
-writer_scope:
-  workspace_role: task-scoped-isolated-writer
-  writes_enabled: true
-  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
-  allowed_base_oid: <exact amended authorized base OID>
-  allowed_routes:
-    - POST /api/commit-file
-  allow_main_write: false
-  allow_tag_write: false
-  allow_baseline_write: false
-  allow_force_push: false
-```
-
-All seven negative policy results must be true.
-
-Submit the identical request a second time. It must return the same grant and
-branch attestation with:
-
-```yaml
-idempotent: true
-```
-
-It must not run the provisioner again.
-
-## Production postchecks
-
-After API deployment and writer provisioning, independently verify:
-
-```yaml
-existing_routes_regression: PASS
-new_endpoint: PASS
-main_ref: expected reviewed merge commit
-V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
-V2R1C5_baseline_unchanged: true
-new_release_tag_created: false
-production_baseline_changed: false
-```
-
-The deployment of this control-plane bridge does not authorize a V2R1C6
-production release. It only enables scoped code authoring.
-
-## Rollback
-
-If the new API route fails:
-
-1. Stop accepting new provisioning calls.
-2. Restore the previous API entrypoint.
-3. Restart and verify all existing routes.
-4. Preserve receipts and logs.
-5. Revoke any task writer capability already minted.
-6. Do not delete a branch or rewrite a tag.
-7. Revert the protected-main bridge commit through an ordinary reviewed revert
-   PR if source rollback is required.
-
-## Required final Agent report
-
-```yaml
-STATUS: COMPLETED | PARTIALLY_COMPLETED | BLOCKED | FAILED
-
-INTEGRATION:
-  branch:
-  commit:
-  protected_pr:
-  merge_commit:
-  files_changed:
-
-TESTS:
-  unit:
-  smoke:
-  py_compile:
-  regression:
-  fault_injection:
-
-DEPLOYMENT:
-  service:
-  entrypoint:
-  runtime_status:
-  endpoint_status:
-  rollback_verified:
-
-PROVISIONING:
-  owner_authorization_reference:
-  approval_plan_id:
-  grant_id:
-  grant_digest_sha256:
-  signing_key_identity:
-  branch:
-  branch_oid:
-  workspace_path:
-  grant_consumed:
-  idempotent_replay:
-
-CONSISTENCY:
-  main_oid:
-  V2R1C5_tag_oid:
-  V2R1C5_peeled_target_oid:
-  baseline_version:
-  baseline_changed:
-  tags_changed:
-
-SECRETS:
-  runtime_secret_reference_used:
-  plaintext_secret_logged:
-  plaintext_secret_committed:
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
@@ -1,401 +0,0 @@
-# Agent Deployment Requirements: Owner Authorization Broker V2
-
-## Objective
-
-Deploy the audited Owner Authorization Broker that closes the bootstrap gap
-without issuing a new general-purpose Owner credential and without modifying
-`/data/aios-gitops/runtime/secrets/gitops.tokens`.
-
-The broker reuses one existing, non-wildcard Owner credential only to
-authenticate the Owner identity through one pre-existing exact scope. It then
-records an immutable task authorization event and directly invokes the
-existing signed grant -> validator -> one-shot provisioner chain.
-
-Production deployment of V2R1C6 is **not** authorized by this task.
-
-## Fixed bindings
-
-```yaml
-task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch: agent/v2r1c6-mainline-reconciliation-20260805
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-The existing V2R1C5 objects are frozen:
-
-```yaml
-tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-baseline_version: V2R1C5
-baseline_status: PRODUCTION_DEPLOYED
-```
-
-## 1. Package verification
-
-Verify `MANIFEST.sha256` before installation. Reject any mismatch.
-
-Run:
-
-```bash
-python3 -m unittest -v \
-  tests/test_authorized_task_writer_provisioning.py \
-  tests/test_owner_authorization_broker.py
-
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 scripts/smoke_owner_authorization_broker.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/aios_authorized_task_writer_api.py \
-  active-runtime/app/owner_authorization_broker.py \
-  active-runtime/app/aios_owner_authorization_broker_api.py
-```
-
-All checks must pass.
-
-## 2. Existing Owner credential selection
-
-Read only the non-secret registry metadata. Select one existing credential
-that satisfies all of the following:
-
-```yaml
-role: owner
-wildcard_scope: false
-account: exact known Owner identity
-contains_exact_intake_scope: true
-```
-
-Use one existing exact scope such as `commit:create` or `file:write`. Prefer
-the narrowest scope already assigned to the intended Owner.
-
-Do not:
-
- use the historical wildcard Owner credential;
- add `writer:provision` to any bearer token;
- create or modify a bearer credential;
- print, copy or commit bearer-token material.
-
-Record only:
-
-```yaml
-owner_account: <non-secret account>
-credential_id: <non-secret ID, when available>
-intake_scope: <one exact existing scope>
-scope_readback_available: true|false
-```
-
-If `handler.need()` returns the exact scope set, configure the Owner account
-allowlist and leave the credential ID allowlist empty.
-
-If scope metadata is not returned, configure the exact non-secret credential
-ID allowlist. If neither exact scope metadata nor a stable non-secret
-credential ID can be proven, stop:
-
-```yaml
-STATUS: BLOCKED
-REASON: OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE
-```
-
-## 3. Staging installation
-
-Install the four application modules in a root-owned staging directory:
-
-```text
-authorized_task_writer_provisioning.py
-aios_authorized_task_writer_api.py
-owner_authorization_broker.py
-aios_owner_authorization_broker_api.py
-```
-
-The directory and files must not be group/world writable.
-
-Prepare environment values:
-
-```yaml
-AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED: "true"
-AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES: <one exact existing scope>
-AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES: <exact owner account>
-AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS: <exact ID or empty>
-AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS: "900"
-AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT:
-  /var/lib/aios-gitops/owner-authorization-broker
-```
-
-Use the existing signer, validator and provisioner paths. Do not change their
-root governance configuration or disable signature checks.
-
-Start a localhost-only staging instance on a temporary port. Do not replace
-the production service yet.
-
-## 4. Authentication fail-closed tests
-
-The staging endpoint is:
-
-```text
-POST /api/governance/owner-authorizations
-```
-
-Required tests:
-
-```yaml
-unauthenticated:
-  expected: 401
-
-wrong_role:
-  expected: 403
-
-wrong_scope:
-  expected: 403
-
-wildcard_owner:
-  expected: 403
-  error: WILDCARD_OWNER_CREDENTIAL_REJECTED
-
-unallowlisted_owner:
-  expected: 403
-  error: OWNER_IDENTITY_NOT_ALLOWED
-
-production_capability_true:
-  expected: 403
-  error: PRODUCTION_CAPABILITY_REJECTED
-```
-
-A connection failure, 404 or 500 is not an authorization-policy pass.
-
-## 5. Formal provisioning request
-
-Use the selected existing non-wildcard Owner credential through its runtime
-secret reference. Never place the bearer token in the request body, command
-line, shell history, output report or Git.
-
-Request:
-
-```json
-{
-  "action": "AUTHORIZE_TASK_WRITER_PROVISIONING",
-  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
-  "repository": "aios/aios",
-  "base_ref": "refs/heads/main",
-  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
-  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
-  "one_time_use": true,
-  "expires_in_seconds": 900,
-  "production_change_authorized": false,
-  "tag_change_authorized": false,
-  "baseline_change_authorized": false,
-  "main_write_authorized": false,
-  "allowed_operations": [
-    "create_worktree",
-    "create_target_branch_if_absent",
-    "commit_to_target_branch",
-    "push_target_branch"
-  ],
-  "denied_operations": [
-    "direct_main_push",
-    "force_push",
-    "tag_create",
-    "tag_update",
-    "tag_delete",
-    "branch_delete",
-    "repository_admin",
-    "baseline_write",
-    "production_deploy",
-    "production_marker_write",
-    "history_rewrite"
-  ]
-}
-```
-
-The Owner authorization reference is generated by the broker. The caller must
-not submit or invent one.
-
-Expected result:
-
-```yaml
-status: READY_FOR_CODE_AUTHORING
-owner_authorization_event_id: generated
-owner_authorization_reference: generated
-owner_authorization_digest_sha256: generated
-owner_authorization_consumed: true
-approval_plan_id: generated
-grant_digest_sha256: generated
-grant_consumed: true
-
-branch_oid: 875d41c3101093149414292067fd700dc214d4d3
-
-writer_scope:
-  workspace_role: task-scoped-isolated-writer
-  writes_enabled: true
-  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
-  allowed_base_oid: 875d41c3101093149414292067fd700dc214d4d3
-  allow_main_write: false
-  allow_tag_write: false
-  allow_baseline_write: false
-  allow_force_push: false
-```
-
-## 6. Independent post-provisioning verification
-
-Verify the Authority ref:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git rev-parse \
-  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-It must equal:
-
-```text
-875d41c3101093149414292067fd700dc214d4d3
-```
-
-Verify `main` remains unchanged, V2R1C5 tag object and peeled target remain
-unchanged, and the Production Baseline remains V2R1C5.
-
-Verify the broker audit event under:
-
-```text
-/var/lib/aios-gitops/owner-authorization-broker/events/
-```
-
-Requirements:
-
-```yaml
-status: CONSUMED
-wildcard_scope_used: false
-grant_consumed: true
-permissions:
-  directory: "0700"
-  json_files: "0600"
-```
-
-Do not return bearer-token material in the report.
-
-## 7. Commit the broker through the new writer
-
-After `READY_FOR_CODE_AUTHORING`, use only the writer's
-`POST /api/commit-file` route to put this code bundle on:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-Commit the bridge and broker as separate intentional commits when practical:
-
-1. Owner-authorized task-writer bridge.
-2. Audited Owner authorization broker and deployment docs.
-
-Do not merge to `main` directly. Create a protected PR after branch commits
-and tests are complete.
-
-## 8. Permanent service deployment
-
-Only after protected review and merge:
-
-1. Install the reviewed files from the merge commit.
-2. Apply a reviewed systemd drop-in based on the provided example.
-3. Start the wrapper entrypoint:
-   `aios_owner_authorization_broker_api.py`.
-4. Verify all existing API routes still work.
-5. Verify the broker remains localhost/reverse-proxy constrained as intended.
-6. Re-run authentication and policy tests.
-7. Remove the temporary staging instance.
-
-This permanent bridge deployment does not authorize a V2R1C6 production tag,
-Baseline update or application deployment.
-
-## 9. Fail-closed conditions
-
-Stop with `BLOCKED` for any of the following:
-
- Authority `main` no longer equals the fixed base OID.
- Target branch exists at a different OID.
- Only a wildcard Owner credential can authenticate.
- Exact credential scope cannot be proven.
- Owner identity is not explicitly allow-listed.
- Signer, validator or provisioner self-test fails.
- Grant is not marked one-time and consumed.
- Writer allows main, tag, Baseline, force-push or branch-delete operations.
- Audit event contains sensitive material.
- V2R1C5 tag or Baseline changes.
-
-## 10. Required Agent result
-
-```yaml
-STATUS: READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
-
-PACKAGE:
-  manifest_verified:
-  unit_tests:
-  smoke_tests:
-  py_compile:
-
-OWNER_CREDENTIAL:
-  account:
-  credential_id:
-  intake_scope:
-  exact_scope_proven:
-  wildcard_used: false
-  token_logged: false
-
-BROKER:
-  staging_listener:
-  endpoint_status:
-  event_id:
-  authorization_reference:
-  authorization_digest_sha256:
-  event_consumed:
-  audit_permissions_valid:
-
-GRANT:
-  approval_plan_id:
-  grant_digest_sha256:
-  signer_identity:
-  signature_valid:
-  one_time_use:
-  consumed:
-
-BRANCH:
-  name:
-  oid:
-  base_oid:
-  ref_exists:
-  worktree_path:
-  worktree_clean:
-
-WRITER:
-  status:
-  writes_enabled:
-  allowed_branch:
-  allowed_base_oid:
-  allowed_routes:
-  main_write_denied:
-  tag_write_denied:
-  baseline_write_denied:
-  force_push_denied:
-
-POSTCHECK:
-  main_unchanged:
-  V2R1C5_tag_unchanged:
-  baseline_unchanged:
-
-REPOSITORY_INTEGRATION:
-  commit_oids:
-  protected_pr:
-  merged:
-  permanent_bridge_deployed:
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
@@ -1,562 +0,0 @@
-# Agent execution requirements: V2R1C6 task identity overlay
-
-## Required result
-
-The Agent must return one of:
-
- `READY_FOR_CODE_AUTHORING`
- `BLOCKED`
- `FAILED`
-
-The Agent may not report success until the task branch, isolated worktree and
-task writer are independently verified.
-
-This stage is **not** a production deployment. It must not modify `main`,
-V2R1C5, tags, Registry, Production Baseline or production services.
-
-## Fixed authority
-
-```yaml
-task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch: agent/v2r1c6-mainline-reconciliation-20260805
-owner_identity: aiman
-one_time_use: true
-maximum_ttl_seconds: 900
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-## 1. Verify package
-
-Verify the externally supplied package against the published SHA-256 values and
-then verify every entry in `MANIFEST.sha256`.
-
-Do not synthesize a missing archive. Use either the verified ZIP or TAR.GZ.
-
-Required checks:
-
-```yaml
-package_hash_match: true
-manifest_entries_match: true
-unit_tests_pass: true
-smoke_tests_pass: true
-py_compile_pass: true
-```
-
-## 2. Create root-owned staging
-
-Extract to a fresh directory such as:
-
-```text
-/var/lib/aios-gitops/staging/v2r1c6-task-identity-overlay-<nonce>
-```
-
-Requirements:
-
-```yaml
-owner: root
-group: root
-directory_mode: "0700"
-files_not_world_writable: true
-symlinks_rejected: true
-```
-
-Do not overwrite the active runtime tree.
-
-## 3. Re-run target-host tests
-
-From the staging root:
-
-```bash
-python3 -m unittest discover -s tests -v
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 scripts/smoke_owner_authorization_broker.py
-python3 scripts/smoke_task_identity_overlay.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/owner_authorization_broker.py \
-  active-runtime/app/task_identity_overlay.py \
-  active-runtime/app/aios_authorized_task_writer_api.py \
-  active-runtime/app/aios_owner_authorization_broker_api.py \
-  active-runtime/app/aios_task_identity_overlay_api.py \
-  active-runtime/app/aios_task_identity_overlay_cli.py \
-  scripts/call_task_identity_overlay.py
-```
-
-Any failure is `BLOCKED`; do not proceed.
-
-## 4. Prestart Git and production freeze checks
-
-Read from the authority repository:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git rev-parse refs/heads/main
-git --git-dir=/data/aios-gitops/repo.git \
-  show-ref --verify --quiet \
-  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-git --git-dir=/data/aios-gitops/repo.git rev-parse refs/tags/V2R1C5
-git --git-dir=/data/aios-gitops/repo.git rev-parse 'refs/tags/V2R1C5^{}'
-```
-
-Expected:
-
-```yaml
-main_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch_exists: false
-V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
-```
-
-Read Baseline and require:
-
-```yaml
-version: V2R1C5
-status: PRODUCTION_DEPLOYED
-target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
-```
-
-If `main` has drifted, return:
-
-```yaml
-STATUS: MANUAL_OWNER_REVIEW_REQUIRED
-REASON: AUTHORIZED_BASE_OID_DRIFT
-```
-
-If the target branch already exists at another OID, return:
-
-```yaml
-STATUS: MANUAL_OWNER_REVIEW_REQUIRED
-REASON: EXISTING_BRANCH_OID_CONFLICT
-```
-
-Do not delete, reset or force-push the branch.
-
-## 5. Discover active secret references
-
-The overlay does not read or modify `gitops.tokens`, but its issuer must compare
-the new random secret against all active bearer secret references.
-
-Discover references without printing secret contents. At minimum include the
-currently active ChatGPT/GitOps bearer secret reference and any other bearer
-files consumed by the active API.
-
-Pass them as a comma-separated list in:
-
-```text
-AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS
-```
-
-Evidence must contain only paths and SHA-256 match counts, not token values.
-
-If active secret references cannot be enumerated, return:
-
-```yaml
-STATUS: BLOCKED
-REASON: ACTIVE_SECRET_REFERENCE_SET_UNRESOLVED
-```
-
-## 6. Install the transient systemd service
-
-Use the provided template:
-
-```text
-deploy/systemd/aios-v2r1c6-task-identity-overlay.service.example
-```
-
-Substitute only:
-
- verified root-owned staging directory;
- verified active secret-ref path list.
-
-Do not change task ID, repository, base OID, target branch or denied
-capabilities.
-
-The service must listen only on:
-
-```text
-127.0.0.1:19864
-```
-
-Before start, run:
-
-```bash
-systemd-analyze verify \
-  /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
-```
-
-Then:
-
-```bash
-sudo systemctl daemon-reload
-sudo systemctl start aios-v2r1c6-task-identity-overlay.service
-```
-
-Confirm:
-
-```bash
-curl --fail --silent http://127.0.0.1:19864/healthz
-```
-
-Expected:
-
-```yaml
-service: aios-task-identity-overlay
-status: active
-global_token_registry_used: false
-loopback_only: true
-```
-
-Do not expose the port externally.
-
-## 7. Issue the one-time overlay
-
-Use the root-only CLI. The authorization assertion is an audit label for this
-already approved Owner task; it must not be described as an external signed
-event.
-
-Example:
-
-```bash
-sudo env \
-  PYTHONPATH=<staging>/active-runtime/app \
-  AIOS_GITOPS_IDENTITY_OVERLAY_STATE_ROOT=/var/lib/aios-gitops/task-identity-overlays \
-  AIOS_GITOPS_IDENTITY_OVERLAY_SECRET_ROOT=/run/aios-gitops/task-identity-overlays \
-  AIOS_GITOPS_IDENTITY_OVERLAY_TASK_ID=V2R1C6_TASK_SCOPED_WRITER_PROVISIONING \
-  AIOS_GITOPS_IDENTITY_OVERLAY_OWNER_IDENTITY=aiman \
-  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_REF=refs/heads/main \
-  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_OID=875d41c3101093149414292067fd700dc214d4d3 \
-  AIOS_GITOPS_IDENTITY_OVERLAY_TARGET_BRANCH=agent/v2r1c6-mainline-reconciliation-20260805 \
-  AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS=<verified-secret-ref-list> \
-  python3 <staging>/active-runtime/app/aios_task_identity_overlay_cli.py \
-    issue \
-    --ttl-seconds 900 \
-    --authorization-assertion-ref owner-session:V2R1C6:approved-20260806 \
-    --operator-identity <audited-agent-identity> \
-    --result-json /run/aios-gitops/v2r1c6-overlay-issued.json
-```
-
-The result must contain:
-
-```yaml
-status: OVERLAY_ACTIVE
-idempotent: false
-overlay_id: present
-secret_ref: under /run/aios-gitops/task-identity-overlays
-expires_at: within 900 seconds
-```
-
-It must not contain a token.
-
-Verify:
-
-```yaml
-secret_file_mode: "0600"
-metadata_contains_raw_token: false
-token_hash_unique_across_configured_secret_refs: true
-```
-
-## 8. Negative tests
-
-Before the valid request:
-
-1. No Authorization header must return HTTP 401.
-2. A random wrong bearer must return HTTP 401.
-3. A request with `production_change_authorized=true` must be rejected.
-4. A request with another base OID or branch must be rejected.
-5. The valid overlay must remain `ACTIVE` after pre-auth request-validation
-   failures.
-
-Do not use the global Owner or ChatGPT bearer credential for this endpoint.
-
-## 9. Send the valid request
-
-Use:
-
-```text
-deploy/v2r1c6-task-writer-authorization-request.json
-```
-
-Use the provided client so the bearer is not placed in argv, shell history or
-logs:
-
-```bash
-sudo python3 <staging>/scripts/call_task_identity_overlay.py \
-  --secret-ref <secret_ref_from_issue_result> \
-  --request-json <staging>/deploy/v2r1c6-task-writer-authorization-request.json \
-  --url http://127.0.0.1:19864/api/governance/owner-authorizations \
-  --result-json /var/lib/aios-gitops/v2r1c6-overlay-provision-result.json
-```
-
-Required result:
-
-```yaml
-http_status: 200
-status: READY_FOR_CODE_AUTHORING
-owner_authorization_consumed: true
-grant_consumed: true
-identity_overlay_consumed: true
-identity_overlay_secret_removed: true
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-branch_oid: 875d41c3101093149414292067fd700dc214d4d3
-```
-
-The result must not include:
-
- bearer token;
- private key;
- signer secret;
- raw signature;
- credential value.
-
-## 10. Independent acceptance
-
-Verify the branch:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git \
-  rev-parse refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-It must equal:
-
-```text
-875d41c3101093149414292067fd700dc214d4d3
-```
-
-Verify worktree evidence returned by the provisioner:
-
-```yaml
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-head_oid: 875d41c3101093149414292067fd700dc214d4d3
-detached_head: false
-worktree_clean: true
-writer_status: active
-writes_enabled: true
-allowed_routes:
-  - POST /api/commit-file
-allow_main_write: false
-allow_tag_write: false
-allow_baseline_write: false
-allow_force_push: false
-```
-
-Run policy negative tests against the task writer and require explicit policy
-denials for:
-
- main write;
- another branch;
- tag create/update;
- Baseline write;
- force push;
- branch delete.
-
-Network errors, 404, 500 and stopped-service failures do not count as policy
-denials.
-
-## 11. Stop and clean up the overlay
-
-After `READY_FOR_CODE_AUTHORING`:
-
-```bash
-sudo systemctl stop aios-v2r1c6-task-identity-overlay.service
-sudo systemctl disable aios-v2r1c6-task-identity-overlay.service || true
-sudo rm -f /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
-sudo systemctl daemon-reload
-```
-
-Verify:
-
-```yaml
-overlay_listener_stopped: true
-overlay_secret_removed: true
-global_token_registry_unchanged: true
-disabled_owner_record_unchanged: true
-active_chatgpt_bot_record_unchanged: true
-audit_metadata_retained: true
-```
-
-The root-owned staging directory may be retained until the code is committed,
-then removed after checksum-confirmed repository integration.
-
-## 12. Commit the developed code through the task writer
-
-Only after writer acceptance, use `POST /api/commit-file` to commit the
-verified package contents to:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-Commit in reviewable groups:
-
-1. authorized task-writer bridge;
-2. Owner authorization broker;
-3. task identity overlay;
-4. tests, docs, OpenAPI and deployment templates.
-
-Do not include:
-
- package archives;
- runtime tokens;
- `/run` or `/var/lib` state;
- test result files containing host paths;
- secret references containing values;
- generated credentials.
-
-Run the complete 40-test suite from the branch after commits.
-
-## 13. Protected PR
-
-Create a protected PR from:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-to:
-
-```text
-main
-```
-
-The PR must state:
-
- this change closes Owner authorization bootstrap gaps;
- the overlay is localhost-only and one-time;
- the global token registry is not modified;
- no production release is authorized;
- V2R1C5 tag and Baseline remain unchanged.
-
-The Agent must not merge without the repository's normal protected review.
-
-## 14. Required Agent report
-
-```yaml
-STATUS:
-  READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
-
-PACKAGE:
-  zip_sha256:
-  tar_gz_sha256:
-  manifest_entries:
-  manifest_matched:
-
-TESTS:
-  unit_total:
-  unit_passed:
-  smoke_bridge:
-  smoke_broker:
-  smoke_overlay:
-  py_compile:
-
-PRESTART:
-  main_oid:
-  target_branch_previously_absent:
-  V2R1C5_tag_oid:
-  V2R1C5_peeled_target:
-  baseline_unchanged:
-
-OVERLAY:
-  overlay_id:
-  status:
-  secret_ref:
-  secret_file_mode:
-  token_hash_unique:
-  global_registry_used: false
-  listener:
-  expires_at:
-  consumed:
-  secret_removed:
-
-NEGATIVE_TESTS:
-  unauthenticated_401:
-  wrong_token_401:
-  production_capability_denied:
-  wrong_base_denied:
-  wrong_branch_denied:
-
-OWNER_AUTHORIZATION:
-  event_id:
-  reference:
-  consumed:
-
-GRANT:
-  approval_plan_id:
-  grant_id:
-  grant_digest_sha256:
-  signature_valid:
-  consumed:
-
-BRANCH:
-  name:
-  oid:
-  base_oid:
-  ref_exists:
-  worktree_path:
-  worktree_clean:
-
-WRITER:
-  status:
-  writes_enabled:
-  allowed_branch:
-  allowed_base_oid:
-  allowed_routes:
-  main_write_denied:
-  tag_write_denied:
-  baseline_write_denied:
-  force_push_denied:
-
-REPOSITORY_INTEGRATION:
-  commits:
-  tests_after_commit:
-  protected_pr:
-  merged: false
-
-POSTCHECK:
-  main_unchanged:
-  V2R1C5_tag_unchanged:
-  baseline_unchanged:
-  global_token_registry_unchanged:
-  overlay_listener_stopped:
-  overlay_secret_removed:
-
-SECRETS:
-  plaintext_logged: false
-  plaintext_committed: false
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
-
-## Fail-closed conditions
-
-Return `BLOCKED` and stop on any of:
-
- authoritative main OID drift;
- target branch conflict;
- inability to enumerate active secret references;
- secret hash collision;
- overlay not bound to the exact task/base/branch;
- non-loopback listener;
- raw secret in result or logs;
- Owner Authorization Broker event not created;
- signer/validator/provisioner failure;
- grant not consumed;
- branch OID mismatch;
- writer exposes main/tag/Baseline/force-push permissions;
- V2R1C5 tag or Baseline changes.
-
-Never fall back to the shared `gitops-write-bot.token`, a wildcard credential,
-manual `gitops.tokens` edits or a direct Git ref write.
@@ -0,0 +1,394 @@
+# AIOS V2R1 生产候选报告
+
+- 候选版本：`V2R1C0-candidate`
+- 候选分支：`integration/aios-v2r1-cto-production-candidate-20260720`
+- 报告语言：中文
+- 架构负责人：AIOS V2 CTO
+- 当前状态：代码与文档闭环已完成；精确 Commit 测试、真实 Runtime 联调和预发布验证待执行
+
+## 1. 执行摘要
+
+AIOS V2R1 Candidate 已完成以下核心建设：
+
+- AIOS 唯一控制面；
+- Tenant、Agent、Task、Policy、Approval 和 Audit 权威模型；
+- SQLite WAL 候选持久化与重启恢复；
+- Execution Orchestrator；
+- OpenClaw 签名命令、Adapter、Transport、Health 和 Audit Callback；
+- Hermes tenant/cell/profile 分区、Queue、Worker Lease、Heartbeat 和 Result；
+- Agent Execution Evidence；
+- Web Console；
+- GitOps Status；
+- systemd、Docker、Compose、Healthcheck 和 Rollback；
+- 用户需求、目标架构、迁移策略、模块契约、追踪矩阵、文档治理和 ADR；
+- 文档—代码匹配检查器；
+- 全量验收入口；
+- OpenClaw 预发布部署任务；
+- Codex 架构监督和阻塞处理任务。
+
+本报告不把“代码已提交”误报为“生产已验证”。以下状态仍需由无人值守任务执行并形成证据：
+
+- 精确 Candidate Commit 的自动测试；
+- 真实 OpenClaw Runtime 联调；
+- Hermes 长任务、Worker 崩溃和 Lease Recovery 演练；
+- systemd/Docker 预发布部署；
+- 重启恢复与回滚演练；
+- 本地仓库与 Gitea Candidate OID 一致验证；
+- 身份代理、安全、性能和容量验证；
+- Owner 对合并、Tag 和生产部署的批准。
+
+## 2. 用户需求完成情况
+
+| 需求 | 代码状态 | 测试状态 | 预发布状态 |
+|---|---|---|---|
+| AIOS 唯一控制面 | 已实现 | 已定义 | 待验证 |
+| 复用 OpenClaw/Hermes/Agent Router | 已实现 | 已定义 | 待真实联调 |
+| OpenClaw/Hermes 解耦 | 已实现 | 已定义 | 待旁路冻结验证 |
+| 全面 Web 化 | 候选实现完成 | 冒烟测试待执行 | 待反向代理接入 |
+| 多租户隔离 | 已实现 | Domain 负向测试已定义 | 待全链路安全验证 |
+| 统一任务生命周期 | 已实现 | 已定义 | 待精确 Commit 执行 |
+| 策略与审批 | 已实现 | 部分测试待补强 | 待身份代理验证 |
+| 幂等与并发安全 | 已实现 | 基础测试已定义 | 待压力和并发验证 |
+| 执行证据 | 已实现 | 已定义 | 待外部执行器持续回写 |
+| GitOps 唯一流程 | 已实现并修复 Controller 冲突 | Runtime 部分验证 | 待双目标持续镜像证据 |
+| 持久化与恢复 | 已实现 | 重启恢复测试已定义 | 待预发布演练 |
+| 审计与合规 | 已实现候选 | 部分断言待补强 | 待不可变外部固化 |
+| 密钥安全 | 引用模式已实现 | 基础扫描纳入验收 | 待 Secret Provider 联调 |
+| 部署与回滚 | 资产完成 | 验收脚本已定义 | 待实际演练 |
+| 文档与代码同步 | 已实现门禁 | 待精确 Commit 执行 | 待接入持续验收 |
+
+## 3. 目标架构
+
+```text
+浏览器 / Web Console / Public API
+                 |
+                 v
+          AIOS 唯一控制面
+ Tenant | Agent | Task | Policy | Approval | Audit
+                 |
+                 v
+       Execution Orchestrator / Agent Router
+             /                 \
+            v                   v
+   OpenClaw Adapter       Hermes Boundary
+            |                   |
+            v                   v
+   OpenClaw Runtime       Hermes Workers
+             \                   /
+              v                 v
+       结果回写 + 审计 + 执行证据
+```
+
+权威边界：
+
+- AIOS：租户、身份、Agent、任务、策略、审批、审计和执行证据；
+- Agent Router：调度与路由；
+- OpenClaw：签名命令执行、取消、状态、健康和回调；
+- Hermes：队列、Worker、Lease、Heartbeat 和结果；
+- Web：只调用 AIOS API；
+- GitOps：所有代码、文档、部署和修复变更入口。
+
+## 4. 实现清单
+
+### 4.1 Control Plane
+
+```text
+active-runtime/app/aios_v2/control_plane.py
+active-runtime/app/aios_v2/persistence.py
+active-runtime/app/aios_v2/gateway.py
+active-runtime/app/aios_v2/app.py
+active-runtime/app/aios_v2/orchestrator.py
+active-runtime/app/aios_v2/execution_tracking.py
+active-runtime/app/aios_v2/gitops_status.py
+active-runtime/app/aios_v2/console.py
+```
+
+### 4.2 OpenClaw
+
+```text
+active-runtime/app/aios_openclaw/contract.py
+active-runtime/app/aios_openclaw/adapter.py
+active-runtime/app/aios_openclaw/transport.py
+active-runtime/app/aios_openclaw/health.py
+active-runtime/app/aios_openclaw/callback.py
+```
+
+### 4.3 Hermes
+
+```text
+active-runtime/app/aios_hermes/contract.py
+active-runtime/app/aios_hermes/adapter.py
+active-runtime/app/aios_hermes/worker.py
+```
+
+### 4.4 测试与治理
+
+```text
+tests/aios_v2_candidate/test_candidate_flow.py
+tools/aios_v2_docs_code_check.py
+deploy/aios-v2/acceptance/run-all.sh
+```
+
+### 4.5 部署
+
+```text
+deploy/aios-v2/systemd/aios-v2.service
+deploy/aios-v2/env/aios-v2.env.example
+deploy/aios-v2/docker/Dockerfile
+deploy/aios-v2/docker/compose.yaml
+deploy/aios-v2/healthcheck/check.sh
+deploy/aios-v2/rollback/rollback.sh
+```
+
+### 4.6 文档与任务
+
+```text
+docs/aios-v2/
+tasks/openclaw-production-deploy-task.yaml
+tasks/codex-production-supervisor-task.yaml
+```
+
+## 5. 多租户与安全设计
+
+### 5.1 权威上下文
+
+```text
+tenant_id
+principal_id
+session_id
+trace_id
+task_id
+policy_version
+idempotency_key
+```
+
+### 5.2 OpenClaw
+
+- HMAC-SHA256 规范化签名；
+- 签名绑定 tenant/task/trace/action/payload/idempotency/time；
+- Runtime Result 身份字段必须匹配；
+- Secret 只通过受保护文件或引用解析。
+
+### 5.3 Hermes
+
+- tenant/cell/profile 分区；
+- Worker Lease 与 Heartbeat；
+- revision 乐观并发；
+- Lease 过期自动回到 QUEUED；
+- Worker 完成前停止 Heartbeat，避免 revision 竞态。
+
+### 5.4 Web/API
+
+- 可信代理注入 `X-AIOS-*`；
+- 浏览器不选择租户；
+- CSP、no-store、nosniff、DENY frame、no-referrer；
+- 应用端口不得直接暴露公网。
+
+### 5.5 GitOps
+
+- Controller detached + clean；
+- 禁止 fetch 到已检出本地分支；
+- 所有修改进入分支、Commit、测试和统一审查；
+- 明文 Secret 门禁；
+- 文档变化与代码变化同步门禁。
+
+## 6. 持久化策略
+
+候选版：
+
+- SQLite WAL；
+- `synchronous=FULL`；
+- `BEGIN IMMEDIATE`；
+- 原子 Snapshot；
+- schema version；
+- 状态目录与代码版本分离；
+- Execution Evidence 租户分区原子 JSON。
+
+已知限制：
+
+- 单进程候选优先；
+- 尚无生产 RLS、多实例 HA、PITR 和容量证据；
+- 后续必须通过新 ADR 迁移到生产数据层。
+
+## 7. 测试与验收
+
+### 7.1 文档—代码匹配
+
+```bash
+python3 tools/aios_v2_docs_code_check.py \
+  --base-ref integration/aios-v2r1-cto-production-candidate-20260720
+```
+
+### 7.2 候选测试
+
+```bash
+python3 -m unittest discover \
+  -s tests/aios_v2_candidate \
+  -p 'test_*.py' \
+  -v
+```
+
+覆盖：
+
+- OpenClaw 完整执行；
+- Hermes 完整执行；
+- 跨租户拒绝；
+- SQLite 重启恢复；
+- Execution Evidence。
+
+### 7.3 全量验收
+
+```bash
+bash deploy/aios-v2/acceptance/run-all.sh
+```
+
+可选在线健康检查：
+
+```bash
+AIOS_RUN_LIVE_HEALTHCHECK=1 \
+  bash deploy/aios-v2/acceptance/run-all.sh
+```
+
+### 7.4 健康检查
+
+```bash
+bash deploy/aios-v2/healthcheck/check.sh
+```
+
+检查：
+
+- systemd；
+- HTTP Health；
+- 状态目录；
+- SQLite quick_check；
+- GitOps detached/clean；
+- Evidence 文件。
+
+## 8. 部署方式
+
+### 8.1 systemd
+
+```text
+/etc/aios-v2/aios-v2.env
+/opt/aios/current
+/var/lib/aios-v2
+```
+
+运行用户：`aios`。
+
+安全选项：NoNewPrivileges、ProtectSystem、ProtectHome、PrivateTmp、Capability 限制。
+
+### 8.2 Docker/Compose
+
+- 非 root UID/GID；
+- Read-only root filesystem；
+- Drop all capabilities；
+- 独立 State Volume；
+- HTTP Healthcheck；
+- Secret 文件只读挂载。
+
+## 9. 回滚
+
+```bash
+bash deploy/aios-v2/rollback/rollback.sh <previous-release>
+```
+
+原则：
+
+- 回滚前自动备份状态；
+- 默认只回滚代码；
+- 状态恢复需显式 `AIOS_V2_RESTORE_STATE=1`；
+- 回滚后必须执行健康检查；
+- 目标版本失败时自动恢复 previous release。
+
+## 10. 无人值守任务
+
+### OpenClaw
+
+任务：`tasks/openclaw-production-deploy-task.yaml`
+
+职责：
+
+- 预发布部署；
+- 健康检查；
+- Runtime 联调；
+- 小型部署与 Runtime Bug 修复；
+- 证据回写。
+
+### Codex
+
+任务：`tasks/codex-production-supervisor-task.yaml`
+
+职责：
+
+- 架构监督；
+- 阻塞分析和跨模块修复；
+- 文档、测试和安全审查；
+- 发布建议。
+
+所有修改和阻塞必须进入 Git 和 Execution Evidence，最终统一审视。
+
+## 11. 当前已知风险
+
+| 风险 | 级别 | 当前处理 |
+|---|---|---|
+| 精确 Candidate Commit 尚未执行全部测试 | 高 | OpenClaw 执行，Codex 监督 |
+| 真实 OpenClaw Runtime 尚未联调 | 高 | 预发布任务必须完成 |
+| 候选 SQLite 不支持生产多实例 HA | 高 | Candidate 单实例；后续 ADR 迁移 |
+| 身份代理 Header 防伪尚未环境验证 | 高 | 预发布安全检查 |
+| Web Console 为候选只读 MVP | 中 | 生产前补充 E2E 与安全验证 |
+| 部分策略负向、并发和审计测试待补强 | 中 | Codex 登记 blocker 并补充 |
+| 本地/Gitea 自动双写状态仍需持续证明 | 中 | 验收记录 OID |
+| 性能、容量和 SLO 尚无实测 | 中 | 预发布基准测试 |
+| 外部不可变审计固化尚未实现 | 中 | 生产数据层阶段完成 |
+
+## 12. 发布 Gate
+
+### 允许进入预发布
+
+条件：
+
+- Candidate 分支可见；
+- 文档完整；
+- 任务合同已生成；
+- 部署资产存在；
+- 无明文 Secret。
+
+### 允许进入合并审查
+
+条件：
+
+- 全量验收通过；
+- OpenClaw/Hermes 联调通过；
+- 重启和回滚通过；
+- 严重/高风险 blocker 已解决；
+- Codex 输出正向监督结论；
+- 本地/Gitea OID 一致。
+
+### 允许生产发布
+
+条件：
+
+- Owner 明确批准；
+- Merge 与 Tag 通过受控流程；
+- 生产配置、Secret 和反向代理准备完成；
+- 发布窗口、观察指标、回滚负责人明确。
+
+## 13. 当前结论
+
+**代码和正式中文文档已经达到候选闭环状态，但尚不能宣称生产已验证。**
+
+下一阶段由 OpenClaw 执行预发布部署和低风险 Bug 修复，由 Codex 监督架构、文档、安全、测试和阻塞。所有过程证据统一进入系统，满足 Gate 后再请求 Owner 批准。
+
+## 14. 更新规则
+
+以下变化必须更新本报告：
+
+- Candidate Commit；
+- 测试结果；
+- 部署和回滚结果；
+- Blocker 和风险；
+- OpenClaw/Codex 任务状态；
+- 文档—代码匹配状态；
+- Gitea OID；
+- 发布建议和 Owner 决策。
@@ -1,9 +0,0 @@
-{
-  "schema": "aios.v2r1c7.engineering-build-receipt.v1",
-  "version": "V2R1C7",
-  "base_oid": "b356dec2ac5bd2a5f721aa73f8fd1902f9c65632",
-  "production_deployed": false,
-  "tag_created": false,
-  "baseline_changed": false,
-  "deployable": true
-}
@@ -0,0 +1,8 @@
+# Changelog
+
+## V2R1C1 - 2.1.0-rc.1
+
+- 固定发布基线为 `fb739f6e8ff9c031d319221ace68dce157694086`。
+- 收口 Hermes 生命周期、Grant 隔离、Dispatch 恢复、运行证据和回滚/前滚验证。
+- Portal Adapter 与 Spark Provisioning 仅保留在 Archive，不属于产品发布图。
+- Future Incubator 保持隔离，不属于 V2R1C1 发布输入。
@@ -1,21 +0,0 @@
-bec7da1adb75bf5feaa63c60ec6d03adf15d7508742a486207033d000f72d4ff  AGENT_DEPLOYMENT_REQUIREMENTS.md
-251b46e51ce09aa2fd843bee48ef24a5608f31d24c599841f086ceb25c1a1715  README.md
-783f68ec4f00a11d43ceed536196bfedccaf6614f6db9805f7b36d24e5fa7bc2  TEST_RESULTS.json
-9208325e5b2e6f5ba6b64e000bc21d14d9f2f214e3ad33dd79857e85218fd6c2  VERSION
-c4b24b65195077716983acdc8611f705324413a74453858994ba51541957afd4  active-runtime/app/aios_authorized_task_writer_api.py
-8a1935fa098d47ac02ce51bbd9fd5fad7cf9ab9374ea3de5f630679b96681d84  active-runtime/app/authorized_task_writer_provisioning.py
-0997ab8332985c7124f334c4e49735d8833326578acc61a61a389bf792424de3  active-runtime/app/deployment_state.py
-dd3f8b1cab88e005a291f077807873c381e8ca92fe863dc05817925f0dff9613  active-runtime/app/v2r1c6_privacy_tools.py
-9e45025c41068cafdea2f360edfc4146a5459b0a6bcfbf1403206fc0161e7bac  active-runtime/app/v2r1c7_health_service.py
-c96ba560d69f6c2eb700b9f2b42a32e394dadd00dffb23bbefdb9fb3e1571c0d  deploy/aios-v2/systemd/aios-v2r1c7-production.service
-a05d4e8038fdb866ce17d4fb8a54798a268a1e8d44ff2cbc559069fa6ab2a667  deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
-a60dac51802bff67c2cfff61acdeb0a3a05d74a4f6cb47e3f78295ceb5c6acd9  docs/gitops/authorized-task-writer-provisioning.md
-2690f76452bceddda90c728278c600bcebd533db24776e2966423c5a8655e4b5  docs/gitops/openapi-authorized-task-writer-fragment.yaml
-560e5d9af8a8e2ec60ec31cf8659a7982b93ea09b7adb486b738ea2fba460d70  release-manifests/V2R1C7.json
-81a423c7814f81cb888b60a538c153e549b2be9099c881c968d55ae84efddc57  scripts/build_v2r1c7_release_artifact.py
-64c78dabffb05c8851f87b2a27c43bd1f21728dca586397d03a6bc22906a906c  scripts/probe_v2r1c7_health.py
-5419dc7de0f50908ad0ef1dac74172fce811bb7b45f314a6e1c1bb9ce618324d  scripts/rollback_v2r1c7_release.sh
-54e2845d2c3c026323ad45515e082d661e3b461feb3bfefedf5adc52db2d7b78  scripts/smoke_authorized_task_writer_provisioning.py
-32a860e28d5afc105f413d878a13fb8600fa74874dbd3bc4c031ef3efa17896a  scripts/verify_v2r1c7_release.py
-3cce2b744326fe12b89bcad3cd352c77738950964bf8519e72cb5e9c7a5dfbfc  tests/test_authorized_task_writer_provisioning.py
-8f3153c625241f60b65109eeac045e8aed7661d95f3a10f0b32ba3e0e9ac0a85  versions/V2R1C7.json
@@ -1,25 +0,0 @@
-{
-  "git_branch_created": false,
-  "git_commit_created": false,
-  "production_mutation": false,
-  "py_compile": {
-    "files": [
-      "active-runtime/app/authorized_task_writer_provisioning.py",
-      "active-runtime/app/aios_authorized_task_writer_api.py"
-    ],
-    "status": "PASS"
-  },
-  "schema": "aios.authorized-task-writer-bridge-test-report.v1",
-  "secrets_included": false,
-  "smoke": {
-    "command": "python3 scripts/smoke_authorized_task_writer_provisioning.py",
-    "status": "PASS"
-  },
-  "status": "PASS",
-  "unit_tests": {
-    "command": "python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py",
-    "errors": 0,
-    "failures": 0,
-    "total": 9
-  }
-}
@@ -1 +1 @@
-V2R1C7
+V2R1C2
@@ -13,7 +13,6 @@ from hashlib import sha256
 from pathlib import Path
 import json
 from typing import Any
-from message_handoff import stable_event_id


 def utc_now() -> str:
@@ -56,19 +55,13 @@ class AgentEventBus:
        payload: dict[str, Any],
        correlation_id: str | None = None,
    ) -> dict[str, Any]:
-        event_id = stable_event_id(
-            source=source, target=target, message_type=kind, payload=payload,
-            tenant_id=(payload.get('tenant_id') if isinstance(payload, dict) else None),
-            user_id=(payload.get('user_id') if isinstance(payload, dict) else None),
-            project_id=(payload.get('project_id') if isinstance(payload, dict) else None),
-            conversation_id=(payload.get('conversation_id') if isinstance(payload, dict) else None),
-            task_id=(payload.get('task_id') if isinstance(payload, dict) else None),
-            run_id=(payload.get('run_id') if isinstance(payload, dict) else None),
-            correlation_id=(payload.get('correlation_id') if isinstance(payload, dict) else None),
-            causation_id=(payload.get('causation_id') if isinstance(payload, dict) else None),
-            sequence=(payload.get('sequence') if isinstance(payload, dict) else None),
-            idempotency_key=(payload.get('idempotency_key') if isinstance(payload, dict) else None),
-        )
+        event_id = "evt_" + sha256(
+            json.dumps(
+                {"kind": kind, "source": source, "summary": summary, "payload": payload},
+                sort_keys=True,
+                ensure_ascii=False,
+            ).encode("utf-8")
+        ).hexdigest()[:16]
        event = AgentEvent(event_id, kind, source, target, summary, payload, correlation_id=correlation_id)
        self._write("pending", event.to_dict())
        self._audit("created", event.to_dict())
@@ -7,7 +7,7 @@ class AgentEventObservabilityBridge:
    def __init__(self, hooks: AgentObservabilityHooks | None = None):
        self.hooks = hooks or AgentObservabilityHooks()

-    def consume(self, event: dict, *, actor=None, trace=None):
+    def consume(self, event: dict):
        kind = event.get("kind")
        payload = event.get("payload", {})
        if kind == "agent_started":
@@ -16,8 +16,6 @@ class AgentEventObservabilityBridge:
                visible_scope=payload.get("scope", "self"),
                entry_agent=payload.get("agent", "unknown"),
                execution_id=event.get("id"),
-                actor=actor,
-                trace=trace,
            )
        if kind == "agent_delegated":
            return self.hooks.delegate(event["execution_id"], payload.get("agent", "unknown"))
@@ -31,18 +31,6 @@ class AgentExecutionRecord:
    status: str = "completed"
    started_at: str = field(default_factory=utc_now)
    ended_at: str = field(default_factory=utc_now)
-    trace_id: str | None = None
-    span_id: str | None = None
-    parent_span_id: str | None = None
-    correlation_id: str | None = None
-    causation_id: str | None = None
-    tenant_id: str | None = None
-    project_id: str | None = None
-    conversation_id: str | None = None
-    task_id: str | None = None
-    claim_id: str | None = None
-    run_id: str | None = None
-    message_id: str | None = None

    def to_dict(self):
        return asdict(self)
@@ -9,49 +9,25 @@ try:
 except Exception:
    APIRouter = None

-from .agent_observability import AgentExecutionRecord, AgentObservability
+from .agent_observability import AgentExecutionRecord
 from .agent_observability_dashboard import AgentObservabilityDashboard
 from .agent_observability_store import AgentObservabilityStore
-from .trace_tool_credential_governance import GovernanceActor, TraceContext, authorize_scope

 store = AgentObservabilityStore()
 dashboard = AgentObservabilityDashboard(store.load())


-def record_agent_execution(payload: dict[str, Any], *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None):
-    scoped = any(payload.get(name) is not None for name in (
-        "trace_id", "span_id", "tenant_id", "project_id", "conversation_id", "task_id", "run_id"
-    ))
-    values = dict(payload)
-    if scoped:
-        if actor is None or trace is None:
-            raise RuntimeError("TRACE_ACTOR_CONTEXT_REQUIRED")
-        trusted = GovernanceActor.from_value(actor)
-        authorize_scope(trusted, trace.scope)
-        bound = {
-            "trace_id": trace.trace_id, "span_id": trace.span_id,
-            "parent_span_id": trace.parent_span_id, "correlation_id": trace.correlation_id,
-            "causation_id": trace.causation_id, "tenant_id": trace.scope.tenant_id,
-            "user_id": trace.scope.user_id, "project_id": trace.scope.project_id,
-            "conversation_id": trace.scope.conversation_id, "task_id": trace.task_id,
-            "claim_id": trace.claim_id, "run_id": trace.scope.run_id, "message_id": trace.message_id,
-        }
-        for name, authoritative in bound.items():
-            if values.get(name) not in (None, authoritative):
-                raise RuntimeError("TRACE_SCOPE_MISMATCH_DENY:" + name)
-            values[name] = authoritative
-    record = AgentExecutionRecord(**values)
+def record_agent_execution(payload: dict[str, Any]):
+    record = AgentExecutionRecord(**payload)
    return {"status": "ok", "record": store.append(record)}


-def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user", *, actor: GovernanceActor | dict[str, Any] | None = None):
-    records = store.query(user_id, group_id, role, actor=actor)
-    visible = AgentObservability()
-    visible.records = [AgentExecutionRecord(**record) for record in records]
+def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user"):
+    records = store.query(user_id, group_id, role)
    return {
        "status": "ok",
        "records": records,
-        "summary": visible.summary(None),
+        "summary": store.load().summary(user_id if role != "owner" else None),
    }


@@ -14,11 +14,6 @@ from uuid import uuid4

 from .agent_observability import AgentExecutionRecord
 from .agent_observability_store import AgentObservabilityStore
-from .trace_tool_credential_governance import (
-    GovernanceActor,
-    TraceContext,
-    authorize_scope,
-)


 def utc_now() -> str:
@@ -41,7 +36,6 @@ class AgentRunContext:
    input_tokens: int = 0
    output_tokens: int = 0
    status: str = "running"
-    trace: TraceContext | None = None

    def delegate(self, agent_name: str) -> None:
        if agent_name not in self.path:
@@ -65,19 +59,7 @@ class AgentObservabilityHooks:
        visible_scope: str,
        entry_agent: str,
        execution_id: str | None = None,
-        *,
-        actor: GovernanceActor | dict[str, Any] | None = None,
-        trace: TraceContext | None = None,
    ) -> dict[str, Any]:
-        if execution_id is not None and execution_id in self.active:
-            raise RuntimeError("OBSERVABILITY_EXECUTION_CONFLICT")
-        if trace is not None:
-            if actor is None:
-                raise RuntimeError("TRACE_ACTOR_CONTEXT_REQUIRED")
-            trusted_actor = GovernanceActor.from_value(actor)
-            authorize_scope(trusted_actor, trace.scope)
-            if trace.scope.user_id is not None and trace.scope.user_id != user_id:
-                raise RuntimeError("TRACE_SCOPE_MISMATCH_DENY:user_id")
        run = AgentRunContext(
            execution_id=execution_id or f"exec_{uuid4().hex[:12]}",
            user_id=user_id,
@@ -85,7 +67,6 @@ class AgentObservabilityHooks:
            entry_agent=entry_agent,
            path=[entry_agent],
            used_hermes=entry_agent.lower() == "hermes",
-            trace=trace,
        )
        self.active[run.execution_id] = run
        return {"status": "started", "execution_id": run.execution_id, "run": run.__dict__}
@@ -125,18 +106,6 @@ class AgentObservabilityHooks:
            status=status,
            started_at=run.started_at,
            ended_at=ended_at,
-            trace_id=run.trace.trace_id if run.trace else None,
-            span_id=run.trace.span_id if run.trace else None,
-            parent_span_id=run.trace.parent_span_id if run.trace else None,
-            correlation_id=run.trace.correlation_id if run.trace else None,
-            causation_id=run.trace.causation_id if run.trace else None,
-            tenant_id=run.trace.scope.tenant_id if run.trace else None,
-            project_id=run.trace.scope.project_id if run.trace else None,
-            conversation_id=run.trace.scope.conversation_id if run.trace else None,
-            task_id=run.trace.task_id if run.trace else None,
-            claim_id=run.trace.claim_id if run.trace else None,
-            run_id=run.trace.scope.run_id if run.trace else None,
-            message_id=run.trace.message_id if run.trace else None,
        )
        return {"status": "stored", "record": self.store.append(record)}

@@ -12,12 +12,6 @@ from pathlib import Path
 from typing import Any

 from .agent_observability import AgentExecutionRecord, AgentObservability
-from .trace_tool_credential_governance import (
-    GovernanceActor,
-    GovernanceError,
-    GovernanceScope,
-    authorize_scope,
-)


 class AgentObservabilityStore:
@@ -29,11 +23,6 @@ class AgentObservabilityStore:
    def append(self, record: AgentExecutionRecord) -> dict[str, Any]:
        path = self.records_dir / f"{record.execution_id}.json"
        data = record.to_dict()
-        if path.exists():
-            existing = json.loads(path.read_text(encoding="utf-8"))
-            if existing == data:
-                return existing
-            raise RuntimeError("OBSERVABILITY_EXECUTION_CONFLICT")
        path.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
        return data

@@ -44,36 +33,8 @@ class AgentObservabilityStore:
            observability.records.append(AgentExecutionRecord(**raw))
        return observability

-    def query(self, user_id: str | None = None, group_id: str | None = None, role: str = "user", *, actor: GovernanceActor | dict[str, Any] | None = None) -> list[dict[str, Any]]:
+    def query(self, user_id: str | None = None, group_id: str | None = None, role: str = "user") -> list[dict[str, Any]]:
        records = [record.to_dict() for record in self.load().records]
-        scoped = [record for record in records if record.get("tenant_id") is not None]
-        legacy = [record for record in records if record.get("tenant_id") is None]
-        if actor is not None:
-            trusted = GovernanceActor.from_value(actor)
-            visible: list[dict[str, Any]] = []
-            for record in scoped:
-                try:
-                    authorize_scope(
-                        trusted,
-                        GovernanceScope(
-                            "tenant",
-                            tenant_id=record.get("tenant_id"),
-                            user_id=record.get("user_id"),
-                            project_id=record.get("project_id"),
-                            conversation_id=record.get("conversation_id"),
-                            run_id=record.get("run_id"),
-                        ),
-                    )
-                except GovernanceError:
-                    continue
-                visible.append(record)
-            if trusted.privileged:
-                visible.extend(legacy)
-            else:
-                visible.extend(record for record in legacy if record.get("user_id") == trusted.scope.user_id)
-            return visible
-        # Caller-supplied role remains a legacy compatibility path only.
-        records = legacy
        if role == "owner":
            return records
        if role == "group_admin" and group_id:
@@ -1,201 +0,0 @@
-"""Fail-closed Agent Pull Runner primitives for AIOS autonomy v1.
-
-The runner owns task discovery and reporting only.  It never accepts shell
-strings: executors receive argv, an allowlisted cwd and an allowlisted env.
-Durable state is intentionally small so restart recovery and duplicate
-suppression can be verified without coupling the runner to one database.
-"""
-from __future__ import annotations
-
-import json
-import os
-import random
-import shutil
-import subprocess
-import tempfile
-import time
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol, Sequence
-
-
-class RunnerError(RuntimeError):
-    """Raised when a runner contract would be violated."""
-
-
-@dataclass(frozen=True)
-class RunnerConfig:
-    worker_id: str
-    capabilities: tuple[str, ...] = ()
-    long_poll_seconds: int = 30
-    fallback_seconds: int = 60
-    jitter_seconds: int = 5
-    max_backoff_seconds: int = 300
-    executable_allowlist: tuple[str, ...] = ()
-    working_directory_allowlist: tuple[str, ...] = ()
-    environment_allowlist: tuple[str, ...] = ()
-
-
-@dataclass
-class RunnerState:
-    inflight: dict[str, dict[str, Any]] = field(default_factory=dict)
-    terminal: dict[str, dict[str, Any]] = field(default_factory=dict)
-
-
-class RunnerTransport(Protocol):
-    def register_worker(self, worker_id: str, capabilities: Sequence[str]) -> Mapping[str, Any]: ...
-    def heartbeat(self, worker_id: str) -> Mapping[str, Any]: ...
-    def long_poll(self, worker_id: str, timeout_seconds: int) -> Mapping[str, Any] | None: ...
-    def poll(self, worker_id: str) -> Mapping[str, Any] | None: ...
-    def claim(self, worker_id: str, task: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def renew(self, worker_id: str, task_id: str) -> Mapping[str, Any]: ...
-    def report_progress(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def report_result(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def report_evidence(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-
-
-class JsonStateStore:
-    """Atomic JSON state store for restart recovery."""
-
-    def __init__(self, path: str | os.PathLike[str]) -> None:
-        self.path = Path(path)
-
-    def load(self) -> RunnerState:
-        if not self.path.exists():
-            return RunnerState()
-        value = json.loads(self.path.read_text(encoding="utf-8"))
-        if not isinstance(value, dict):
-            raise RunnerError("runner state must be an object")
-        return RunnerState(
-            inflight=dict(value.get("inflight", {})),
-            terminal=dict(value.get("terminal", {})),
-        )
-
-    def save(self, state: RunnerState) -> None:
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        fd, name = tempfile.mkstemp(prefix=self.path.name + ".", dir=self.path.parent)
-        try:
-            with os.fdopen(fd, "w", encoding="utf-8") as handle:
-                json.dump({"inflight": state.inflight, "terminal": state.terminal}, handle, sort_keys=True)
-                handle.write("\n")
-            os.chmod(name, 0o600)
-            os.replace(name, self.path)
-        finally:
-            if os.path.exists(name):
-                os.unlink(name)
-
-
-class AgentPullRunner:
-    """Pull, claim, execute and report one task at a time."""
-
-    def __init__(
-        self,
-        config: RunnerConfig,
-        transport: RunnerTransport,
-        state_store: JsonStateStore | None = None,
-        *,
-        random_fn: Callable[[], float] = random.random,
-    ) -> None:
-        if not config.worker_id.strip():
-            raise RunnerError("worker_id is required")
-        self.config = config
-        self.transport = transport
-        self.state_store = state_store
-        self.random_fn = random_fn
-        self.state = state_store.load() if state_store else RunnerState()
-
-    def _save(self) -> None:
-        if self.state_store:
-            self.state_store.save(self.state)
-
-    def register(self) -> Mapping[str, Any]:
-        return self.transport.register_worker(self.config.worker_id, self.config.capabilities)
-
-    def heartbeat(self) -> Mapping[str, Any]:
-        return self.transport.heartbeat(self.config.worker_id)
-
-    def discovery_delay(self, failures: int) -> float:
-        failures = max(0, int(failures))
-        base = min(self.config.max_backoff_seconds, self.config.fallback_seconds * (2**failures))
-        jitter = self.random_fn() * max(0, self.config.jitter_seconds)
-        return min(self.config.max_backoff_seconds, base + jitter)
-
-    def discover_once(self) -> Mapping[str, Any] | None:
-        try:
-            task = self.transport.long_poll(self.config.worker_id, self.config.long_poll_seconds)
-        except Exception:
-            task = None
-        if task is None:
-            task = self.transport.poll(self.config.worker_id)
-        if not task:
-            return None
-        task_id = str(task.get("task_id", ""))
-        if not task_id:
-            raise RunnerError("task_id is required")
-        if task_id in self.state.terminal:
-            return {"status": "duplicate_suppressed", "task_id": task_id}
-        claimed = dict(self.transport.claim(self.config.worker_id, task))
-        self.state.inflight[task_id] = claimed
-        self._save()
-        return claimed
-
-    def renew(self, task_id: str) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.renew(self.config.worker_id, task_id)
-
-    def report_progress(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.report_progress(self.config.worker_id, task_id, payload)
-
-    def report_evidence(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.report_evidence(self.config.worker_id, task_id, payload)
-
-    def report_result(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id in self.state.terminal:
-            return {"status": "duplicate_terminal_suppressed", "task_id": task_id}
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        result = dict(self.transport.report_result(self.config.worker_id, task_id, payload))
-        self.state.terminal[task_id] = {"result": result, "reported_at": time.time()}
-        self.state.inflight.pop(task_id, None)
-        self._save()
-        return result
-
-    def recover_after_restart(self) -> list[Mapping[str, Any]]:
-        recovered: list[Mapping[str, Any]] = []
-        for task_id in tuple(self.state.inflight):
-            recovered.append(self.renew(task_id))
-        return recovered
-
-    def validate_execution(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> None:
-        if not argv or any(not isinstance(item, str) or not item for item in argv):
-            raise RunnerError("argv_only_execution_required")
-        if any(ch in argv[0] for ch in (";", "|", "&", "`", "\n")):
-            raise RunnerError("shell_syntax_denied")
-        executable = shutil.which(argv[0])
-        if not executable:
-            raise RunnerError("executable_not_found")
-        if self.config.executable_allowlist and not any(
-            os.path.realpath(executable).startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
-            or os.path.realpath(executable) == os.path.realpath(prefix)
-            for prefix in self.config.executable_allowlist
-        ):
-            raise RunnerError("executable_not_allowlisted")
-        real_cwd = os.path.realpath(os.fspath(cwd))
-        if self.config.working_directory_allowlist and not any(
-            real_cwd == os.path.realpath(prefix)
-            or real_cwd.startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
-            for prefix in self.config.working_directory_allowlist
-        ):
-            raise RunnerError("working_directory_not_allowlisted")
-        if self.config.environment_allowlist and any(key not in self.config.environment_allowlist for key in env):
-            raise RunnerError("environment_key_not_allowlisted")
-
-    def execute_argv(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> Mapping[str, Any]:
-        self.validate_execution(argv, cwd, env)
-        completed = subprocess.run(list(argv), cwd=os.fspath(cwd), env=dict(env), shell=False, text=True, capture_output=True, check=False)
-        return {"returncode": completed.returncode, "stdout": completed.stdout, "stderr": completed.stderr}
@@ -1,36 +0,0 @@
-"""Small operational CLI for the Agent Pull Runner contract."""
-from __future__ import annotations
-
-import argparse
-import json
-
-from agent_pull_runner import AgentPullRunner, RunnerConfig
-
-
-class _NoopTransport:
-    def register_worker(self, worker_id, capabilities): return {"status": "registered", "worker_id": worker_id, "capabilities": list(capabilities)}
-    def heartbeat(self, worker_id): return {"status": "alive", "worker_id": worker_id}
-    def long_poll(self, worker_id, timeout_seconds): return None
-    def poll(self, worker_id): return None
-    def claim(self, worker_id, task): return task
-    def renew(self, worker_id, task_id): return {"status": "renewed", "task_id": task_id}
-    def report_progress(self, worker_id, task_id, payload): return {"status": "progress_recorded", "task_id": task_id}
-    def report_result(self, worker_id, task_id, payload): return {"status": "result_recorded", "task_id": task_id}
-    def report_evidence(self, worker_id, task_id, payload): return {"status": "evidence_recorded", "task_id": task_id}
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="AIOS Agent Pull Runner")
-    parser.add_argument("--worker-id", default="self-test-worker")
-    parser.add_argument("--self-test", action="store_true")
-    args = parser.parse_args()
-    runner = AgentPullRunner(RunnerConfig(worker_id=args.worker_id, fallback_seconds=60), _NoopTransport())
-    if args.self_test:
-        print(json.dumps({"status": "PASS", "registration": runner.register(), "fallback_seconds": runner.config.fallback_seconds}, sort_keys=True))
-        return 0
-    print(json.dumps({"status": "READY", "worker_id": args.worker_id}, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,315 +0,0 @@
-#!/usr/bin/env python3
-"""HTTP API for AIOS external-agent online task distribution.
-
-The service is intended to bind to loopback and be published through the
-existing TLS reverse proxy. Control operations use a server-managed control
-Bearer token. Agents receive individual Bearer tokens at registration; only
-token hashes are persisted.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hmac
-import json
-import os
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from pathlib import Path
-import re
-from typing import Any, Mapping
-from urllib.parse import urlparse
-
-from aios_agent_task_protocol import TaskProtocolError, TaskStore
-
-
-MAX_BODY = 1024 * 1024
-TASK_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-
-
-@dataclass(frozen=True, slots=True)
-class APIConfig:
-    db_path: Path
-    control_token_path: Path
-    host: str = "127.0.0.1"
-    port: int = 18940
-    token_pepper: str = ""
-
-    @classmethod
-    def from_env(cls) -> "APIConfig":
-        return cls(
-            db_path=Path(os.getenv(
-                "AIOS_AGENT_TASK_DB",
-                "/var/lib/aios-agent-task/state.sqlite3",
-            )),
-            control_token_path=Path(os.getenv(
-                "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-                "/run/credentials/aios-agent-task-api.service/control_token",
-            )),
-            host=os.getenv("AIOS_AGENT_TASK_HOST", "127.0.0.1"),
-            port=int(os.getenv("AIOS_AGENT_TASK_PORT", "18940")),
-            token_pepper=os.getenv("AIOS_AGENT_TASK_TOKEN_PEPPER", ""),
-        )
-
-
-class AgentTaskApplication:
-    def __init__(self, config: APIConfig) -> None:
-        self.config = config
-        self.store = TaskStore(
-            config.db_path,
-            token_pepper=config.token_pepper,
-        )
-
-    def _control_token(self) -> str:
-        path = self.config.control_token_path
-        if path.is_symlink() or not path.is_file():
-            raise TaskProtocolError("CONTROL_CREDENTIAL_UNAVAILABLE", 503)
-        value = path.read_text(encoding="utf-8").strip()
-        if len(value) < 32:
-            raise TaskProtocolError("CONTROL_CREDENTIAL_INVALID", 503)
-        return value
-
-    @staticmethod
-    def _bearer(headers: Mapping[str, str]) -> str:
-        value = str(headers.get("Authorization") or "")
-        if not value.startswith("Bearer "):
-            return ""
-        return value[7:].strip()
-
-    def authenticate_control(self, headers: Mapping[str, str]) -> None:
-        supplied = self._bearer(headers)
-        expected = self._control_token()
-        if not supplied or not hmac.compare_digest(supplied, expected):
-            raise TaskProtocolError("UNAUTHORIZED", 401)
-
-    def authenticate_agent(self, headers: Mapping[str, str]) -> dict[str, Any]:
-        return self.store.authenticate_agent(self._bearer(headers))
-
-    def principal(self, headers: Mapping[str, str]) -> tuple[str, dict[str, Any] | None]:
-        supplied = self._bearer(headers)
-        if not supplied:
-            raise TaskProtocolError("UNAUTHORIZED", 401)
-        try:
-            expected = self._control_token()
-        except TaskProtocolError:
-            expected = ""
-        if expected and hmac.compare_digest(supplied, expected):
-            return "control", None
-        return "agent", self.store.authenticate_agent(supplied)
-
-    def health(self) -> dict[str, Any]:
-        return {
-            "status": "ok",
-            "schema": "aios.agent-task.v1",
-            "task_states": [
-                "QUEUED", "CLAIMED", "RUNNING", "VERIFYING",
-                "SUCCEEDED", "FAILED", "EXPIRED", "CANCELLED",
-            ],
-            "lease_recovery": True,
-            "atomic_claim": True,
-            "idempotent_result_submission": True,
-            "server_side_verification_required": True,
-            "plaintext_credentials_persisted": False,
-        }
-
-    def register_agent(self, headers: Mapping[str, str], body: Mapping[str, Any]) -> dict[str, Any]:
-        self.authenticate_control(headers)
-        return self.store.register_agent(
-            agent_id=str(body.get("agent_id") or ""),
-            agent_type=str(body.get("agent_type") or ""),
-            agent_version=str(body.get("agent_version") or ""),
-            capabilities=body.get("capabilities") or [],
-            metadata=body.get("metadata") if isinstance(body.get("metadata"), Mapping) else {},
-        )
-
-    def create_task(self, headers: Mapping[str, str], body: Mapping[str, Any]) -> dict[str, Any]:
-        self.authenticate_control(headers)
-        return self.store.create_task(
-            task_id=str(body.get("task_id") or "") or None,
-            goal=str(body.get("goal") or ""),
-            instructions=str(body.get("instructions") or ""),
-            success_criteria=body.get("success_criteria"),
-            required_capabilities=body.get("required_capabilities") or [],
-            constraints=body.get("constraints") if isinstance(body.get("constraints"), Mapping) else {},
-            metadata=body.get("metadata") if isinstance(body.get("metadata"), Mapping) else {},
-            deadline=str(body.get("deadline") or "") or None,
-            priority=body.get("priority", 0),
-            max_attempts=body.get("max_attempts", 3),
-            idempotency_key=str(body.get("idempotency_key") or ""),
-        )
-
-    def poll(self, headers: Mapping[str, str], body: Mapping[str, Any]) -> dict[str, Any]:
-        agent = self.authenticate_agent(headers)
-        tasks = self.store.poll_tasks(
-            agent_id=agent["agent_id"],
-            limit=int(body.get("limit", 20)),
-        )
-        return {"agent_id": agent["agent_id"], "tasks": tasks}
-
-    def claim(self, task_id: str, headers: Mapping[str, str], body: Mapping[str, Any]) -> dict[str, Any]:
-        agent = self.authenticate_agent(headers)
-        return self.store.claim_task(
-            task_id=task_id,
-            agent_id=agent["agent_id"],
-            lease_seconds=int(body.get("lease_seconds", 300)),
-        )
-
-    def heartbeat(self, task_id: str, headers: Mapping[str, str], body: Mapping[str, Any]) -> dict[str, Any]:
-        agent = self.authenticate_agent(headers)
-        return self.store.heartbeat(
-            task_id=task_id,
-            agent_id=agent["agent_id"],
-            lease_token=str(body.get("lease_token") or ""),
-            progress=body.get("progress") if isinstance(body.get("progress"), Mapping) else {},
-            lease_seconds=int(body.get("lease_seconds", 300)),
-        )
-
-    def result(self, task_id: str, headers: Mapping[str, str], body: Mapping[str, Any]) -> dict[str, Any]:
-        agent = self.authenticate_agent(headers)
-        result = body.get("result")
-        if not isinstance(result, Mapping):
-            raise TaskProtocolError("RESULT_INVALID", 400)
-        return self.store.submit_result(
-            task_id=task_id,
-            agent_id=agent["agent_id"],
-            lease_token=str(body.get("lease_token") or ""),
-            idempotency_key=str(body.get("idempotency_key") or ""),
-            result=result,
-        )
-
-    def verify(self, task_id: str, headers: Mapping[str, str], body: Mapping[str, Any]) -> dict[str, Any]:
-        self.authenticate_control(headers)
-        return self.store.verify_task(
-            task_id=task_id,
-            decision=str(body.get("decision") or ""),
-            verification=body.get("verification") if isinstance(body.get("verification"), Mapping) else {},
-        )
-
-    def cancel(self, task_id: str, headers: Mapping[str, str], body: Mapping[str, Any]) -> dict[str, Any]:
-        self.authenticate_control(headers)
-        return self.store.cancel_task(task_id=task_id, reason=str(body.get("reason") or ""))
-
-    def get_task(self, task_id: str, headers: Mapping[str, str]) -> dict[str, Any]:
-        kind, agent = self.principal(headers)
-        task = self.store.get_task(task_id)
-        if kind == "agent" and task.get("claimed_by") != agent["agent_id"]:
-            raise TaskProtocolError("FORBIDDEN", 403)
-        return task
-
-    def events(self, task_id: str, headers: Mapping[str, str]) -> dict[str, Any]:
-        self.authenticate_control(headers)
-        return {"task_id": task_id, "events": self.store.get_events(task_id)}
-
-
-class Handler(BaseHTTPRequestHandler):
-    app: AgentTaskApplication | None = None
-    server_version = "AIOSAgentTaskAPI/1"
-
-    def log_message(self, _format: str, *_args: Any) -> None:
-        return
-
-    def _headers(self) -> dict[str, str]:
-        return {key: value for key, value in self.headers.items()}
-
-    def _json(self, value: Any, status: int = 200) -> None:
-        payload = json.dumps(value, ensure_ascii=False, sort_keys=True).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json; charset=utf-8")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def _body(self) -> dict[str, Any]:
-        try:
-            size = int(self.headers.get("Content-Length", "0"))
-        except ValueError as exc:
-            raise TaskProtocolError("CONTENT_LENGTH_INVALID", 400) from exc
-        if size < 0 or size > MAX_BODY:
-            raise TaskProtocolError("REQUEST_TOO_LARGE", 413)
-        raw = self.rfile.read(size) if size else b"{}"
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise TaskProtocolError("JSON_INVALID", 400) from exc
-        if not isinstance(value, dict):
-            raise TaskProtocolError("JSON_OBJECT_REQUIRED", 400)
-        return value
-
-    @staticmethod
-    def _task_route(path: str) -> tuple[str, str | None]:
-        match = re.fullmatch(
-            r"/v1/tasks/([A-Za-z0-9][A-Za-z0-9._:-]{2,179})(?:/(claim|heartbeat|result|verify|cancel|events))?",
-            path,
-        )
-        if match:
-            return match.group(1), match.group(2)
-        return "", None
-
-    def _run(self, callback) -> None:
-        try:
-            callback()
-        except TaskProtocolError as exc:
-            self._json({"error": exc.code}, exc.http_status)
-        except Exception as exc:
-            self._json({"error": "INTERNAL_ERROR", "detail": type(exc).__name__}, 500)
-
-    def do_GET(self) -> None:
-        def action() -> None:
-            if self.app is None:
-                raise TaskProtocolError("SERVICE_UNAVAILABLE", 503)
-            path = urlparse(self.path).path.rstrip("/") or "/"
-            if path == "/health":
-                self._json(self.app.health())
-                return
-            task_id, suffix = self._task_route(path)
-            if task_id and suffix is None:
-                self._json(self.app.get_task(task_id, self._headers()))
-                return
-            if task_id and suffix == "events":
-                self._json(self.app.events(task_id, self._headers()))
-                return
-            self._json({"error": "NOT_FOUND"}, 404)
-        self._run(action)
-
-    def do_POST(self) -> None:
-        def action() -> None:
-            if self.app is None:
-                raise TaskProtocolError("SERVICE_UNAVAILABLE", 503)
-            path = urlparse(self.path).path.rstrip("/") or "/"
-            body = self._body()
-            if path == "/v1/agents/register":
-                self._json(self.app.register_agent(self._headers(), body), 201)
-                return
-            if path == "/v1/tasks":
-                self._json(self.app.create_task(self._headers(), body), 201)
-                return
-            if path == "/v1/tasks/poll":
-                self._json(self.app.poll(self._headers(), body))
-                return
-            task_id, suffix = self._task_route(path)
-            if not task_id:
-                self._json({"error": "NOT_FOUND"}, 404)
-                return
-            if suffix == "claim":
-                self._json(self.app.claim(task_id, self._headers(), body))
-            elif suffix == "heartbeat":
-                self._json(self.app.heartbeat(task_id, self._headers(), body))
-            elif suffix == "result":
-                self._json(self.app.result(task_id, self._headers(), body))
-            elif suffix == "verify":
-                self._json(self.app.verify(task_id, self._headers(), body))
-            elif suffix == "cancel":
-                self._json(self.app.cancel(task_id, self._headers(), body))
-            else:
-                self._json({"error": "NOT_FOUND"}, 404)
-        self._run(action)
-
-
-def serve(config: APIConfig | None = None) -> None:
-    config = config or APIConfig.from_env()
-    application = AgentTaskApplication(config)
-    Handler.app = application
-    ThreadingHTTPServer((config.host, config.port), Handler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,722 +0,0 @@
-"""Owner-controlled CAS-bound execution-envelope rebind for Online Agent Tasks.
-
-This service exists for a narrow recovery case: a Task was projected/claimed with a read-only
-source_capture envelope before its already-registered deterministic plan became authoritative.
-
-It never creates Tasks/Jobs/branches and never accepts arbitrary metadata patches. It only replaces
-metadata.execution + the derived execution_projection for the same governed binding, after an
-official NEEDS_REWORK transition has returned the Task to QUEUED with no active lease.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Callable, Mapping, Sequence
-import urllib.error
-import urllib.request
-
-from aios_online_agent_execution import (
-    GovernedExecutionBinding,
-    validate_execution_envelope,
-)
-
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-MAX_BODY = 64 * 1024
-AUTHORIZATION_ID_ENV = "AIOS_AGENT_TASK_EXECUTION_REBIND_AUTHORIZATION_ID"
-
-
-class ExecutionRebindError(RuntimeError):
-    def __init__(self, code: str, status: int = 409) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def _canonical(value: object) -> bytes:
-    return json.dumps(
-        value, sort_keys=True, separators=(",", ":"), ensure_ascii=False
-    ).encode("utf-8")
-
-
-def _sha(value: object) -> str:
-    return hashlib.sha256(_canonical(value)).hexdigest()
-
-
-def _now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def _require_string(
-    value: object,
-    code: str,
-    pattern: re.Pattern[str] | None = None,
-) -> str:
-    if not isinstance(value, str) or not value.strip():
-        raise ExecutionRebindError(code, 400)
-    value = value.strip()
-    if pattern is not None and pattern.fullmatch(value) is None:
-        raise ExecutionRebindError(code, 400)
-    return value
-
-
-def _required_authorization_id() -> str:
-    value = os.environ.get(AUTHORIZATION_ID_ENV, "").strip()
-    if not value:
-        raise RuntimeError("TASK_EXECUTION_REBIND_AUTHORIZATION_ID_MISSING")
-    if KEY_RE.fullmatch(value) is None:
-        raise RuntimeError("TASK_EXECUTION_REBIND_AUTHORIZATION_ID_INVALID")
-    return value
-
-
-@dataclass(frozen=True)
-class ExecutionRebindRequest:
-    expected_status: str
-    expected_revision: int
-    expected_attempt: int
-    previous_verification_sha256: str
-    expected_old_execution_digest: str
-    expected_new_execution_digest: str
-    authorization_id: str
-    idempotency_key: str
-    reason: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "ExecutionRebindRequest":
-        allowed = {
-            "expected_status",
-            "expected_revision",
-            "expected_attempt",
-            "previous_verification_sha256",
-            "expected_old_execution_digest",
-            "expected_new_execution_digest",
-            "authorization_id",
-            "idempotency_key",
-            "reason",
-        }
-        if set(value) != allowed:
-            raise ExecutionRebindError("EXECUTION_REBIND_FIELDS_INVALID", 400)
-
-        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
-        if status != "QUEUED":
-            raise ExecutionRebindError("EXPECTED_STATUS_INVALID", 400)
-
-        revision = value["expected_revision"]
-        attempt = value["expected_attempt"]
-        if (
-            not isinstance(revision, int)
-            or isinstance(revision, bool)
-            or revision < 0
-            or not isinstance(attempt, int)
-            or isinstance(attempt, bool)
-            or attempt < 1
-        ):
-            raise ExecutionRebindError("EXECUTION_REBIND_INTEGER_INVALID", 400)
-
-        verification = _require_string(
-            value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID"
-        )
-        old_digest = _require_string(
-            value["expected_old_execution_digest"], "OLD_EXECUTION_DIGEST_INVALID"
-        )
-        new_digest = _require_string(
-            value["expected_new_execution_digest"], "NEW_EXECUTION_DIGEST_INVALID"
-        )
-        for digest, code in (
-            (verification, "VERIFICATION_SHA256_INVALID"),
-            (old_digest, "OLD_EXECUTION_DIGEST_INVALID"),
-            (new_digest, "NEW_EXECUTION_DIGEST_INVALID"),
-        ):
-            if SHA_RE.fullmatch(digest) is None:
-                raise ExecutionRebindError(code, 400)
-        if old_digest == new_digest:
-            raise ExecutionRebindError("EXECUTION_REBIND_DIGEST_UNCHANGED", 400)
-
-        authorization = _require_string(
-            value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE
-        )
-        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
-        reason = _require_string(value["reason"], "EXECUTION_REBIND_REASON_INVALID")
-        if len(reason) > 512:
-            raise ExecutionRebindError("EXECUTION_REBIND_REASON_INVALID", 400)
-
-        return cls(
-            status,
-            revision,
-            attempt,
-            verification,
-            old_digest,
-            new_digest,
-            authorization,
-            key,
-            reason,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "expected_status": self.expected_status,
-            "expected_revision": self.expected_revision,
-            "expected_attempt": self.expected_attempt,
-            "previous_verification_sha256": self.previous_verification_sha256,
-            "expected_old_execution_digest": self.expected_old_execution_digest,
-            "expected_new_execution_digest": self.expected_new_execution_digest,
-            "authorization_id": self.authorization_id,
-            "idempotency_key": self.idempotency_key,
-            "reason": self.reason,
-        }
-
-
-class CanonicalBridgeExecutionResolver:
-    """Resolve the already-registered plan from the canonical governed Bridge."""
-
-    def __init__(self, base_url: str, control_token: str) -> None:
-        self.base_url = base_url.rstrip("/")
-        self.control_token = control_token
-
-    def __call__(
-        self,
-        task_id: str,
-        required_capabilities: Sequence[str],
-    ) -> dict[str, Any]:
-        body = json.dumps(
-            {
-                "task_id": task_id,
-                "required_capabilities": list(required_capabilities),
-            },
-            sort_keys=True,
-            separators=(",", ":"),
-        ).encode("utf-8")
-        request = urllib.request.Request(
-            self.base_url + "/v2/execution-envelope",
-            method="POST",
-            data=body,
-            headers={
-                "Authorization": "Bearer " + self.control_token,
-                "Content-Type": "application/json",
-                "Accept": "application/json",
-            },
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=15) as response:
-                raw = response.read()
-                status = response.status
-        except urllib.error.HTTPError as exc:
-            raw = exc.read()
-            status = exc.code
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise ExecutionRebindError("CANONICAL_EXECUTION_RESPONSE_INVALID", 502) from exc
-        if not isinstance(value, Mapping):
-            raise ExecutionRebindError("CANONICAL_EXECUTION_RESPONSE_INVALID", 502)
-        if status != 200:
-            raise ExecutionRebindError(
-                str(value.get("error") or "CANONICAL_EXECUTION_RESOLUTION_FAILED"),
-                502 if status >= 500 else 409,
-            )
-        return dict(value)
-
-
-class ExecutionRebindStore:
-    """Official owner-controlled mutation with CAS, plan resolution and durable audit."""
-
-    def __init__(
-        self,
-        db_path: Path,
-        resolver: Callable[[str, Sequence[str]], Mapping[str, Any]],
-    ) -> None:
-        self.db_path = Path(db_path)
-        self.resolver = resolver
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _columns(
-        connection: sqlite3.Connection,
-        table: str,
-    ) -> dict[str, sqlite3.Row]:
-        return {
-            str(row["name"]): row
-            for row in connection.execute(f'PRAGMA table_info("{table}")')
-        }
-
-    @staticmethod
-    def _json_value(raw: object, code: str) -> dict[str, Any]:
-        if isinstance(raw, Mapping):
-            return dict(raw)
-        if not isinstance(raw, str):
-            raise ExecutionRebindError(code, 409)
-        try:
-            value = json.loads(raw)
-        except json.JSONDecodeError as exc:
-            raise ExecutionRebindError(code, 409) from exc
-        if not isinstance(value, Mapping):
-            raise ExecutionRebindError(code, 409)
-        return dict(value)
-
-    @staticmethod
-    def _verification_hash(raw: object) -> str:
-        if raw in (None, ""):
-            value: object = {}
-        elif isinstance(raw, str):
-            try:
-                value = json.loads(raw)
-            except json.JSONDecodeError as exc:
-                raise ExecutionRebindError("TASK_VERIFICATION_INVALID", 409) from exc
-        else:
-            value = raw
-        return _sha(value)
-
-    @staticmethod
-    def _metadata_column(columns: Mapping[str, sqlite3.Row]) -> str:
-        for name in ("metadata_json", "metadata"):
-            if name in columns:
-                return name
-        raise ExecutionRebindError("TASK_METADATA_SCHEMA_UNSUPPORTED", 503)
-
-    @staticmethod
-    def _required_capabilities(
-        task: sqlite3.Row,
-        columns: Mapping[str, sqlite3.Row],
-        old_execution: Mapping[str, Any],
-    ) -> list[str]:
-        for field in ("required_capabilities_json", "required_capabilities"):
-            if field not in columns:
-                continue
-            raw = task[field]
-            if raw in (None, ""):
-                continue
-            if isinstance(raw, str):
-                try:
-                    value = json.loads(raw)
-                except json.JSONDecodeError:
-                    value = [item for item in raw.split(",") if item.strip()]
-            else:
-                value = raw
-            if isinstance(value, list) and all(isinstance(item, str) for item in value):
-                return [item.strip() for item in value if item.strip()]
-        value = old_execution.get("capability_scope")
-        if isinstance(value, list) and all(isinstance(item, str) for item in value):
-            return [item for item in value if item]
-        raise ExecutionRebindError("TASK_CAPABILITIES_UNAVAILABLE", 503)
-
-    @staticmethod
-    def _event_table(
-        connection: sqlite3.Connection,
-    ) -> tuple[str, dict[str, sqlite3.Row]]:
-        tables = {
-            row["name"]
-            for row in connection.execute(
-                "SELECT name FROM sqlite_master WHERE type='table'"
-            )
-        }
-        for name in ("task_events", "events"):
-            if name not in tables:
-                continue
-            columns = ExecutionRebindStore._columns(connection, name)
-            if "task_id" in columns and ("event_type" in columns or "type" in columns):
-                return name, columns
-        raise ExecutionRebindError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
-
-    @staticmethod
-    def _insert_event(
-        connection: sqlite3.Connection,
-        task_id: str,
-        payload: Mapping[str, Any],
-    ) -> None:
-        table, columns = ExecutionRebindStore._event_table(connection)
-        values: dict[str, Any] = {"task_id": task_id}
-        if "event_type" in columns:
-            values["event_type"] = "TASK_EXECUTION_REBIND_AUTHORIZED"
-        else:
-            values["type"] = "TASK_EXECUTION_REBIND_AUTHORIZED"
-        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-        if "payload_json" in columns:
-            values["payload_json"] = payload_text
-        elif "payload" in columns:
-            values["payload"] = payload_text
-        else:
-            raise ExecutionRebindError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
-        if "created_at" in columns:
-            values["created_at"] = _now()
-        if "agent_id" in columns:
-            values["agent_id"] = "owner-control"
-        if "actor_id" in columns:
-            values["actor_id"] = "owner-control"
-        names = list(values)
-        quoted = ",".join('"' + name + '"' for name in names)
-        placeholders = ",".join("?" for _ in names)
-        connection.execute(
-            f'INSERT INTO "{table}" ({quoted}) VALUES ({placeholders})',
-            tuple(values[name] for name in names),
-        )
-
-    @staticmethod
-    def _ensure_rebind_table(connection: sqlite3.Connection) -> None:
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_execution_rebinds (
-              task_id TEXT NOT NULL,
-              idempotency_key TEXT NOT NULL,
-              request_sha256 TEXT NOT NULL,
-              authorization_id TEXT NOT NULL,
-              previous_verification_sha256 TEXT NOT NULL,
-              old_execution_digest TEXT NOT NULL,
-              new_execution_digest TEXT NOT NULL,
-              expected_revision INTEGER NOT NULL,
-              applied_revision INTEGER NOT NULL,
-              attempt INTEGER NOT NULL,
-              reason TEXT NOT NULL,
-              created_at TEXT NOT NULL,
-              PRIMARY KEY(task_id,idempotency_key)
-            )
-            """
-        )
-
-    def _load_and_validate(
-        self,
-        connection: sqlite3.Connection,
-        task_id: str,
-        request: ExecutionRebindRequest,
-    ) -> tuple[sqlite3.Row, dict[str, sqlite3.Row], str, dict[str, Any], dict[str, Any]]:
-        columns = self._columns(connection, "tasks")
-        required = {
-            "task_id",
-            "status",
-            "attempt",
-            "revision",
-            "claimed_by",
-            "lease_token_hash",
-            "lease_expires_at",
-            "verification_json",
-        }
-        if not required.issubset(columns):
-            raise ExecutionRebindError("TASK_SCHEMA_EXECUTION_REBIND_UNSUPPORTED", 503)
-        metadata_column = self._metadata_column(columns)
-        task = connection.execute(
-            "SELECT * FROM tasks WHERE task_id=?",
-            (task_id,),
-        ).fetchone()
-        if task is None:
-            raise ExecutionRebindError("TASK_NOT_FOUND", 404)
-
-        if (
-            str(task["status"]) != request.expected_status
-            or int(task["revision"]) != request.expected_revision
-            or int(task["attempt"]) != request.expected_attempt
-        ):
-            raise ExecutionRebindError("EXECUTION_REBIND_CAS_MISMATCH", 409)
-        if task["lease_token_hash"] not in (None, "") or task["lease_expires_at"] not in (None, ""):
-            raise ExecutionRebindError("EXECUTION_REBIND_ACTIVE_LEASE_DENY", 409)
-
-        verification_sha = self._verification_hash(task["verification_json"])
-        if verification_sha != request.previous_verification_sha256:
-            raise ExecutionRebindError("EXECUTION_REBIND_VERIFICATION_DRIFT", 409)
-
-        metadata = self._json_value(
-            task[metadata_column],
-            "TASK_METADATA_INVALID",
-        )
-        execution = metadata.get("execution")
-        if not isinstance(execution, Mapping):
-            raise ExecutionRebindError("TASK_EXECUTION_METADATA_MISSING", 409)
-        old_execution = validate_execution_envelope(dict(execution))
-        if old_execution["execution_digest"] != request.expected_old_execution_digest:
-            raise ExecutionRebindError("EXECUTION_REBIND_OLD_DIGEST_DRIFT", 409)
-        if old_execution.get("action") != "source_capture":
-            raise ExecutionRebindError("EXECUTION_REBIND_SOURCE_CAPTURE_REQUIRED", 409)
-
-        projection = metadata.get("execution_projection")
-        if isinstance(projection, Mapping):
-            projected_digest = str(projection.get("execution_digest") or "")
-            if projected_digest and projected_digest != request.expected_old_execution_digest:
-                raise ExecutionRebindError("EXECUTION_REBIND_PROJECTION_DRIFT", 409)
-        return task, columns, metadata_column, metadata, old_execution
-
-    def rebind(
-        self,
-        task_id: str,
-        request: ExecutionRebindRequest,
-    ) -> dict[str, Any]:
-        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
-        required_authorization = _required_authorization_id()
-        if request.authorization_id != required_authorization:
-            raise ExecutionRebindError("EXECUTION_REBIND_AUTHORIZATION_ID_MISMATCH", 403)
-
-        request_sha = _sha(request.public())
-
-        # Idempotent replay must win before CAS validation because a successful
-        # rebind necessarily increments the Task revision and changes the persisted envelope.
-        with self._connect() as connection:
-            self._ensure_rebind_table(connection)
-            replay = connection.execute(
-                "SELECT * FROM task_execution_rebinds WHERE task_id=? AND idempotency_key=?",
-                (task_id, request.idempotency_key),
-            ).fetchone()
-            if replay is not None:
-                if replay["request_sha256"] != request_sha:
-                    raise ExecutionRebindError("EXECUTION_REBIND_IDEMPOTENCY_CONFLICT", 409)
-                connection.commit()
-                return {
-                    "task_id": task_id,
-                    "status": "QUEUED",
-                    "attempt": int(replay["attempt"]),
-                    "revision": int(replay["applied_revision"]),
-                    "old_execution_digest": replay["old_execution_digest"],
-                    "new_execution_digest": replay["new_execution_digest"],
-                    "authorization_id": replay["authorization_id"],
-                    "idempotent": True,
-                }
-
-        # Read/CAS snapshot first. Canonical Bridge resolution happens outside the DB write lock.
-        with self._connect() as connection:
-            task, columns, _, _, old_execution = self._load_and_validate(
-                connection, task_id, request
-            )
-            capabilities = self._required_capabilities(task, columns, old_execution)
-
-        binding = GovernedExecutionBinding.from_mapping(old_execution)
-        resolved = dict(self.resolver(task_id, capabilities))
-        new_execution = validate_execution_envelope(resolved, binding=binding)
-        if new_execution.get("action") != "deterministic":
-            raise ExecutionRebindError("EXECUTION_REBIND_DETERMINISTIC_PLAN_REQUIRED", 409)
-        if new_execution["execution_digest"] != request.expected_new_execution_digest:
-            raise ExecutionRebindError("EXECUTION_REBIND_NEW_DIGEST_DRIFT", 409)
-        if new_execution["execution_digest"] == old_execution["execution_digest"]:
-            raise ExecutionRebindError("EXECUTION_REBIND_DIGEST_UNCHANGED", 409)
-
-        # Re-read under BEGIN IMMEDIATE and apply only if the exact snapshot is unchanged.
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_rebind_table(connection)
-
-            replay = connection.execute(
-                "SELECT * FROM task_execution_rebinds WHERE task_id=? AND idempotency_key=?",
-                (task_id, request.idempotency_key),
-            ).fetchone()
-            if replay is not None:
-                if replay["request_sha256"] != request_sha:
-                    raise ExecutionRebindError("EXECUTION_REBIND_IDEMPOTENCY_CONFLICT", 409)
-                connection.commit()
-                return {
-                    "task_id": task_id,
-                    "status": "QUEUED",
-                    "attempt": int(replay["attempt"]),
-                    "revision": int(replay["applied_revision"]),
-                    "old_execution_digest": replay["old_execution_digest"],
-                    "new_execution_digest": replay["new_execution_digest"],
-                    "authorization_id": replay["authorization_id"],
-                    "idempotent": True,
-                }
-
-            task, columns, metadata_column, metadata, current_old = self._load_and_validate(
-                connection, task_id, request
-            )
-            if current_old["execution_digest"] != old_execution["execution_digest"]:
-                raise ExecutionRebindError("EXECUTION_REBIND_OLD_DIGEST_DRIFT", 409)
-
-            new_metadata = dict(metadata)
-            new_metadata["execution"] = new_execution
-            new_metadata["execution_projection"] = {
-                "schema": "aios.online-agent.task-projection.v1",
-                "task_id": binding.task_id,
-                "job_id": binding.job_id,
-                "execution_digest": new_execution["execution_digest"],
-            }
-            applied_revision = request.expected_revision + 1
-            previous_claimed_by = task["claimed_by"]
-
-            cursor = connection.execute(
-                f"""
-                UPDATE tasks
-                   SET "{metadata_column}"=?, revision=?, claimed_by=NULL,
-                       lease_token_hash=NULL, lease_expires_at=NULL
-                 WHERE task_id=? AND status=? AND revision=? AND attempt=?
-                   AND claimed_by IS ? AND lease_token_hash IS NULL AND lease_expires_at IS NULL
-                """,
-                (
-                    json.dumps(new_metadata, sort_keys=True, separators=(",", ":")),
-                    applied_revision,
-                    task_id,
-                    request.expected_status,
-                    request.expected_revision,
-                    request.expected_attempt,
-                    previous_claimed_by,
-                ),
-            )
-            if cursor.rowcount != 1:
-                raise ExecutionRebindError("EXECUTION_REBIND_CAS_MISMATCH", 409)
-
-            event_payload = {
-                "schema": "aios.task-execution-rebind.event.v1",
-                "task_id": task_id,
-                "job_id": binding.job_id,
-                "authorization_id": request.authorization_id,
-                "idempotency_key": request.idempotency_key,
-                "reason": request.reason,
-                "previous_verification_sha256": request.previous_verification_sha256,
-                "old_execution_digest": old_execution["execution_digest"],
-                "new_execution_digest": new_execution["execution_digest"],
-                "old_action": old_execution.get("action"),
-                "new_action": new_execution.get("action"),
-                "previous_revision": request.expected_revision,
-                "applied_revision": applied_revision,
-                "attempt": request.expected_attempt,
-                "request_sha256": request_sha,
-                "previous_claimed_by": previous_claimed_by,
-                "stale_claim_normalized": previous_claimed_by not in (None, ""),
-            }
-            self._insert_event(connection, task_id, event_payload)
-            connection.execute(
-                """
-                INSERT INTO task_execution_rebinds(
-                  task_id,idempotency_key,request_sha256,authorization_id,
-                  previous_verification_sha256,old_execution_digest,new_execution_digest,
-                  expected_revision,applied_revision,attempt,reason,created_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    task_id,
-                    request.idempotency_key,
-                    request_sha,
-                    request.authorization_id,
-                    request.previous_verification_sha256,
-                    old_execution["execution_digest"],
-                    new_execution["execution_digest"],
-                    request.expected_revision,
-                    applied_revision,
-                    request.expected_attempt,
-                    request.reason,
-                    _now(),
-                ),
-            )
-            connection.commit()
-            return {
-                "task_id": task_id,
-                "status": "QUEUED",
-                "attempt": request.expected_attempt,
-                "revision": applied_revision,
-                "old_execution_digest": old_execution["execution_digest"],
-                "new_execution_digest": new_execution["execution_digest"],
-                "authorization_id": request.authorization_id,
-                "idempotent": False,
-            }
-
-
-class ExecutionRebindHandler(BaseHTTPRequestHandler):
-    store: ExecutionRebindStore | None = None
-    control_token: str = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def _json(self, value: Mapping[str, Any], status: int) -> None:
-        data = json.dumps(
-            dict(value), sort_keys=True, separators=(",", ":")
-        ).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def _authorized(self) -> bool:
-        header = self.headers.get("Authorization", "")
-        return (
-            header.startswith("Bearer ")
-            and bool(self.control_token)
-            and hmac.compare_digest(header[7:], self.control_token)
-        )
-
-    def do_GET(self) -> None:
-        if self.path == "/health":
-            self._json(
-                {"status": "ok", "service": "aios-agent-task-execution-rebind"},
-                200,
-            )
-        else:
-            self._json({"error": "NOT_FOUND"}, 404)
-
-    def do_POST(self) -> None:
-        match = re.fullmatch(r"/v1/tasks/([^/]+)/execution-rebind", self.path)
-        if match is None:
-            self._json({"error": "NOT_FOUND"}, 404)
-            return
-        if not self._authorized():
-            self._json({"error": "UNAUTHORIZED"}, 401)
-            return
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError:
-            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
-            return
-        if length < 1 or length > MAX_BODY:
-            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
-            return
-        try:
-            value = json.loads(self.rfile.read(length).decode("utf-8"))
-            if not isinstance(value, Mapping):
-                raise ValueError
-            request = ExecutionRebindRequest.from_mapping(value)
-            if self.store is None:
-                raise ExecutionRebindError("RUNTIME_UNAVAILABLE", 503)
-            result = self.store.rebind(match.group(1), request)
-            self._json(result, 200 if result["idempotent"] else 201)
-        except ExecutionRebindError as exc:
-            self._json({"error": exc.code}, exc.status)
-        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
-            self._json({"error": "REQUEST_INVALID"}, 400)
-
-
-def load_control_token(path: Path) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise RuntimeError("TASK_EXECUTION_REBIND_CONTROL_CREDENTIAL_UNAVAILABLE")
-    value = path.read_text(encoding="utf-8").strip()
-    if len(value) < 32:
-        raise RuntimeError("TASK_EXECUTION_REBIND_CONTROL_CREDENTIAL_INVALID")
-    return value
-
-
-def serve() -> None:
-    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
-    _required_authorization_id()
-    token_path = Path(
-        os.environ.get(
-            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-            str(
-                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-                / "agent_task_control_token"
-            ),
-        )
-    )
-    token = load_control_token(token_path)
-    bridge = os.environ.get(
-        "AIOS_GOVERNED_WRITE_API_URL",
-        "http://127.0.0.1:18892",
-    )
-    host = os.environ.get("AIOS_TASK_EXECUTION_REBIND_HOST", "127.0.0.1")
-    port = int(os.environ.get("AIOS_TASK_EXECUTION_REBIND_PORT", "18942"))
-    ExecutionRebindHandler.store = ExecutionRebindStore(
-        db,
-        CanonicalBridgeExecutionResolver(bridge, token),
-    )
-    ExecutionRebindHandler.control_token = token
-    ThreadingHTTPServer((host, port), ExecutionRebindHandler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,870 +0,0 @@
-#!/usr/bin/env python3
-"""Durable online task protocol for external AIOS agents.
-
-The store is deliberately independent from Git/Gitea mutation. It provides a
-small durable state machine for publishing work, atomic claim/lease ownership,
-heartbeat, idempotent result submission, explicit server-side verification,
-lease recovery, and audit events.
-
-No plaintext agent credential or task lease token is persisted.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-import hashlib
-import hmac
-import json
-from pathlib import Path
-import secrets
-import sqlite3
-from typing import Any, Callable, Iterable, Mapping
-import uuid
-
-from aios_capability_contract import has_capabilities
-from aios_online_agent_execution import (
-    ExecutionProjectionError,
-    validate_execution_envelope,
-)
-
-
-TERMINAL_STATES = frozenset({"SUCCEEDED", "FAILED", "EXPIRED", "CANCELLED"})
-ACTIVE_LEASE_STATES = frozenset({"CLAIMED", "RUNNING"})
-TASK_STATES = frozenset({
-    "QUEUED", "CLAIMED", "RUNNING", "VERIFYING",
-    "SUCCEEDED", "FAILED", "EXPIRED", "CANCELLED",
-})
-VERIFY_DECISIONS = frozenset({"SUCCEEDED", "NEEDS_REWORK", "FAILED"})
-
-
-GOVERNED_WRITE_CAPABILITIES = frozenset({
-    "governed.write.branch",
-    "governed.write.file",
-})
-EXECUTION_PROJECTION_SCHEMA = "aios.online-agent.task-projection.v1"
-
-
-def _validate_write_execution_binding(
-    task_id: str,
-    required_capabilities: list[str],
-    metadata: Mapping[str, Any],
-) -> None:
-    required = set(required_capabilities)
-    if not required.intersection(GOVERNED_WRITE_CAPABILITIES):
-        return
-    execution = metadata.get("execution")
-    projection = metadata.get("execution_projection")
-    if not isinstance(execution, Mapping) or not isinstance(projection, Mapping):
-        raise TaskProtocolError("GOVERNED_EXECUTION_BINDING_REQUIRED", 409)
-    try:
-        canonical = validate_execution_envelope(dict(execution))
-    except (ExecutionProjectionError, TypeError, ValueError, KeyError) as exc:
-        raise TaskProtocolError("EXECUTION_ENVELOPE_INVALID", 409) from exc
-    if canonical.get("task_id") != task_id:
-        raise TaskProtocolError("TASK_BINDING_CONFLICT", 409)
-    if set(canonical.get("capability_scope") or ()) != required:
-        raise TaskProtocolError("EXECUTION_CAPABILITY_SCOPE_CONFLICT", 409)
-    if (
-        projection.get("schema") != EXECUTION_PROJECTION_SCHEMA
-        or projection.get("task_id") != task_id
-        or projection.get("job_id") != canonical.get("job_id")
-        or projection.get("execution_digest") != canonical.get("execution_digest")
-    ):
-        raise TaskProtocolError("EXECUTION_PROJECTION_INVALID", 409)
-
-
-class TaskProtocolError(RuntimeError):
-    def __init__(self, code: str, http_status: int = 409) -> None:
-        super().__init__(code)
-        self.code = code
-        self.http_status = http_status
-
-
-@dataclass(frozen=True, slots=True)
-class Principal:
-    kind: str
-    identifier: str
-
-
-def utcnow() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def iso(value: datetime) -> str:
-    return value.astimezone(timezone.utc).isoformat()
-
-
-def parse_time(value: str | None) -> datetime | None:
-    if not value:
-        return None
-    parsed = datetime.fromisoformat(value)
-    if parsed.tzinfo is None:
-        parsed = parsed.replace(tzinfo=timezone.utc)
-    return parsed.astimezone(timezone.utc)
-
-
-def canonical_json(value: Any) -> str:
-    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-
-
-def digest_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json(value).encode("utf-8")).hexdigest()
-
-
-def _string_list(value: Iterable[object] | None, field: str, *, max_items: int = 128) -> list[str]:
-    if value is None:
-        return []
-    if isinstance(value, (str, bytes)) or not isinstance(value, Iterable):
-        raise TaskProtocolError(field.upper() + "_INVALID", 400)
-    result: list[str] = []
-    for item in value:
-        text = str(item).strip()
-        if not text or len(text) > 160:
-            raise TaskProtocolError(field.upper() + "_INVALID", 400)
-        result.append(text)
-        if len(result) > max_items:
-            raise TaskProtocolError(field.upper() + "_TOO_LARGE", 400)
-    return sorted(set(result))
-
-
-def _json_object(value: object | None, field: str, *, max_bytes: int = 128 * 1024) -> dict[str, Any]:
-    if value is None:
-        return {}
-    if not isinstance(value, Mapping):
-        raise TaskProtocolError(field.upper() + "_INVALID", 400)
-    result = dict(value)
-    if len(canonical_json(result).encode("utf-8")) > max_bytes:
-        raise TaskProtocolError(field.upper() + "_TOO_LARGE", 413)
-    return result
-
-
-def _criteria(value: object | None) -> list[Any]:
-    if value is None:
-        return []
-    if isinstance(value, (str, bytes)) or not isinstance(value, list):
-        raise TaskProtocolError("SUCCESS_CRITERIA_INVALID", 400)
-    if len(value) > 128:
-        raise TaskProtocolError("SUCCESS_CRITERIA_TOO_LARGE", 413)
-    if len(canonical_json(value).encode("utf-8")) > 128 * 1024:
-        raise TaskProtocolError("SUCCESS_CRITERIA_TOO_LARGE", 413)
-    return list(value)
-
-
-class TaskStore:
-    """SQLite-backed durable task store.
-
-    SQLite BEGIN IMMEDIATE serializes claims so two agents cannot successfully
-    claim the same queued task. WAL mode allows concurrent readers.
-    """
-
-    def __init__(
-        self,
-        path: str | Path,
-        *,
-        now: Callable[[], datetime] = utcnow,
-        token_pepper: str = "",
-    ) -> None:
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        self.now = now
-        self.token_pepper = token_pepper
-        self._initialize()
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.path, timeout=10, isolation_level=None)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA journal_mode=WAL")
-        connection.execute("PRAGMA synchronous=FULL")
-        connection.execute("PRAGMA busy_timeout=10000")
-        return connection
-
-    def _initialize(self) -> None:
-        with self._connect() as connection:
-            connection.executescript(
-                """
-                CREATE TABLE IF NOT EXISTS agents (
-                    agent_id TEXT PRIMARY KEY,
-                    agent_type TEXT NOT NULL,
-                    agent_version TEXT NOT NULL,
-                    capabilities_json TEXT NOT NULL,
-                    metadata_json TEXT NOT NULL,
-                    token_hash TEXT NOT NULL UNIQUE,
-                    status TEXT NOT NULL,
-                    created_at TEXT NOT NULL,
-                    last_seen_at TEXT NOT NULL
-                );
-
-                CREATE TABLE IF NOT EXISTS tasks (
-                    task_id TEXT PRIMARY KEY,
-                    goal TEXT NOT NULL,
-                    instructions TEXT NOT NULL,
-                    success_criteria_json TEXT NOT NULL,
-                    required_capabilities_json TEXT NOT NULL,
-                    constraints_json TEXT NOT NULL,
-                    metadata_json TEXT NOT NULL,
-                    deadline TEXT,
-                    priority INTEGER NOT NULL,
-                    max_attempts INTEGER NOT NULL,
-                    attempt INTEGER NOT NULL DEFAULT 0,
-                    status TEXT NOT NULL,
-                    claimed_by TEXT,
-                    lease_token_hash TEXT,
-                    lease_expires_at TEXT,
-                    result_json TEXT,
-                    result_digest TEXT,
-                    result_idempotency_key TEXT,
-                    verification_json TEXT,
-                    revision INTEGER NOT NULL DEFAULT 1,
-                    created_at TEXT NOT NULL,
-                    updated_at TEXT NOT NULL,
-                    FOREIGN KEY(claimed_by) REFERENCES agents(agent_id)
-                );
-
-                CREATE TABLE IF NOT EXISTS idempotency (
-                    scope TEXT NOT NULL,
-                    key TEXT NOT NULL,
-                    payload_digest TEXT NOT NULL,
-                    response_json TEXT NOT NULL,
-                    created_at TEXT NOT NULL,
-                    PRIMARY KEY(scope, key)
-                );
-
-                CREATE TABLE IF NOT EXISTS events (
-                    event_id INTEGER PRIMARY KEY AUTOINCREMENT,
-                    task_id TEXT,
-                    agent_id TEXT,
-                    event_type TEXT NOT NULL,
-                    payload_json TEXT NOT NULL,
-                    created_at TEXT NOT NULL
-                );
-
-                CREATE INDEX IF NOT EXISTS idx_tasks_queue
-                ON tasks(status, priority DESC, created_at);
-
-                CREATE INDEX IF NOT EXISTS idx_tasks_lease
-                ON tasks(status, lease_expires_at);
-
-                CREATE INDEX IF NOT EXISTS idx_events_task
-                ON events(task_id, event_id);
-                """
-            )
-
-    def _token_hash(self, token: str) -> str:
-        return hashlib.sha256((self.token_pepper + "\0" + token).encode("utf-8")).hexdigest()
-
-    @staticmethod
-    def _row_task(row: sqlite3.Row, *, include_result: bool = True) -> dict[str, Any]:
-        value: dict[str, Any] = {
-            "task_id": row["task_id"],
-            "goal": row["goal"],
-            "instructions": row["instructions"],
-            "success_criteria": json.loads(row["success_criteria_json"]),
-            "required_capabilities": json.loads(row["required_capabilities_json"]),
-            "constraints": json.loads(row["constraints_json"]),
-            "metadata": json.loads(row["metadata_json"]),
-            "deadline": row["deadline"],
-            "priority": row["priority"],
-            "max_attempts": row["max_attempts"],
-            "attempt": row["attempt"],
-            "status": row["status"],
-            "claimed_by": row["claimed_by"],
-            "lease_expires_at": row["lease_expires_at"],
-            "revision": row["revision"],
-            "created_at": row["created_at"],
-            "updated_at": row["updated_at"],
-        }
-        if include_result:
-            value["result"] = json.loads(row["result_json"]) if row["result_json"] else None
-            value["verification"] = (
-                json.loads(row["verification_json"]) if row["verification_json"] else None
-            )
-        return value
-
-    def _event(
-        self,
-        connection: sqlite3.Connection,
-        event_type: str,
-        *,
-        task_id: str | None = None,
-        agent_id: str | None = None,
-        payload: Mapping[str, Any] | None = None,
-    ) -> None:
-        connection.execute(
-            "INSERT INTO events(task_id,agent_id,event_type,payload_json,created_at)"
-            " VALUES(?,?,?,?,?)",
-            (task_id, agent_id, event_type, canonical_json(dict(payload or {})), iso(self.now())),
-        )
-
-    def register_agent(
-        self,
-        *,
-        agent_id: str,
-        agent_type: str,
-        agent_version: str,
-        capabilities: Iterable[object],
-        metadata: Mapping[str, Any] | None = None,
-    ) -> dict[str, Any]:
-        agent_id = agent_id.strip()
-        agent_type = agent_type.strip()
-        agent_version = agent_version.strip()
-        if not agent_id or len(agent_id) > 160 or not agent_type or not agent_version:
-            raise TaskProtocolError("AGENT_IDENTITY_INVALID", 400)
-        caps = _string_list(capabilities, "capabilities")
-        meta = _json_object(metadata, "metadata")
-        token = "agt_" + secrets.token_urlsafe(32)
-        now = iso(self.now())
-        try:
-            with self._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                connection.execute(
-                    "INSERT INTO agents(agent_id,agent_type,agent_version,capabilities_json,"
-                    "metadata_json,token_hash,status,created_at,last_seen_at)"
-                    " VALUES(?,?,?,?,?,?,?,?,?)",
-                    (
-                        agent_id,
-                        agent_type,
-                        agent_version,
-                        canonical_json(caps),
-                        canonical_json(meta),
-                        self._token_hash(token),
-                        "ACTIVE",
-                        now,
-                        now,
-                    ),
-                )
-                self._event(
-                    connection,
-                    "AGENT_REGISTERED",
-                    agent_id=agent_id,
-                    payload={"agent_type": agent_type, "agent_version": agent_version},
-                )
-                connection.commit()
-        except sqlite3.IntegrityError as exc:
-            raise TaskProtocolError("AGENT_ALREADY_EXISTS", 409) from exc
-        return {
-            "agent_id": agent_id,
-            "agent_type": agent_type,
-            "agent_version": agent_version,
-            "capabilities": caps,
-            "agent_token": token,
-            "credential_returned_once": True,
-        }
-
-    def authenticate_agent(self, token: str) -> dict[str, Any]:
-        if not token:
-            raise TaskProtocolError("UNAUTHORIZED", 401)
-        token_hash = self._token_hash(token)
-        with self._connect() as connection:
-            row = connection.execute(
-                "SELECT * FROM agents WHERE token_hash=? AND status='ACTIVE'",
-                (token_hash,),
-            ).fetchone()
-            if row is None:
-                raise TaskProtocolError("UNAUTHORIZED", 401)
-            connection.execute(
-                "UPDATE agents SET last_seen_at=? WHERE agent_id=?",
-                (iso(self.now()), row["agent_id"]),
-            )
-            return {
-                "agent_id": row["agent_id"],
-                "agent_type": row["agent_type"],
-                "agent_version": row["agent_version"],
-                "capabilities": json.loads(row["capabilities_json"]),
-                "metadata": json.loads(row["metadata_json"]),
-            }
-
-    def _idempotent_lookup(
-        self,
-        connection: sqlite3.Connection,
-        *,
-        scope: str,
-        key: str,
-        payload_digest: str,
-    ) -> dict[str, Any] | None:
-        row = connection.execute(
-            "SELECT payload_digest,response_json FROM idempotency WHERE scope=? AND key=?",
-            (scope, key),
-        ).fetchone()
-        if row is None:
-            return None
-        if not hmac.compare_digest(row["payload_digest"], payload_digest):
-            raise TaskProtocolError("IDEMPOTENCY_CONFLICT", 409)
-        return json.loads(row["response_json"])
-
-    def _idempotent_store(
-        self,
-        connection: sqlite3.Connection,
-        *,
-        scope: str,
-        key: str,
-        payload_digest: str,
-        response: Mapping[str, Any],
-    ) -> None:
-        connection.execute(
-            "INSERT INTO idempotency(scope,key,payload_digest,response_json,created_at)"
-            " VALUES(?,?,?,?,?)",
-            (scope, key, payload_digest, canonical_json(dict(response)), iso(self.now())),
-        )
-
-    def create_task(
-        self,
-        *,
-        task_id: str | None,
-        goal: str,
-        instructions: str,
-        success_criteria: object | None,
-        required_capabilities: Iterable[object] | None = None,
-        constraints: Mapping[str, Any] | None = None,
-        metadata: Mapping[str, Any] | None = None,
-        deadline: str | None = None,
-        priority: int = 0,
-        max_attempts: int = 3,
-        idempotency_key: str,
-    ) -> dict[str, Any]:
-        task_id = (task_id or ("task-" + uuid.uuid4().hex)).strip()
-        goal = goal.strip()
-        instructions = instructions.strip()
-        idempotency_key = idempotency_key.strip()
-        if not task_id or len(task_id) > 180 or not goal or not instructions:
-            raise TaskProtocolError("TASK_BINDING_INVALID", 400)
-        if not idempotency_key or len(idempotency_key) > 160:
-            raise TaskProtocolError("IDEMPOTENCY_KEY_INVALID", 400)
-        if not isinstance(priority, int) or isinstance(priority, bool) or not -100 <= priority <= 100:
-            raise TaskProtocolError("PRIORITY_INVALID", 400)
-        if not isinstance(max_attempts, int) or isinstance(max_attempts, bool) or not 1 <= max_attempts <= 20:
-            raise TaskProtocolError("MAX_ATTEMPTS_INVALID", 400)
-        parsed_deadline = parse_time(deadline)
-        if parsed_deadline and parsed_deadline <= self.now():
-            raise TaskProtocolError("DEADLINE_INVALID", 400)
-        criteria = _criteria(success_criteria)
-        required = _string_list(required_capabilities, "required_capabilities")
-        constraints_value = _json_object(constraints, "constraints")
-        metadata_value = _json_object(metadata, "metadata")
-        _validate_write_execution_binding(task_id, required, metadata_value)
-        payload = {
-            "task_id": task_id,
-            "goal": goal,
-            "instructions": instructions,
-            "success_criteria": criteria,
-            "required_capabilities": required,
-            "constraints": constraints_value,
-            "metadata": metadata_value,
-            "deadline": iso(parsed_deadline) if parsed_deadline else None,
-            "priority": priority,
-            "max_attempts": max_attempts,
-        }
-        payload_digest = digest_json(payload)
-        now = iso(self.now())
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            replay = self._idempotent_lookup(
-                connection,
-                scope="create_task",
-                key=idempotency_key,
-                payload_digest=payload_digest,
-            )
-            if replay is not None:
-                connection.commit()
-                return {**replay, "idempotent": True}
-            try:
-                connection.execute(
-                    "INSERT INTO tasks(task_id,goal,instructions,success_criteria_json,"
-                    "required_capabilities_json,constraints_json,metadata_json,deadline,priority,"
-                    "max_attempts,attempt,status,revision,created_at,updated_at)"
-                    " VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
-                    (
-                        task_id,
-                        goal,
-                        instructions,
-                        canonical_json(criteria),
-                        canonical_json(required),
-                        canonical_json(constraints_value),
-                        canonical_json(metadata_value),
-                        payload["deadline"],
-                        priority,
-                        max_attempts,
-                        0,
-                        "QUEUED",
-                        1,
-                        now,
-                        now,
-                    ),
-                )
-            except sqlite3.IntegrityError as exc:
-                raise TaskProtocolError("TASK_ID_CONFLICT", 409) from exc
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            result = self._row_task(row)
-            self._idempotent_store(
-                connection,
-                scope="create_task",
-                key=idempotency_key,
-                payload_digest=payload_digest,
-                response=result,
-            )
-            self._event(connection, "TASK_CREATED", task_id=task_id, payload={"priority": priority})
-            connection.commit()
-            return result
-
-    def _expire_locked(self, connection: sqlite3.Connection) -> None:
-        now_dt = self.now()
-        now = iso(now_dt)
-        rows = connection.execute(
-            "SELECT * FROM tasks WHERE status IN ('QUEUED','CLAIMED','RUNNING')"
-        ).fetchall()
-        for row in rows:
-            deadline = parse_time(row["deadline"])
-            if deadline is not None and deadline <= now_dt:
-                connection.execute(
-                    "UPDATE tasks SET status='EXPIRED',lease_token_hash=NULL,"
-                    "lease_expires_at=NULL,revision=revision+1,updated_at=? WHERE task_id=?",
-                    (now, row["task_id"]),
-                )
-                self._event(connection, "TASK_EXPIRED", task_id=row["task_id"])
-                continue
-            if row["status"] in ACTIVE_LEASE_STATES:
-                lease_expires = parse_time(row["lease_expires_at"])
-                if lease_expires is not None and lease_expires <= now_dt:
-                    if row["attempt"] >= row["max_attempts"]:
-                        next_state = "FAILED"
-                    else:
-                        next_state = "QUEUED"
-                    if next_state == "FAILED":
-                        connection.execute(
-                            "UPDATE tasks SET status=?,lease_token_hash=NULL,"
-                            "lease_expires_at=NULL,revision=revision+1,updated_at=? WHERE task_id=?",
-                            (next_state, now, row["task_id"]),
-                        )
-                    else:
-                        connection.execute(
-                            "UPDATE tasks SET status=?,claimed_by=NULL,lease_token_hash=NULL,"
-                            "lease_expires_at=NULL,revision=revision+1,updated_at=? WHERE task_id=?",
-                            (next_state, now, row["task_id"]),
-                        )
-                    self._event(
-                        connection,
-                        "LEASE_EXPIRED",
-                        task_id=row["task_id"],
-                        agent_id=row["claimed_by"],
-                        payload={"next_state": next_state, "attempt": row["attempt"]},
-                    )
-
-    def expire_leases(self) -> int:
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            before = connection.total_changes
-            self._expire_locked(connection)
-            changed = connection.total_changes - before
-            connection.commit()
-            return changed
-
-    def poll_tasks(self, *, agent_id: str, limit: int = 20) -> list[dict[str, Any]]:
-        if not 1 <= int(limit) <= 100:
-            raise TaskProtocolError("LIMIT_INVALID", 400)
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._expire_locked(connection)
-            agent = connection.execute(
-                "SELECT capabilities_json FROM agents WHERE agent_id=? AND status='ACTIVE'",
-                (agent_id,),
-            ).fetchone()
-            if agent is None:
-                raise TaskProtocolError("AGENT_NOT_FOUND", 404)
-            capabilities = json.loads(agent["capabilities_json"])
-            rows = connection.execute(
-                "SELECT * FROM tasks WHERE status='QUEUED' ORDER BY priority DESC,created_at ASC"
-            ).fetchall()
-            result = []
-            for row in rows:
-                required = json.loads(row["required_capabilities_json"])
-                if has_capabilities(capabilities, required):
-                    result.append(self._row_task(row, include_result=False))
-                    if len(result) >= int(limit):
-                        break
-            connection.commit()
-            return result
-
-    def _agent_capabilities(self, connection: sqlite3.Connection, agent_id: str) -> set[str]:
-        row = connection.execute(
-            "SELECT capabilities_json FROM agents WHERE agent_id=? AND status='ACTIVE'",
-            (agent_id,),
-        ).fetchone()
-        if row is None:
-            raise TaskProtocolError("AGENT_NOT_FOUND", 404)
-        return set(json.loads(row["capabilities_json"]))
-
-    def claim_task(
-        self,
-        *,
-        task_id: str,
-        agent_id: str,
-        lease_seconds: int = 300,
-    ) -> dict[str, Any]:
-        if not isinstance(lease_seconds, int) or isinstance(lease_seconds, bool) or not 30 <= lease_seconds <= 3600:
-            raise TaskProtocolError("LEASE_SECONDS_INVALID", 400)
-        lease_token = "lease_" + secrets.token_urlsafe(32)
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._expire_locked(connection)
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            if row is None:
-                raise TaskProtocolError("TASK_NOT_FOUND", 404)
-            if row["status"] != "QUEUED":
-                raise TaskProtocolError("TASK_NOT_CLAIMABLE", 409)
-            capabilities = self._agent_capabilities(connection, agent_id)
-            required = json.loads(row["required_capabilities_json"])
-            if not has_capabilities(capabilities, required):
-                raise TaskProtocolError("AGENT_CAPABILITY_MISMATCH", 403)
-            attempt = int(row["attempt"]) + 1
-            if attempt > int(row["max_attempts"]):
-                raise TaskProtocolError("TASK_ATTEMPTS_EXHAUSTED", 409)
-            expires = self.now() + timedelta(seconds=lease_seconds)
-            now = iso(self.now())
-            updated = connection.execute(
-                "UPDATE tasks SET status='CLAIMED',claimed_by=?,lease_token_hash=?,"
-                "lease_expires_at=?,attempt=?,revision=revision+1,updated_at=? "
-                "WHERE task_id=? AND status='QUEUED'",
-                (
-                    agent_id,
-                    self._token_hash(lease_token),
-                    iso(expires),
-                    attempt,
-                    now,
-                    task_id,
-                ),
-            )
-            if updated.rowcount != 1:
-                raise TaskProtocolError("TASK_CLAIM_CONFLICT", 409)
-            self._event(
-                connection,
-                "TASK_CLAIMED",
-                task_id=task_id,
-                agent_id=agent_id,
-                payload={"attempt": attempt, "lease_expires_at": iso(expires)},
-            )
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            connection.commit()
-            return {
-                **self._row_task(row, include_result=False),
-                "lease_token": lease_token,
-                "lease_token_returned_once": True,
-            }
-
-    def _validate_lease(
-        self,
-        connection: sqlite3.Connection,
-        *,
-        task_id: str,
-        agent_id: str,
-        lease_token: str,
-        allowed_states: frozenset[str] = ACTIVE_LEASE_STATES,
-    ) -> sqlite3.Row:
-        self._expire_locked(connection)
-        row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-        if row is None:
-            raise TaskProtocolError("TASK_NOT_FOUND", 404)
-        if row["status"] not in allowed_states:
-            raise TaskProtocolError("TASK_LEASE_NOT_ACTIVE", 409)
-        if row["claimed_by"] != agent_id:
-            raise TaskProtocolError("TASK_LEASE_OWNER_MISMATCH", 403)
-        if not row["lease_token_hash"] or not hmac.compare_digest(
-            row["lease_token_hash"], self._token_hash(lease_token)
-        ):
-            raise TaskProtocolError("TASK_LEASE_TOKEN_INVALID", 403)
-        expires = parse_time(row["lease_expires_at"])
-        if expires is None or expires <= self.now():
-            raise TaskProtocolError("TASK_LEASE_EXPIRED", 409)
-        return row
-
-    def heartbeat(
-        self,
-        *,
-        task_id: str,
-        agent_id: str,
-        lease_token: str,
-        progress: Mapping[str, Any] | None = None,
-        lease_seconds: int = 300,
-    ) -> dict[str, Any]:
-        if not 30 <= int(lease_seconds) <= 3600:
-            raise TaskProtocolError("LEASE_SECONDS_INVALID", 400)
-        progress_value = _json_object(progress, "progress", max_bytes=64 * 1024)
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._validate_lease(
-                connection,
-                task_id=task_id,
-                agent_id=agent_id,
-                lease_token=lease_token,
-            )
-            expires = self.now() + timedelta(seconds=int(lease_seconds))
-            now = iso(self.now())
-            connection.execute(
-                "UPDATE tasks SET status='RUNNING',lease_expires_at=?,revision=revision+1,"
-                "updated_at=? WHERE task_id=?",
-                (iso(expires), now, task_id),
-            )
-            self._event(
-                connection,
-                "TASK_HEARTBEAT",
-                task_id=task_id,
-                agent_id=agent_id,
-                payload={"progress": progress_value, "lease_expires_at": iso(expires)},
-            )
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            connection.commit()
-            return self._row_task(row, include_result=False)
-
-    def submit_result(
-        self,
-        *,
-        task_id: str,
-        agent_id: str,
-        lease_token: str,
-        idempotency_key: str,
-        result: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        idempotency_key = idempotency_key.strip()
-        if not idempotency_key or len(idempotency_key) > 160:
-            raise TaskProtocolError("IDEMPOTENCY_KEY_INVALID", 400)
-        result_value = _json_object(result, "result", max_bytes=1024 * 1024)
-        result_digest = digest_json(result_value)
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            if row is None:
-                raise TaskProtocolError("TASK_NOT_FOUND", 404)
-            if row["result_idempotency_key"] == idempotency_key:
-                if not row["result_digest"] or not hmac.compare_digest(row["result_digest"], result_digest):
-                    raise TaskProtocolError("IDEMPOTENCY_CONFLICT", 409)
-                connection.commit()
-                return {**self._row_task(row), "idempotent": True}
-            self._validate_lease(
-                connection,
-                task_id=task_id,
-                agent_id=agent_id,
-                lease_token=lease_token,
-            )
-            now = iso(self.now())
-            connection.execute(
-                "UPDATE tasks SET status='VERIFYING',result_json=?,result_digest=?,"
-                "result_idempotency_key=?,lease_token_hash=NULL,lease_expires_at=NULL,"
-                "revision=revision+1,updated_at=? WHERE task_id=?",
-                (
-                    canonical_json(result_value),
-                    result_digest,
-                    idempotency_key,
-                    now,
-                    task_id,
-                ),
-            )
-            self._event(
-                connection,
-                "RESULT_SUBMITTED",
-                task_id=task_id,
-                agent_id=agent_id,
-                payload={"result_digest": result_digest, "idempotency_key": idempotency_key},
-            )
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            connection.commit()
-            return self._row_task(row)
-
-    def verify_task(
-        self,
-        *,
-        task_id: str,
-        decision: str,
-        verification: Mapping[str, Any] | None = None,
-    ) -> dict[str, Any]:
-        decision = decision.strip().upper()
-        if decision not in VERIFY_DECISIONS:
-            raise TaskProtocolError("VERIFICATION_DECISION_INVALID", 400)
-        verification_value = _json_object(verification, "verification")
-        verification_value = {"decision": decision, **verification_value}
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            if row is None:
-                raise TaskProtocolError("TASK_NOT_FOUND", 404)
-            if row["status"] != "VERIFYING":
-                raise TaskProtocolError("TASK_NOT_VERIFYING", 409)
-            if decision == "SUCCEEDED":
-                next_state = "SUCCEEDED"
-            elif decision == "FAILED":
-                next_state = "FAILED"
-            elif int(row["attempt"]) >= int(row["max_attempts"]):
-                next_state = "FAILED"
-                verification_value["reason"] = verification_value.get(
-                    "reason", "MAX_ATTEMPTS_EXHAUSTED"
-                )
-            else:
-                next_state = "QUEUED"
-            now = iso(self.now())
-            if next_state in {"SUCCEEDED", "FAILED"}:
-                connection.execute(
-                    "UPDATE tasks SET status=?,lease_token_hash=NULL,"
-                    "lease_expires_at=NULL,verification_json=?,revision=revision+1,updated_at=? "
-                    "WHERE task_id=?",
-                    (next_state, canonical_json(verification_value), now, task_id),
-                )
-            else:
-                connection.execute(
-                    "UPDATE tasks SET status=?,claimed_by=NULL,lease_token_hash=NULL,"
-                    "lease_expires_at=NULL,verification_json=?,revision=revision+1,updated_at=? "
-                    "WHERE task_id=?",
-                    (next_state, canonical_json(verification_value), now, task_id),
-                )
-            self._event(
-                connection,
-                "TASK_VERIFIED",
-                task_id=task_id,
-                agent_id=row["claimed_by"],
-                payload={"decision": decision, "next_state": next_state},
-            )
-            updated = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            connection.commit()
-            return self._row_task(updated)
-
-    def cancel_task(self, *, task_id: str, reason: str = "") -> dict[str, Any]:
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            if row is None:
-                raise TaskProtocolError("TASK_NOT_FOUND", 404)
-            if row["status"] in TERMINAL_STATES:
-                connection.commit()
-                return self._row_task(row)
-            connection.execute(
-                "UPDATE tasks SET status='CANCELLED',lease_token_hash=NULL,"
-                "lease_expires_at=NULL,revision=revision+1,updated_at=? WHERE task_id=?",
-                (iso(self.now()), task_id),
-            )
-            self._event(connection, "TASK_CANCELLED", task_id=task_id, payload={"reason": reason})
-            updated = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            connection.commit()
-            return self._row_task(updated)
-
-    def get_task(self, task_id: str) -> dict[str, Any]:
-        self.expire_leases()
-        with self._connect() as connection:
-            row = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            if row is None:
-                raise TaskProtocolError("TASK_NOT_FOUND", 404)
-            return self._row_task(row)
-
-    def get_events(self, task_id: str, *, limit: int = 200) -> list[dict[str, Any]]:
-        with self._connect() as connection:
-            rows = connection.execute(
-                "SELECT * FROM events WHERE task_id=? ORDER BY event_id DESC LIMIT ?",
-                (task_id, max(1, min(int(limit), 1000))),
-            ).fetchall()
-            return [
-                {
-                    "event_id": row["event_id"],
-                    "task_id": row["task_id"],
-                    "agent_id": row["agent_id"],
-                    "event_type": row["event_type"],
-                    "payload": json.loads(row["payload_json"]),
-                    "created_at": row["created_at"],
-                }
-                for row in reversed(rows)
-            ]
@@ -1,427 +0,0 @@
-"""Owner-controlled, CAS-bound retry extension for exhausted Online Agent Tasks."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Mapping
-
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
-MAX_BODY = 64 * 1024
-AUTHORIZE_EXTENSION_ID_ENV = "AIOS_AGENT_TASK_AUTHORIZATION_ID"
-
-
-class RetryExtensionError(RuntimeError):
-    def __init__(self, code: str, status: int = 409) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def _canonical(value: object) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def _sha(value: object) -> str:
-    return hashlib.sha256(_canonical(value)).hexdigest()
-
-
-def _required_authorization_id() -> str:
-    value = os.environ.get(AUTHORIZE_EXTENSION_ID_ENV, "").strip()
-    if not value:
-        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_MISSING")
-    if KEY_RE.fullmatch(value) is None:
-        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_INVALID")
-    return value
-
-
-def _now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def _require_string(value: object, code: str, pattern: re.Pattern[str] | None = None) -> str:
-    if not isinstance(value, str) or not value.strip():
-        raise RetryExtensionError(code, 400)
-    value = value.strip()
-    if pattern is not None and pattern.fullmatch(value) is None:
-        raise RetryExtensionError(code, 400)
-    return value
-
-
-@dataclass(frozen=True)
-class RetryExtensionRequest:
-    expected_status: str
-    expected_revision: int
-    expected_attempt: int
-    expected_max_attempts: int
-    next_max_attempts: int
-    previous_verification_sha256: str
-    authorization_id: str
-    idempotency_key: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "RetryExtensionRequest":
-        allowed = {
-            "expected_status", "expected_revision", "expected_attempt", "expected_max_attempts",
-            "next_max_attempts", "previous_verification_sha256", "authorization_id", "idempotency_key",
-        }
-        if set(value) != allowed:
-            raise RetryExtensionError("RETRY_EXTENSION_FIELDS_INVALID", 400)
-        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
-        if status != "FAILED":
-            raise RetryExtensionError("EXPECTED_STATUS_INVALID", 400)
-        ints: dict[str, int] = {}
-        for field in ("expected_revision", "expected_attempt", "expected_max_attempts", "next_max_attempts"):
-            item = value[field]
-            if not isinstance(item, int) or isinstance(item, bool) or item < 0:
-                raise RetryExtensionError("RETRY_EXTENSION_INTEGER_INVALID", 400)
-            ints[field] = item
-        if ints["expected_attempt"] != ints["expected_max_attempts"]:
-            raise RetryExtensionError("RETRY_EXTENSION_NOT_EXHAUSTED", 409)
-        if ints["next_max_attempts"] != ints["expected_max_attempts"] + 1:
-            raise RetryExtensionError("RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP", 400)
-        if ints["next_max_attempts"] > 50:
-            raise RetryExtensionError("RETRY_EXTENSION_LIMIT_EXCEEDED", 400)
-        verification = _require_string(value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID")
-        if re.fullmatch(r"[0-9a-f]{64}", verification) is None:
-            raise RetryExtensionError("VERIFICATION_SHA256_INVALID", 400)
-        authorization = _require_string(value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE)
-        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
-        return cls(
-            status,
-            ints["expected_revision"],
-            ints["expected_attempt"],
-            ints["expected_max_attempts"],
-            ints["next_max_attempts"],
-            verification,
-            authorization,
-            key,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "expected_status": self.expected_status,
-            "expected_revision": self.expected_revision,
-            "expected_attempt": self.expected_attempt,
-            "expected_max_attempts": self.expected_max_attempts,
-            "next_max_attempts": self.next_max_attempts,
-            "previous_verification_sha256": self.previous_verification_sha256,
-            "authorization_id": self.authorization_id,
-            "idempotency_key": self.idempotency_key,
-        }
-
-
-class RetryExtensionStore:
-    """Owns the official mutation. Direct/manual DB edits remain forbidden."""
-
-    def __init__(self, db_path: Path) -> None:
-        self.db_path = Path(db_path)
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _columns(connection: sqlite3.Connection, table: str) -> dict[str, sqlite3.Row]:
-        return {str(row["name"]): row for row in connection.execute(f'PRAGMA table_info("{table}")')}
-
-    @staticmethod
-    def _event_table(connection: sqlite3.Connection) -> tuple[str, dict[str, sqlite3.Row]]:
-        tables = {
-            row["name"]
-            for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")
-        }
-        for name in ("task_events", "events"):
-            if name not in tables:
-                continue
-            columns = RetryExtensionStore._columns(connection, name)
-            if "task_id" in columns and ("event_type" in columns or "type" in columns):
-                return name, columns
-        raise RetryExtensionError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
-
-    @staticmethod
-    def _verification_hash(raw: object) -> str:
-        if raw in (None, ""):
-            value: object = {}
-        elif isinstance(raw, str):
-            try:
-                value = json.loads(raw)
-            except json.JSONDecodeError as exc:
-                raise RetryExtensionError("TASK_VERIFICATION_INVALID", 409) from exc
-        else:
-            value = raw
-        return _sha(value)
-
-    @staticmethod
-    def _ensure_extension_table(connection: sqlite3.Connection) -> None:
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_retry_extensions (
-              task_id TEXT NOT NULL,
-              idempotency_key TEXT NOT NULL,
-              request_sha256 TEXT NOT NULL,
-              authorization_id TEXT NOT NULL,
-              previous_verification_sha256 TEXT NOT NULL,
-              previous_max_attempts INTEGER NOT NULL,
-              next_max_attempts INTEGER NOT NULL,
-              expected_revision INTEGER NOT NULL,
-              applied_revision INTEGER NOT NULL,
-              created_at TEXT NOT NULL,
-              PRIMARY KEY(task_id, idempotency_key)
-            )
-            """
-        )
-
-    @staticmethod
-    def _insert_event(
-        connection: sqlite3.Connection,
-        task_id: str,
-        payload: Mapping[str, Any],
-    ) -> None:
-        table, columns = RetryExtensionStore._event_table(connection)
-        values: dict[str, Any] = {"task_id": task_id}
-        if "event_type" in columns:
-            values["event_type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
-        else:
-            values["type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
-        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-        if "payload_json" in columns:
-            values["payload_json"] = payload_text
-        elif "payload" in columns:
-            values["payload"] = payload_text
-        else:
-            raise RetryExtensionError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
-        if "created_at" in columns:
-            values["created_at"] = _now()
-        if "agent_id" in columns:
-            values["agent_id"] = "owner-control"
-        if "actor_id" in columns:
-            values["actor_id"] = "owner-control"
-        names = list(values)
-        sql = f'INSERT INTO "{table}" ({",".join(f"""\"{name}\"""" for name in names)}) VALUES ({",".join("?" for _ in names)})'
-        connection.execute(sql, tuple(values[name] for name in names))
-
-    def extend(self, task_id: str, request: RetryExtensionRequest) -> dict[str, Any]:
-        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
-        required_authorization_id = _required_authorization_id()
-        if request.authorization_id != required_authorization_id:
-            raise RetryExtensionError("RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH", 403)
-        request_payload = request.public()
-        request_sha = _sha(request_payload)
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_extension_table(connection)
-            replay = connection.execute(
-                "SELECT * FROM task_retry_extensions WHERE task_id=? AND idempotency_key=?",
-                (task_id, request.idempotency_key),
-            ).fetchone()
-            if replay is not None:
-                if replay["request_sha256"] != request_sha:
-                    raise RetryExtensionError("RETRY_EXTENSION_IDEMPOTENCY_CONFLICT", 409)
-                connection.commit()
-                return {
-                    "task_id": task_id,
-                    "status": "QUEUED",
-                    "attempt": request.expected_attempt,
-                    "max_attempts": int(replay["next_max_attempts"]),
-                    "revision": int(replay["applied_revision"]),
-                    "idempotent": True,
-                    "authorization_id": replay["authorization_id"],
-                    "previous_verification_sha256": replay["previous_verification_sha256"],
-                }
-
-            columns = self._columns(connection, "tasks")
-            required = {
-                "task_id", "status", "attempt", "max_attempts", "revision", "claimed_by",
-                "lease_token_hash", "lease_expires_at", "verification_json",
-            }
-            if not required.issubset(columns):
-                raise RetryExtensionError("TASK_SCHEMA_RETRY_EXTENSION_UNSUPPORTED", 503)
-            task = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            if task is None:
-                raise RetryExtensionError("TASK_NOT_FOUND", 404)
-            actual_verification_sha = self._verification_hash(task["verification_json"])
-            if actual_verification_sha != request.previous_verification_sha256:
-                raise RetryExtensionError("RETRY_EXTENSION_VERIFICATION_DRIFT", 409)
-            if (
-                task["status"] != request.expected_status
-                or int(task["revision"]) != request.expected_revision
-                or int(task["attempt"]) != request.expected_attempt
-                or int(task["max_attempts"]) != request.expected_max_attempts
-            ):
-                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
-            for lease_field in ("lease_token_hash", "lease_expires_at"):
-                if lease_field in columns and task[lease_field] not in (None, ""):
-                    raise RetryExtensionError("RETRY_EXTENSION_ACTIVE_LEASE_DENY", 409)
-
-            previous_claimed_by = task["claimed_by"]
-            applied_revision = request.expected_revision + 1
-            cursor = connection.execute(
-                """
-                UPDATE tasks
-                   SET status='QUEUED', max_attempts=?, revision=?, claimed_by=NULL,
-                       lease_token_hash=NULL, lease_expires_at=NULL
-                 WHERE task_id=? AND status=? AND revision=? AND attempt=? AND max_attempts=?
-                   AND claimed_by IS ?
-                   AND lease_token_hash IS NULL AND lease_expires_at IS NULL
-                """,
-                (
-                    request.next_max_attempts,
-                    applied_revision,
-                    task_id,
-                    request.expected_status,
-                    request.expected_revision,
-                    request.expected_attempt,
-                    request.expected_max_attempts,
-                    previous_claimed_by,
-                ),
-            )
-            if cursor.rowcount != 1:
-                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
-
-            event_payload = {
-                "schema": "aios.task-retry-extension.event.v1",
-                "task_id": task_id,
-                "authorization_id": request.authorization_id,
-                "idempotency_key": request.idempotency_key,
-                "previous_verification_sha256": request.previous_verification_sha256,
-                "previous_max_attempts": request.expected_max_attempts,
-                "next_max_attempts": request.next_max_attempts,
-                "previous_revision": request.expected_revision,
-                "applied_revision": applied_revision,
-                "request_sha256": request_sha,
-                "previous_claimed_by": previous_claimed_by,
-                "stale_terminal_claim_normalized": previous_claimed_by not in (None, ""),
-            }
-            self._insert_event(connection, task_id, event_payload)
-            connection.execute(
-                """
-                INSERT INTO task_retry_extensions(
-                  task_id,idempotency_key,request_sha256,authorization_id,previous_verification_sha256,
-                  previous_max_attempts,next_max_attempts,expected_revision,applied_revision,created_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    task_id,
-                    request.idempotency_key,
-                    request_sha,
-                    request.authorization_id,
-                    request.previous_verification_sha256,
-                    request.expected_max_attempts,
-                    request.next_max_attempts,
-                    request.expected_revision,
-                    applied_revision,
-                    _now(),
-                ),
-            )
-            connection.commit()
-            return {
-                "task_id": task_id,
-                "status": "QUEUED",
-                "attempt": request.expected_attempt,
-                "max_attempts": request.next_max_attempts,
-                "revision": applied_revision,
-                "idempotent": False,
-                "authorization_id": request.authorization_id,
-                "previous_verification_sha256": request.previous_verification_sha256,
-            }
-
-
-class RetryExtensionHandler(BaseHTTPRequestHandler):
-    store: RetryExtensionStore | None = None
-    control_token: str = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def _json(self, value: Mapping[str, Any], status: int) -> None:
-        data = json.dumps(dict(value), sort_keys=True, separators=(",", ":")).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def _authorized(self) -> bool:
-        header = self.headers.get("Authorization", "")
-        return (
-            header.startswith("Bearer ")
-            and bool(self.control_token)
-            and hmac.compare_digest(header[7:], self.control_token)
-        )
-
-    def do_GET(self) -> None:
-        if self.path == "/health":
-            self._json({"status": "ok", "service": "aios-agent-task-retry-extension"}, 200)
-        else:
-            self._json({"error": "NOT_FOUND"}, 404)
-
-    def do_POST(self) -> None:
-        match = re.fullmatch(r"/v1/tasks/([^/]+)/retry-extension", self.path)
-        if match is None:
-            self._json({"error": "NOT_FOUND"}, 404)
-            return
-        if not self._authorized():
-            self._json({"error": "UNAUTHORIZED"}, 401)
-            return
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError:
-            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
-            return
-        if length < 1 or length > MAX_BODY:
-            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
-            return
-        try:
-            value = json.loads(self.rfile.read(length).decode("utf-8"))
-            if not isinstance(value, Mapping):
-                raise ValueError
-            request = RetryExtensionRequest.from_mapping(value)
-            if self.store is None:
-                raise RetryExtensionError("RUNTIME_UNAVAILABLE", 503)
-            result = self.store.extend(match.group(1), request)
-            self._json(result, 200 if result["idempotent"] else 201)
-        except RetryExtensionError as exc:
-            self._json({"error": exc.code}, exc.status)
-        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
-            self._json({"error": "REQUEST_INVALID"}, 400)
-
-
-def load_control_token(path: Path) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_UNAVAILABLE")
-    value = path.read_text(encoding="utf-8").strip()
-    if len(value) < 32:
-        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_INVALID")
-    return value
-
-
-def serve() -> None:
-    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
-    _required_authorization_id()
-    token_path = Path(
-        os.environ.get(
-            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-            str(Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials")) / "agent_task_control_token"),
-        )
-    )
-    host = os.environ.get("AIOS_TASK_RETRY_HOST", "127.0.0.1")
-    port = int(os.environ.get("AIOS_TASK_RETRY_PORT", "18941"))
-    RetryExtensionHandler.store = RetryExtensionStore(db)
-    RetryExtensionHandler.control_token = load_control_token(token_path)
-    ThreadingHTTPServer((host, port), RetryExtensionHandler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,655 +0,0 @@
-"""CAS-bound projection from an unprivileged planner to a host coordinator."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Callable, Mapping, Sequence
-import urllib.error
-import urllib.request
-
-from aios_agent_task_initial_execution_projection import (
-    InitialExecutionProjectionError,
-    InitialExecutionProjectionStore,
-    JOB_RE,
-    KEY_RE,
-    MAX_BODY,
-    SHA_RE,
-    TASK_RE,
-    _canonical,
-    _now,
-    _required_authorization_id,
-    _require_string,
-    _sha,
-    load_control_token,
-)
-from aios_online_agent_execution import (
-    GovernedExecutionBinding,
-    validate_execution_envelope,
-)
-
-
-RUNTIME_CAPABILITY = "agent.runtime.openclaw"
-COORDINATOR_CAPABILITY = "engineering.autonomous"
-COORDINATOR_CAPABILITIES = [RUNTIME_CAPABILITY, COORDINATOR_CAPABILITY]
-
-
-@dataclass(frozen=True)
-class SupervisorCoordinatorProjectionRequest:
-    expected_status: str
-    expected_revision: int
-    expected_attempt: int
-    expected_metadata_sha256: str
-    expected_required_capabilities_sha256: str
-    previous_verification_sha256: str
-    expected_planner_result_sha256: str
-    expected_old_execution_digest: str
-    expected_new_execution_digest: str
-    expected_job_id: str
-    authorization_id: str
-    idempotency_key: str
-    reason: str
-
-    @classmethod
-    def from_mapping(
-        cls, value: Mapping[str, Any]
-    ) -> "SupervisorCoordinatorProjectionRequest":
-        allowed = {
-            "expected_status",
-            "expected_revision",
-            "expected_attempt",
-            "expected_metadata_sha256",
-            "expected_required_capabilities_sha256",
-            "previous_verification_sha256",
-            "expected_planner_result_sha256",
-            "expected_old_execution_digest",
-            "expected_new_execution_digest",
-            "expected_job_id",
-            "authorization_id",
-            "idempotency_key",
-            "reason",
-        }
-        if set(value) != allowed:
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_PROJECTION_FIELDS_INVALID", 400
-            )
-        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
-        revision = value["expected_revision"]
-        attempt = value["expected_attempt"]
-        if (
-            status != "QUEUED"
-            or not isinstance(revision, int)
-            or isinstance(revision, bool)
-            or revision < 2
-            or not isinstance(attempt, int)
-            or isinstance(attempt, bool)
-            or attempt < 1
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_PROJECTION_STATE_INVALID", 400
-            )
-        names = (
-            "expected_metadata_sha256",
-            "expected_required_capabilities_sha256",
-            "previous_verification_sha256",
-            "expected_planner_result_sha256",
-            "expected_old_execution_digest",
-            "expected_new_execution_digest",
-        )
-        digests = {
-            name: _require_string(value[name], name.upper() + "_INVALID", SHA_RE)
-            for name in names
-        }
-        job_id = _require_string(value["expected_job_id"], "JOB_ID_INVALID", JOB_RE)
-        authorization_id = _require_string(
-            value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE
-        )
-        idempotency_key = _require_string(
-            value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE
-        )
-        reason = _require_string(value["reason"], "PROJECTION_REASON_INVALID")
-        if len(reason) > 512:
-            raise InitialExecutionProjectionError("PROJECTION_REASON_INVALID", 400)
-        return cls(
-            status,
-            revision,
-            attempt,
-            digests["expected_metadata_sha256"],
-            digests["expected_required_capabilities_sha256"],
-            digests["previous_verification_sha256"],
-            digests["expected_planner_result_sha256"],
-            digests["expected_old_execution_digest"],
-            digests["expected_new_execution_digest"],
-            job_id,
-            authorization_id,
-            idempotency_key,
-            reason,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "expected_status": self.expected_status,
-            "expected_revision": self.expected_revision,
-            "expected_attempt": self.expected_attempt,
-            "expected_metadata_sha256": self.expected_metadata_sha256,
-            "expected_required_capabilities_sha256": self.expected_required_capabilities_sha256,
-            "previous_verification_sha256": self.previous_verification_sha256,
-            "expected_planner_result_sha256": self.expected_planner_result_sha256,
-            "expected_old_execution_digest": self.expected_old_execution_digest,
-            "expected_new_execution_digest": self.expected_new_execution_digest,
-            "expected_job_id": self.expected_job_id,
-            "authorization_id": self.authorization_id,
-            "idempotency_key": self.idempotency_key,
-            "reason": self.reason,
-        }
-
-
-class CanonicalCoordinatorExecutionResolver:
-    def __init__(self, base_url: str, control_token: str) -> None:
-        self.base_url = base_url.rstrip("/")
-        self.control_token = control_token
-
-    def __call__(
-        self,
-        task_id: str,
-        expected_job_id: str,
-        runtime_input: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        body = {
-            "task_id": task_id,
-            "job_id": expected_job_id,
-            "required_capabilities": COORDINATOR_CAPABILITIES,
-            "execution": {
-                "action": "agent_runtime",
-                "adapter": "openclaw",
-                "capability_scope": COORDINATOR_CAPABILITIES,
-                "runtime_input": dict(runtime_input),
-            },
-        }
-        request = urllib.request.Request(
-            self.base_url + "/v2/execution-envelope",
-            method="POST",
-            data=_canonical(body),
-            headers={
-                "Authorization": "Bearer " + self.control_token,
-                "Content-Type": "application/json",
-                "Accept": "application/json",
-            },
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=15) as response:
-                raw, status = response.read(), response.status
-        except urllib.error.HTTPError as exc:
-            raw, status = exc.read(), exc.code
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise InitialExecutionProjectionError(
-                "CANONICAL_COORDINATOR_EXECUTION_RESPONSE_INVALID", 502
-            ) from exc
-        if not isinstance(value, Mapping):
-            raise InitialExecutionProjectionError(
-                "CANONICAL_COORDINATOR_EXECUTION_RESPONSE_INVALID", 502
-            )
-        if status != 200:
-            raise InitialExecutionProjectionError(
-                str(value.get("error") or "CANONICAL_COORDINATOR_EXECUTION_FAILED"),
-                502 if status >= 500 else 409,
-            )
-        return dict(value)
-
-
-class SupervisorCoordinatorProjectionStore(InitialExecutionProjectionStore):
-    def __init__(
-        self,
-        db_path: Path,
-        resolver: Callable[[str, str, Mapping[str, Any]], Mapping[str, Any]],
-    ) -> None:
-        super().__init__(db_path, resolver)  # type: ignore[arg-type]
-        self.coordinator_resolver = resolver
-
-    @staticmethod
-    def _ensure_table(connection: sqlite3.Connection) -> None:
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_supervisor_coordinator_projections (
-              task_id TEXT NOT NULL,
-              idempotency_key TEXT NOT NULL,
-              request_sha256 TEXT NOT NULL,
-              authorization_id TEXT NOT NULL,
-              expected_job_id TEXT NOT NULL,
-              planner_result_sha256 TEXT NOT NULL,
-              old_execution_digest TEXT NOT NULL,
-              new_execution_digest TEXT NOT NULL,
-              expected_revision INTEGER NOT NULL,
-              applied_revision INTEGER NOT NULL,
-              attempt INTEGER NOT NULL,
-              created_at TEXT NOT NULL,
-              PRIMARY KEY(task_id,idempotency_key)
-            )
-            """
-        )
-
-    @classmethod
-    def _planner_event_chain(
-        cls, connection: sqlite3.Connection, task_id: str
-    ) -> None:
-        table, columns = cls._event_table(connection)
-        ordering = "event_id" if "event_id" in columns else "rowid"
-        rows = connection.execute(
-            f'SELECT event_type,payload_json FROM "{table}" '
-            f'WHERE task_id=? ORDER BY {ordering}',
-            (task_id,),
-        ).fetchall()
-        events = [str(row[0]) for row in rows]
-        try:
-            projection = len(events) - 1 - events[::-1].index(
-                "TASK_INITIAL_EXECUTION_PROJECTION_AUTHORIZED"
-            )
-        except ValueError as exc:
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_PROJECTION_EVENT_MISSING", 409
-            ) from exc
-        tail = events[projection + 1 :]
-        if (
-            len(tail) < 4
-            or tail[0] != "TASK_CLAIMED"
-            or tail.count("TASK_CLAIMED") != 1
-            or tail.count("RESULT_SUBMITTED") != 1
-            or tail.count("TASK_VERIFIED") != 1
-            or tail[-1] != "TASK_VERIFIED"
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_EVENT_CHAIN_INVALID", 409
-            )
-        result = tail.index("RESULT_SUBMITTED")
-        if (
-            not any(event == "TASK_HEARTBEAT" for event in tail[1:result])
-            or any(
-                event not in {
-                    "TASK_CLAIMED",
-                    "TASK_HEARTBEAT",
-                    "RESULT_SUBMITTED",
-                    "TASK_VERIFIED",
-                }
-                for event in tail
-            )
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_EVENT_CHAIN_INVALID", 409
-            )
-        verification_event = json.loads(rows[-1][1])
-        if (
-            verification_event.get("decision") != "NEEDS_REWORK"
-            or verification_event.get("next_state") != "QUEUED"
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_NEEDS_REWORK_EVENT_REQUIRED", 409
-            )
-
-    def _load(
-        self,
-        connection: sqlite3.Connection,
-        task_id: str,
-        request: SupervisorCoordinatorProjectionRequest,
-    ) -> tuple[sqlite3.Row, dict[str, Any], dict[str, Any]]:
-        task = connection.execute(
-            "SELECT * FROM tasks WHERE task_id=?", (task_id,)
-        ).fetchone()
-        if task is None:
-            raise InitialExecutionProjectionError("TASK_NOT_FOUND", 404)
-        if (
-            task["status"] != request.expected_status
-            or int(task["revision"]) != request.expected_revision
-            or int(task["attempt"]) != request.expected_attempt
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_PROJECTION_CAS_MISMATCH", 409
-            )
-        if (
-            task["claimed_by"] not in (None, "")
-            or task["lease_token_hash"] not in (None, "")
-            or task["lease_expires_at"] not in (None, "")
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_ACTIVE_LEASE_DENY", 409
-            )
-        metadata = self._json_value(task["metadata_json"], "TASK_METADATA_INVALID")
-        capabilities = self._json_value(
-            task["required_capabilities_json"], "TASK_CAPABILITIES_INVALID"
-        )
-        result = self._json_value(task["result_json"], "PLANNER_RESULT_INVALID")
-        verification = self._json_value(
-            task["verification_json"], "PLANNER_VERIFICATION_INVALID"
-        )
-        if (
-            not isinstance(metadata, Mapping)
-            or not isinstance(capabilities, list)
-            or not isinstance(result, Mapping)
-            or not isinstance(verification, Mapping)
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_STATE_INVALID", 409
-            )
-        metadata, result, verification = dict(metadata), dict(result), dict(verification)
-        if _sha(metadata) != request.expected_metadata_sha256:
-            raise InitialExecutionProjectionError("TASK_METADATA_DRIFT", 409)
-        if _sha(capabilities) != request.expected_required_capabilities_sha256:
-            raise InitialExecutionProjectionError("TASK_CAPABILITIES_DRIFT", 409)
-        if _sha(result) != request.expected_planner_result_sha256:
-            raise InitialExecutionProjectionError("PLANNER_RESULT_DRIFT", 409)
-        if _sha(verification) != request.previous_verification_sha256:
-            raise InitialExecutionProjectionError("PLANNER_VERIFICATION_DRIFT", 409)
-        old = metadata.get("execution")
-        if not isinstance(old, Mapping):
-            raise InitialExecutionProjectionError("TASK_EXECUTION_METADATA_MISSING", 409)
-        old_execution = validate_execution_envelope(dict(old))
-        if (
-            old_execution.get("action") != "agent_runtime"
-            or old_execution.get("adapter") != "openclaw"
-            or old_execution.get("capability_scope") != [RUNTIME_CAPABILITY]
-            or old_execution.get("execution_digest")
-            != request.expected_old_execution_digest
-            or capabilities != [RUNTIME_CAPABILITY]
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_EXECUTION_CONTRACT_INVALID", 409
-            )
-        expected_result = {
-            "task_id": task_id,
-            "job_id": request.expected_job_id,
-            "status": "SUCCEEDED",
-            "execution_mode": "agent_runtime",
-            "agent_runtime": "openclaw",
-            "execution_digest": request.expected_old_execution_digest,
-            "control_plane_access_granted_to_runtime": False,
-            "credential_material_exposed": False,
-            "secret_material_exposed": False,
-            "changed_files": [],
-            "writer_lease": "NONE",
-            "direct_main_write": False,
-            "production_write": False,
-            "force_push": False,
-            "protected_ref_bypass": False,
-        }
-        if any(result.get(name) != expected for name, expected in expected_result.items()):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_RESULT_CONTRACT_INVALID", 409
-            )
-        if verification.get("decision") != "NEEDS_REWORK":
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_NEEDS_REWORK_REQUIRED", 409
-            )
-        self._planner_event_chain(connection, task_id)
-        return task, metadata, result
-
-    def project(
-        self,
-        task_id: str,
-        request: SupervisorCoordinatorProjectionRequest,
-    ) -> dict[str, Any]:
-        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
-        if request.authorization_id != _required_authorization_id():
-            raise InitialExecutionProjectionError("AUTHORIZATION_ID_MISMATCH", 403)
-        request_sha = _sha(request.public())
-        with self._connect() as connection:
-            self._ensure_table(connection)
-            replay = connection.execute(
-                "SELECT * FROM task_supervisor_coordinator_projections "
-                "WHERE task_id=? AND idempotency_key=?",
-                (task_id, request.idempotency_key),
-            ).fetchone()
-            if replay is not None:
-                if replay["request_sha256"] != request_sha:
-                    raise InitialExecutionProjectionError("IDEMPOTENCY_CONFLICT", 409)
-                return {
-                    "task_id": task_id,
-                    "status": "QUEUED",
-                    "attempt": replay["attempt"],
-                    "revision": replay["applied_revision"],
-                    "execution_digest": replay["new_execution_digest"],
-                    "required_capabilities": COORDINATOR_CAPABILITIES,
-                    "idempotent": True,
-                }
-        with self._connect() as connection:
-            task, _, result = self._load(connection, task_id, request)
-            runtime_input = self._runtime_input(task)
-        resolved = dict(
-            self.coordinator_resolver(task_id, request.expected_job_id, runtime_input)
-        )
-        binding = GovernedExecutionBinding.from_mapping(resolved)
-        if binding.task_id != task_id or binding.job_id != request.expected_job_id:
-            raise InitialExecutionProjectionError("GOVERNED_BINDING_CONFLICT", 409)
-        result_binding = {
-            name: result.get(name)
-            for name in (
-                "task_id",
-                "job_id",
-                "repository",
-                "base_oid",
-                "expected_branch_oid",
-                "target_branch",
-                "generation",
-            )
-        }
-        expected_binding = {
-            "task_id": binding.task_id,
-            "job_id": binding.job_id,
-            "repository": binding.repository,
-            "base_oid": binding.base_oid,
-            "expected_branch_oid": binding.expected_branch_oid,
-            "target_branch": binding.target_branch,
-            "generation": binding.generation,
-        }
-        if result_binding != expected_binding:
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_BINDING_CONFLICT", 409
-            )
-        execution = validate_execution_envelope(resolved, binding=binding)
-        if (
-            execution.get("action") != "agent_runtime"
-            or execution.get("adapter") != "openclaw"
-            or execution.get("capability_scope") != COORDINATOR_CAPABILITIES
-            or execution.get("change_set") != []
-            or execution.get("verification") != []
-            or execution.get("governance", {}).get("writer_lease") is not False
-            or execution.get("execution_digest") != request.expected_new_execution_digest
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_ENVELOPE_INVALID", 409
-            )
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_table(connection)
-            task, metadata, _ = self._load(connection, task_id, request)
-            new_metadata = dict(metadata)
-            new_metadata["execution"] = execution
-            new_metadata["execution_projection"] = {
-                "schema": "aios.online-agent.task-projection.v1",
-                "task_id": task_id,
-                "job_id": request.expected_job_id,
-                "execution_digest": execution["execution_digest"],
-            }
-            applied_revision = request.expected_revision + 1
-            cursor = connection.execute(
-                """
-                UPDATE tasks SET metadata_json=?,required_capabilities_json=?,
-                    revision=?,updated_at=?
-                 WHERE task_id=? AND status=? AND revision=? AND attempt=?
-                   AND claimed_by IS NULL AND lease_token_hash IS NULL
-                   AND lease_expires_at IS NULL AND metadata_json=?
-                   AND required_capabilities_json=? AND result_json=?
-                   AND verification_json=?
-                """,
-                (
-                    json.dumps(new_metadata, sort_keys=True, separators=(",", ":")),
-                    json.dumps(COORDINATOR_CAPABILITIES, separators=(",", ":")),
-                    applied_revision,
-                    _now(),
-                    task_id,
-                    request.expected_status,
-                    request.expected_revision,
-                    request.expected_attempt,
-                    task["metadata_json"],
-                    task["required_capabilities_json"],
-                    task["result_json"],
-                    task["verification_json"],
-                ),
-            )
-            if cursor.rowcount != 1:
-                raise InitialExecutionProjectionError(
-                    "SUPERVISOR_COORDINATOR_PROJECTION_CAS_MISMATCH", 409
-                )
-            event = {
-                "schema": "aios.supervisor-coordinator-projection.event.v1",
-                "task_id": task_id,
-                "job_id": request.expected_job_id,
-                "authorization_id": request.authorization_id,
-                "idempotency_key": request.idempotency_key,
-                "reason": request.reason,
-                "old_execution_digest": request.expected_old_execution_digest,
-                "new_execution_digest": execution["execution_digest"],
-                "required_capabilities": COORDINATOR_CAPABILITIES,
-                "previous_revision": request.expected_revision,
-                "applied_revision": applied_revision,
-                "attempt": request.expected_attempt,
-                "request_sha256": request_sha,
-                "credential_forwarded_to_planner": False,
-                "writer_lease": False,
-                "main_write": False,
-                "production_write": False,
-            }
-            table, columns = self._event_table(connection)
-            values = {
-                "task_id": task_id,
-                "event_type": "TASK_SUPERVISOR_COORDINATOR_PROJECTION_AUTHORIZED",
-                "payload_json": json.dumps(event, sort_keys=True, separators=(",", ":")),
-                "created_at": _now(),
-                "agent_id": "owner-control",
-            }
-            names = [name for name in values if name in columns]
-            connection.execute(
-                f'INSERT INTO "{table}" ({",".join(chr(34)+name+chr(34) for name in names)}) '
-                f'VALUES ({",".join("?" for _ in names)})',
-                tuple(values[name] for name in names),
-            )
-            connection.execute(
-                """
-                INSERT INTO task_supervisor_coordinator_projections(
-                  task_id,idempotency_key,request_sha256,authorization_id,
-                  expected_job_id,planner_result_sha256,old_execution_digest,
-                  new_execution_digest,expected_revision,applied_revision,
-                  attempt,created_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    task_id,
-                    request.idempotency_key,
-                    request_sha,
-                    request.authorization_id,
-                    request.expected_job_id,
-                    request.expected_planner_result_sha256,
-                    request.expected_old_execution_digest,
-                    execution["execution_digest"],
-                    request.expected_revision,
-                    applied_revision,
-                    request.expected_attempt,
-                    _now(),
-                ),
-            )
-            connection.commit()
-            return {
-                "task_id": task_id,
-                "status": "QUEUED",
-                "attempt": request.expected_attempt,
-                "revision": applied_revision,
-                "execution_digest": execution["execution_digest"],
-                "required_capabilities": COORDINATOR_CAPABILITIES,
-                "credential_forwarded_to_planner": False,
-                "idempotent": False,
-            }
-
-
-class Handler(BaseHTTPRequestHandler):
-    store: SupervisorCoordinatorProjectionStore | None = None
-    control_token: str = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def send_json(self, value: Mapping[str, Any], status: int) -> None:
-        raw = _canonical(dict(value))
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(raw)))
-        self.end_headers()
-        self.wfile.write(raw)
-
-    def do_GET(self) -> None:
-        if self.path == "/health":
-            self.send_json(
-                {"status": "ok", "service": "aios-supervisor-coordinator-projection"},
-                200,
-            )
-        else:
-            self.send_json({"error": "NOT_FOUND"}, 404)
-
-    def do_POST(self) -> None:
-        match = re.fullmatch(
-            r"/v1/tasks/([^/]+)/supervisor-coordinator-projection", self.path
-        )
-        header = self.headers.get("Authorization", "")
-        if match is None:
-            self.send_json({"error": "NOT_FOUND"}, 404)
-            return
-        if (
-            not header.startswith("Bearer ")
-            or not hmac.compare_digest(header[7:], self.control_token)
-        ):
-            self.send_json({"error": "UNAUTHORIZED"}, 401)
-            return
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-            if length < 1 or length > MAX_BODY:
-                raise InitialExecutionProjectionError("REQUEST_SIZE_INVALID", 413)
-            value = json.loads(self.rfile.read(length).decode("utf-8"))
-            if not isinstance(value, Mapping) or self.store is None:
-                raise InitialExecutionProjectionError("REQUEST_INVALID", 400)
-            request = SupervisorCoordinatorProjectionRequest.from_mapping(value)
-            result = self.store.project(match.group(1), request)
-            self.send_json(result, 200 if result["idempotent"] else 201)
-        except InitialExecutionProjectionError as exc:
-            self.send_json({"error": exc.code}, exc.status)
-        except (ValueError, UnicodeDecodeError, json.JSONDecodeError):
-            self.send_json({"error": "REQUEST_INVALID"}, 400)
-
-
-def serve() -> None:
-    credential = Path(
-        os.environ.get(
-            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-            str(
-                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-                / "agent_task_control_token"
-            ),
-        )
-    )
-    token = load_control_token(credential)
-    bridge = os.environ.get("AIOS_GOVERNED_WRITE_API_URL", "http://127.0.0.1:18892")
-    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
-    Handler.control_token = token
-    Handler.store = SupervisorCoordinatorProjectionStore(
-        db, CanonicalCoordinatorExecutionResolver(bridge, token)
-    )
-    host = os.environ.get("AIOS_SUPERVISOR_COORDINATOR_PROJECTION_HOST", "127.0.0.1")
-    port = int(os.environ.get("AIOS_SUPERVISOR_COORDINATOR_PROJECTION_PORT", "18944"))
-    ThreadingHTTPServer((host, port), Handler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,470 +0,0 @@
-#!/usr/bin/env python3
-"""Canonical AIOS all-modified-files evidence packager.
-
-The bundle contract is intentionally compatible with the historical
-aios_package_all_modified_files_v1.sh output while keeping secret scanning in
-version-controlled, tested code.
-"""
-
-from __future__ import annotations
-
-from datetime import datetime, timezone
-import argparse
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import subprocess
-import tempfile
-import zipfile
-from typing import Iterable
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-
-# A PEM private-key finding requires the complete PEM header. Source code,
-# tests, docs, or error text containing only "BEGIN PRIVATE KEY" are not
-# credentials and must not be rejected.
-PEM_PRIVATE_KEY_RE = re.compile(
-    rb"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",
-    re.IGNORECASE,
-)
-BEARER_RE = re.compile(
-    rb"authorization\s*:\s*bearer\s+[A-Za-z0-9._~+/=-]{20,}",
-    re.IGNORECASE,
-)
-KEY_VALUE_SECRET_RE = re.compile(
-    rb"(?:password|passwd|secret|api[_-]?key)\s*[:=]\s*[^\s,;]{12,}",
-    re.IGNORECASE,
-)
-
-DOCUMENT_SUFFIXES = {".md", ".rst", ".adoc", ".txt"}
-DOCUMENT_PREFIXES = (
-    "README",
-    "CHANGELOG",
-    "RUNBOOK",
-    "ADR",
-    "ARCHITECTURE",
-    "DEPLOYMENT",
-    "TROUBLESHOOTING",
-)
-
-
-class PackagerError(RuntimeError):
-    pass
-
-
-def sha256(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-
-def secret_finding(data: bytes) -> str | None:
-    if PEM_PRIVATE_KEY_RE.search(data):
-        return "PEM_PRIVATE_KEY"
-    if BEARER_RE.search(data):
-        return "AUTHORIZATION_BEARER"
-    if KEY_VALUE_SECRET_RE.search(data):
-        return "KEY_VALUE_SECRET"
-    return None
-
-
-def scan_secret(data: bytes, label: str) -> None:
-    finding = secret_finding(data)
-    if finding is not None:
-        raise PackagerError(
-            f"MODIFIED_FILES_SECRET_SCAN_MATCH:{finding}:{label}"
-        )
-
-
-def git_bytes(git_dir: Path, oid: str, path: str) -> bytes:
-    try:
-        return subprocess.check_output(
-            [
-                "/usr/bin/git",
-                f"--git-dir={git_dir}",
-                "show",
-                f"{oid}:{path}",
-            ],
-            timeout=30,
-        )
-    except subprocess.CalledProcessError as exc:
-        raise PackagerError(
-            "MODIFIED_FILES_GIT_SHOW_FAILED:" + path
-        ) from exc
-
-
-def git_text(git_dir: Path, *args: str) -> str:
-    try:
-        return subprocess.check_output(
-            ["/usr/bin/git", f"--git-dir={git_dir}", *args],
-            text=True,
-            timeout=30,
-        )
-    except subprocess.CalledProcessError as exc:
-        raise PackagerError(
-            "MODIFIED_FILES_GIT_COMMAND_FAILED:" + " ".join(args)
-        ) from exc
-
-
-def validate_lineage(git_dir: Path, base: str, candidate: str) -> None:
-    if OID_RE.fullmatch(base) is None or OID_RE.fullmatch(candidate) is None:
-        raise PackagerError("MODIFIED_FILES_OID_INVALID")
-    for oid in (base, candidate):
-        try:
-            subprocess.run(
-                [
-                    "/usr/bin/git",
-                    f"--git-dir={git_dir}",
-                    "cat-file",
-                    "-e",
-                    f"{oid}^{{commit}}",
-                ],
-                check=True,
-                timeout=30,
-            )
-        except subprocess.CalledProcessError as exc:
-            raise PackagerError("MODIFIED_FILES_COMMIT_MISSING:" + oid) from exc
-    if subprocess.run(
-        [
-            "/usr/bin/git",
-            f"--git-dir={git_dir}",
-            "merge-base",
-            "--is-ancestor",
-            base,
-            candidate,
-        ],
-        check=False,
-        timeout=30,
-    ).returncode != 0:
-        raise PackagerError("MODIFIED_FILES_LINEAGE_INVALID")
-
-
-def safe_destination(root: Path, relative: str) -> Path:
-    path = Path(relative)
-    if path.is_absolute() or ".." in path.parts:
-        raise PackagerError("MODIFIED_FILE_PATH_INVALID:" + relative)
-    destination = root / path
-    destination.parent.mkdir(parents=True, exist_ok=True)
-    return destination
-
-
-def is_document_path(path: str) -> bool:
-    value = Path(path)
-    if path.startswith("docs/"):
-        return True
-    if value.suffix.lower() in DOCUMENT_SUFFIXES:
-        return True
-    upper = value.name.upper()
-    return any(upper.startswith(prefix) for prefix in DOCUMENT_PREFIXES)
-
-
-def diff_entries(
-    git_dir: Path,
-    base: str,
-    candidate: str,
-    before_root: Path,
-    after_root: Path,
-) -> list[dict[str, object]]:
-    raw = git_text(
-        git_dir,
-        "diff",
-        "--name-status",
-        "-M",
-        "-C",
-        base,
-        candidate,
-    )
-    entries: list[dict[str, object]] = []
-    for line in raw.splitlines():
-        if not line.strip():
-            continue
-        parts = line.split("\t")
-        status = parts[0]
-        code = status[0]
-        old_path: str | None = None
-        new_path: str | None = None
-        if code in {"R", "C"}:
-            if len(parts) != 3:
-                raise PackagerError(
-                    "MODIFIED_FILES_DIFF_PARSE_INVALID:" + line
-                )
-            old_path, new_path = parts[1], parts[2]
-        else:
-            if len(parts) != 2:
-                raise PackagerError(
-                    "MODIFIED_FILES_DIFF_PARSE_INVALID:" + line
-                )
-            new_path = parts[1] if code != "D" else None
-            old_path = parts[1] if code != "A" else None
-
-        entry: dict[str, object] = {"status": status}
-        if old_path is not None:
-            entry["previous_path"] = old_path
-            before = git_bytes(git_dir, base, old_path)
-            scan_secret(before, "before:" + old_path)
-            safe_destination(before_root, old_path).write_bytes(before)
-            entry["before_sha256"] = sha256(before)
-            entry["before_bytes"] = len(before)
-        if new_path is not None:
-            entry["path"] = new_path
-            after = git_bytes(git_dir, candidate, new_path)
-            scan_secret(after, "after:" + new_path)
-            safe_destination(after_root, new_path).write_bytes(after)
-            entry["after_sha256"] = sha256(after)
-            entry["after_bytes"] = len(after)
-        entry["deleted"] = code == "D"
-        entry["added"] = code == "A"
-        entry["renamed"] = code == "R"
-        entry["copied"] = code == "C"
-        entries.append(entry)
-    return entries
-
-
-def execution_entries(
-    extra_root: Path | None,
-    execution_root: Path,
-) -> list[dict[str, object]]:
-    if extra_root is None or not extra_root.exists():
-        return []
-    if extra_root.is_symlink() or not extra_root.is_dir():
-        raise PackagerError("EXTRA_FILES_DIR_INVALID")
-
-    entries: list[dict[str, object]] = []
-    for path in sorted(extra_root.rglob("*")):
-        if path.is_symlink():
-            raise PackagerError(
-                "EXTRA_FILE_SYMLINK_REJECTED:" + str(path)
-            )
-        if not path.is_file():
-            continue
-        relative = path.relative_to(extra_root).as_posix()
-        data = path.read_bytes()
-        scan_secret(data, "execution:" + relative)
-        safe_destination(execution_root, relative).write_bytes(data)
-        entries.append(
-            {
-                "path": relative,
-                "sha256": sha256(data),
-                "bytes": len(data),
-            }
-        )
-    return entries
-
-
-def write_checksums(bundle: Path) -> None:
-    checks: list[tuple[str, str]] = []
-    for path in sorted(bundle.rglob("*")):
-        if path.is_file() and path.name != "checksums.sha256":
-            checks.append(
-                (
-                    sha256(path.read_bytes()),
-                    path.relative_to(bundle).as_posix(),
-                )
-            )
-    (bundle / "checksums.sha256").write_text(
-        "".join(f"{digest}  {name}\n" for digest, name in checks),
-        encoding="utf-8",
-    )
-
-
-def verify_checksums(bundle: Path) -> None:
-    checksum_path = bundle / "checksums.sha256"
-    for line in checksum_path.read_text(encoding="utf-8").splitlines():
-        digest, relative = line.split("  ", 1)
-        path = bundle / relative
-        if not path.is_file() or sha256(path.read_bytes()) != digest:
-            raise PackagerError(
-                "MODIFIED_FILES_CHECKSUM_CLOSURE_INVALID:" + relative
-            )
-
-
-def build_bundle(
-    *,
-    git_dir: Path,
-    base: str,
-    candidate: str,
-    task_id: str,
-    extra_dir: Path | None = None,
-    output_root: Path | None = None,
-    now: datetime | None = None,
-) -> dict[str, object]:
-    if TASK_RE.fullmatch(task_id) is None:
-        raise PackagerError("TASK_ID_INVALID")
-    validate_lineage(git_dir, base, candidate)
-
-    timestamp = (now or datetime.now(timezone.utc)).strftime(
-        "%Y%m%dT%H%M%SZ"
-    )
-    safe_task = re.sub(r"[^A-Za-z0-9._-]+", "-", task_id).strip("-")
-    if output_root is None:
-        output_root = Path(
-            tempfile.mkdtemp(
-                prefix=f"aios-modified-files-bundle-{safe_task}-{timestamp}-",
-                dir="/var/tmp",
-            )
-        )
-    else:
-        output_root.mkdir(parents=True, exist_ok=True)
-
-    bundle = output_root / "bundle"
-    before_root = bundle / "repo" / "before"
-    after_root = bundle / "repo" / "after"
-    execution_root = bundle / "execution"
-    before_root.mkdir(parents=True)
-    after_root.mkdir(parents=True)
-    execution_root.mkdir(parents=True)
-
-    changes = diff_entries(
-        git_dir,
-        base,
-        candidate,
-        before_root,
-        after_root,
-    )
-    execution_files = execution_entries(extra_dir, execution_root)
-
-    document_changes = [
-        entry
-        for entry in changes
-        if is_document_path(
-            str(entry.get("path") or entry.get("previous_path") or "")
-        )
-    ]
-    execution_documents = [
-        entry
-        for entry in execution_files
-        if is_document_path(str(entry["path"]))
-    ]
-
-    documents_index = {
-        "schema": "aios.modified-documents.index.v1",
-        "task_id": task_id,
-        "base_oid": base,
-        "candidate_oid": candidate,
-        "repository_documents": document_changes,
-        "execution_documents": execution_documents,
-        "repository_document_count": len(document_changes),
-        "execution_document_count": len(execution_documents),
-    }
-    (bundle / "documents-index.json").write_text(
-        json.dumps(documents_index, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-
-    manifest = {
-        "schema": "aios.all-modified-files.bundle.v1",
-        "task_id": task_id,
-        "base_oid": base,
-        "candidate_oid": candidate,
-        "generated_at": (
-            now or datetime.now(timezone.utc)
-        ).isoformat(),
-        "changed_file_count": len(changes),
-        "execution_file_count": len(execution_files),
-        "repository_document_count": len(document_changes),
-        "execution_document_count": len(execution_documents),
-        "changes": changes,
-        "execution_files": execution_files,
-    }
-    (bundle / "all-modified-files-manifest.json").write_text(
-        json.dumps(manifest, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-    write_checksums(bundle)
-    verify_checksums(bundle)
-
-    zip_name = (
-        f"AIOS_{task_id}_ALL_MODIFIED_FILES_{candidate[:12]}.zip"
-        .replace("/", "-")
-    )
-    zip_path = output_root / zip_name
-    with zipfile.ZipFile(
-        zip_path,
-        "w",
-        compression=zipfile.ZIP_DEFLATED,
-    ) as archive:
-        for path in sorted(bundle.rglob("*")):
-            if path.is_symlink():
-                raise PackagerError(
-                    "BUNDLE_SYMLINK_REJECTED:" + str(path)
-                )
-            if path.is_file():
-                archive.write(
-                    path,
-                    arcname=path.relative_to(bundle).as_posix(),
-                )
-
-    zip_sha = sha256(zip_path.read_bytes())
-    summary = {
-        "schema": "aios.all-modified-files.bundle-summary.v1",
-        "task_id": task_id,
-        "base_oid": base,
-        "candidate_oid": candidate,
-        "bundle_path": str(zip_path),
-        "bundle_sha256": zip_sha,
-        "changed_file_count": len(changes),
-        "execution_file_count": len(execution_files),
-        "repository_document_count": len(document_changes),
-        "execution_document_count": len(execution_documents),
-    }
-    (output_root / "ALL_MODIFIED_FILES_BUNDLE.json").write_text(
-        json.dumps(summary, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-    return summary
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("base")
-    parser.add_argument("candidate")
-    parser.add_argument("task_id")
-    parser.add_argument("extra_dir", nargs="?")
-    parser.add_argument(
-        "--authority-git-dir",
-        default=os.environ.get(
-            "AIOS_AUTHORITY_GIT_DIR",
-            "/data/aios-gitops/repo.git",
-        ),
-    )
-    parser.add_argument("--output-root")
-    args = parser.parse_args()
-
-    try:
-        summary = build_bundle(
-            git_dir=Path(args.authority_git_dir),
-            base=args.base,
-            candidate=args.candidate,
-            task_id=args.task_id,
-            extra_dir=Path(args.extra_dir) if args.extra_dir else None,
-            output_root=(
-                Path(args.output_root) if args.output_root else None
-            ),
-        )
-    except PackagerError as exc:
-        print("FATAL:" + str(exc))
-        return 20
-
-    print("ALL_MODIFIED_FILES_BUNDLE=PASS")
-    print("ALL_MODIFIED_FILES_BUNDLE_PATH=" + str(summary["bundle_path"]))
-    print("ALL_MODIFIED_FILES_BUNDLE_SHA256=" + str(summary["bundle_sha256"]))
-    print("CHANGED_FILE_COUNT=" + str(summary["changed_file_count"]))
-    print("EXECUTION_FILE_COUNT=" + str(summary["execution_file_count"]))
-    print(
-        "REPOSITORY_DOCUMENT_COUNT="
-        + str(summary["repository_document_count"])
-    )
-    print(
-        "EXECUTION_DOCUMENT_COUNT="
-        + str(summary["execution_document_count"])
-    )
-    print(
-        "ALL_MODIFIED_FILES_EVIDENCE="
-        + str(Path(str(summary["bundle_path"])).parent)
-    )
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,258 +0,0 @@
-"""Fail-closed Authority Git side-effect boundary.
-
-Only this module may issue the narrowly scoped ref CAS primitives used by the
-durable executor. It never accepts force updates, arbitrary refs, tags, or
-direct production mutations.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-import os
-from pathlib import Path
-import re
-import subprocess
-import tempfile
-from typing import Mapping, Sequence
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_BRANCH_RE = re.compile(r"^refs/heads/agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-
-
-class AuthorityGitError(RuntimeError):
-    pass
-
-
-def _oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise AuthorityGitError(f"{field}_INVALID")
-    return value
-
-
-@dataclass(frozen=True, slots=True)
-class AuthorityGitExecutor:
-    git_dir: Path
-    worktree_root: Path = Path("/var/lib/aios-gitops/worktrees")
-
-    def __post_init__(self) -> None:
-        if not self.git_dir.is_absolute() or self.git_dir.is_symlink():
-            raise AuthorityGitError("AUTHORITY_GIT_DIR_INVALID")
-        if not self.worktree_root.is_absolute() or self.worktree_root.is_symlink():
-            raise AuthorityGitError("WORKTREE_ROOT_INVALID")
-
-    def _git(self, args: Sequence[str], *, check: bool = True) -> str:
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", *args],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if check and result.returncode != 0:
-            raise AuthorityGitError("AUTHORITY_GIT_COMMAND_FAILED")
-        return result.stdout.strip()
-
-    def read_ref(self, ref: str) -> str | None:
-        if not ref.startswith("refs/") or ref.startswith(("refs/tags/", "refs/remotes/")):
-            raise AuthorityGitError("REF_READ_SCOPE_DENIED")
-        value = self._git(["rev-parse", "--verify", ref], check=False)
-        return value if value and OID_RE.fullmatch(value) else None
-
-    def commit_exists(self, oid: str) -> bool:
-        _oid(oid, "commit_oid")
-        result = subprocess.run(["git", f"--git-dir={self.git_dir}", "cat-file", "-e", oid + "^{commit}"], capture_output=True, check=False)
-        return result.returncode == 0
-
-    def ancestry_check(self, older_oid: str, newer_oid: str) -> bool:
-        _oid(older_oid, "older_oid")
-        _oid(newer_oid, "newer_oid")
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", "merge-base", "--is-ancestor", older_oid, newer_oid],
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode not in (0, 1):
-            raise AuthorityGitError("ANCESTRY_CHECK_FAILED")
-        return result.returncode == 0
-
-    def create_detached_worktree(
-        self,
-        base_oid: str,
-        worktree_name: str,
-        root: Path | None = None,
-    ) -> Path:
-        _oid(base_oid, "base_oid")
-        if not worktree_name or "/" in worktree_name or "\\" in worktree_name or worktree_name in {".", ".."}:
-            raise AuthorityGitError("WORKTREE_NAME_INVALID")
-        parent = root or self.worktree_root
-        if not parent.is_absolute() or parent.is_symlink():
-            raise AuthorityGitError("WORKTREE_ROOT_INVALID")
-        path = parent / worktree_name
-        if path.exists() or path.is_symlink():
-            raise AuthorityGitError("WORKTREE_ALREADY_EXISTS")
-        parent.mkdir(parents=True, exist_ok=True)
-        self._git(["worktree", "add", "--detach", str(path), base_oid])
-        return path
-
-    def recover_failed_detached_worktree_exact(
-        self,
-        *,
-        path: Path,
-        expected_oid: str,
-        stale_oid: str,
-        target_ref: str,
-    ) -> str:
-        """Recreate one exact clean, detached, single-attempt worktree at its durable head."""
-        _oid(expected_oid, "expected_oid")
-        _oid(stale_oid, "stale_oid")
-        if not TASK_BRANCH_RE.fullmatch(target_ref):
-            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        if self.read_ref(target_ref) is not None:
-            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
-        if (
-            not path.is_absolute()
-            or path.parent != self.worktree_root
-            or path.name in {"", ".", ".."}
-            or path.is_symlink()
-            or not path.is_dir()
-        ):
-            raise AuthorityGitError("WORKTREE_RECOVERY_PATH_INVALID")
-        head = subprocess.run(
-            ["git", "-C", str(path), "rev-parse", "HEAD"],
-            text=True, capture_output=True, check=False,
-        )
-        if head.returncode != 0 or head.stdout.strip() != stale_oid or stale_oid == expected_oid:
-            raise AuthorityGitError("WORKTREE_RECOVERY_HEAD_INVALID")
-        symbolic = subprocess.run(
-            ["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"],
-            text=True, capture_output=True, check=False,
-        )
-        if symbolic.returncode != 1:
-            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_DETACHED")
-        status = subprocess.run(
-            ["git", "-C", str(path), "status", "--porcelain=v1", "--untracked-files=all"],
-            text=True, capture_output=True, check=False,
-        )
-        if status.returncode != 0 or status.stdout:
-            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_CLEAN")
-        parents = self._git(["rev-list", "--parents", "-n", "1", stale_oid]).split()
-        if parents != [stale_oid, expected_oid]:
-            raise AuthorityGitError("WORKTREE_RECOVERY_LINEAGE_INVALID")
-        registered = [
-            line.removeprefix("worktree ")
-            for line in self._git(["worktree", "list", "--porcelain"]).splitlines()
-            if line.startswith("worktree ")
-        ]
-        if registered.count(str(path)) != 1:
-            raise AuthorityGitError("WORKTREE_RECOVERY_REGISTRATION_INVALID")
-        self._git(["worktree", "remove", "--force", str(path)])
-        if path.exists() or path.is_symlink():
-            raise AuthorityGitError("WORKTREE_RECOVERY_REMOVE_FAILED")
-        recreated = self.create_detached_worktree(expected_oid, path.name, path.parent)
-        readback = subprocess.run(
-            ["git", "-C", str(recreated), "rev-parse", "HEAD"],
-            text=True, capture_output=True, check=False,
-        )
-        detached = subprocess.run(
-            ["git", "-C", str(recreated), "symbolic-ref", "-q", "HEAD"],
-            text=True, capture_output=True, check=False,
-        )
-        if readback.returncode != 0 or readback.stdout.strip() != expected_oid or detached.returncode != 1:
-            raise AuthorityGitError("WORKTREE_RECOVERY_READBACK_MISMATCH")
-        return stale_oid
-
-    def create_task_branch_CAS(self, branch: str, expected_base_oid: str, new_oid: str) -> str:
-        if not TASK_BRANCH_RE.fullmatch(branch):
-            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        _oid(expected_base_oid, "expected_base_oid")
-        _oid(new_oid, "new_oid")
-        current = self.read_ref(branch)
-        if current is not None:
-            if current == new_oid:
-                return new_oid
-            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
-        if not self.ancestry_check(expected_base_oid, new_oid):
-            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
-        self._git(["update-ref", branch, new_oid, "0" * 40])
-        readback = self.read_ref(branch)
-        if readback != new_oid:
-            raise AuthorityGitError("AUTHORITY_CREATE_READBACK_MISMATCH")
-        return readback
-
-    def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
-        if not TASK_BRANCH_RE.fullmatch(branch):
-            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        _oid(expected_oid, "expected_oid")
-        _oid(new_oid, "new_oid")
-        current = self.read_ref(branch)
-        if current != expected_oid:
-            if current == new_oid:
-                return new_oid
-            raise AuthorityGitError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
-        if not self.ancestry_check(expected_oid, new_oid):
-            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
-        self._git(["update-ref", branch, new_oid, expected_oid])
-        readback = self.read_ref(branch)
-        if readback != new_oid:
-            raise AuthorityGitError("AUTHORITY_CAS_READBACK_MISMATCH")
-        return readback
-
-    def ff_CAS_main_after_verified_protected_merge(self, expected_oid: str, new_oid: str) -> str:
-        _oid(expected_oid, "expected_oid")
-        _oid(new_oid, "new_oid")
-        if not self.ancestry_check(expected_oid, new_oid):
-            raise AuthorityGitError("MAIN_FF_REQUIRED")
-        current = self.read_ref("refs/heads/main")
-        if current != expected_oid:
-            if current == new_oid:
-                return new_oid
-            raise AuthorityGitError("AUTHORITY_MAIN_EXPECTATION_MISMATCH")
-        self._git(["update-ref", "refs/heads/main", new_oid, expected_oid])
-        readback = self.read_ref("refs/heads/main")
-        if readback != new_oid:
-            raise AuthorityGitError("AUTHORITY_MAIN_CAS_READBACK_MISMATCH")
-        return readback
-
-    def commit_file_in_isolated_worktree(
-        self,
-        *,
-        base_oid: str,
-        files: Mapping[str, bytes],
-        message: str,
-        worktree_name: str,
-    ) -> str:
-        _oid(base_oid, "base_oid")
-        if not worktree_name or "/" in worktree_name or "\\" in worktree_name or worktree_name in {".", ".."}:
-            raise AuthorityGitError("WORKTREE_NAME_INVALID")
-        root = self.worktree_root / worktree_name
-        if root.exists() or root.is_symlink():
-            raise AuthorityGitError("WORKTREE_ALREADY_EXISTS")
-        self.worktree_root.mkdir(parents=True, exist_ok=True)
-        self._git(["worktree", "add", "--detach", str(root), base_oid])
-        try:
-            for relative, content in files.items():
-                path = Path(relative)
-                if path.is_absolute() or ".." in path.parts or not path.parts or path.parts[0] == ".git":
-                    raise AuthorityGitError("FILE_PATH_INVALID")
-                target = root / path
-                target.parent.mkdir(parents=True, exist_ok=True)
-                target.write_bytes(content)
-            result = subprocess.run(
-                ["git", "-C", str(root), "add", "--", *files.keys()],
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            if result.returncode != 0:
-                raise AuthorityGitError("WORKTREE_ADD_FAILED")
-            result = subprocess.run(
-                ["git", "-C", str(root), "-c", "user.name=aios-durable-job", "-c", "user.email=aios-durable-job@localhost", "commit", "--no-verify", "-m", message],
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            if result.returncode != 0:
-                raise AuthorityGitError("WORKTREE_COMMIT_FAILED")
-            return subprocess.check_output(["git", "-C", str(root), "rev-parse", "HEAD"], text=True).strip()
-        finally:
-            subprocess.run(["git", f"--git-dir={self.git_dir}", "worktree", "remove", "--force", str(root)], capture_output=True, check=False)
@@ -1,73 +0,0 @@
-"""HTTP adapter for Owner-authorized task writer provisioning.
-
-Run this module instead of aios_chatgpt_actions_api.py. All existing routes are
-delegated unchanged; only POST /api/task-writer/provision-authorized is added.
-"""
-from __future__ import annotations
-
-import os
-import urllib.parse
-
-import aios_chatgpt_actions_api as api
-from authorized_task_writer_provisioning import (
-    AuthorizedTaskWriterProvisioner,
-    OwnerContext,
-    ProvisioningError,
-)
-
-
-_original_do_post = api.H.do_POST
-_ENDPOINT = "/api/task-writer/provision-authorized"
-
-
-def _owner_authorization(handler):
-    scope = os.getenv(
-        "AIOS_GITOPS_OWNER_PROVISION_SCOPE", "writer:provision"
-    )
-    auth = handler.need(scope)
-    if not auth:
-        return None
-    if auth.get("role") != "owner":
-        handler.sendj({"error": "OWNER_AUTHORIZATION_REQUIRED"}, 403)
-        return None
-    identity = str(auth.get("account") or "").strip()
-    if not identity:
-        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
-        return None
-    return auth
-
-
-def _authorized_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != _ENDPOINT:
-        return _original_do_post(self)
-    auth = _owner_authorization(self)
-    if not auth:
-        return
-    data = self.body()
-    owner_reference = str(data.get("owner_authorization_reference") or "")
-    try:
-        result = AuthorizedTaskWriterProvisioner().provision(
-            data,
-            OwnerContext(
-                identity=str(auth["account"]),
-                role=str(auth["role"]),
-                authorization_reference=owner_reference,
-            ),
-        )
-        return self.sendj(result)
-    except ProvisioningError as exc:
-        body = {"error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        return self.sendj(body, exc.status)
-    except Exception:
-        # Do not expose tool output, paths containing credentials, or traceback data.
-        return self.sendj({"error": "AUTHORIZED_WRITER_BRIDGE_INTERNAL_ERROR"}, 500)
-
-
-api.H.do_POST = _authorized_do_post
-
-
-if __name__ == "__main__":
-    api.main()
@@ -1,288 +0,0 @@
-"""Unified autonomous control-plane primitives.
-
-This is deliberately a library, not another daemon. Task API, workers and host
-recovery code consume the same Admission -> Invariant -> Repair semantics.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-from enum import Enum
-import re
-from typing import Callable, Iterable, Mapping, Sequence
-
-from aios_capability_contract import (
-    capability_contract,
-    has_capabilities,
-    normalize_required_capabilities,
-    normalize_worker_capabilities,
-    registered_capability,
-    validate_capability_contract_registry,
-)
-
-
-class FailureClass(str, Enum):
-    CAPABILITY_CONTRACT_ERROR = "CAPABILITY_CONTRACT_ERROR"
-    CREDENTIAL_PROJECTION_ERROR = "CREDENTIAL_PROJECTION_ERROR"
-    DEPENDENCY_UNAVAILABLE = "DEPENDENCY_UNAVAILABLE"
-    POLICY_DENIED = "POLICY_DENIED"
-    RESOURCE_UNAVAILABLE = "RESOURCE_UNAVAILABLE"
-    WORKER_CRASH = "WORKER_CRASH"
-    LEASE_LOST = "LEASE_LOST"
-    BUSINESS_PERMANENT = "BUSINESS_PERMANENT"
-    UNKNOWN = "UNKNOWN"
-
-
-class RepairLevel(int, Enum):
-    AUTO_LOCAL = 0
-    AUTO_REPAIR_TASK = 1
-    OWNER_APPROVAL = 2
-    MANUAL = 3
-
-
-@dataclass(frozen=True)
-class InvariantResult:
-    name: str
-    passed: bool
-    detail: str = ""
-
-    def as_dict(self) -> dict[str, object]:
-        return asdict(self)
-
-
-@dataclass(frozen=True)
-class AdmissionDecision:
-    admitted: bool
-    state: str
-    invariants: tuple[InvariantResult, ...]
-    failure_class: FailureClass | None = None
-    repair_level: RepairLevel | None = None
-    repair_action: str | None = None
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "schema": "aios.runtime-admission.decision.v1",
-            "admitted": self.admitted,
-            "state": self.state,
-            "invariants": [item.as_dict() for item in self.invariants],
-            "failure_class": None if self.failure_class is None else self.failure_class.value,
-            "repair_level": None if self.repair_level is None else int(self.repair_level),
-            "repair_action": self.repair_action,
-        }
-
-
-@dataclass(frozen=True)
-class RepairDecision:
-    failure_class: FailureClass
-    level: RepairLevel
-    action: str
-    consumes_business_attempt: bool
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "failure_class": self.failure_class.value,
-            "level": int(self.level),
-            "action": self.action,
-            "consumes_business_attempt": self.consumes_business_attempt,
-        }
-
-
-def classify_failure(error: object, *, phase: str = "") -> FailureClass:
-    text = (str(error) + " " + str(phase)).lower()
-    if any(token in text for token in (
-        "credential", "permission denied", "token registry", "secret", "unauthorized"
-    )):
-        return FailureClass.CREDENTIAL_PROJECTION_ERROR
-    if any(token in text for token in (
-        "transport", "unavailable", "timeout", "connection", "bad gateway", "http_5"
-    )):
-        return FailureClass.DEPENDENCY_UNAVAILABLE
-    if any(token in text for token in (
-        "capability", "eligible", "matcher", "contract"
-    )):
-        return FailureClass.CAPABILITY_CONTRACT_ERROR
-    if any(token in text for token in (
-        "policy", "forbidden", "approval required", "not authorized"
-    )):
-        return FailureClass.POLICY_DENIED
-    if any(token in text for token in ("lease lost", "lease_expired", "heartbeat_failed")):
-        return FailureClass.LEASE_LOST
-    if any(token in text for token in ("out of memory", "disk full", "resource")):
-        return FailureClass.RESOURCE_UNAVAILABLE
-    if any(token in text for token in ("worker crash", "process exited", "signal")):
-        return FailureClass.WORKER_CRASH
-    if any(token in text for token in ("invalid release", "business permanent")):
-        return FailureClass.BUSINESS_PERMANENT
-    return FailureClass.UNKNOWN
-
-
-def repair_for_failure(failure: FailureClass) -> RepairDecision:
-    table = {
-        FailureClass.CAPABILITY_CONTRACT_ERROR: RepairDecision(
-            failure, RepairLevel.AUTO_REPAIR_TASK,
-            "create_same_lineage_capability_contract_repair", False,
-        ),
-        FailureClass.CREDENTIAL_PROJECTION_ERROR: RepairDecision(
-            failure, RepairLevel.AUTO_REPAIR_TASK,
-            "restore_service_private_credential_projection", False,
-        ),
-        FailureClass.DEPENDENCY_UNAVAILABLE: RepairDecision(
-            failure, RepairLevel.AUTO_LOCAL,
-            "retry_dependency_health_and_resume", False,
-        ),
-        FailureClass.RESOURCE_UNAVAILABLE: RepairDecision(
-            failure, RepairLevel.AUTO_LOCAL,
-            "heal_runtime_resource_and_resume", False,
-        ),
-        FailureClass.WORKER_CRASH: RepairDecision(
-            failure, RepairLevel.AUTO_LOCAL,
-            "restart_worker_and_resume_same_lineage", False,
-        ),
-        FailureClass.LEASE_LOST: RepairDecision(
-            failure, RepairLevel.AUTO_LOCAL,
-            "recover_lease_and_resume_same_lineage", False,
-        ),
-        FailureClass.POLICY_DENIED: RepairDecision(
-            failure, RepairLevel.OWNER_APPROVAL,
-            "request_bound_owner_authorization", False,
-        ),
-        FailureClass.BUSINESS_PERMANENT: RepairDecision(
-            failure, RepairLevel.MANUAL,
-            "terminal_business_failure", True,
-        ),
-        FailureClass.UNKNOWN: RepairDecision(
-            failure, RepairLevel.AUTO_REPAIR_TASK,
-            "create_diagnostic_repair_task", False,
-        ),
-    }
-    return table[failure]
-
-
-def _probe(
-    name: str,
-    probes: Mapping[str, Callable[[], bool]],
-) -> InvariantResult:
-    fn = probes.get(name)
-    if fn is None:
-        return InvariantResult(name, False, "PROBE_MISSING")
-    try:
-        passed = bool(fn())
-    except Exception as exc:
-        return InvariantResult(name, False, "PROBE_ERROR:" + type(exc).__name__)
-    return InvariantResult(name, passed, "PASS" if passed else "NOT_READY")
-
-
-def runtime_admission(
-    *,
-    worker_capabilities: Iterable[object],
-    required_capabilities: Iterable[object],
-    requested_operations: Sequence[str] = (),
-    probes: Mapping[str, Callable[[], bool]] | None = None,
-) -> AdmissionDecision:
-    """Admission is evaluated before claim; failures do not consume attempts."""
-
-    worker_values = tuple(worker_capabilities)
-    required_values = tuple(required_capabilities)
-    probe_map = probes or {}
-    invariants: list[InvariantResult] = []
-
-    registry = validate_capability_contract_registry()
-    invariants.append(InvariantResult(
-        "capability_contract_registry",
-        bool(registry.get("valid")),
-        "PASS" if registry.get("valid") else "REGISTRY_INVALID",
-    ))
-
-    task_known = all(registered_capability(item) for item in required_values)
-    worker_known = all(registered_capability(item, worker=True) for item in worker_values)
-    invariants.extend((
-        InvariantResult("task_capabilities_registered", task_known, "PASS" if task_known else "UNKNOWN_TASK_CAPABILITY"),
-        InvariantResult("worker_capabilities_registered", worker_known, "PASS" if worker_known else "UNKNOWN_WORKER_CAPABILITY"),
-    ))
-
-    capability_match = (
-        task_known
-        and worker_known
-        and has_capabilities(worker_values, required_values)
-    )
-    invariants.append(InvariantResult(
-        "capability_match",
-        capability_match,
-        "PASS" if capability_match else "WORKER_NOT_ELIGIBLE",
-    ))
-
-    normalized = normalize_required_capabilities(required_values)
-    contracts = [
-        capability_contract(item)
-        for item in normalized
-        if not str(item).startswith("exact:")
-    ]
-    contracts = [item for item in contracts if item is not None]
-
-    forbidden: set[str] = set()
-    dependencies: set[str] = set()
-    health: set[str] = set()
-    for contract in contracts:
-        forbidden.update(contract.forbidden)
-        dependencies.update(contract.dependencies)
-        health.update(contract.health_requirements)
-
-    requested = {str(item).strip().lower() for item in requested_operations if str(item).strip()}
-    forbidden_hit = sorted(requested & {item.lower() for item in forbidden})
-    invariants.append(InvariantResult(
-        "forbidden_operations_absent",
-        not forbidden_hit,
-        "PASS" if not forbidden_hit else "FORBIDDEN:" + ",".join(forbidden_hit),
-    ))
-
-    for name in sorted(dependencies | health):
-        invariants.append(_probe(name, probe_map))
-
-    failed = [item for item in invariants if not item.passed]
-    if not failed:
-        return AdmissionDecision(
-            True,
-            "EXECUTION_READY",
-            tuple(invariants),
-        )
-
-    details = " ".join(item.name + ":" + item.detail for item in failed)
-    failure = classify_failure(details, phase="admission")
-    if any(item.name == "forbidden_operations_absent" and not item.passed for item in failed):
-        failure = FailureClass.POLICY_DENIED
-    elif any("credential" in item.name for item in failed):
-        failure = FailureClass.CREDENTIAL_PROJECTION_ERROR
-    elif any(item.name in {"capability_contract_registry", "task_capabilities_registered", "worker_capabilities_registered", "capability_match"} for item in failed):
-        failure = FailureClass.CAPABILITY_CONTRACT_ERROR
-    elif any(item.name in dependencies or item.name in health for item in failed):
-        failure = FailureClass.DEPENDENCY_UNAVAILABLE
-
-    repair = repair_for_failure(failure)
-    return AdmissionDecision(
-        False,
-        "EXECUTION_READY_FAILED",
-        tuple(invariants),
-        failure,
-        repair.level,
-        repair.action,
-    )
-
-
-def system_invariant_snapshot(
-    *,
-    worker_capabilities: Iterable[object],
-    required_capabilities: Iterable[object],
-    requested_operations: Sequence[str] = (),
-    probes: Mapping[str, Callable[[], bool]] | None = None,
-) -> dict[str, object]:
-    decision = runtime_admission(
-        worker_capabilities=worker_capabilities,
-        required_capabilities=required_capabilities,
-        requested_operations=requested_operations,
-        probes=probes,
-    )
-    return {
-        "schema": "aios.system-invariants.v1",
-        "status": "HEALTHY" if decision.admitted else "DEGRADED",
-        "execution_ready": decision.admitted,
-        "admission": decision.as_dict(),
-    }
@@ -1,89 +0,0 @@
-"""Governed API facade for branch-bound repair leases.
-
-The facade is transport-neutral so the permanent control plane can expose it
-through its existing authenticated loopback/API seam without creating a second
-Git writer or a global credential registry.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-from branch_repair_lease import LeaseError, RepairLease, RepairLeaseManager, sanitized_lease_view
-
-
-class BranchRepairLeaseAPI:
-    """Validate operation envelopes and return sanitized lease metadata."""
-
-    def __init__(self, manager: RepairLeaseManager) -> None:
-        self.manager = manager
-
-    @staticmethod
-    def _required(request: Mapping[str, Any], name: str) -> Any:
-        value = request.get(name)
-        if value is None or value == "":
-            raise LeaseError(f"missing required field: {name}")
-        return value
-
-    @staticmethod
-    def _view(lease: RepairLease) -> dict[str, Any]:
-        return {"status": "ok", "lease": sanitized_lease_view(lease)}
-
-    def handle(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        try:
-            operation = self._required(request, "operation")
-            owner = str(self._required(request, "owner_identity"))
-            if operation == "issue":
-                lease = self.manager.issue(
-                    task_id=str(self._required(request, "task_id")),
-                    owner_identity=owner,
-                    branch=str(self._required(request, "branch")),
-                    description=str(self._required(request, "description")),
-                    allowed_paths=tuple(self._required(request, "allowed_paths")),
-                    ttl_seconds=int(request.get("ttl_seconds", 3600)),
-                )
-            elif operation == "attach_existing_branch":
-                lease = self.manager.attach_existing_branch(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                )
-            elif operation == "authorize_commit":
-                lease = self.manager.authorize_commit(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                    paths=tuple(self._required(request, "paths")),
-                    content=request.get("content"),
-                )
-            elif operation == "record_commit":
-                lease = self.manager.record_commit(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                    new_head_oid=str(self._required(request, "new_head_oid")),
-                    paths=tuple(self._required(request, "paths")),
-                )
-            elif operation == "recover":
-                lease = self.manager.recover(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            elif operation == "renew":
-                lease = self.manager.renew(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    ttl_seconds=int(self._required(request, "ttl_seconds")),
-                )
-            elif operation == "complete":
-                lease = self.manager.complete(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            elif operation == "revoke":
-                lease = self.manager.revoke(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            else:
-                raise LeaseError("unsupported lease operation")
-            return self._view(lease)
-        except (LeaseError, TypeError, ValueError):
-            return {"status": "blocked", "error": "lease_request_rejected"}
@@ -1,48 +0,0 @@
-"""Root-only CLI for the branch-bound repair lease API."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-
-from aios_branch_repair_lease_api import BranchRepairLeaseAPI
-from branch_repair_lease import GitProbe, LeaseStore
-from branch_repair_lease import RepairLeaseManager
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="AIOS branch repair lease CLI")
-    parser.add_argument("--store", required=True)
-    parser.add_argument("--bare-repo", required=True)
-    parser.add_argument("--request-file")
-    parser.add_argument("--request-json")
-    args = parser.parse_args()
-    if hasattr(os, "geteuid") and os.geteuid() != 0:
-        print(json.dumps({"status": "blocked", "error": "root_required"}))
-        return 2
-    if bool(args.request_file) == bool(args.request_json):
-        print(json.dumps({"status": "blocked", "error": "one_request_source_required"}))
-        return 2
-    try:
-        raw = (
-            Path(args.request_file).read_text(encoding="utf-8")
-            if args.request_file
-            else str(args.request_json)
-        )
-        request = json.loads(raw)
-        if not isinstance(request, dict):
-            raise ValueError("request must be an object")
-        api = BranchRepairLeaseAPI(RepairLeaseManager(LeaseStore(args.store), GitProbe(args.bare_repo)))
-        response = api.handle(request)
-        print(json.dumps(response, ensure_ascii=True, sort_keys=True, separators=(",", ":")))
-        return 0 if response.get("status") == "ok" else 1
-    except Exception:
-        print(json.dumps({"status": "blocked", "error": "lease_cli_failed"}))
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,142 +0,0 @@
-"""Private Unix-socket caller projection and rehydration client.
-
-The broker response body is deliberately public metadata only. The short-lived
-credential projection is delivered in a private response header, consumed
-inside the model API process, and never returned by an HTTP API or persisted.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hashlib
-import http.client
-import json
-from pathlib import Path
-import socket
-from typing import Any, Mapping
-
-CALLER = "chatgpt-governed-implementer-singlehost"
-SCOPE = "release:candidate"
-GOVERNED_TASK_SCOPE = "governed-task:project"
-PROJECTED_SCOPES = frozenset({GOVERNED_TASK_SCOPE, SCOPE})
-CREDENTIAL_HEADER = "X-AIOS-Caller-Projection-Credential"
-
-
-class CallerProjectionError(RuntimeError):
-    def __init__(self, code: str, status: int = 503) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-@dataclass(frozen=True)
-class ProjectionResult:
-    public: dict[str, Any]
-    credential_loaded: bool
-
-
-class _UnixHTTPConnection(http.client.HTTPConnection):
-    def __init__(self, socket_path: Path, timeout: float) -> None:
-        super().__init__("localhost", timeout=timeout)
-        self.socket_path = socket_path
-
-    def connect(self) -> None:
-        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        sock.settimeout(self.timeout)
-        try:
-            sock.connect(str(self.socket_path))
-        except Exception:
-            sock.close()
-            raise
-        self.sock = sock
-
-
-class CallerProjectionClient:
-    def __init__(self, socket_path: Path, *, timeout: float = 2.0) -> None:
-        self.socket_path = Path(socket_path)
-        self.timeout = timeout
-
-    @staticmethod
-    def _idempotency_key(caller: str, scope: str) -> str:
-        digest = hashlib.sha256((caller + "\0" + scope).encode()).hexdigest()
-        return "caller-projection-" + digest[:32] + "-v1"
-
-    def rehydrate(
-        self,
-        caller: str,
-        scope: str,
-        request: Mapping[str, Any] | None = None,
-    ) -> ProjectionResult:
-        if caller != CALLER:
-            raise CallerProjectionError("CALLER_MISMATCH", 403)
-        if scope not in PROJECTED_SCOPES:
-            raise CallerProjectionError("SCOPE_MISMATCH", 403)
-        body = {
-            "caller": caller,
-            "scope": scope,
-            "idempotency_key": self._idempotency_key(caller, scope),
-            "request": dict(request or {}),
-        }
-        connection = _UnixHTTPConnection(self.socket_path, self.timeout)
-        try:
-            connection.request(
-                "POST",
-                "/v1/project-caller",
-                body=json.dumps(body, sort_keys=True, separators=(",", ":")).encode(),
-                headers={
-                    "Content-Type": "application/json",
-                    "Accept": "application/json",
-                    "X-AIOS-Account": caller,
-                },
-            )
-            response = connection.getresponse()
-            status = response.status
-            raw = response.read()
-            credential = response.getheader(CREDENTIAL_HEADER, "")
-        except (OSError, TimeoutError, http.client.HTTPException) as exc:
-            raise CallerProjectionError("PROJECTION_BROKER_UNAVAILABLE", 503) from exc
-        finally:
-            connection.close()
-
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except Exception as exc:
-            raise CallerProjectionError("PROJECTION_RESPONSE_INVALID", 503) from exc
-        if not isinstance(value, Mapping):
-            raise CallerProjectionError("PROJECTION_RESPONSE_INVALID", 503)
-        if status != 200:
-            code = str(value.get("error") or "PROJECTION_DENIED")
-            raise CallerProjectionError(code, 403 if status < 500 else 503)
-        if any(
-            str(key).lower() in {
-                "credential",
-                "credential_material",
-                "token",
-                "bearer",
-                "secret",
-                "password",
-            }
-            for key in value
-        ):
-            raise CallerProjectionError("PROJECTION_SECRET_FIELD_REJECTED", 503)
-        if value.get("caller") != CALLER or value.get("scope") != scope:
-            raise CallerProjectionError("PROJECTION_BINDING_INVALID", 503)
-        if value.get("projection_state") != "ACKED":
-            raise CallerProjectionError("PROJECTION_STATE_INVALID", 503)
-        if value.get("credential_state") != "REHYDRATED":
-            raise CallerProjectionError("CREDENTIAL_REHYDRATION_INVALID", 503)
-        if value.get("rehydration_state") not in {"GENERATED", "RECOVERED"}:
-            raise CallerProjectionError("REHYDRATION_STATE_INVALID", 503)
-        effective_scopes = value.get("effective_scopes")
-        if (
-            not isinstance(effective_scopes, list)
-            or len(effective_scopes) != len(set(effective_scopes))
-            or not all(isinstance(item, str) for item in effective_scopes)
-            or scope not in effective_scopes
-            or not set(effective_scopes).issubset(PROJECTED_SCOPES)
-        ):
-            raise CallerProjectionError("PROJECTION_SCOPE_INVALID", 503)
-        if value.get("secret_exposed") is not False:
-            raise CallerProjectionError("PROJECTION_SECRET_EXPOSURE", 503)
-        if not isinstance(credential, str) or len(credential) < 32:
-            raise CallerProjectionError("CREDENTIAL_REHYDRATION_MISSING", 503)
-        return ProjectionResult(public=dict(value), credential_loaded=True)
@@ -1,104 +0,0 @@
-"""Read-only validation of recovered campaign authorization evidence."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-from pathlib import Path
-import stat
-from typing import Any
-
-
-class RecoveryEvidenceError(RuntimeError):
-    pass
-
-
-def _digest(path: Path) -> str:
-    h = hashlib.sha256()
-    with path.open("rb") as stream:
-        for block in iter(lambda: stream.read(1024 * 1024), b""):
-            h.update(block)
-    return h.hexdigest()
-
-
-def _secure_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_MISSING")
-    info = path.stat(follow_symlinks=False)
-    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & 0o022:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_PERMISSIONS")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_INVALID") from exc
-    if not isinstance(value, dict):
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_OBJECT_REQUIRED")
-    return value
-
-
-def load_recovered_authorization(path: str | Path) -> dict[str, Any]:
-    """Verify the recovery receipt, sidecar, and all referenced immutable files."""
-    receipt_path = Path(path)
-    receipt = _secure_json(receipt_path)
-    sidecar = receipt_path.with_suffix(receipt_path.suffix + ".sha256")
-    if sidecar.is_symlink() or not sidecar.is_file():
-        raise RecoveryEvidenceError("RECOVERY_DIGEST_SIDECAR_MISSING")
-    expected = sidecar.read_text(encoding="ascii").split()[0]
-    actual = _digest(receipt_path)
-    if expected != actual:
-        raise RecoveryEvidenceError("RECOVERY_DIGEST_MISMATCH")
-    required = {
-        "schema",
-        "campaign_id",
-        "original_event_id",
-        "original_authorization_digest",
-        "signed_grant_id",
-        "signed_grant_digest",
-        "task_id",
-        "repository",
-        "original_base_oid",
-        "branch",
-        "expected_branch_oid",
-        "recovered_from_existing_evidence",
-        "new_owner_interaction",
-        "recovery_state",
-        "production_side_effect_executed",
-        "global_writes_enabled",
-        "grant_consumed",
-        "owner_authorization_consumed",
-        "original_receipts_immutable",
-        "recovered_at",
-        "evidence_files",
-    }
-    if set(receipt) != required or receipt["schema"] != "aios.owner-authorization-recovery.v1":
-        raise RecoveryEvidenceError("RECOVERY_SCHEMA_INVALID")
-    if receipt["recovered_from_existing_evidence"] is not True or receipt["new_owner_interaction"] is not False:
-        raise RecoveryEvidenceError("RECOVERY_NOT_APPEND_ONLY")
-    if receipt["production_side_effect_executed"] is not False or receipt["global_writes_enabled"] is not False:
-        raise RecoveryEvidenceError("RECOVERY_SCOPE_INVALID")
-    if receipt["recovery_state"] != "RECOVERED_PENDING_CONTINUATION_LEASE":
-        raise RecoveryEvidenceError("RECOVERY_STATE_INVALID")
-    evidence = receipt["evidence_files"]
-    if not isinstance(evidence, list) or not evidence:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_LIST_INVALID")
-    for item in evidence:
-        if not isinstance(item, dict) or set(item) != {"path", "sha256"}:
-            raise RecoveryEvidenceError("RECOVERY_EVIDENCE_ENTRY_INVALID")
-        target = Path(item["path"])
-        if _digest(target) != item["sha256"]:
-            raise RecoveryEvidenceError("RECOVERY_EVIDENCE_DIGEST_MISMATCH")
-    return {
-        "schema": receipt["schema"],
-        "state": receipt["recovery_state"],
-        "campaign_id": receipt["campaign_id"],
-        "original_event_id": receipt["original_event_id"],
-        "original_authorization_digest": receipt["original_authorization_digest"],
-        "signed_grant_id": receipt["signed_grant_id"],
-        "task_id": receipt["task_id"],
-        "repository": receipt["repository"],
-        "original_base_oid": receipt["original_base_oid"],
-        "branch": receipt["branch"],
-        "expected_branch_oid": receipt["expected_branch_oid"],
-        "digest": actual,
-        "new_owner_interaction": False,
-    }
@@ -1,341 +0,0 @@
-"""Canonical fail-closed capability semantics for task eligibility."""
-
-from __future__ import annotations
-
-from collections.abc import Iterable
-from dataclasses import asdict, dataclass
-from typing import Any
-
-
-_TASK_ALIASES: dict[str, frozenset[str]] = {
-    "repository_read": frozenset({"repo.read"}),
-    "git.read": frozenset({"repo.read"}),
-    "repo.read": frozenset({"repo.read"}),
-    "test_execution": frozenset({"test.execute"}),
-    "git.test": frozenset({"test.execute"}),
-    "test.execute": frozenset({"test.execute"}),
-    "governed_git_write": frozenset({"governed.git.write.branch", "governed.git.write.file"}),
-    "governed.git.write": frozenset({"governed.git.write.branch", "governed.git.write.file"}),
-    "governed.write.branch": frozenset({"governed.git.write.branch"}),
-    "governed.write.file": frozenset({"governed.git.write.file"}),
-    "shell": frozenset({"runtime.shell"}),
-    "git": frozenset({"runtime.git"}),
-    "python": frozenset({"runtime.python"}),
-    "code.read": frozenset({"legacy.code.read"}),
-    "code.review": frozenset({"legacy.code.review"}),
-    "code.write": frozenset({"legacy.code.write"}),
-    "code.write.patch": frozenset({"legacy.code.write.patch"}),
-    "test.python": frozenset({"legacy.test.python"}),
-    "test.shell.allowlisted": frozenset({"legacy.test.shell.allowlisted"}),
-    "git.commit": frozenset({"legacy.git.commit"}),
-    "git.diff.read": frozenset({"legacy.git.diff.read"}),
-    "git.force_push": frozenset({"legacy.git.force_push"}),
-    "deploy.production": frozenset({"legacy.deploy.production"}),
-    "secret.transform": frozenset({"legacy.secret.transform"}),
-    "secure_file_transformer": frozenset({"legacy.secure_file_transformer"}),
-    "runtime.shadow": frozenset({"legacy.runtime.shadow"}),
-    "review.security": frozenset({"legacy.review.security"}),
-    "review.api-contract": frozenset({"legacy.review.api-contract"}),
-    "gpu.train": frozenset({"legacy.gpu.train"}),
-    "agent.runtime.hermes": frozenset({"agent.runtime.hermes"}),
-    "agent.runtime.openclaw": frozenset({"agent.runtime.openclaw"}),
-    "engineering.autonomous": frozenset({"engineering.autonomous"}),
-    "release:candidate": frozenset({"release:candidate"}),
-}
-
-_WORKER_ALIASES: dict[str, frozenset[str]] = {
-    "git.read": frozenset({"repo.read"}),
-    "repo.read": frozenset({"repo.read"}),
-    "repository_read": frozenset({"repo.read"}),
-    "git.test": frozenset({"test.execute"}),
-    "test.execute": frozenset({"test.execute"}),
-    "test_execution": frozenset({"test.execute"}),
-    "governed.write.branch": frozenset({"governed.git.write.branch"}),
-    "governed.git.write.branch": frozenset({"governed.git.write.branch"}),
-    "governed.write.file": frozenset({"governed.git.write.file"}),
-    "governed.git.write.file": frozenset({"governed.git.write.file"}),
-    "shell": frozenset({"runtime.shell"}),
-    "git": frozenset({"runtime.git"}),
-    "python": frozenset({"runtime.python"}),
-    "code.read": frozenset({"legacy.code.read"}),
-    "code.review": frozenset({"legacy.code.review"}),
-    "code.write": frozenset({"legacy.code.write"}),
-    "code.write.patch": frozenset({"legacy.code.write.patch"}),
-    "test.python": frozenset({"legacy.test.python"}),
-    "test.shell.allowlisted": frozenset({"legacy.test.shell.allowlisted"}),
-    "git.commit": frozenset({"legacy.git.commit"}),
-    "git.diff.read": frozenset({"legacy.git.diff.read"}),
-    "git.force_push": frozenset({"legacy.git.force_push"}),
-    "deploy.production": frozenset({"legacy.deploy.production"}),
-    "secret.transform": frozenset({"legacy.secret.transform"}),
-    "secure_file_transformer": frozenset({"legacy.secure_file_transformer"}),
-    "runtime.shadow": frozenset({"legacy.runtime.shadow"}),
-    "review.security": frozenset({"legacy.review.security"}),
-    "review.api-contract": frozenset({"legacy.review.api-contract"}),
-    "gpu.train": frozenset({"legacy.gpu.train"}),
-    "agent.runtime.hermes": frozenset({"agent.runtime.hermes"}),
-    "agent.runtime.openclaw": frozenset({"agent.runtime.openclaw"}),
-    "engineering.autonomous": frozenset({"engineering.autonomous"}),
-    "release:candidate": frozenset({"release:candidate"}),
-}
-
-
-
-@dataclass(frozen=True)
-class CapabilityContract:
-    """Versioned runtime contract attached to one canonical semantic capability."""
-
-    name: str
-    min_version: int = 1
-    max_version: int = 1
-    permissions: tuple[str, ...] = ()
-    forbidden: tuple[str, ...] = ()
-    dependencies: tuple[str, ...] = ()
-    health_requirements: tuple[str, ...] = ()
-
-    def as_dict(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-# This registry is the semantic source of truth. Alias tables below are retained
-# as compatibility adapters; startup/tests validate every alias target against
-# this registry so a name cannot be accepted in one layer and be unknown in
-# another.
-_CAPABILITY_CONTRACTS: dict[str, CapabilityContract] = {
-    "repo.read": CapabilityContract("repo.read", permissions=("repository_read",)),
-    "test.execute": CapabilityContract("test.execute", permissions=("test_execution",)),
-    "governed.git.write.branch": CapabilityContract(
-        "governed.git.write.branch",
-        permissions=("governed_branch_write",),
-        dependencies=("writer_lease", "governed_gitops"),
-    ),
-    "governed.git.write.file": CapabilityContract(
-        "governed.git.write.file",
-        permissions=("governed_file_write",),
-        dependencies=("writer_lease", "governed_gitops"),
-    ),
-    "governed.git.write": CapabilityContract(
-        "governed.git.write",
-        permissions=("governed_git_write",),
-        dependencies=("writer_lease", "governed_gitops"),
-    ),
-    "runtime.shell": CapabilityContract("runtime.shell", permissions=("runtime_shell",)),
-    "runtime.git": CapabilityContract("runtime.git", permissions=("runtime_git",)),
-    "runtime.python": CapabilityContract("runtime.python", permissions=("runtime_python",)),
-    "legacy.code.read": CapabilityContract("legacy.code.read"),
-    "legacy.code.review": CapabilityContract("legacy.code.review"),
-    "legacy.code.write": CapabilityContract("legacy.code.write"),
-    "legacy.code.write.patch": CapabilityContract("legacy.code.write.patch"),
-    "legacy.test.python": CapabilityContract("legacy.test.python"),
-    "legacy.test.shell.allowlisted": CapabilityContract("legacy.test.shell.allowlisted"),
-    "legacy.git.commit": CapabilityContract("legacy.git.commit"),
-    "legacy.git.diff.read": CapabilityContract("legacy.git.diff.read"),
-    "legacy.git.force_push": CapabilityContract(
-        "legacy.git.force_push",
-        forbidden=("protected_ref_bypass",),
-    ),
-    "legacy.deploy.production": CapabilityContract(
-        "legacy.deploy.production",
-        permissions=("production_deploy",),
-        dependencies=("owner_approval", "deployment_controller"),
-        health_requirements=("approval_envelope_verified", "runtime_acceptance_available"),
-    ),
-    "legacy.secret.transform": CapabilityContract("legacy.secret.transform"),
-    "legacy.secure_file_transformer": CapabilityContract("legacy.secure_file_transformer"),
-    "legacy.runtime.shadow": CapabilityContract("legacy.runtime.shadow"),
-    "legacy.review.security": CapabilityContract("legacy.review.security"),
-    "legacy.review.api-contract": CapabilityContract("legacy.review.api-contract"),
-    "legacy.gpu.train": CapabilityContract("legacy.gpu.train"),
-    "agent.runtime.hermes": CapabilityContract(
-        "agent.runtime.hermes",
-        dependencies=("hermes_runtime",),
-        health_requirements=("worker_liveness",),
-    ),
-    "agent.runtime.openclaw": CapabilityContract(
-        "agent.runtime.openclaw",
-        dependencies=("openclaw_runtime",),
-        health_requirements=("worker_liveness",),
-    ),
-    "engineering.autonomous": CapabilityContract(
-        "engineering.autonomous",
-        dependencies=("agent_task_control_plane",),
-        health_requirements=("worker_liveness",),
-    ),
-    "release:candidate": CapabilityContract(
-        "release:candidate",
-        min_version=1,
-        max_version=1,
-        permissions=("prepare_release",),
-        forbidden=(
-            "production_deploy",
-            "submit_owner_approval",
-            "tag_publish",
-            "baseline_registry_finalize",
-            "runtime_switch",
-        ),
-        dependencies=(
-            "credential_projection",
-            "trusted_builder",
-        ),
-        health_requirements=(
-            "authenticated_probe",
-            "release_api_health",
-            "worker_liveness",
-        ),
-    ),
-}
-
-
-def capability_contract(name: object) -> CapabilityContract | None:
-    """Return the contract for one canonical or registered capability name."""
-
-    text = _clean(name)
-    direct = _CAPABILITY_CONTRACTS.get(text)
-    if direct is not None:
-        return direct
-    mapped = _TASK_ALIASES.get(text) or _WORKER_ALIASES.get(text)
-    if mapped is None or len(mapped) != 1:
-        return None
-    return _CAPABILITY_CONTRACTS.get(next(iter(mapped)))
-
-
-def registered_capability(name: object, *, worker: bool = False) -> bool:
-    """Fail-closed validation used by registration/task admission."""
-
-    text = _clean(name)
-    if "*" in text:
-        return False
-    aliases = _WORKER_ALIASES if worker else _TASK_ALIASES
-    mapped = aliases.get(text)
-    if mapped is None:
-        return text in _CAPABILITY_CONTRACTS
-    return all(item in _CAPABILITY_CONTRACTS for item in mapped)
-
-
-def validate_capability_contract_registry() -> dict[str, object]:
-    """Prove alias/contract closure and contract safety invariants."""
-
-    alias_targets: set[str] = set()
-    for mapping in (_TASK_ALIASES, _WORKER_ALIASES):
-        for values in mapping.values():
-            alias_targets.update(values)
-    missing = sorted(alias_targets - set(_CAPABILITY_CONTRACTS))
-    invalid_versions = sorted(
-        name
-        for name, contract in _CAPABILITY_CONTRACTS.items()
-        if contract.min_version < 1 or contract.max_version < contract.min_version
-    )
-    permission_forbidden_overlap = sorted(
-        name
-        for name, contract in _CAPABILITY_CONTRACTS.items()
-        if set(contract.permissions) & set(contract.forbidden)
-    )
-    return {
-        "schema": "aios.capability-contract-registry.v1",
-        "contract_count": len(_CAPABILITY_CONTRACTS),
-        "missing_alias_targets": missing,
-        "invalid_versions": invalid_versions,
-        "permission_forbidden_overlap": permission_forbidden_overlap,
-        "valid": not missing and not invalid_versions and not permission_forbidden_overlap,
-    }
-
-
-def capability_contract_snapshot() -> dict[str, dict[str, Any]]:
-    return {
-        name: contract.as_dict()
-        for name, contract in sorted(_CAPABILITY_CONTRACTS.items())
-    }
-
-
-_UNKNOWN_PREFIX = "exact:"
-
-
-def _clean(value: object) -> str:
-    if not isinstance(value, str):
-        raise ValueError("capability must be a string")
-    text = value.strip().lower()
-    if not text:
-        raise ValueError("capability must not be empty")
-    return text
-
-
-def normalize_required_capabilities(values: Iterable[object]) -> frozenset[str]:
-    """Map task-facing names to one semantic vocabulary.
-
-    Unknown names remain explicit exact requirements. They are never treated
-    as wildcards or granted by a failed normalization.
-    """
-
-    result: set[str] = set()
-    for value in values:
-        text = _clean(value)
-        if "*" in text:
-            result.add(_UNKNOWN_PREFIX + text)
-        else:
-            mapped = _TASK_ALIASES.get(text)
-            if mapped is None or any(item not in _CAPABILITY_CONTRACTS for item in mapped):
-                result.add(_UNKNOWN_PREFIX + text)
-            else:
-                result.update(mapped)
-    return frozenset(result)
-
-
-def normalize_worker_capabilities(values: Iterable[object]) -> frozenset[str]:
-    """Map registered worker names to effective semantic capabilities."""
-
-    result: set[str] = set()
-    for value in values:
-        text = _clean(value)
-        if "*" in text:
-            continue
-        mapped = _WORKER_ALIASES.get(text)
-        if mapped is not None and all(item in _CAPABILITY_CONTRACTS for item in mapped):
-            result.update(mapped)
-    if {
-        "governed.git.write.branch",
-        "governed.git.write.file",
-    }.issubset(result):
-        result.add("governed.git.write")
-    return frozenset(result)
-
-
-def has_capabilities(
-    worker_capabilities: Iterable[object],
-    required_capabilities: Iterable[object],
-) -> bool:
-    """Return the single eligibility decision used by poll and claim."""
-
-    required = normalize_required_capabilities(required_capabilities)
-    effective = normalize_worker_capabilities(worker_capabilities)
-    if any(value.startswith(_UNKNOWN_PREFIX) for value in required):
-        return False
-    return required.issubset(effective)
-
-
-def required_capabilities_subset(
-    granted_requirements: Iterable[object],
-    required_requirements: Iterable[object],
-) -> bool:
-    """Check semantic capability containment for delegation constraints."""
-    granted = normalize_required_capabilities(granted_requirements)
-    required = normalize_required_capabilities(required_requirements)
-    if any(value.startswith(_UNKNOWN_PREFIX) for value in granted | required):
-        return False
-    return required.issubset(granted)
-
-
-def normalized_capability_matrix(
-    worker_capabilities: Iterable[object],
-    required_capabilities: Iterable[object],
-) -> dict[str, object]:
-    """Expose non-secret decision evidence for tests and diagnostics."""
-
-    worker_values = tuple(worker_capabilities)
-    required_values = tuple(required_capabilities)
-    worker = normalize_worker_capabilities(worker_values)
-    required = normalize_required_capabilities(required_values)
-    return {
-        "worker_effective": sorted(worker),
-        "task_required": sorted(required),
-        "eligible": has_capabilities(worker_values, required_values),
-    }
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 from __future__ import annotations
-import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, urllib.request, uuid
+import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, uuid
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
@@ -33,11 +33,6 @@ from silent_release_hardening import (
    SignedReleasePlanApproval,
    SilentReleaseActionService,
 )
-try:
-    from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
-    from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
 try:
    from authoritative_git import (
        AuthoritativeGitError,
@@ -125,12 +120,6 @@ def reject_non_read_http(handler, method: str, path: str) -> bool:
        return False
    if path in SILENT_RELEASE_POST_PATHS:
        return False
-    if (
-        method == 'POST'
-        and path in ('/api/file', '/api/commit-file')
-        and os.getenv('AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED', os.getenv('AIOS_GITOPS_JOB_CONTROLLER_ENABLED', 'false')).lower() in {'1', 'true', 'yes', 'on'}
-    ):
-        return False
    decision = evaluate_git_write(WS)
    if decision.allowed:
        return False
@@ -404,51 +393,6 @@ class H(BaseHTTPRequestHandler):
        if not a['ok']: self.sendj({'error':'unauthorized','hint':'Bearer token required'},401); return None
        if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
        return a
-    def bridge_release(self, path, data):
-        route = {
-            '/createTagApprovalRequest': '/v2/tag/approval-request',
-            '/requestOrCreateTag': '/v2/tag/publish',
-            '/getTagPublicationStatus': '/v2/tag/status',
-            '/buildProductionArtifact': '/v2/release/artifact',
-            '/executeApprovedProductionRelease': '/v2/release/execute',
-            '/getReleaseConsistency': '/v2/release/consistency',
-            '/runReleaseAcceptance': '/v2/release/acceptance',
-        }.get(path)
-        if route is None:
-            raise ValueError('governed_release_route_invalid')
-        base = os.getenv('AIOS_BRIDGE_V2_URL', 'http://127.0.0.1:18892').rstrip('/')
-        request = urllib.request.Request(
-            base + route,
-            data=json.dumps(data, sort_keys=True, separators=(',', ':')).encode('utf-8'),
-            headers={'Content-Type': 'application/json'},
-            method='POST',
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=30) as response:
-                result = json.loads(response.read().decode('utf-8'))
-                return self.sendj(result, response.status)
-        except urllib.error.HTTPError as exc:
-            try:
-                body = json.loads(exc.read().decode('utf-8'))
-            except Exception:
-                body = {'error': 'bridge_http_error'}
-            return self.sendj(body, exc.code)
-        except (urllib.error.URLError, TimeoutError) as exc:
-            return self.sendj({'error': 'GOVERNED_BRIDGE_UNAVAILABLE', 'detail': type(exc).__name__}, 503)
-    def do_POST(self):
-        path = urllib.parse.urlparse(self.path).path
-        if path in {
-            '/createTagApprovalRequest', '/requestOrCreateTag', '/getTagPublicationStatus',
-            '/buildProductionArtifact', '/executeApprovedProductionRelease',
-            '/getReleaseConsistency', '/runReleaseAcceptance',
-        }:
-            actor = self.need('tag:create')
-            if not actor:
-                return
-            return self.bridge_release(path, self.body())
-        if reject_non_read_http(self, 'POST', path):
-            return
-        return self.sendj({'error': 'not_found', 'path': path}, 404)
    def do_GET(self):
        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
        if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
@@ -722,44 +666,7 @@ class H(BaseHTTPRequestHandler):
    def file(self,data):
        a=self.need('file:write');
        if not a: return
-        if os.getenv('AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED', os.getenv('AIOS_GITOPS_JOB_CONTROLLER_ENABLED', 'false')).lower() not in {'1','true','yes','on'}:
-            return self.sendj({'error':'DURABLE_JOB_CONTROLLER_UNAVAILABLE','retryable':True},503)
-        try:
-            path = relpath(str(data.get('path') or ''))
-            branch = str(data.get('branch') or '')
-            expected = str(data.get('expected_branch_oid') or '')
-            campaign_id = str(data.get('campaign_id') or os.getenv('AIOS_GITOPS_CAMPAIGN_ID') or '')
-            supplied_digest = str(data.get('payload_digest') or '')
-            content = data.get('content')
-            payload_bytes = None
-            if content is not None:
-                payload_bytes = content.encode('utf-8') if isinstance(content, str) else json.dumps(content, sort_keys=True, ensure_ascii=False).encode('utf-8')
-            payload_digest = supplied_digest or hashlib.sha256(payload_bytes or b'').hexdigest()
-            if not campaign_id or not branch or not expected:
-                return self.sendj({'error':'JOB_BINDING_REQUIRED','retryable':False},409)
-            request = {
-                'campaign_id': campaign_id,
-                'repository': REPOSITORY_IDENTITY or 'aios/aios',
-                'operation': 'commit-file',
-                'branch': branch,
-                'expected_branch_oid': expected,
-                'payload_digest': payload_digest,
-                # The controller persists only the binding and digest. Raw
-                # content is never copied into durable state or logs.
-            }
-            receipt = GitOpsJobController(
-                JobStore(Path(os.getenv('AIOS_GITOPS_JOB_ROOT', '/var/lib/aios-gitops/jobs')))
-            ).submit(request, payload=payload_bytes)
-            return self.sendj({
-                'job_id': receipt.job_id,
-                'state': receipt.state.value,
-                'side_effect_state': receipt.side_effect_state,
-                'retryable': receipt.http_status == 503,
-            }, receipt.http_status)
-        except ServiceUnavailable as exc:
-            return self.sendj({'error':str(exc),'layer':'durable_job','retryable':True,'side_effect_state':'UNKNOWN'},503)
-        except JobError as exc:
-            return self.sendj({'error':str(exc),'retryable':False},409)
+        b=checkout(data.get('branch'), data.get('base','main'), bool(data.get('create_branch'))); r=write_file(data.get('path'), data.get('content','')); c=commit([r], data.get('message') or f'chore(chatgpt): update {r}'); audit(a['account'],'file',r,{'branch':b,'commit':c}); self.sendj({'status':'committed','branch':b,'path':r,'commit':c})
    def commit(self,data):
        a=self.need('commit:create');
        if not a: return
@@ -950,4 +857,3 @@ def main():
    print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
    ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()
-
@@ -1,224 +0,0 @@
-"""ChatGPT GitOps Bridge v2 contract and governed release operations."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hashlib
-from pathlib import Path
-from typing import Any, Callable, Mapping
-
-
-BRIDGE_SCHEMA_VERSION = "aios.chatgpt-gitops-bridge.v2"
-BRIDGE_OPERATIONS = (
-    "getRuntimeStatus",
-    "getGovernedWriteCapabilities",
-    "createGovernedTask",
-    "acquireWriterLease",
-    "bootstrapWriterLease",
-    "renewWriterLease",
-    "commitFileGoverned",
-    "commitFilesGoverned",
-    "getGitOpsJob",
-    "resumeGitOpsJob",
-    "reconcileGitOpsJob",
-    "createTagApprovalRequest",
-    "requestOrCreateTag",
-    "getTagPublicationStatus",
-    "buildProductionArtifact",
-    "executeApprovedProductionRelease",
-    "getReleaseConsistency",
-    "runReleaseAcceptance",
-    "getControlPlaneSnapshot",
-)
-
-OPERATION_REQUIRED_FIELDS = {
-    "createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
-    "acquireWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
-    "bootstrapWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
-    "renewWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
-    "commitFileGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "path", "content_base64", "message"),
-    "commitFilesGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "files", "message"),
-    "getGitOpsJob": ("job_id",),
-    "resumeGitOpsJob": ("job_id", "expected_revision"),
-    "reconcileGitOpsJob": ("job_id", "expected_revision"),
-    "createTagApprovalRequest": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "owner_approval", "execute"),
-    "requestOrCreateTag": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
-    "getTagPublicationStatus": ("version",),
-    "buildProductionArtifact": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "executeApprovedProductionRelease": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
-    "getReleaseConsistency": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "runReleaseAcceptance": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "getControlPlaneSnapshot": (),
-}
-
-BRIDGE_OPERATION_CONTRACTS = {
-    "acquireWriterLease": {
-        "method": "POST",
-        "path": "/v2/writer-lease",
-        "required_fields": OPERATION_REQUIRED_FIELDS["acquireWriterLease"],
-        "response_fields": (
-            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
-            "create_target_branch", "worktree_mode", "cas_ref_update_required",
-        ),
-    },
-    "bootstrapWriterLease": {
-        "method": "POST",
-        "path": "/v2/writer-lease/bootstrap",
-        "required_fields": OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"],
-        "response_fields": (
-            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
-            "create_target_branch", "worktree_mode", "cas_ref_update_required",
-            "recovered", "bootstrapped", "runtime_rehydrated",
-            "durable_branch_lease_present", "idempotent",
-        ),
-    },
-    "renewWriterLease": {
-        "method": "POST",
-        "path": "/v2/writer-lease/renew",
-        "required_fields": OPERATION_REQUIRED_FIELDS["renewWriterLease"],
-        "response_fields": (
-            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
-            "recovered", "bootstrapped", "runtime_rehydrated",
-            "durable_branch_lease_present", "idempotent",
-        ),
-    },
-    "commitFileGoverned": {
-        "method": "POST", "path": "/v2/commit-file",
-        "required_fields": OPERATION_REQUIRED_FIELDS["commitFileGoverned"],
-        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
-    },
-    "commitFilesGoverned": {
-        "method": "POST", "path": "/v2/commit-files",
-        "required_fields": OPERATION_REQUIRED_FIELDS["commitFilesGoverned"],
-        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
-    },
-}
-
-
-class RuntimeDriftError(RuntimeError):
-    pass
-
-
-class BridgeV2Error(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class ControlPlaneReleaseManifest:
-    control_plane_release_version: str
-    control_plane_target_oid: str
-    artifact_sha256: str
-    runtime_path: Path
-    bridge_schema_version: str
-    repository_identity: str
-    authoritative_git_dir: Path
-    deployment_state: str
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "control_plane_release_version": self.control_plane_release_version,
-            "control_plane_target_oid": self.control_plane_target_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "runtime_path": str(self.runtime_path),
-            "bridge_schema_version": self.bridge_schema_version,
-            "repository_identity": self.repository_identity,
-            "authoritative_git_dir": str(self.authoritative_git_dir),
-            "deployment_state": self.deployment_state,
-        }
-
-    def validate(self, artifact: Path, *, observed_oid: str, approved_root: Path = Path("/opt/aios/gitops-control-plane")) -> dict[str, object]:
-        try:
-            runtime = self.runtime_path.resolve(strict=True)
-            root = approved_root.resolve(strict=True)
-            artifact_path = artifact.resolve(strict=True)
-            runtime.relative_to(root)
-            artifact_path.relative_to(runtime)
-        except (OSError, ValueError):
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT") from None
-        mutable_markers = {"workspace", "workspaces", "worktree", "worktrees"}
-        if mutable_markers.intersection(part.lower() for part in runtime.parts):
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
-        valid = (
-            len(self.control_plane_target_oid) == 40
-            and observed_oid == self.control_plane_target_oid
-            and len(self.artifact_sha256) == 64
-            and hashlib.sha256(artifact_path.read_bytes()).hexdigest() == self.artifact_sha256
-            and self.bridge_schema_version == BRIDGE_SCHEMA_VERSION
-            and self.repository_identity == "aios/aios"
-            and self.authoritative_git_dir == Path("/data/aios-gitops/repo.git")
-            and self.authoritative_git_dir.is_absolute()
-            and self.deployment_state == "STAGING"
-        )
-        if not valid:
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
-        return {**self.as_dict(), "drift_status": "PASS"}
-
-
-class BridgeV2Adapter:
-    """Thin operation adapter; all mutating handlers are injected seams."""
-
-    def __init__(self, *, runtime_status: Mapping[str, Any], handlers: Mapping[str, Callable[[Mapping[str, Any]], Any]] | None = None) -> None:
-        self.runtime_status = dict(runtime_status)
-        self.handlers = dict(handlers or {})
-
-    def getRuntimeStatus(self) -> dict[str, Any]:
-        return {"bridge_schema_version": BRIDGE_SCHEMA_VERSION, **self.runtime_status}
-
-    def getGovernedWriteCapabilities(self) -> dict[str, Any]:
-        return {
-            "bridge_schema_version": BRIDGE_SCHEMA_VERSION,
-            "legacy_writes_enabled": False,
-            "governed_writes_enabled": True,
-            "operations": list(BRIDGE_OPERATIONS),
-            "operation_contracts": {
-                operation: {
-                    **contract,
-                    "required_fields": list(contract["required_fields"]),
-                    "response_fields": list(contract["response_fields"]),
-                }
-                for operation, contract in BRIDGE_OPERATION_CONTRACTS.items()
-            },
-            "force_push": False,
-            "main_write": False,
-            "tag_write": False,
-            "baseline_write": False,
-            "production_write": False,
-            "approved_release_operations": True,
-            "approved_release_scope": {
-                "version": "V2R2C1",
-                "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
-                "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
-                "approval_plan_id": "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e",
-            },
-        }
-
-    @staticmethod
-    def legacy_write_disabled() -> dict[str, object]:
-        return {"error": "LEGACY_WRITE_DISABLED", "replacement": "createGovernedTask", "governed_writes_available": True}
-
-    def _call(self, operation: str, request: Mapping[str, Any]) -> Any:
-        required = OPERATION_REQUIRED_FIELDS[operation]
-        if any(key not in request for key in required):
-            raise BridgeV2Error("BRIDGE_REQUEST_FIELDS_MISSING")
-        handler = self.handlers.get(operation)
-        if handler is None:
-            raise BridgeV2Error("GOVERNED_HANDLER_UNAVAILABLE")
-        return handler(dict(request))
-
-    def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
-    def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
-    def bootstrapWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("bootstrapWriterLease", request)
-    def renewWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("renewWriterLease", request)
-    def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
-    def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
-    def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)
-    def resumeGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("resumeGitOpsJob", request)
-    def reconcileGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("reconcileGitOpsJob", request)
-    def createTagApprovalRequest(self, request: Mapping[str, Any]) -> Any: return self._call("createTagApprovalRequest", request)
-    def requestOrCreateTag(self, request: Mapping[str, Any]) -> Any: return self._call("requestOrCreateTag", request)
-    def getTagPublicationStatus(self, request: Mapping[str, Any]) -> Any: return self._call("getTagPublicationStatus", request)
-    def buildProductionArtifact(self, request: Mapping[str, Any]) -> Any: return self._call("buildProductionArtifact", request)
-    def executeApprovedProductionRelease(self, request: Mapping[str, Any]) -> Any: return self._call("executeApprovedProductionRelease", request)
-    def getReleaseConsistency(self, request: Mapping[str, Any]) -> Any: return self._call("getReleaseConsistency", request)
-    def runReleaseAcceptance(self, request: Mapping[str, Any]) -> Any: return self._call("runReleaseAcceptance", request)
-
-    def getControlPlaneSnapshot(self, request: Mapping[str, Any] | None = None) -> Any: return self._call("getControlPlaneSnapshot", request or {})
@@ -1,692 +0,0 @@
-"""Governed continuation executor for exact existing task branches.
-
-The executor composes the existing continuation lease and durable Job store.
-All Git and Gitea side effects live behind injected narrow interfaces so the
-state machine can prove Authority, Git-network, API-branch, and commit-object
-agreement before it reports completion.
-"""
-
-from __future__ import annotations
-
-import base64
-from dataclasses import asdict, dataclass
-from datetime import datetime, timezone
-import hashlib
-import json
-import os
-from pathlib import Path, PurePosixPath
-import re
-import subprocess
-from typing import Callable, Mapping, Protocol
-from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlsplit
-from urllib.request import Request, urlopen
-
-from aios_authority_git_executor import AuthorityGitExecutor
-from aios_continuation_lease import WriterLeaseRequestV2
-from aios_gitops_job_controller import GitOpsJobController, JobState
-from aios_gitops_reconciliation_core import ReconciliationAction, RemoteObservation, decide_reconciliation
-from authorized_task_writer_provisioning import validate_writer_lease_request_v2
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SECRET_PATTERNS = (
-    re.compile(rb"gh[pousr]_[A-Za-z0-9]{20,}"),
-    re.compile(rb"(?i)(?:token|password|secret|api[_-]?key)\s*[:=]\s*[\"'][^\"'\s]{12,}[\"']"),
-    re.compile(rb"-----BEGIN " + rb"(?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
-)
-
-
-class ContinuationExecutionError(RuntimeError):
-    """Stable fail-closed continuation execution error."""
-
-
-class DetachedWorkspace(Protocol):
-    def is_detached(self) -> bool: ...
-    def head_oid(self) -> str: ...
-    def commit_files(self, files: Mapping[str, bytes], message: str) -> str: ...
-
-
-class AuthorityPort(Protocol):
-    def branch_exists(self, branch: str) -> bool: ...
-    def branch_head(self, branch: str) -> str: ...
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str: ...
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
-
-
-class RemotePort(Protocol):
-    def repository_identity(self) -> str: ...
-    def push_new_exact(self, branch: str, new: str) -> None: ...
-    def push_exact(self, branch: str, expected: str, new: str) -> None: ...
-    def read_git_ref(self, branch: str) -> str | None: ...
-    def read_api_branch(self, branch: str) -> str | None: ...
-    def commit_visible(self, oid: str) -> bool: ...
-
-
-class CredentialProjection(Protocol):
-    def project(self) -> None: ...
-    def revoke(self) -> None: ...
-
-
-def _run(argv: list[str], *, cwd: Path | None = None, environment: Mapping[str, str] | None = None) -> str:
-    result = subprocess.run(
-        argv,
-        cwd=cwd,
-        env=None if environment is None else dict(environment),
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise ContinuationExecutionError("SUBPROCESS_FAILED")
-    return result.stdout.strip()
-
-
-@dataclass(slots=True)
-class AuthorityGitAdapter:
-    """Branch-name adapter over the existing narrow AuthorityGitExecutor."""
-
-    executor: AuthorityGitExecutor
-
-    @staticmethod
-    def _ref(branch: str) -> str:
-        return f"refs/heads/{branch}"
-
-    def branch_exists(self, branch: str) -> bool:
-        return self.executor.read_ref(self._ref(branch)) is not None
-
-    def branch_head(self, branch: str) -> str:
-        value = self.executor.read_ref(self._ref(branch))
-        if value is None:
-            raise ContinuationExecutionError("EXISTING_BRANCH_MISSING")
-        return value
-
-    def is_ancestor(self, older: str, newer: str) -> bool:
-        return self.executor.ancestry_check(older, newer)
-
-    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str:
-        return self.executor.create_task_branch_CAS(self._ref(branch), expected_base, new)
-
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
-        return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
-
-
-@dataclass(slots=True)
-class DetachedGitWorkspace:
-    path: Path
-
-    def __post_init__(self) -> None:
-        if not self.path.is_absolute() or self.path.is_symlink() or not self.path.is_dir():
-            raise ContinuationExecutionError("WORKTREE_PATH_INVALID")
-        top = Path(_run(["git", "rev-parse", "--show-toplevel"], cwd=self.path)).resolve()
-        if top != self.path.resolve():
-            raise ContinuationExecutionError("WORKTREE_PATH_INVALID")
-
-    def is_detached(self) -> bool:
-        result = subprocess.run(
-            ["git", "symbolic-ref", "-q", "HEAD"],
-            cwd=self.path,
-            capture_output=True,
-            check=False,
-        )
-        return result.returncode == 1
-
-    def head_oid(self) -> str:
-        return _run(["git", "rev-parse", "HEAD"], cwd=self.path)
-
-    def _dirty_paths(self) -> set[str]:
-        command = subprocess.run(
-            ["git", "status", "--porcelain=v1", "--untracked-files=all"],
-            cwd=self.path,
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if command.returncode != 0:
-            raise ContinuationExecutionError("SUBPROCESS_FAILED")
-        output = command.stdout
-        result: set[str] = set()
-        for line in output.splitlines():
-            path = line[3:]
-            if " -> " in path:
-                path = path.split(" -> ", 1)[1]
-            result.add(path)
-        return result
-
-    def materialize_files(self, files: Mapping[str, bytes]) -> None:
-        dirty = self._dirty_paths()
-        expected_paths = set(files)
-        if dirty and not dirty.issubset(expected_paths):
-            raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
-        for relative, content in files.items():
-            target = (self.path / relative).resolve()
-            try:
-                target.relative_to(self.path.resolve())
-            except ValueError as exc:
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED") from exc
-            if target.is_symlink():
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED")
-            target.parent.mkdir(parents=True, exist_ok=True)
-            target.write_bytes(content)
-
-    def commit_files(self, files: Mapping[str, bytes], message: str) -> str:
-        expected_paths = set(files)
-        if self._dirty_paths() != expected_paths:
-            raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
-        for relative, content in files.items():
-            target = (self.path / relative).resolve()
-            try:
-                target.relative_to(self.path.resolve())
-            except ValueError as exc:
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED") from exc
-            if not target.is_file() or target.is_symlink() or target.read_bytes() != content:
-                raise ContinuationExecutionError("AUTHORING_PAYLOAD_MISMATCH")
-        _run(["git", "add", "--", *sorted(expected_paths)], cwd=self.path)
-        staged = set(_run(["git", "diff", "--cached", "--name-only"], cwd=self.path).splitlines())
-        if staged != expected_paths:
-            raise ContinuationExecutionError("STAGED_SCOPE_MISMATCH")
-        environment = os.environ.copy()
-        environment.update(
-            {
-                "GIT_AUTHOR_NAME": "AIOS Governed Continuation",
-                "GIT_AUTHOR_EMAIL": "aios-governed-continuation@localhost",
-                "GIT_COMMITTER_NAME": "AIOS Governed Continuation",
-                "GIT_COMMITTER_EMAIL": "aios-governed-continuation@localhost",
-            }
-        )
-        _run(["git", "commit", "--no-gpg-sign", "-m", message, "--", *sorted(expected_paths)], cwd=self.path, environment=environment)
-        if not self.is_detached():
-            raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
-        return self.head_oid()
-
-
-@dataclass(slots=True)
-class ServerSideCredentialProjection:
-    ssh_key_path: Path
-    api_token_path: Path
-    active: bool = False
-
-    def project(self) -> None:
-        for path in (self.ssh_key_path, self.api_token_path):
-            if path.is_symlink() or not path.is_file() or path.stat().st_size < 32:
-                raise ContinuationExecutionError("CREDENTIAL_PROJECTION_MISSING")
-        self.active = True
-
-    def revoke(self) -> None:
-        self.active = False
-
-
-@dataclass(slots=True)
-class GiteaContinuationRemote:
-    workspace: Path
-    credential: ServerSideCredentialProjection
-    remote_name: str = "gitea"
-    repository: str = "aios/aios"
-    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
-    expected_host: str = "g.cnnetmkt.top"
-
-    @staticmethod
-    def validate_remote_url(value: str, expected_host: str = "g.cnnetmkt.top") -> None:
-        if value.startswith(("/", "file:")) or value.endswith("/data/aios-gitops/repo.git"):
-            raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-        if "://" in value:
-            parsed = urlsplit(value)
-            host, path = parsed.hostname, parsed.path
-        else:
-            location = value.split("@", 1)[-1]
-            host, separator, path = location.partition(":")
-            if not separator:
-                raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-            path = "/" + path
-        if host != expected_host or path.rstrip("/") not in {"/aios/aios.git", "/git/aios/aios.git"}:
-            raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-
-    def repository_identity(self) -> str:
-        url = _run(["git", "remote", "get-url", self.remote_name], cwd=self.workspace)
-        self.validate_remote_url(url, self.expected_host)
-        if self.repository != "aios/aios":
-            raise ContinuationExecutionError("REMOTE_REPOSITORY_IDENTITY_MISMATCH")
-        return self.repository
-
-    def _require_projected(self) -> None:
-        if not self.credential.active:
-            raise ContinuationExecutionError("CREDENTIAL_PROJECTION_MISSING")
-
-    def read_git_ref(self, branch: str) -> str | None:
-        self._require_projected()
-        output = _run(["git", "ls-remote", self.remote_name, f"refs/heads/{branch}"], cwd=self.workspace)
-        if not output:
-            return None
-        oid, ref = output.split(maxsplit=1)
-        if ref != f"refs/heads/{branch}" or not OID_RE.fullmatch(oid):
-            raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
-        return oid
-
-    def push_new_exact(self, branch: str, new: str) -> None:
-        self._require_projected()
-        self.repository_identity()
-        if self.read_git_ref(branch) is not None:
-            raise ContinuationExecutionError("GITEA_TARGET_BRANCH_ALREADY_EXISTS")
-        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
-        if self.read_git_ref(branch) != new:
-            raise ContinuationExecutionError("GITEA_CREATE_READBACK_MISMATCH")
-
-    def push_exact(self, branch: str, expected: str, new: str) -> None:
-        self._require_projected()
-        self.repository_identity()
-        if self.read_git_ref(branch) != expected:
-            raise ContinuationExecutionError("GITEA_BRANCH_EXPECTATION_MISMATCH")
-        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
-
-    def _api(self, path: str) -> object:
-        self._require_projected()
-        token = self.credential.api_token_path.read_text(encoding="utf-8").strip()
-        request = Request(
-            self.api_base.rstrip("/") + path,
-            headers={"Accept": "application/json", "Authorization": f"token {token}"},
-        )
-        try:
-            with urlopen(request, timeout=20) as response:
-                return json.loads(response.read().decode("utf-8"))
-        except HTTPError as exc:
-            if exc.code == 404:
-                return None
-            raise ContinuationExecutionError(f"GITEA_API_HTTP_{exc.code}") from exc
-        except (URLError, TimeoutError, OSError, json.JSONDecodeError) as exc:
-            raise ContinuationExecutionError("GITEA_API_UNAVAILABLE") from exc
-
-    def read_api_branch(self, branch: str) -> str | None:
-        owner, name = self.repository.split("/", 1)
-        page = 1
-        while page <= 100:
-            value = self._api(f"/repos/{quote(owner)}/{quote(name)}/branches?page={page}&limit=50")
-            if value is None:
-                return None
-            if not isinstance(value, list):
-                raise ContinuationExecutionError("GITEA_API_BRANCH_COLLECTION_INVALID")
-            for item in value:
-                if not isinstance(item, dict) or item.get("name") != branch:
-                    continue
-                oid = item.get("commit", {}).get("id")
-                if not isinstance(oid, str) or not OID_RE.fullmatch(oid):
-                    raise ContinuationExecutionError("GITEA_API_BRANCH_INVALID")
-                return oid
-            if len(value) < 50:
-                return None
-            page += 1
-        raise ContinuationExecutionError("GITEA_API_BRANCH_PAGINATION_LIMIT")
-
-    def commit_visible(self, oid: str) -> bool:
-        owner, name = self.repository.split("/", 1)
-        value = self._api(f"/repos/{quote(owner)}/{quote(name)}/git/commits/{oid}")
-        if not isinstance(value, dict):
-            return False
-        observed = value.get("sha") or value.get("id")
-        return observed == oid
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationPermissions:
-    create_target_branch: bool = False
-    force_push: bool = False
-    tag_write: bool = False
-    baseline_write: bool = False
-    production_write: bool = False
-    main_write: bool = False
-
-    def validate(self) -> None:
-        if any(asdict(self).values()):
-            raise ContinuationExecutionError("MUTATION_PERMISSION_DENIED")
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationRuntimeBinding:
-    request: WriterLeaseRequestV2
-    job_id: str
-    workspace_path: Path
-    lease_not_before: datetime
-    lease_expires_at: datetime
-    original_receipt_valid: bool
-    original_grant_consumed: bool
-    permissions: ContinuationPermissions
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationCommit:
-    idempotency_key: str
-    files: Mapping[str, bytes]
-    message: str
-
-    def payload(self) -> bytes:
-        if not self.idempotency_key or not self.message.strip() or not self.files:
-            raise ContinuationExecutionError("COMMIT_REQUEST_INVALID")
-        normalized: dict[str, str] = {}
-        for path, content in self.files.items():
-            pure = PurePosixPath(path)
-            if (
-                not isinstance(path, str)
-                or pure.is_absolute()
-                or ".." in pure.parts
-                or path.startswith((".git/", "baseline/", "production/"))
-                or not isinstance(content, bytes)
-            ):
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED")
-            if any(pattern.search(content) for pattern in SECRET_PATTERNS):
-                raise ContinuationExecutionError("SECRET_LIKE_PAYLOAD_REJECTED")
-            normalized[path] = base64.b64encode(content).decode("ascii")
-        return json.dumps(
-            {"files_base64": normalized, "message": self.message},
-            sort_keys=True,
-            separators=(",", ":"),
-        ).encode("utf-8")
-
-
-class ContinuationExecutor:
-    def __init__(
-        self,
-        controller: GitOpsJobController,
-        authority: AuthorityPort,
-        workspace: DetachedWorkspace,
-        remote: RemotePort,
-        credential: CredentialProjection,
-        *,
-        now: Callable[[], datetime] = lambda: datetime.now(timezone.utc),
-    ) -> None:
-        self.controller = controller
-        self.authority = authority
-        self.workspace = workspace
-        self.remote = remote
-        self.credential = credential
-        self.now = now
-        self._observed_generations: dict[str, int] = {}
-
-    def observe_generation(self, branch: str, generation: int) -> None:
-        self._observed_generations[branch] = max(generation, self._observed_generations.get(branch, 0))
-
-    def _max_generation(self, branch: str, *, exclude_job_id: str | None = None) -> int:
-        observed = self._observed_generations.get(branch, 0)
-        with self.controller.store._connect() as connection:
-            if exclude_job_id is None:
-                row = connection.execute(
-                    "SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
-                    (branch,),
-                ).fetchone()
-            else:
-                row = connection.execute(
-                    "SELECT MAX(generation) AS generation FROM branch_leases "
-                    "WHERE branch=? AND job_id!=?",
-                    (branch, exclude_job_id),
-                ).fetchone()
-        durable = int(row["generation"] or 0)
-        return max(observed, durable)
-
-    @staticmethod
-    def _request_mapping(request: WriterLeaseRequestV2) -> dict[str, object]:
-        return {
-            "schema": WriterLeaseRequestV2.schema,
-            "task_id": request.task_id,
-            "job_id": request.job_id,
-            "repository": request.repository,
-            "branch_mode": request.branch_mode,
-            "base_oid": request.base_oid,
-            "expected_branch_oid": request.expected_branch_oid,
-            "target_branch": request.target_branch,
-            "generation": request.generation,
-            "lease_seconds": request.lease_seconds,
-        }
-
-    def _validate_preflight(self, binding: ContinuationRuntimeBinding, *, job_id: str | None = None) -> None:
-        request = binding.request
-        request_mapping = self._request_mapping(request)
-        normalized = validate_writer_lease_request_v2(request_mapping, self.authority)
-        expected_normalized = {
-            **request_mapping,
-            "create_target_branch": request.branch_mode == "CREATE_NEW",
-            "worktree_mode": (
-                "detached_at_base_oid"
-                if request.branch_mode == "CREATE_NEW"
-                else "detached_at_expected_head"
-            ),
-            "cas_ref_update_required": True,
-        }
-        if normalized != expected_normalized:
-            raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
-        if not binding.original_receipt_valid or not binding.original_grant_consumed:
-            raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
-        binding.permissions.validate()
-        now = self.now()
-        if now < binding.lease_not_before:
-            raise ContinuationExecutionError("LEASE_NOT_ACTIVE")
-        if now >= binding.lease_expires_at:
-            raise ContinuationExecutionError("LEASE_EXPIRED")
-        if request.generation <= self._max_generation(request.target_branch, exclude_job_id=job_id):
-            raise ContinuationExecutionError("GENERATION_NOT_MONOTONIC")
-        if not self.workspace.is_detached():
-            raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
-        if self.workspace.head_oid() != request.expected_branch_oid:
-            raise ContinuationExecutionError("WORKTREE_HEAD_MISMATCH")
-        if self.remote.repository_identity() != request.repository:
-            raise ContinuationExecutionError("REMOTE_REPOSITORY_IDENTITY_MISMATCH")
-
-    def _job_request(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit, payload: bytes) -> dict[str, object]:
-        request = binding.request
-        return {
-            "idempotency_key": commit.idempotency_key,
-            "campaign_id": request.task_id,
-            "task_id": request.task_id,
-            "repository": request.repository,
-            "operation": "CONTINUATION_COMMIT_FILES",
-            "branch": request.target_branch,
-            "expected_branch_oid": request.expected_branch_oid,
-            "base_oid": request.base_oid,
-            "branch_mode": request.branch_mode,
-            "payload_digest": hashlib.sha256(payload).hexdigest(),
-            "lineage_anchor_oid": request.base_oid,
-            "generation": request.generation,
-        }
-
-    def execute(
-        self,
-        binding: ContinuationRuntimeBinding,
-        commit: ContinuationCommit,
-        *,
-        before_complete: Callable[[str], None] | None = None,
-    ) -> dict[str, object]:
-        commit.payload()
-        if not binding.job_id or binding.request.job_id != binding.job_id:
-            raise ContinuationExecutionError("RUNTIME_LINEAGE_MISSING_JOB_ID")
-        current = self.controller.store.read(binding.job_id)
-        current_state = JobState(current["state"])
-        if current_state == JobState.COMPLETED:
-            return self.controller.store._receipt(current, duplicate=True).as_dict()
-        if current_state == JobState.REMOTE_VERIFIED:
-            receipt = json.loads(str(current["receipt_json"] or "{}"))
-            commit_oid = str(receipt.get("authority_oid") or "")
-            if not OID_RE.fullmatch(commit_oid):
-                raise ContinuationExecutionError("GOVERNED_COMMIT_OID_INVALID")
-            if before_complete is not None:
-                before_complete(commit_oid)
-            return self.controller.advance(
-                binding.job_id,
-                JobState.COMPLETED,
-                side_effect_state="REMOTE_VERIFIED",
-                receipt=receipt,
-            ).as_dict()
-        self._validate_preflight(binding, job_id=binding.job_id)
-        request = binding.request
-        projected = False
-        try:
-            self.credential.project()
-            projected = True
-            row = self.controller.store.read(binding.job_id)
-            state = JobState(row["state"])
-            if state == JobState.REQUESTED:
-                self.controller.advance(
-                    binding.job_id,
-                    JobState.AUTHORIZED,
-                    side_effect_state="AUTHORIZED",
-                    receipt={"task_id": request.task_id, "original_grant_consumed": True},
-                    expected_revision=int(row["revision"]),
-                )
-                row = self.controller.store.read(binding.job_id)
-                state = JobState(row["state"])
-            if state == JobState.AUTHORIZED:
-                self.controller.lease_job(
-                    binding.job_id,
-                    lease_id=f"lease-{binding.job_id}",
-                    lineage_anchor_oid=request.base_oid,
-                    current_head_oid=request.expected_branch_oid,
-                    generation=request.generation,
-                    lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
-                    expected_revision=int(row["revision"]),
-                )
-                row = self.controller.store.read(binding.job_id)
-                state = JobState(row["state"])
-            if state == JobState.LEASED:
-                self.controller.advance(binding.job_id, JobState.WORKTREE_READY,
-                                        side_effect_state="WORKTREE_READY", expected_revision=int(row["revision"]))
-                row = self.controller.store.read(binding.job_id)
-                state = JobState(row["state"])
-            if state == JobState.WORKTREE_READY:
-                self.controller.advance(binding.job_id, JobState.EXECUTING,
-                                        side_effect_state="IN_PROGRESS", expected_revision=int(row["revision"]))
-            elif state != JobState.EXECUTING:
-                raise ContinuationExecutionError("JOB_EXECUTION_STATE_INVALID")
-            new_oid = self.workspace.commit_files(commit.files, commit.message)
-            if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
-                raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
-            if request.branch_mode == "CREATE_NEW":
-                authority_oid = self.authority.create_task_branch_cas(request.target_branch, request.base_oid, new_oid)
-            else:
-                authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
-            if authority_oid != new_oid:
-                raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
-            self.controller.advance(
-                binding.job_id,
-                JobState.LOCAL_VERIFIED,
-                side_effect_state="LOCAL_VERIFIED",
-                receipt={"authority_oid": authority_oid, "force_push": False},
-            )
-            try:
-                self.controller.advance(binding.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
-                if request.branch_mode == "CREATE_NEW":
-                    self.remote.push_new_exact(request.target_branch, new_oid)
-                else:
-                    self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
-            except Exception:
-                return self._remote_pending(binding.job_id, authority_oid, new_oid)
-            return self._finish_remote_verification(
-                binding.job_id,
-                authority_oid,
-                new_oid,
-                before_complete=before_complete,
-            )
-        finally:
-            if projected:
-                self.credential.revoke()
-
-    def _observe_remote(self, branch: str, oid: str) -> tuple[str | None, str | None, bool]:
-        return self.remote.read_git_ref(branch), self.remote.read_api_branch(branch), self.remote.commit_visible(oid)
-
-    def _remote_pending(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
-        receipt = {
-            "authority_oid": authority_oid,
-            "desired_remote_oid": new_oid,
-            "remote_verified": False,
-            "force_push": False,
-        }
-        result = self.controller.advance(
-            job_id,
-            JobState.RECONCILIATION_REQUIRED,
-            side_effect_state="REMOTE_PUSH_PENDING",
-            receipt=receipt,
-        )
-        return result.as_dict()
-
-    def _finish_remote_verification(
-        self,
-        job_id: str,
-        authority_oid: str,
-        new_oid: str,
-        *,
-        before_complete: Callable[[str], None] | None = None,
-    ) -> dict[str, object]:
-        row = self.controller.store.read(job_id)
-        branch = row["branch"]
-        request = json.loads(row["request_json"])["binding"]
-        git_oid, api_oid, visible = self._observe_remote(branch, new_oid)
-        decision = decide_reconciliation(RemoteObservation("aios/aios", branch, new_oid, authority_oid, git_oid, api_oid, visible, datetime.now(timezone.utc).isoformat(), request.get("expected_branch_oid")))
-        if decision.action is not ReconciliationAction.MARK_REMOTE_VERIFIED:
-            return self._remote_pending(job_id, authority_oid, new_oid)
-        receipt = {
-            "authority_oid": authority_oid,
-            "git_remote_oid": git_oid,
-            "api_branch_oid": api_oid,
-            "commit_visible": True,
-            "remote_verified": True,
-            "reconciliation_decision": decision.action.value,
-            "force_push": False,
-        }
-        self.controller.advance(
-            job_id,
-            JobState.REMOTE_VERIFIED,
-            side_effect_state="REMOTE_VERIFIED",
-            receipt=receipt,
-        )
-        if before_complete is not None:
-            before_complete(new_oid)
-        return self.controller.advance(
-            job_id,
-            JobState.COMPLETED,
-            side_effect_state="REMOTE_VERIFIED",
-            receipt=receipt,
-        ).as_dict()
-
-    def reconcile(self, job_id: str) -> dict[str, object]:
-        row = self.controller.store.read(job_id)
-        state = JobState(row["state"])
-        if state == JobState.COMPLETED:
-            return self.controller.store._receipt(row, duplicate=True).as_dict()
-        if state != JobState.RECONCILIATION_REQUIRED:
-            raise ContinuationExecutionError("JOB_NOT_RECONCILABLE")
-        request = json.loads(row["request_json"])["binding"]
-        receipt = json.loads(row["receipt_json"])
-        new_oid = receipt["desired_remote_oid"]
-        authority_oid = self.authority.branch_head(row["branch"])
-        try:
-            generation = int(request.get("generation") or 0)
-        except (TypeError, ValueError) as exc:
-            raise ContinuationExecutionError("DURABLE_BINDING_GENERATION_INVALID") from exc
-        if generation > 0:
-            with self.controller.store._connect() as connection:
-                earlier = connection.execute(
-                    "SELECT 1 FROM jobs WHERE branch=? AND state=? "
-                    "AND CAST(json_extract(request_json, '$.binding.generation') AS INTEGER) < ? LIMIT 1",
-                    (row["branch"], JobState.RECONCILIATION_REQUIRED.value, generation),
-                ).fetchone()
-            if earlier is not None:
-                raise ContinuationExecutionError("EARLIER_RECONCILIATION_REQUIRED")
-        self.credential.project()
-        try:
-            git_oid, api_oid, visible = self._observe_remote(row["branch"], new_oid)
-            if authority_oid == git_oid == api_oid == new_oid and visible:
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST")
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            expected_oid = request["expected_branch_oid"]
-            if (
-                self.authority.is_ancestor(new_oid, authority_oid)
-                and git_oid is not None
-                and git_oid == api_oid
-                and self.authority.is_ancestor(git_oid, new_oid)
-            ):
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_CHAIN")
-                self.remote.push_exact(row["branch"], git_oid, new_oid)
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            if authority_oid == new_oid and git_oid == api_oid == expected_oid:
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_RETRY")
-                self.remote.push_exact(row["branch"], expected_oid, new_oid)
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            return self.controller.store._receipt(row, duplicate=True).as_dict()
-        finally:
-            self.credential.revoke()
@@ -1,157 +0,0 @@
-"""Campaign-aware continuation leases for an existing Git branch.
-
-This module is deliberately transport-neutral. It validates branch lineage
-and hands ref mutation to an injected compare-and-swap broker; it does not run
-Git, inspect credentials, or create a branch itself.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, replace
-from datetime import datetime, timedelta, timezone
-import re
-from typing import Protocol
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TARGET_BRANCH = "agent/autonomous-release-campaign-v1-20260807"
-LINEAGE_ANCHOR = "69b45e81dcd2c3707c367003b08c55fd361faae8"
-CAMPAIGN_HEAD = "bba675fab3b7e0c5fba7066720252b3c91b9f20d"
-
-
-class ContinuationError(RuntimeError):
-    """Stable fail-closed error for lease or branch binding violations."""
-
-
-class BranchProbe(Protocol):
-    def branch_exists(self, branch: str) -> bool: ...
-    def branch_head(self, branch: str) -> str: ...
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-
-
-class RefCAS(Protocol):
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
-
-
-def _oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise ContinuationError(f"{field}_invalid")
-    return value
-
-
-@dataclass(frozen=True, slots=True)
-class WriterLeaseRequestV2:
-    task_id: str
-    repository: str
-    branch_mode: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    generation: int
-    lease_seconds: int = 900
-    job_id: str = ""
-
-    schema = "aios.task-writer-lease.v2"
-    accepted_schemas = frozenset({"aios.task-writer-lease.v2", "aios.task-writer-lease-request.v2"})
-
-    def validate(self, probe: BranchProbe) -> None:
-        if not self.task_id or self.repository != "aios/aios":
-            raise ContinuationError("request_identity_invalid")
-        if not self.job_id or not self.job_id.startswith("job-"):
-            raise ContinuationError("job_id_invalid")
-        if self.branch_mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
-            raise ContinuationError("branch_mode_invalid")
-        _oid(self.base_oid, "base_oid")
-        _oid(self.expected_branch_oid, "expected_branch_oid")
-        if self.target_branch in {"main", "master"} or self.target_branch.startswith(("refs/", "tags/")):
-            raise ContinuationError("protected_branch_rejected")
-        if not isinstance(self.generation, int) or isinstance(self.generation, bool) or self.generation < 1:
-            raise ContinuationError("generation_invalid")
-        if not isinstance(self.lease_seconds, int) or not 1 <= self.lease_seconds <= 86_400:
-            raise ContinuationError("lease_duration_invalid")
-        if self.branch_mode == "CONTINUE_EXISTING":
-            if not probe.branch_exists(self.target_branch):
-                raise ContinuationError("EXISTING_BRANCH_MISSING")
-            actual = _oid(probe.branch_head(self.target_branch), "actual_branch_oid")
-            if actual != self.expected_branch_oid:
-                raise ContinuationError("EXISTING_BRANCH_OID_CONFLICT")
-            if not probe.is_ancestor(self.base_oid, actual):
-                raise ContinuationError("BASE_NOT_ANCESTOR_OF_BRANCH")
-        elif hasattr(probe, "commit_exists") and not probe.commit_exists(self.base_oid):
-            raise ContinuationError("BASE_COMMIT_NOT_FOUND")
-        elif self.branch_mode == "CREATE_NEW" and probe.branch_exists(self.target_branch):
-            raise ContinuationError("TARGET_BRANCH_ALREADY_EXISTS")
-        elif self.branch_mode == "CREATE_NEW" and self.base_oid != self.expected_branch_oid:
-            raise ContinuationError("CREATE_NEW_BASE_EXPECTATION_MISMATCH")
-
-
-@dataclass(frozen=True, slots=True)
-class CampaignWriterLease:
-    task_id: str
-    repository: str
-    branch: str
-    lineage_anchor_oid: str
-    current_head_oid: str
-    generation: int
-    lease_expires_at: datetime
-    append_only: bool = True
-    renewable: bool = True
-    multi_commit: bool = True
-    recoverable: bool = True
-    state: str = "ACTIVE"
-    branch_bound: bool = True
-
-    def __post_init__(self) -> None:
-        _oid(self.lineage_anchor_oid, "lineage_anchor_oid")
-        _oid(self.current_head_oid, "current_head_oid")
-        if not all((self.append_only, self.renewable, self.multi_commit, self.recoverable, self.branch_bound)):
-            raise ContinuationError("lease_capability_downgrade")
-
-
-class ContinuationLeaseManager:
-    """State machine for a multi-commit lease with CAS-only ref updates."""
-
-    def __init__(self, probe: BranchProbe, refs: RefCAS, *, now=datetime.now) -> None:
-        self.probe = probe
-        self.refs = refs
-        self.now = now
-
-    def open(self, request: WriterLeaseRequestV2) -> CampaignWriterLease:
-        request.validate(self.probe)
-        if request.branch_mode != "CONTINUE_EXISTING":
-            raise ContinuationError("CREATE_NEW_REQUIRES_SEPARATE_PROVISIONER")
-        return CampaignWriterLease(
-            task_id=request.task_id,
-            repository=request.repository,
-            branch=request.target_branch,
-            lineage_anchor_oid=request.base_oid,
-            current_head_oid=request.expected_branch_oid,
-            generation=request.generation,
-            lease_expires_at=self.now(timezone.utc) + timedelta(seconds=request.lease_seconds),
-        )
-
-    def renew(self, lease: CampaignWriterLease, seconds: int) -> CampaignWriterLease:
-        if lease.state != "ACTIVE" or not lease.renewable or seconds < 1:
-            raise ContinuationError("lease_not_renewable")
-        return replace(lease, lease_expires_at=self.now(timezone.utc) + timedelta(seconds=seconds))
-
-    def append_commit(self, lease: CampaignWriterLease, new_head_oid: str) -> CampaignWriterLease:
-        if lease.state != "ACTIVE":
-            raise ContinuationError("lease_not_active")
-        _oid(new_head_oid, "new_head_oid")
-        if not self.probe.is_ancestor(lease.current_head_oid, new_head_oid):
-            raise ContinuationError("NON_FAST_FORWARD_COMMIT")
-        try:
-            actual = self.refs.compare_and_swap_branch(
-                lease.branch, lease.current_head_oid, new_head_oid
-            )
-        except Exception as exc:
-            raise ContinuationError("BRANCH_LEASE_STALE") from exc
-        if actual != new_head_oid:
-            raise ContinuationError("BRANCH_LEASE_STALE")
-        return replace(lease, current_head_oid=new_head_oid)
-
-    def supersede(self, lease: CampaignWriterLease) -> CampaignWriterLease:
-        if lease.state not in {"ACTIVE", "RECOVERABLE_FAILURE", "RECONCILIATION_REQUIRED"}:
-            raise ContinuationError("lease_not_supersedable")
-        return replace(lease, generation=lease.generation + 1, state="SUPERSEDED")
@@ -1,25 +0,0 @@
-"""Separate read, write, and release plane readiness evaluation."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Mapping
-
-
-@dataclass(frozen=True, slots=True)
-class RuntimeStatus:
-    read_plane: Mapping[str, bool]
-    write_plane: Mapping[str, bool]
-    release_plane: Mapping[str, bool]
-
-    @property
-    def release_control_plane_ready(self) -> bool:
-        return all(self.read_plane.values()) and all(self.write_plane.values()) and all(self.release_plane.values())
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "READ_PLANE": dict(self.read_plane),
-            "WRITE_PLANE": dict(self.write_plane),
-            "RELEASE_PLANE": dict(self.release_plane),
-            "release_control_plane_ready": self.release_control_plane_ready,
-        }
@@ -1,58 +0,0 @@
-"""Workspace-independent authority/network/Gitea ref sentinel."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from pathlib import Path
-import subprocess
-from typing import Callable, Mapping
-
-
-class SentinelError(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class SentinelInputs:
-    authority_git_dir: Path
-    gitea_remote: str
-    gitea_api: str
-    ref: str
-    expected_oid: str
-
-
-@dataclass(frozen=True, slots=True)
-class SentinelResult:
-    authority_oid: str | None
-    network_oid: str | None
-    gitea_oid: str | None
-    equal: bool
-    error: str | None = None
-
-
-def authority_oid(inputs: SentinelInputs) -> str:
-    result = subprocess.run(
-        ["git", "--git-dir", str(inputs.authority_git_dir), "rev-parse", inputs.ref],
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise SentinelError("AUTHORITY_REF_UNAVAILABLE")
-    return result.stdout.strip()
-
-
-def evaluate(
-    inputs: SentinelInputs,
-    *,
-    network_reader: Callable[[str, str], str | None],
-    gitea_reader: Callable[[str, str], str | None],
-) -> SentinelResult:
-    try:
-        local = authority_oid(inputs)
-        network = network_reader(inputs.gitea_remote, inputs.ref)
-        gitea = gitea_reader(inputs.gitea_api, inputs.ref)
-        equal = local == network == gitea == inputs.expected_oid
-        return SentinelResult(local, network, gitea, equal, None if equal else "OID_MISMATCH")
-    except SentinelError as exc:
-        return SentinelResult(None, None, None, False, str(exc))
@@ -1,26 +0,0 @@
-"""Non-sensitive control-plane snapshot assembly."""
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-
-def _copy(value: Mapping[str, Any] | None, keys: tuple[str, ...]) -> dict[str, Any]:
-    value = value or {}
-    return {key: value.get(key) for key in keys}
-
-
-def build_control_plane_snapshot(*, target_version: str, runtime: Mapping[str, Any] | None = None, repository: Mapping[str, Any] | None = None, production: Mapping[str, Any] | None = None, task: Mapping[str, Any] | None = None, capabilities: Mapping[str, Any] | None = None, credential_broker: Mapping[str, Any] | None = None) -> dict[str, Any]:
-    return {
-        "version": {"target_release": target_version},
-        "runtime": _copy(runtime, ("bridge_schema_version", "control_plane_release_version", "runtime_release_commit", "runtime_path", "artifact_sha256", "drift_status")),
-        "repository": _copy(repository, ("identity", "authority_git_dir", "authority_main_oid")),
-        "production": _copy(production, ("baseline_version", "target_oid", "deployment_state")),
-        "task": _copy(task, ("task_id", "branch", "authority_branch_oid", "gitea_git_oid", "gitea_api_oid", "commit_visible", "generation", "reconciliation_state")),
-        "capabilities": _copy(capabilities, ("legacy_writes_enabled", "governed_writes_enabled", "force_push", "main_write", "tag_write", "baseline_write", "production_write")),
-        "credential_broker": _copy(credential_broker, ("status", "provider")),
-        "secret_material_exposed": False,
-    }
-
-
-def getControlPlaneSnapshot(**kwargs: Any) -> dict[str, Any]:
-    return build_control_plane_snapshot(**kwargs)
@@ -1,124 +0,0 @@
-"""Metadata-only, server-side credential lease broker."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-import os
-from pathlib import Path
-import secrets
-import re
-from typing import Any, Callable, Mapping
-
-
-@dataclass(frozen=True, slots=True)
-class CredentialLease:
-    lease_id: str
-    task_id: str
-    repository: str
-    target_branch: str
-    generation: int
-    issued_at: str
-    expires_at: str
-    scopes: tuple[str, ...]
-    provider: str
-    state: str = "ACTIVE"
-    scope_type: str = "system"
-    tenant_id: str | None = None
-    user_id: str | None = None
-    project_id: str | None = None
-    run_id: str | None = None
-
-    def as_dict(self) -> dict[str, Any]:
-        return {"lease_id": self.lease_id, "task_id": self.task_id, "repository": self.repository, "target_branch": self.target_branch, "generation": self.generation, "issued_at": self.issued_at, "expires_at": self.expires_at, "scopes": list(self.scopes), "provider": self.provider, "state": self.state, "scope_type": self.scope_type, "tenant_id": self.tenant_id, "user_id": self.user_id, "project_id": self.project_id, "run_id": self.run_id}
-
-
-class FileCredentialProvider:
-    def __init__(self, token_path: str | os.PathLike[str], *, actor: str = "aios-autonomy-agent") -> None:
-        self.token_path = Path(token_path)
-        self.actor = actor
-
-    def environment(self, lease: CredentialLease) -> dict[str, str]:
-        if not self.token_path.is_file():
-            raise RuntimeError("CREDENTIAL_PROVIDER_UNAVAILABLE")
-        return {"CREDENTIAL_FILE": str(self.token_path), "GITEA_MACHINE_ACTOR": self.actor}
-
-
-class CredentialBroker:
-    def __init__(self, provider: Any, *, now: Callable[[], datetime] | None = None) -> None:
-        self.provider = provider
-        self.now = now or (lambda: datetime.now(timezone.utc))
-        self._leases: dict[str, CredentialLease] = {}
-
-    def issue(self, *, task_id: str, repository: str, target_branch: str, generation: int, scopes: tuple[str, ...] = ("git:push", "gitea:read"), lease_seconds: int = 900, scope_type: str = "system", tenant_id: str | None = None, user_id: str | None = None, project_id: str | None = None, run_id: str | None = None) -> dict[str, Any]:
-        if repository != "aios/aios" or not target_branch.startswith("agent/") or generation < 1 or not 1 <= lease_seconds <= 86400:
-            raise ValueError("CREDENTIAL_LEASE_BINDING_INVALID")
-        if scope_type == "tenant":
-            if not tenant_id:
-                raise ValueError("CREDENTIAL_SCOPE_DENY")
-        elif scope_type in {"system", "global"}:
-            if any((tenant_id, user_id, project_id, run_id)):
-                raise ValueError("CREDENTIAL_SCOPE_DENY")
-        else:
-            raise ValueError("CREDENTIAL_SCOPE_DENY")
-        now = self.now().astimezone(timezone.utc)
-        lease = CredentialLease("lease-" + secrets.token_hex(16), task_id, repository, target_branch, generation, now.isoformat(), (now + timedelta(seconds=lease_seconds)).isoformat(), tuple(scopes), type(self.provider).__name__, "ACTIVE", scope_type, tenant_id, user_id, project_id, run_id)
-        self._leases[lease.lease_id] = lease
-        return lease.as_dict()
-
-    def _get(self, lease_id: str) -> CredentialLease:
-        lease = self._leases.get(lease_id)
-        if lease is None:
-            raise KeyError("CREDENTIAL_LEASE_NOT_FOUND")
-        if lease.state == "ACTIVE" and self.now().astimezone(timezone.utc) >= datetime.fromisoformat(lease.expires_at):
-            lease = CredentialLease(**{**lease.as_dict(), "scopes": tuple(lease.scopes), "state": "EXPIRED"})
-            self._leases[lease_id] = lease
-        return lease
-
-    def environment(self, lease_id: str) -> Mapping[str, str]:
-        lease = self._get(lease_id)
-        if lease.state != "ACTIVE":
-            raise RuntimeError("CREDENTIAL_LEASE_NOT_ACTIVE")
-        environment = self.provider.environment(lease)
-        for key, value in environment.items():
-            upper = str(key).upper()
-            if not isinstance(value, str):
-                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-            sensitive = any(marker in upper for marker in ("CREDENTIAL", "TOKEN", "SECRET", "PASSWORD", "PRIVATE_KEY", "API_KEY"))
-            if re.search(r"(?i)bearer\s+\S+|(?:token|secret|password|api[_-]?key)\s*[:=]", value):
-                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-            if sensitive and upper.endswith("_FILE"):
-                candidate = Path(value)
-                credential_root = Path("/run/credentials")
-                try:
-                    resolved = candidate.resolve(strict=False)
-                except OSError as exc:
-                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY") from exc
-                if not candidate.is_absolute() or not (resolved == credential_root or credential_root in resolved.parents):
-                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-            elif sensitive and upper.endswith("_REFERENCE"):
-                if re.fullmatch(r"(?:systemd-credential|vault|secret-manager):[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}", value) is None:
-                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-            elif sensitive:
-                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-        return environment
-
-    def authorize(self, lease_id: str, *, task_id: str, operation: str, scope_type: str = "system", tenant_id: str | None = None, user_id: str | None = None, project_id: str | None = None, run_id: str | None = None) -> Mapping[str, str]:
-        lease = self._get(lease_id)
-        if lease.state != "ACTIVE" or lease.task_id != task_id or operation not in lease.scopes:
-            raise RuntimeError("CREDENTIAL_SCOPE_DENY")
-        requested = (scope_type, tenant_id, user_id, project_id, run_id)
-        actual = (lease.scope_type, lease.tenant_id, lease.user_id, lease.project_id, lease.run_id)
-        if requested != actual:
-            raise RuntimeError("CREDENTIAL_SCOPE_DENY")
-        return self.environment(lease_id)
-
-    def status(self, lease_id: str) -> dict[str, Any]:
-        return self._get(lease_id).as_dict()
-
-    def revoke(self, lease_id: str) -> dict[str, Any]:
-        lease = self._get(lease_id)
-        if lease.state == "REVOKED":
-            return lease.as_dict()
-        updated = CredentialLease(**{**lease.as_dict(), "scopes": tuple(lease.scopes), "state": "REVOKED"})
-        self._leases[lease_id] = updated
-        return updated.as_dict()
@@ -1,125 +0,0 @@
-"""Non-Owner Gitea machine capability and branch reconciliation boundary."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Mapping, Protocol
-
-
-class MachineBrokerError(RuntimeError):
-    pass
-
-
-class GiteaTransport(Protocol):
-    def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str: ...
-    def create_or_update_pr(self, branch: str, target: str, title: str, body: str) -> Mapping[str, Any]: ...
-    def publish_status(self, branch: str, state: str, description: str) -> Mapping[str, Any]: ...
-    def protected_merge(self, pr_number: int) -> Mapping[str, Any]: ...
-    def read_branch(self, branch: str) -> str | None: ...
-    def whoami(self) -> Mapping[str, Any]: ...
-    def repository(self, owner: str, name: str) -> Mapping[str, Any]: ...
-
-
-@dataclass(frozen=True, slots=True)
-class MachineCredentialProjection:
-    """Opaque systemd credential reference; the credential value is never accepted."""
-
-    reference: str
-    account: str
-    owner_account: str = "aiman"
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "MachineCredentialProjection":
-        if set(value) != {"scheme", "name", "account"}:
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        if value["scheme"] != "systemd-credential" or value["name"] != "gitea-machine-token":
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        return cls(f"{value['scheme']}:{value['name']}", str(value["account"]))
-
-    def __post_init__(self) -> None:
-        if self.reference != "systemd-credential:gitea-machine-token":
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        if not self.account or self.account == self.owner_account:
-            raise MachineBrokerError("OWNER_MACHINE_IDENTITY_REJECTED")
-
-
-@dataclass(frozen=True, slots=True)
-class CampaignCapabilityReceipt:
-    campaign_id: str
-    task_id: str
-    repository: str
-    branch: str
-    expected_oid: str
-    capabilities: frozenset[str]
-    denied: frozenset[str]
-
-    def require(self, capability: str) -> None:
-        if capability in self.denied or capability not in self.capabilities:
-            raise MachineBrokerError("CAPABILITY_DENIED")
-        if self.branch in {"main", "master"}:
-            raise MachineBrokerError("PROTECTED_BRANCH_DENIED")
-
-
-class GiteaMachineBroker:
-    def __init__(self, transport: GiteaTransport, credential: MachineCredentialProjection, receipt: CampaignCapabilityReceipt) -> None:
-        self.transport = transport
-        self.credential = credential
-        self.receipt = receipt
-
-    def verify_identity(self) -> Mapping[str, Any]:
-        identity = dict(self.transport.whoami())
-        login = identity.get("login") or identity.get("username")
-        if not isinstance(login, str) or not login or login == self.credential.owner_account or login != self.credential.account:
-            raise MachineBrokerError("GITEA_MACHINE_IDENTITY_INVALID")
-        owner, name = self.receipt.repository.split("/", 1)
-        repo = dict(self.transport.repository(owner, name))
-        if repo.get("full_name") != self.receipt.repository:
-            raise MachineBrokerError("GITEA_REPOSITORY_MISMATCH")
-        return {"login": login, "repository": self.receipt.repository, "owner_account": self.credential.owner_account}
-
-    def push_branch(self, new_oid: str) -> str:
-        self.receipt.require("exact_task_branch_push")
-        return self.transport.compare_and_swap_branch(self.receipt.branch, self.receipt.expected_oid, new_oid)
-
-    def create_pr(self, title: str, body: str) -> Mapping[str, Any]:
-        self.receipt.require("pr_create_update")
-        return self.transport.create_or_update_pr(self.receipt.branch, "main", title, body)
-
-    def status(self, state: str, description: str, context: str = "aios/durable-release") -> Mapping[str, Any]:
-        self.receipt.require("status_publish")
-        return self.transport.publish_status(self.receipt.branch, state, description, context)
-
-    def merge(self, pr_number: int) -> Mapping[str, Any]:
-        self.receipt.require("protected_merge")
-        return self.transport.protected_merge(pr_number)
-
-    def readback(self) -> str | None:
-        self.receipt.require("remote_readback")
-        return self.transport.read_branch(self.receipt.branch)
-
-
-def reconcile_exact_branch(authority_oid: str, gitea_oid: str | None, expected_oid: str) -> str:
-    if authority_oid != expected_oid:
-        return "AUTHORITY_EXPECTATION_MISMATCH"
-    if gitea_oid is None:
-        return "CREATE_REQUIRED"
-    if gitea_oid == expected_oid:
-        return "ALREADY_IN_SYNC"
-    return "MANUAL_OWNER_REVIEW_REQUIRED"
-
-
-def reconcile_fast_forward(
-    remote_oid: str | None,
-    expected_old_oid: str,
-    new_oid: str,
-    *,
-    old_is_ancestor_of_new: bool,
-) -> str:
-    """Return a bounded action for an active Job/lease branch scope."""
-    if remote_oid is None:
-        return "CREATE_REQUIRED"
-    if remote_oid == new_oid:
-        return "ALREADY_IN_SYNC"
-    if remote_oid == expected_old_oid and old_is_ancestor_of_new:
-        return "FAST_FORWARD_REQUIRED"
-    return "MANUAL_OWNER_REVIEW_REQUIRED"
@@ -1,208 +0,0 @@
-"""Gitea HTTP/Git transport using only a projected systemd credential."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-import json
-import os
-from pathlib import Path
-import subprocess
-import tempfile
-from typing import Any, Mapping
-from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlencode
-from urllib.request import Request, urlopen
-
-
-class GiteaTransportError(RuntimeError):
-    pass
-
-
-def _safe_oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
-        raise GiteaTransportError(f"{field}_INVALID")
-    return value
-
-
-@dataclass(slots=True)
-class GiteaMachineTransport:
-    api_base: str
-    repository_id: str
-    remote_url: str
-    authority_git_dir: Path
-    credential_name: str = "gitea-machine-token"
-    actor: str = "aios-autonomy-agent"
-    timeout: int = 20
-    expected_merge_head: str | None = None
-    expected_merge_base: str | None = None
-
-    def __post_init__(self) -> None:
-        if self.credential_name != "gitea-machine-token":
-            raise GiteaTransportError("CREDENTIAL_NAME_INVALID")
-        if "/" not in self.repository_id or self.repository_id.startswith("/"):
-            raise GiteaTransportError("REPOSITORY_INVALID")
-        if not self.api_base.startswith("https://") and not self.api_base.startswith("http://127.0.0.1"):
-            raise GiteaTransportError("GITEA_API_SCOPE_INVALID")
-        if not self.remote_url.startswith("https://"):
-            raise GiteaTransportError("GITEA_REMOTE_SCOPE_INVALID")
-
-    @property
-    def _credential_path(self) -> Path:
-        directory = os.environ.get("CREDENTIALS_DIRECTORY", "")
-        if not directory:
-            raise GiteaTransportError("CREDENTIAL_PROJECTION_MISSING")
-        path = Path(directory) / self.credential_name
-        if path.is_symlink() or not path.is_file():
-            raise GiteaTransportError("CREDENTIAL_PROJECTION_MISSING")
-        return path
-
-    def _token(self) -> str:
-        value = self._credential_path.read_text(encoding="utf-8").strip()
-        if not value:
-            raise GiteaTransportError("CREDENTIAL_EMPTY")
-        return value
-
-    def _request(self, method: str, path: str, body: Mapping[str, Any] | None = None) -> tuple[int, Any]:
-        data = None if body is None else json.dumps(dict(body), separators=(",", ":")).encode()
-        headers = {"Accept": "application/json", "Authorization": f"token {self._token()}"}
-        if data is not None:
-            headers["Content-Type"] = "application/json"
-        request = Request(self.api_base.rstrip("/") + path, data=data, headers=headers, method=method)
-        try:
-            with urlopen(request, timeout=self.timeout) as response:
-                raw = response.read()
-                return response.status, json.loads(raw.decode()) if raw else {}
-        except HTTPError as exc:
-            # Never include response bodies: Gitea may echo sensitive request context.
-            raise GiteaTransportError(f"GITEA_HTTP_{exc.code}") from exc
-        except (URLError, TimeoutError, OSError) as exc:
-            raise GiteaTransportError("GITEA_NETWORK_ERROR") from exc
-
-    def whoami(self) -> Mapping[str, Any]:
-        return self._request("GET", "/user")[1]
-
-    def repository_info(self) -> Mapping[str, Any]:
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("GET", f"/repos/{quote(owner)}/{quote(name)}")[1]
-
-    def repository(self, owner: str, name: str) -> Mapping[str, Any]:
-        if f"{owner}/{name}" != self.repository_id:
-            raise GiteaTransportError("REPOSITORY_SCOPE_DENIED")
-        return self.repository_info()
-
-    def read_branch(self, branch: str) -> str | None:
-        owner, name = self.repository_id.split("/", 1)
-        try:
-            value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/branches/{quote(branch, safe='/')}")[1]
-        except GiteaTransportError as exc:
-            if str(exc) == "GITEA_HTTP_404":
-                return None
-            raise
-        sha = value.get("commit", {}).get("id") if isinstance(value, dict) else None
-        return _safe_oid(sha, "remote_branch_oid")
-
-    def _askpass(self) -> tuple[Path, dict[str, str]]:
-        credential = self._credential_path
-        fd, name = tempfile.mkstemp(prefix="aios-gitea-askpass-", dir="/tmp")
-        path = Path(name)
-        os.fchmod(fd, 0o700)
-        script = "#!/bin/sh\ncase \"$1\" in *Username*) printf '%s\\n' \"$GITEA_MACHINE_ACTOR\" ;; *) cat \"$CREDENTIAL_FILE\" ;; esac\n"
-        with os.fdopen(fd, "w", encoding="utf-8") as stream:
-            stream.write(script)
-            stream.flush()
-            os.fsync(stream.fileno())
-        return path, {
-            "GIT_ASKPASS": str(path),
-            "GIT_TERMINAL_PROMPT": "0",
-            "GITEA_MACHINE_ACTOR": self.actor,
-            "CREDENTIAL_FILE": str(credential),
-        }
-
-    def _push_branch_fast_forward(self, branch: str, new_oid: str) -> None:
-        askpass, additions = self._askpass()
-        environment = os.environ.copy()
-        environment.update(additions)
-        try:
-            result = subprocess.run(
-                ["git", f"--git-dir={self.authority_git_dir}", "push", self.remote_url, f"{new_oid}:refs/heads/{branch}"],
-                text=True,
-                capture_output=True,
-                check=False,
-                env=environment,
-                timeout=self.timeout,
-            )
-            if result.returncode != 0:
-                raise GiteaTransportError("GITEA_BRANCH_CREATE_FAILED")
-        finally:
-            askpass.unlink(missing_ok=True)
-
-    def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str:
-        _safe_oid(expected_oid, "expected_oid")
-        _safe_oid(new_oid, "new_oid")
-        current = self.read_branch(branch)
-        if current == new_oid:
-            return new_oid
-        if current is None:
-            self._push_branch_fast_forward(branch, new_oid)
-            readback = self.read_branch(branch)
-            if readback != new_oid:
-                raise GiteaTransportError("GITEA_BRANCH_CREATE_READBACK_MISMATCH")
-            return readback
-        if current != expected_oid:
-            raise GiteaTransportError("GITEA_BRANCH_EXPECTATION_MISMATCH")
-        # The preflight read binds the expected old tip. The Git receive-pack
-        # then enforces the actual fast-forward CAS while transferring the new
-        # objects; no force/lease override or arbitrary ref is permitted.
-        self._push_branch_fast_forward(branch, new_oid)
-        readback = self.read_branch(branch)
-        if readback != new_oid:
-            raise GiteaTransportError("GITEA_BRANCH_CAS_READBACK_MISMATCH")
-        return readback
-
-    def _pulls(self) -> list[Mapping[str, Any]]:
-        owner, name = self.repository_id.split("/", 1)
-        query = urlencode({"state": "all", "base_branch": "main", "limit": 100})
-        value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/pulls?{query}")[1]
-        return value if isinstance(value, list) else []
-
-    def create_or_update_pr(self, branch: str, target: str, title: str, body: str) -> Mapping[str, Any]:
-        if target != "main":
-            raise GiteaTransportError("PR_BASE_SCOPE_DENIED")
-        head = self.read_branch(branch)
-        if head is None:
-            raise GiteaTransportError("PR_HEAD_MISSING")
-        matches = [p for p in self._pulls() if (p.get("head") or {}).get("ref") == branch and (p.get("base") or {}).get("ref") == target]
-        open_matches = [p for p in matches if p.get("state") == "open"]
-        if len(open_matches) > 1:
-            raise GiteaTransportError("MULTIPLE_MATCHING_PRS")
-        if open_matches:
-            if (open_matches[0].get("head") or {}).get("sha") != head:
-                raise GiteaTransportError("PR_HEAD_CONFLICT")
-            return open_matches[0]
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/pulls", {"head": branch, "base": target, "title": title, "body": body, "allow_maintainer_edit": False})[1]
-
-    def publish_status(self, branch: str, state: str, description: str, context: str = "aios/durable-release") -> Mapping[str, Any]:
-        oid = self.read_branch(branch)
-        if oid is None:
-            raise GiteaTransportError("STATUS_BRANCH_MISSING")
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/statuses/{oid}", {"state": state, "context": context, "description": description})[1]
-
-    def protected_merge(self, pr_number: int) -> Mapping[str, Any]:
-        if not isinstance(pr_number, int) or pr_number < 1:
-            raise GiteaTransportError("PR_NUMBER_INVALID")
-        owner, name = self.repository_id.split("/", 1)
-        pr = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/pulls/{pr_number}")[1]
-        if pr.get("state") != "open" or (pr.get("base") or {}).get("ref") != "main":
-            raise GiteaTransportError("PR_MERGE_BINDING_INVALID")
-        if pr.get("mergeable") is False:
-            raise GiteaTransportError("PR_NOT_MERGEABLE")
-        head_oid = (pr.get("head") or {}).get("sha")
-        base_oid = (pr.get("base") or {}).get("sha")
-        if self.expected_merge_head is not None and head_oid != self.expected_merge_head:
-            raise GiteaTransportError("PR_HEAD_EXPECTATION_MISMATCH")
-        if self.expected_merge_base is not None and base_oid != self.expected_merge_base:
-            raise GiteaTransportError("PR_BASE_EXPECTATION_MISMATCH")
-        body = {"do": "fast-forward-only", "force_merge": False, "merge_when_checks_succeed": False, "head_commit_id": head_oid}
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/pulls/{pr_number}/merge", body)[1]
@@ -1,93 +0,0 @@
-"""Canonical Gitea transport and slash-branch verification."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import json
-import os
-from pathlib import Path
-import subprocess
-from typing import Any, Callable, Mapping, Optional
-from urllib.parse import quote
-from urllib.request import Request, urlopen
-
-from aios_gitops_reconciliation_core import RemoteObservation
-
-
-@dataclass(frozen=True, slots=True)
-class GiteaPublisherConfig:
-    repository: str = "aios/aios"
-    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
-    remote_name: str = "gitea-http"
-
-
-class GiteaPublisher:
-    def __init__(self, workspace: Path, *, config: GiteaPublisherConfig = GiteaPublisherConfig(), credential: Any = None, api_get: Callable[[str], Any] | None = None, git_ref: Callable[[str], Optional[str]] | None = None) -> None:
-        self.workspace = Path(workspace)
-        self.config = config
-        self.credential = credential
-        self._api_get = api_get
-        self._git_ref = git_ref
-
-    @staticmethod
-    def validate_repository(repository: str) -> None:
-        if repository != "aios/aios":
-            raise ValueError("REPOSITORY_IDENTITY_MISMATCH")
-
-    @staticmethod
-    def validate_branch(branch: str) -> None:
-        if not isinstance(branch, str) or not branch.startswith("agent/") or branch in {"main", "master"}:
-            raise ValueError("BRANCH_SCOPE_DENIED")
-
-    def repository_identity(self) -> str:
-        self.validate_repository(self.config.repository)
-        return self.config.repository
-
-    def _environment(self) -> dict[str, str]:
-        if self.credential is not None and hasattr(self.credential, "environment"):
-            return dict(self.credential.environment())
-        return {}
-
-    def read_git_ref(self, branch: str) -> Optional[str]:
-        self.validate_branch(branch)
-        if self._git_ref is not None:
-            return self._git_ref(branch)
-        result = subprocess.run(["git", "-C", str(self.workspace), "ls-remote", self.config.remote_name, f"refs/heads/{branch}"], text=True, capture_output=True, check=False, env={**os.environ, **self._environment(), "GIT_TERMINAL_PROMPT": "0"})
-        if result.returncode != 0 or not result.stdout.strip():
-            return None
-        return result.stdout.split()[0]
-
-    def _api(self, path: str) -> Any:
-        if self._api_get is not None:
-            return self._api_get(path)
-        headers = {"Accept": "application/json"}
-        env = self._environment()
-        if env.get("AIOS_GITEA_TOKEN"):
-            headers["Authorization"] = "token " + env["AIOS_GITEA_TOKEN"]
-        with urlopen(Request(self.config.api_base.rstrip("/") + path, headers=headers), timeout=20) as response:
-            return json.loads(response.read() or b"{}")
-
-    def read_api_branch(self, branch: str) -> Optional[str]:
-        self.validate_branch(branch)
-        for page in range(1, 101):
-            value = self._api(f"/repos/aios/aios/branches?page={page}&limit=50")
-            if not isinstance(value, list):
-                return None
-            for item in value:
-                if isinstance(item, Mapping) and item.get("name") == branch:
-                    commit = item.get("commit")
-                    return commit.get("id") if isinstance(commit, Mapping) else None
-            if len(value) < 50:
-                return None
-        raise RuntimeError("GITEA_BRANCH_PAGINATION_LIMIT")
-
-    def commit_visible(self, oid: str) -> bool:
-        if not isinstance(oid, str) or len(oid) != 40:
-            return False
-        try:
-            value = self._api(f"/repos/aios/aios/git/commits/{quote(oid, safe='')}")
-            return isinstance(value, Mapping) and value.get("sha", oid) == oid
-        except Exception:
-            return False
-
-    def observe(self, branch: str, desired_oid: str, authority_oid: Optional[str], *, expected_oid: Optional[str] = None, observed_at: str = "") -> RemoteObservation:
-        return RemoteObservation(self.repository_identity(), branch, desired_oid, authority_oid, self.read_git_ref(branch), self.read_api_branch(branch), self.commit_visible(desired_oid), observed_at, expected_oid)
@@ -1,707 +0,0 @@
-"""SQLite-backed durable GitOps Job Controller.
-
-The controller owns durable intent, idempotency, lease metadata, state
-transitions, receipts, and payload references. A worker owns Git side effects
-behind the campaign capability and branch-CAS boundaries.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from enum import Enum
-import hashlib
-import json
-import os
-from pathlib import Path
-import sqlite3
-import tempfile
-from datetime import datetime, timezone
-from typing import Any, Callable, Mapping
-
-
-class JobError(RuntimeError):
-    pass
-
-
-class ServiceUnavailable(JobError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class LeaseRenewalResult:
-    """Durable outcome of one writer-lease recovery attempt."""
-
-    renewed: bool
-    idempotent: bool
-    durable: bool
-    lease_expires_at: str | None
-
-    def __bool__(self) -> bool:
-        return self.renewed or self.idempotent
-
-
-class BindingConflict(JobError):
-    pass
-
-
-class JobState(str, Enum):
-    REQUESTED = "REQUESTED"
-    AUTHORIZED = "AUTHORIZED"
-    LEASED = "LEASED"
-    WORKTREE_READY = "WORKTREE_READY"
-    EXECUTING = "EXECUTING"
-    LOCAL_VERIFIED = "LOCAL_VERIFIED"
-    REMOTE_SYNCING = "REMOTE_SYNCING"
-    REMOTE_VERIFIED = "REMOTE_VERIFIED"
-    COMPLETED = "COMPLETED"
-    RECOVERABLE_FAILURE = "RECOVERABLE_FAILURE"
-    RECONCILING = "RECONCILING"
-    RECONCILIATION_REQUIRED = "RECONCILIATION_REQUIRED"
-    MANUAL_OWNER_REVIEW_REQUIRED = "MANUAL_OWNER_REVIEW_REQUIRED"
-
-
-_ORDER = {
-    JobState.REQUESTED: 0,
-    JobState.AUTHORIZED: 1,
-    JobState.LEASED: 2,
-    JobState.WORKTREE_READY: 3,
-    JobState.EXECUTING: 4,
-    JobState.LOCAL_VERIFIED: 5,
-    JobState.REMOTE_SYNCING: 6,
-    JobState.REMOTE_VERIFIED: 7,
-    JobState.COMPLETED: 8,
-}
-_RECOVERABLE = {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}
-_TERMINAL = {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED}
-
-
-def utc_now() -> str:
-    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def parse_utc(value: str) -> datetime:
-    normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
-    parsed = datetime.fromisoformat(normalized)
-    if parsed.tzinfo is None:
-        raise ValueError("LEASE_EXPIRY_INVALID")
-    return parsed.astimezone(timezone.utc)
-
-
-def canonical_json(value: Any) -> bytes:
-    return (
-        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json(value)).hexdigest()
-
-
-class PayloadStore:
-    """Content-addressed filesystem payloads; raw content never enters SQLite."""
-
-    def __init__(self, root: str | os.PathLike[str]) -> None:
-        self.root = Path(root)
-        if not self.root.is_absolute() or self.root.is_symlink():
-            raise JobError("PAYLOAD_ROOT_INVALID")
-        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
-        os.chmod(self.root, 0o700)
-
-    def put(self, content: bytes, expected_digest: str) -> tuple[str, int]:
-        digest = hashlib.sha256(content).hexdigest()
-        if digest != expected_digest:
-            raise JobError("PAYLOAD_DIGEST_MISMATCH")
-        if len(expected_digest) != 64 or any(ch not in "0123456789abcdef" for ch in expected_digest):
-            raise JobError("PAYLOAD_DIGEST_INVALID")
-        target = self.root / expected_digest
-        if target.is_symlink():
-            raise JobError("PAYLOAD_PATH_SYMLINK")
-        if target.is_file():
-            if target.stat().st_size != len(content) or hashlib.sha256(target.read_bytes()).hexdigest() != digest:
-                raise JobError("PAYLOAD_EXISTING_MISMATCH")
-            return f"sha256/{digest}", len(content)
-        fd, temporary = tempfile.mkstemp(prefix=".payload-", dir=self.root)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "wb") as stream:
-                stream.write(content)
-                stream.flush()
-                os.fsync(stream.fileno())
-            os.replace(temporary, target)
-            os.chmod(target, 0o600)
-        finally:
-            if os.path.exists(temporary):
-                os.unlink(temporary)
-        return f"sha256/{digest}", len(content)
-
-    def read_verified(self, reference: str, expected_digest: str, expected_size: int) -> bytes:
-        if reference != f"sha256/{expected_digest}":
-            raise JobError("PAYLOAD_REFERENCE_MISMATCH")
-        path = self.root / expected_digest
-        if path.is_symlink() or not path.is_file():
-            raise JobError("PAYLOAD_MISSING")
-        content = path.read_bytes()
-        if len(content) != expected_size or hashlib.sha256(content).hexdigest() != expected_digest:
-            raise JobError("PAYLOAD_VERIFY_FAILED")
-        return content
-
-
-@dataclass(frozen=True, slots=True)
-class JobReceipt:
-    job_id: str
-    idempotency_key: str
-    state: JobState
-    side_effect_state: str
-    http_status: int
-    revision: int
-    receipt: Mapping[str, Any] | None = None
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "job_id": self.job_id,
-            "idempotency_key": self.idempotency_key,
-            "state": self.state.value,
-            "side_effect_state": self.side_effect_state,
-            "http_status": self.http_status,
-            "revision": self.revision,
-            "receipt": dict(self.receipt) if self.receipt else None,
-        }
-
-
-class JobStore:
-    SCHEMA_VERSION = 1
-
-    def __init__(self, root: str | os.PathLike[str], *, payload_root: str | os.PathLike[str] | None = None) -> None:
-        self.root = Path(root)
-        if not self.root.is_absolute() or self.root.is_symlink():
-            raise JobError("JOB_ROOT_INVALID")
-        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
-        os.chmod(self.root, 0o700)
-        self.db_path = self.root / "state.sqlite3"
-        self.payloads = PayloadStore(payload_root or self.root.parent / "payloads" / "sha256")
-        self._initialize()
-
-    def _connect(self) -> sqlite3.Connection:
-        if self.db_path.is_symlink():
-            raise ServiceUnavailable("JOB_DB_SYMLINK")
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA journal_mode=WAL")
-        connection.execute("PRAGMA synchronous=FULL")
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    def _initialize(self) -> None:
-        try:
-            with self._connect() as connection:
-                connection.executescript(
-                    """
-                    CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);
-                    CREATE TABLE IF NOT EXISTS jobs (
-                      job_id TEXT PRIMARY KEY, idempotency_key TEXT NOT NULL UNIQUE,
-                      campaign_id TEXT NOT NULL, repository TEXT NOT NULL, operation TEXT NOT NULL,
-                      branch TEXT NOT NULL, expected_branch_oid TEXT NOT NULL,
-                      payload_digest TEXT NOT NULL, payload_ref TEXT, payload_size INTEGER,
-                      state TEXT NOT NULL, side_effect_state TEXT NOT NULL,
-                      revision INTEGER NOT NULL, request_json TEXT NOT NULL,
-                      receipt_json TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
-                    );
-                    CREATE TABLE IF NOT EXISTS idempotency_keys (
-                      key TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE,
-                      binding_json TEXT NOT NULL, created_at TEXT NOT NULL,
-                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS branch_leases (
-                      lease_id TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE,
-                      branch TEXT NOT NULL, lineage_anchor_oid TEXT NOT NULL,
-                      current_head_oid TEXT NOT NULL, generation INTEGER NOT NULL,
-                      lease_expires_at TEXT NOT NULL, state TEXT NOT NULL,
-                      revision INTEGER NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS state_transitions (
-                      sequence INTEGER PRIMARY KEY AUTOINCREMENT, job_id TEXT NOT NULL,
-                      from_state TEXT, to_state TEXT NOT NULL, revision INTEGER NOT NULL,
-                      side_effect_state TEXT NOT NULL, created_at TEXT NOT NULL,
-                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS receipts (
-                      receipt_id TEXT PRIMARY KEY, job_id TEXT NOT NULL,
-                      kind TEXT NOT NULL, digest TEXT NOT NULL, payload_json TEXT NOT NULL,
-                      created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '1');
-                    """
-                )
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def _mirror(self, job: Mapping[str, Any]) -> None:
-        directory = self.root / str(job["job_id"])
-        directory.mkdir(mode=0o700, exist_ok=True)
-        (directory / "receipts").mkdir(mode=0o700, exist_ok=True)
-        (directory / "logs-digest").mkdir(mode=0o700, exist_ok=True)
-        for name, value in (("request.json", job["request"]), ("state.json", job)):
-            target = directory / name
-            fd, temporary = tempfile.mkstemp(prefix=".mirror-", dir=directory)
-            try:
-                os.fchmod(fd, 0o600)
-                with os.fdopen(fd, "wb") as stream:
-                    stream.write(canonical_json(value))
-                    stream.flush()
-                    os.fsync(stream.fileno())
-                os.replace(temporary, target)
-            finally:
-                if os.path.exists(temporary):
-                    os.unlink(temporary)
-
-    def read(self, job_id: str) -> dict[str, Any]:
-        try:
-            with self._connect() as connection:
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        if row is None:
-            raise JobError("JOB_NOT_FOUND")
-        return dict(row)
-
-    def _receipt(self, row: Mapping[str, Any], *, duplicate: bool) -> JobReceipt:
-        state = JobState(row["state"])
-        if state == JobState.COMPLETED:
-            status, side = 200, "COMPLETED"
-        elif state in _RECOVERABLE:
-            status = 202
-            side = row["side_effect_state"] if row["side_effect_state"] == "REMOTE_PUSH_PENDING" else "RESUME_SAME_JOB"
-        elif row["side_effect_state"] == "UNKNOWN":
-            status, side = 503, "UNKNOWN"
-        else:
-            status, side = 202, "SAME_JOB" if duplicate else "QUEUED"
-        receipt = json.loads(row["receipt_json"]) if row["receipt_json"] else None
-        return JobReceipt(row["job_id"], row["idempotency_key"], state, side, status, int(row["revision"]), receipt)
-
-
-class GitOpsJobController:
-    def __init__(self, store: JobStore) -> None:
-        self.store = store
-
-    @staticmethod
-    def _binding(request: Mapping[str, Any]) -> dict[str, str]:
-        fields = ("campaign_id", "repository", "operation", "branch", "expected_branch_oid", "payload_digest")
-        if any(not isinstance(request.get(field), str) or not request[field].strip() for field in fields):
-            raise JobError("JOB_BINDING_INVALID")
-        oid = request["expected_branch_oid"]
-        digest = request["payload_digest"]
-        if len(oid) != 40 or any(ch not in "0123456789abcdef" for ch in oid):
-            raise JobError("EXPECTED_BRANCH_OID_INVALID")
-        if len(digest) != 64 or any(ch not in "0123456789abcdef" for ch in digest):
-            raise JobError("PAYLOAD_DIGEST_INVALID")
-        if request["branch"] in {"main", "master"} or request["branch"].startswith(("refs/", "tags/")):
-            raise JobError("PROTECTED_BRANCH_REJECTED")
-        binding = {field: str(request[field]) for field in fields}
-        # Operation-specific, non-secret binding inputs must survive the
-        # durable round trip and participate in idempotency. Arbitrary request
-        # fields are intentionally discarded rather than persisted.
-        optional = (
-            "idempotency_key",
-            "task_id",
-            "new_branch_oid",
-            "authorization_recovery_digest",
-            "lineage_anchor_oid",
-            "base_oid",
-            "branch_mode",
-            "generation",
-            "expected_main_oid",
-            "pr_number",
-            "target_branch",
-            "check_context",
-            "check_state",
-            "check_description",
-        )
-        for field in optional:
-            value = request.get(field)
-            if value is None:
-                continue
-            if isinstance(value, bool) or not isinstance(value, (str, int)):
-                raise JobError("JOB_BINDING_OPTION_INVALID")
-            text = str(value).strip()
-            if not text or len(text) > 512:
-                raise JobError("JOB_BINDING_OPTION_INVALID")
-            binding[field] = text
-        return binding
-
-    def submit(self, request: Mapping[str, Any], *, payload: bytes | None = None) -> JobReceipt:
-        binding = self._binding(request)
-        payload_ref = request.get("payload_ref")
-        payload_size = request.get("payload_size")
-        if payload is not None:
-            payload_ref, payload_size = self.store.payloads.put(payload, binding["payload_digest"])
-        if payload_ref is not None and payload_ref != f"sha256/{binding['payload_digest']}":
-            raise JobError("PAYLOAD_REFERENCE_MISMATCH")
-        if payload_ref is not None and (not isinstance(payload_size, int) or payload_size < 0):
-            raise JobError("PAYLOAD_SIZE_INVALID")
-        client_idempotency_key = binding.get("idempotency_key")
-        if client_idempotency_key is not None:
-            if len(client_idempotency_key) > 128 or not all(
-                character.isalnum() or character in "._:-" for character in client_idempotency_key
-            ):
-                raise JobError("IDEMPOTENCY_KEY_INVALID")
-            key = sha256_json({"client_idempotency_key": client_idempotency_key})
-        else:
-            key = sha256_json(binding)
-        job_id = "job-" + key[:32]
-        durable_request = dict(binding)
-        if payload_ref is not None:
-            durable_request.update({"payload_ref": str(payload_ref), "payload_size": int(payload_size)})
-        now = utc_now()
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                existing = connection.execute("SELECT * FROM jobs WHERE idempotency_key=?", (key,)).fetchone()
-                if existing is not None:
-                    if json.loads(existing["request_json"]).get("binding") != binding:
-                        raise BindingConflict("BINDING_CONFLICT")
-                    row = dict(existing)
-                    connection.commit()
-                    return self.store._receipt(row, duplicate=True)
-                connection.execute(
-                    "INSERT INTO jobs(job_id,idempotency_key,campaign_id,repository,operation,branch,expected_branch_oid,payload_digest,payload_ref,payload_size,state,side_effect_state,revision,request_json,receipt_json,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
-                    (job_id, key, binding["campaign_id"], binding["repository"], binding["operation"], binding["branch"], binding["expected_branch_oid"], binding["payload_digest"], payload_ref, payload_size, JobState.REQUESTED.value, "NONE", 0, json.dumps({"binding": binding, **durable_request}, sort_keys=True), None, now, now),
-                )
-                connection.execute("INSERT INTO idempotency_keys(key,job_id,binding_json,created_at) VALUES(?,?,?,?)", (key, job_id, json.dumps(binding, sort_keys=True), now))
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, None, JobState.REQUESTED.value, 0, "NONE", now))
-                row = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except BindingConflict:
-            raise
-        except sqlite3.IntegrityError:
-            row = self.store.read(job_id)
-            return self.store._receipt(row, duplicate=True)
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        row["request"] = json.loads(row["request_json"])
-        self.store._mirror(row)
-        return self.store._receipt(row, duplicate=False)
-
-    def lease_job(
-        self,
-        job_id: str,
-        *,
-        lease_id: str,
-        lineage_anchor_oid: str,
-        current_head_oid: str,
-        generation: int,
-        lease_expires_at: str,
-        expected_revision: int,
-    ) -> JobReceipt:
-        """Atomically create a branch lease and move its Job to LEASED."""
-        if generation < 1 or any(len(oid) != 40 for oid in (lineage_anchor_oid, current_head_oid)):
-            raise JobError("LEASE_BINDING_INVALID")
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-                if row is None:
-                    raise JobError("JOB_NOT_FOUND")
-                if int(row["revision"]) != expected_revision:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                if row["branch"] in {"main", "master"}:
-                    raise JobError("PROTECTED_BRANCH_REJECTED")
-                now = utc_now()
-                connection.execute("INSERT INTO branch_leases(lease_id,job_id,branch,lineage_anchor_oid,current_head_oid,generation,lease_expires_at,state,revision) VALUES(?,?,?,?,?,?,?,?,?)", (lease_id, job_id, row["branch"], lineage_anchor_oid, current_head_oid, generation, lease_expires_at, "ACTIVE", 0))
-                next_revision = expected_revision + 1
-                updated = connection.execute("UPDATE jobs SET state=?,side_effect_state=?,revision=?,updated_at=? WHERE job_id=? AND revision=?", (JobState.LEASED.value, "LEASED", next_revision, now, job_id, expected_revision))
-                if updated.rowcount != 1:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, row["state"], JobState.LEASED.value, next_revision, "LEASED", now))
-                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except sqlite3.IntegrityError as exc:
-            raise JobError("LEASE_CONFLICT") from exc
-        except (JobError, BindingConflict):
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        result["request"] = json.loads(result["request_json"])
-        self.store._mirror(result)
-        return self.store._receipt(result, duplicate=True)
-
-    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE", lease_expires_at: str | None = None) -> None:
-        if len(current_head_oid) != 40 or generation < 1:
-            raise JobError("LEASE_BINDING_INVALID")
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                if lease_expires_at is None:
-                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
-                else:
-                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,lease_expires_at=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, lease_expires_at, state, lease_id, expected_revision))
-                if updated.rowcount != 1:
-                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
-                connection.commit()
-        except JobError:
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def renew_lease(
-        self,
-        *,
-        branch: str,
-        lineage_anchor_oid: str,
-        current_head_oid: str,
-        generation: int,
-        lease_expires_at: str,
-    ) -> LeaseRenewalResult:
-        if (
-            not branch
-            or len(lineage_anchor_oid) != 40
-            or len(current_head_oid) != 40
-            or generation < 1
-            or not lease_expires_at.strip()
-        ):
-            raise JobError("LEASE_BINDING_INVALID")
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                rows = connection.execute(
-                    "SELECT lease_id, revision, generation, state, lease_expires_at "
-                    "FROM branch_leases "
-                    "WHERE branch=? AND lineage_anchor_oid=? AND current_head_oid=? "
-                    "AND generation=? AND state='ACTIVE' ORDER BY revision DESC",
-                    (branch, lineage_anchor_oid, current_head_oid, generation),
-                ).fetchall()
-                if not rows:
-                    connection.commit()
-                    return LeaseRenewalResult(False, False, False, None)
-                if len(rows) != 1:
-                    raise JobError("LEASE_BINDING_CONFLICT")
-                row = rows[0]
-                try:
-                    current_expires_at = parse_utc(str(row["lease_expires_at"]))
-                    requested_expires_at = parse_utc(lease_expires_at)
-                except (TypeError, ValueError) as exc:
-                    raise JobError("LEASE_EXPIRY_INVALID") from exc
-                now = datetime.now(timezone.utc)
-                if requested_expires_at <= now:
-                    raise JobError("LEASE_EXPIRY_INVALID")
-                if current_expires_at > now:
-                    connection.commit()
-                    return LeaseRenewalResult(
-                        False,
-                        True,
-                        True,
-                        str(row["lease_expires_at"]),
-                    )
-                updated = connection.execute(
-                    "UPDATE branch_leases SET lease_expires_at=?,revision=revision+1 "
-                    "WHERE lease_id=? AND revision=? AND generation=? "
-                    "AND state='ACTIVE' AND lease_expires_at=?",
-                    (
-                        lease_expires_at,
-                        row["lease_id"],
-                        int(row["revision"]),
-                        generation,
-                        row["lease_expires_at"],
-                    ),
-                )
-                if updated.rowcount != 1:
-                    current = connection.execute(
-                        "SELECT lease_expires_at, generation, state FROM branch_leases "
-                        "WHERE lease_id=?",
-                        (row["lease_id"],),
-                    ).fetchone()
-                    if (
-                        current is not None
-                        and int(current["generation"]) == generation
-                        and current["state"] == "ACTIVE"
-                        and parse_utc(str(current["lease_expires_at"])) > now
-                    ):
-                        connection.commit()
-                        return LeaseRenewalResult(
-                            False,
-                            True,
-                            True,
-                            str(current["lease_expires_at"]),
-                        )
-                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
-                connection.commit()
-                return LeaseRenewalResult(True, False, True, lease_expires_at)
-        except JobError:
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
-        return self._advance(
-            job_id,
-            state,
-            side_effect_state=side_effect_state,
-            receipt=receipt,
-            expected_revision=expected_revision,
-        )
-
-    def _advance(
-        self,
-        job_id: str,
-        state: JobState,
-        *,
-        side_effect_state: str,
-        receipt: Mapping[str, Any] | None = None,
-        expected_revision: int | None = None,
-        _allow_verified_external_recovery: bool = False,
-    ) -> JobReceipt:
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-                if row is None:
-                    raise JobError("JOB_NOT_FOUND")
-                previous = JobState(row["state"])
-                revision = int(row["revision"])
-                if expected_revision is not None and expected_revision != revision:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                recovery_transition = (
-                    _allow_verified_external_recovery
-                    and previous == JobState.MANUAL_OWNER_REVIEW_REQUIRED
-                    and state == JobState.COMPLETED
-                )
-                if previous in _TERMINAL and state != previous and not recovery_transition:
-                    raise JobError("JOB_TERMINAL")
-                if state not in _RECOVERABLE | {JobState.RECONCILING, JobState.MANUAL_OWNER_REVIEW_REQUIRED}:
-                    if previous in _RECOVERABLE:
-                        raise JobError("RECONCILE_REQUIRED")
-                    if previous != JobState.RECONCILING and _ORDER.get(state, -1) < _ORDER.get(previous, -1):
-                        raise JobError("JOB_STATE_REGRESSION")
-                next_revision = revision + 1
-                receipt_json = json.dumps(dict(receipt), sort_keys=True) if receipt is not None else row["receipt_json"]
-                now = utc_now()
-                updated = connection.execute("UPDATE jobs SET state=?,side_effect_state=?,revision=?,receipt_json=?,updated_at=? WHERE job_id=? AND revision=?", (state.value, side_effect_state, next_revision, receipt_json, now, job_id, revision))
-                if updated.rowcount != 1:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, previous.value, state.value, next_revision, side_effect_state, now))
-                if receipt is not None:
-                    digest = hashlib.sha256(canonical_json(receipt)).hexdigest()
-                    connection.execute("INSERT INTO receipts(receipt_id,job_id,kind,digest,payload_json,created_at) VALUES(?,?,?,?,?,?)", (f"receipt-{job_id}-{next_revision}", job_id, state.value, digest, json.dumps(dict(receipt), sort_keys=True), now))
-                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except (JobError, BindingConflict):
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        result["request"] = json.loads(result["request_json"])
-        self.store._mirror(result)
-        return self.store._receipt(result, duplicate=True)
-
-    @staticmethod
-    def _validate_verified_external_merge_proof(
-        job_id: str,
-        binding: Mapping[str, Any],
-        proof: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        if not isinstance(proof, Mapping):
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-
-        def require_oid(field: str) -> str:
-            value = proof.get(field)
-            if not isinstance(value, str) or len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
-                raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-            return value
-
-        if proof.get("proof_schema") != "aios.job-recovery.v1":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-        if proof.get("job_id") != job_id:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("operation") != "PROTECTED_MERGE" or binding.get("operation") != "PROTECTED_MERGE":
-            raise JobError("EXTERNAL_SIDE_EFFECT_OPERATION_REJECTED")
-        if proof.get("pr_number") != 53 or str(binding.get("pr_number")) != "53":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("pr_merged") is not True or proof.get("protected_merge") is not True:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("force_push") is not False:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("machine_actor") != "aios-autonomy-agent":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-
-        expected_head = str(binding.get("expected_branch_oid", ""))
-        expected_base = str(binding.get("expected_main_oid", ""))
-        head_oid = require_oid("head_oid")
-        base_oid = require_oid("base_oid")
-        merged_main = require_oid("main_oid_after_protected_merge")
-        gitea_merged_main = require_oid("gitea_main_oid_after_protected_merge")
-        authority_merged_main = require_oid("authority_main_oid_after_protected_merge")
-        current_gitea = require_oid("current_gitea_main_oid")
-        current_authority = require_oid("current_authority_main_oid")
-        if head_oid != expected_head or base_oid != expected_base:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if not (merged_main == gitea_merged_main == authority_merged_main == head_oid):
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if current_gitea != current_authority or proof.get("current_main_descends_from_protected_merge") is not True:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        return dict(proof)
-
-    def complete_verified_external_side_effect(
-        self,
-        job_id: str,
-        proof: Mapping[str, Any],
-        *,
-        expected_revision: int | None = None,
-    ) -> JobReceipt:
-        """Close one historical manual job from independently verified proof.
-
-        This is deliberately narrower than advance: it is only valid for the
-        known protected PR53 recovery shape and preserves the old receipt.
-        The actual state change still uses the normal revision-CAS path.
-        """
-        current = self.store.read(job_id)
-        revision = int(current["revision"])
-        if expected_revision is not None and expected_revision != revision:
-            raise JobError("REVISION_CAS_CONFLICT")
-        request = json.loads(current["request_json"])
-        binding = request.get("binding", request)
-        normalized_proof = self._validate_verified_external_merge_proof(job_id, binding, proof)
-        existing_receipt = json.loads(current["receipt_json"]) if current["receipt_json"] else None
-        if JobState(current["state"]) == JobState.COMPLETED:
-            if (
-                existing_receipt
-                and existing_receipt.get("recovered_from_historical_manual") is True
-                and existing_receipt.get("proof") == normalized_proof
-            ):
-                return self.store._receipt(current, duplicate=True)
-            raise JobError("JOB_TERMINAL")
-        if JobState(current["state"]) != JobState.MANUAL_OWNER_REVIEW_REQUIRED:
-            raise JobError("EXTERNAL_SIDE_EFFECT_RECOVERY_STATE_INVALID")
-        recovery_receipt = {
-            "recovered_from_historical_manual": True,
-            "recovery_kind": "VERIFIED_EXTERNAL_SIDE_EFFECT",
-            "historical_receipt": existing_receipt,
-            "proof": normalized_proof,
-        }
-        return self._advance(
-            job_id,
-            JobState.COMPLETED,
-            side_effect_state="REMOTE_VERIFIED",
-            receipt=recovery_receipt,
-            expected_revision=revision,
-            _allow_verified_external_recovery=True,
-        )
-
-    def reconcile(self, job_id: str, observer: Callable[[Mapping[str, Any]], Mapping[str, Any]]) -> JobReceipt:
-        current = self.store.read(job_id)
-        if JobState(current["state"]) not in _RECOVERABLE:
-            return self.store._receipt(current, duplicate=True)
-        self.advance(job_id, JobState.RECONCILING, side_effect_state="IN_PROGRESS")
-        try:
-            observed = dict(observer(current))
-            stable = JobState(observed.get("state", JobState.REQUESTED.value))
-            if stable in {JobState.RECOVERABLE_FAILURE, JobState.RECONCILING}:
-                raise JobError("RECONCILIATION_UNSTABLE")
-            return self.advance(job_id, stable, side_effect_state=str(observed.get("side_effect_state", "NONE")), receipt=observed.get("receipt"))
-        except Exception as exc:
-            self.advance(job_id, JobState.RECONCILIATION_REQUIRED, side_effect_state="UNKNOWN", receipt={"error_code": type(exc).__name__})
-            raise JobError("RECONCILIATION_REQUIRED") from exc
-
-    def resume(self, job_id: str) -> JobReceipt:
-        current = self.store.read(job_id)
-        if JobState(current["state"]) in _TERMINAL:
-            raise JobError("JOB_TERMINAL")
-        return self.reconcile(job_id, lambda _current: {"state": JobState.REQUESTED.value, "side_effect_state": "RESUME_SAME_JOB"})
@@ -1,279 +0,0 @@
-"""Durable Job side-effect executor for the AIOS campaign control plane."""
-
-from __future__ import annotations
-
-import argparse
-import base64
-from dataclasses import dataclass, replace
-import json
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_authority_git_executor import AuthorityGitExecutor, AuthorityGitError
-from aios_campaign_recovery import RecoveryEvidenceError, load_recovered_authorization
-from aios_gitea_machine_broker import CampaignCapabilityReceipt, GiteaMachineBroker, MachineBrokerError
-from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore
-
-
-TASK_ID = "AIOS_AUTONOMOUS_RELEASE_CAMPAIGN_V1"
-CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
-REPOSITORY = "aios/aios"
-BRANCH = "agent/autonomous-release-campaign-v1-20260807"
-EXPECTED_BRANCH_OID = "bba675fab3b7e0c5fba7066720252b3c91b9f20d"
-AUTHORIZATION_DIGEST = "6b0bf550eb702126e967eeff2d561fa808444b924d8a71f5399accad508ed3b2"
-LINEAGE_ANCHOR = "69b45e81dcd2c3707c367003b08c55fd361faae8"
-
-
-class JobExecutionError(RuntimeError):
-    pass
-
-
-@dataclass(slots=True)
-class DurableJobExecutor:
-    controller: GitOpsJobController
-    authority: AuthorityGitExecutor
-    broker: GiteaMachineBroker
-    recovery_path: Path
-
-    def _request(self, job_id: str) -> tuple[dict[str, Any], dict[str, Any]]:
-        row = self.controller.store.read(job_id)
-        try:
-            request = json.loads(row["request_json"])
-        except (KeyError, TypeError, json.JSONDecodeError) as exc:
-            raise JobExecutionError("JOB_REQUEST_INVALID") from exc
-        return row, dict(request.get("binding") or {})
-
-    def _validate_campaign(self, request: Mapping[str, Any]) -> str:
-        operation = str(request.get("operation", ""))
-        expected_branch_oid = request.get("expected_branch_oid")
-        required = {
-            "task_id": TASK_ID,
-            "campaign_id": CAMPAIGN_ID,
-            "repository": REPOSITORY,
-            "branch": BRANCH,
-            "authorization_recovery_digest": AUTHORIZATION_DIGEST,
-        }
-        for key, expected in required.items():
-            if request.get(key) != expected:
-                raise JobExecutionError(f"JOB_{key.upper()}_MISMATCH")
-        new_oid = request.get("new_branch_oid")
-        if not isinstance(new_oid, str) or len(new_oid) != 40 or any(ch not in "0123456789abcdef" for ch in new_oid):
-            raise JobExecutionError("NEW_BRANCH_OID_INVALID")
-        if not isinstance(expected_branch_oid, str) or len(expected_branch_oid) != 40 or any(ch not in "0123456789abcdef" for ch in expected_branch_oid):
-            raise JobExecutionError("EXPECTED_BRANCH_OID_INVALID")
-        if operation == "ADVANCE_EXISTING_CAMPAIGN_BRANCH" and expected_branch_oid == new_oid:
-            raise JobExecutionError("EXPECTED_BRANCH_OID_INVALID")
-        if operation != "ADVANCE_EXISTING_CAMPAIGN_BRANCH" and expected_branch_oid != new_oid:
-            raise JobExecutionError("POST_ADVANCE_HEAD_BINDING_INVALID")
-        try:
-            recovery = load_recovered_authorization(self.recovery_path)
-        except RecoveryEvidenceError as exc:
-            raise JobExecutionError(str(exc)) from exc
-        if recovery["digest"] != AUTHORIZATION_DIGEST:
-            raise JobExecutionError("RECOVERY_DIGEST_MISMATCH")
-        for key, expected in required.items():
-            if key == "campaign_id":
-                actual = recovery.get(key)
-            elif key == "authorization_recovery_digest":
-                continue
-            else:
-                actual = recovery.get({"expected_branch_oid": "expected_branch_oid"}.get(key, key))
-            if actual is not None and actual != expected:
-                raise JobExecutionError("RECOVERY_BINDING_MISMATCH")
-        if recovery.get("expected_branch_oid") != EXPECTED_BRANCH_OID:
-            raise JobExecutionError("RECOVERY_BRANCH_OID_MISMATCH")
-        authority_head = self.authority.read_ref(f"refs/heads/{BRANCH}")
-        if authority_head not in {expected_branch_oid, new_oid}:
-            raise JobExecutionError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
-        if not self.authority.ancestry_check(expected_branch_oid, new_oid):
-            raise JobExecutionError("NEW_OID_NOT_DESCENDANT")
-        if not self.authority.ancestry_check(EXPECTED_BRANCH_OID, new_oid):
-            raise JobExecutionError("NEW_OID_OUTSIDE_AUTHORIZED_LINEAGE")
-        identity = self.broker.verify_identity()
-        if identity.get("repository") != REPOSITORY or identity.get("login") == "aiman":
-            raise JobExecutionError("MACHINE_IDENTITY_SCOPE_INVALID")
-        return new_oid
-
-    def dry_run(self, job_id: str) -> dict[str, Any]:
-        _row, request = self._request(job_id)
-        new_oid = self._validate_campaign(request)
-        remote = self.broker.readback()
-        if remote is None:
-            action = "CREATE_REQUIRED"
-        elif remote == new_oid:
-            action = "ALREADY_IN_SYNC"
-        elif remote == request["expected_branch_oid"]:
-            action = "FAST_FORWARD_REQUIRED"
-        else:
-            action = "MANUAL_OWNER_REVIEW_REQUIRED"
-        if action == "MANUAL_OWNER_REVIEW_REQUIRED":
-            raise JobExecutionError("GITEA_BRANCH_CONFLICT")
-        return {
-            "decision": "SAFE_TO_ADVANCE",
-            "authority_action": "CAS_REQUIRED",
-            "gitea_action": action,
-            "previous_branch_oid": request["expected_branch_oid"],
-            "final_branch_oid": new_oid,
-            "force_push": False,
-        }
-
-    def _recover_requested(self, job_id: str) -> dict[str, Any]:
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) in {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}:
-            self.controller.resume(job_id)
-            row = self.controller.store.read(job_id)
-        return row
-
-    def execute(self, job_id: str, *, dry_run: bool = False) -> dict[str, Any]:
-        try:
-            return self._execute_unprotected(job_id, dry_run=dry_run)
-        except Exception as exc:
-            try:
-                row = self.controller.store.read(job_id)
-                state = JobState(row["state"])
-                if state not in {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED, JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}:
-                    self.controller.advance(job_id, JobState.RECOVERABLE_FAILURE, side_effect_state="UNKNOWN", receipt={"error_code": type(exc).__name__})
-            except Exception:
-                pass
-            raise
-
-    def _execute_unprotected(self, job_id: str, *, dry_run: bool = False) -> dict[str, Any]:
-        row, request = self._request(job_id)
-        operation = request.get("operation")
-        if operation == "ADVANCE_EXISTING_CAMPAIGN_BRANCH":
-            if dry_run:
-                return self.dry_run(job_id)
-            return self._advance_campaign(job_id)
-        if operation == "COMMIT_FILE":
-            return self._commit_file(job_id, request)
-        if operation == "SYNC_TASK_BRANCH_TO_GITEA":
-            new_oid = self._validate_campaign(request)
-            final = self.broker.push_branch(new_oid)
-            return {"operation": operation, "remote_verified": final == new_oid, "final_network_oid": final}
-        if operation == "CREATE_PR":
-            self._validate_campaign(request)
-            return dict(self.broker.create_pr("AIOS autonomous release control plane", "Durable campaign continuation; exact head and recovery evidence are bound in the Job."))
-        if operation == "PUBLISH_CHECK":
-            self._validate_campaign(request)
-            context = request.get("check_context", "aios/durable-release")
-            state = request.get("check_state", "success")
-            description = request.get("check_description", "Durable campaign control-plane check passed")
-            return dict(self.broker.status(str(state), str(description), str(context)))
-        if operation == "PROTECTED_MERGE":
-            self._validate_campaign(request)
-            number = int(request.get("pr_number", "0"))
-            self.broker.transport.expected_merge_head = request["expected_branch_oid"]
-            expected_main = request.get("expected_main_oid")
-            if expected_main is not None:
-                self.broker.transport.expected_merge_base = expected_main
-            return dict(self.broker.merge(number))
-        if operation == "RECONCILE_AUTHORITY_MAIN":
-            self._validate_campaign(request)
-            old = request.get("expected_main_oid")
-            new = request.get("new_branch_oid")
-            if not isinstance(old, str) or not isinstance(new, str):
-                raise JobExecutionError("MAIN_RECONCILIATION_BINDING_INVALID")
-            gitea_main = self.broker.transport.read_branch("main")
-            if gitea_main != new:
-                raise JobExecutionError("GITEA_MAIN_EXPECTATION_MISMATCH")
-            if not self.authority.ancestry_check(old, new):
-                raise JobExecutionError("MAIN_OID_NOT_DESCENDANT")
-            return {"authority_main": self.authority.ff_CAS_main_after_verified_protected_merge(old, new)}
-        raise JobExecutionError("OPERATION_NOT_ALLOWED")
-
-    def _advance_campaign(self, job_id: str) -> dict[str, Any]:
-        self._recover_requested(job_id)
-        row, request = self._request(job_id)
-        new_oid = self._validate_campaign(request)
-        expected_oid = request["expected_branch_oid"]
-        state = JobState(row["state"])
-        if state == JobState.REQUESTED:
-            receipt = self.controller.advance(job_id, JobState.AUTHORIZED, side_effect_state="AUTHORIZED", receipt={"authorization_digest": AUTHORIZATION_DIGEST, "task_id": TASK_ID})
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.AUTHORIZED:
-            self.controller.lease_job(job_id, lease_id=f"lease-{job_id}", lineage_anchor_oid=LINEAGE_ANCHOR, current_head_oid=expected_oid, generation=1, lease_expires_at="2099-01-01T00:00:00Z", expected_revision=int(row["revision"]))
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.LEASED:
-            self.controller.advance(job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY", receipt={"branch": BRANCH, "expected_oid": expected_oid})
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.WORKTREE_READY:
-            self.controller.advance(job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
-            row = self.controller.store.read(job_id)
-        authority_before = self.authority.read_ref(f"refs/heads/{BRANCH}")
-        if authority_before == expected_oid:
-            authority_oid = self.authority.advance_task_branch_CAS(f"refs/heads/{BRANCH}", expected_oid, new_oid)
-        elif authority_before == new_oid:
-            authority_oid = new_oid
-        else:
-            raise JobExecutionError("AUTHORITY_BRANCH_CONFLICT")
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.EXECUTING:
-            self.controller.advance(job_id, JobState.LOCAL_VERIFIED, side_effect_state="LOCAL_VERIFIED", receipt={"authority": {"branch": BRANCH, "previous_oid": expected_oid, "new_oid": new_oid, "CAS_success": True, "readback_oid": authority_oid}})
-        row = self.controller.store.read(job_id)
-        remote_before = self.broker.readback()
-        if remote_before != new_oid:
-            if remote_before not in {None, expected_oid}:
-                raise JobExecutionError("GITEA_BRANCH_CONFLICT")
-            if JobState(row["state"]) == JobState.LOCAL_VERIFIED:
-                if hasattr(self.broker, "receipt"):
-                    self.broker.receipt = replace(self.broker.receipt, expected_oid=expected_oid)
-                self.controller.advance(job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS", receipt={"gitea": {"previous_oid": remote_before, "desired_oid": new_oid, "force_push": False}})
-            final_network = self.broker.push_branch(new_oid)
-        else:
-            final_network = new_oid
-        final_api = self.broker.readback()
-        if final_api != new_oid:
-            raise JobExecutionError("GITEA_BRANCH_READBACK_MISMATCH")
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) in {JobState.LOCAL_VERIFIED, JobState.REMOTE_SYNCING}:
-            self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt={"gitea": {"machine_actor": "aios-autonomy-agent", "previous_oid": remote_before, "desired_oid": new_oid, "final_network_oid": final_network, "final_API_oid": final_api, "force_push": False}})
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.REMOTE_VERIFIED:
-            self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt={"authority_oid": authority_oid, "network_oid": final_network, "gitea_api_oid": final_api, "force_push": False})
-        return self.controller.store._receipt(self.controller.store.read(job_id), duplicate=True).as_dict()
-
-    def _commit_file(self, job_id: str, request: Mapping[str, Any]) -> dict[str, Any]:
-        row = self.controller.store.read(job_id)
-        payload_ref = request.get("payload_ref")
-        if not payload_ref:
-            raise JobExecutionError("PAYLOAD_REQUIRED")
-        payload = self.controller.store.payloads.read_verified(payload_ref, row["payload_digest"], int(request["payload_size"]))
-        try:
-            spec = json.loads(payload.decode())
-            path = str(spec["path"])
-            content = base64.b64decode(spec["content_base64"], validate=True)
-        except Exception as exc:
-            raise JobExecutionError("COMMIT_FILE_PAYLOAD_INVALID") from exc
-        new_oid = self.authority.commit_file_in_isolated_worktree(base_oid=row["expected_branch_oid"], files={path: content}, message="chore(gitops): durable commit-file", worktree_name=job_id)
-        return {"operation": "COMMIT_FILE", "new_oid": new_oid}
-
-
-def build_from_environment(job_root: Path) -> DurableJobExecutor:
-    from aios_gitea_machine_transport import GiteaMachineTransport
-    from aios_gitea_machine_broker import MachineCredentialProjection
-
-    account = __import__("os").environ.get("AIOS_GITEA_MACHINE_ACCOUNT", "aios-autonomy-agent")
-    api = __import__("os").environ.get("AIOS_GITEA_API", "https://g.cnnetmkt.top/git/api/v1")
-    remote = __import__("os").environ.get("AIOS_GITEA_REMOTE", "https://g.cnnetmkt.top/git/aios/aios.git")
-    authority_dir = Path(__import__("os").environ.get("AIOS_GITOPS_AUTHORITY_GIT_DIR", "/data/aios-gitops/repo.git"))
-    worktree_root = Path(__import__("os").environ.get("AIOS_GITOPS_WORKTREE_ROOT", "/var/lib/aios-gitops/worktrees"))
-    recovery = Path(__import__("os").environ.get("AIOS_RELEASE_RECOVERY_RECEIPT", "/var/lib/aios-gitops/release-campaigns/AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807/authorization-recovery.json"))
-    transport = GiteaMachineTransport(api, REPOSITORY, remote, authority_dir)
-    credential = MachineCredentialProjection.from_mapping({"scheme": "systemd-credential", "name": "gitea-machine-token", "account": account})
-    receipt = CampaignCapabilityReceipt(CAMPAIGN_ID, TASK_ID, REPOSITORY, BRANCH, EXPECTED_BRANCH_OID, frozenset({"exact_task_branch_push", "pr_create_update", "status_publish", "protected_merge", "remote_readback"}), frozenset({"direct_main_push", "force_push", "tag_update", "tag_delete", "baseline_write", "production_deploy"}))
-    return DurableJobExecutor(GitOpsJobController(JobStore(job_root)), AuthorityGitExecutor(authority_dir, worktree_root), GiteaMachineBroker(transport, credential, receipt), recovery)
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--job-root", required=True, type=Path)
-    parser.add_argument("--job-id", required=True)
-    parser.add_argument("--dry-run", action="store_true")
-    args = parser.parse_args(argv)
-    result = build_from_environment(args.job_root).execute(args.job_id, dry_run=args.dry_run)
-    print(json.dumps(result, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,80 +0,0 @@
-"""Pure, observation-first decisions for governed GitOps reconciliation."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from enum import Enum
-import re
-from typing import Optional
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-
-
-class ReconciliationAction(str, Enum):
-    NOOP = "NOOP"
-    PUSH_EXACT = "PUSH_EXACT"
-    VERIFY_REMOTE = "VERIFY_REMOTE"
-    MARK_REMOTE_VERIFIED = "MARK_REMOTE_VERIFIED"
-    MARK_RECONCILIATION_REQUIRED = "MARK_RECONCILIATION_REQUIRED"
-    FAIL_CONFLICT = "FAIL_CONFLICT"
-
-
-@dataclass(frozen=True, slots=True)
-class RemoteObservation:
-    repository_identity: str
-    branch: str
-    desired_oid: str
-    authority_oid: Optional[str]
-    remote_git_oid: Optional[str]
-    remote_api_oid: Optional[str]
-    commit_visible: bool
-    observed_at: str
-    expected_oid: Optional[str] = None
-
-    @property
-    def all_equal(self) -> bool:
-        values = (self.authority_oid, self.remote_git_oid, self.remote_api_oid, self.desired_oid)
-        return all(isinstance(value, str) for value in values) and len(set(values)) == 1
-
-
-@dataclass(frozen=True, slots=True)
-class ReconciliationDecision:
-    action: ReconciliationAction
-    state: str
-    reason: str
-    retry_safe: bool = False
-
-
-def _valid_oid(value: Optional[str]) -> bool:
-    return value is None or bool(OID_RE.fullmatch(value))
-
-
-def decide_reconciliation(observation: RemoteObservation) -> ReconciliationDecision:
-    """Decide from a fresh observation; never complete on a missing remote."""
-    if observation.repository_identity != "aios/aios":
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "REPOSITORY_IDENTITY_MISMATCH")
-    if not observation.branch.startswith("agent/"):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "BRANCH_SCOPE_DENIED")
-    if not _valid_oid(observation.desired_oid) or not _valid_oid(observation.expected_oid):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "OID_INVALID")
-    if observation.authority_oid is None:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "AUTHORITY_UNAVAILABLE")
-    if observation.authority_oid != observation.desired_oid:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "AUTHORITY_CONFLICT")
-    present = [oid for oid in (observation.remote_git_oid, observation.remote_api_oid) if oid is not None]
-    if any(oid not in {observation.desired_oid, observation.expected_oid} for oid in present):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "REMOTE_OID_CONFLICT")
-    if observation.all_equal and observation.commit_visible:
-        return ReconciliationDecision(ReconciliationAction.MARK_REMOTE_VERIFIED, "REMOTE_VERIFIED", "ALL_OIDS_EQUAL_AND_VISIBLE")
-    if observation.remote_git_oid is None and observation.remote_api_oid is None:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "REMOTE_PUSH_PENDING", "AUTHORITY_DESIRED_REMOTE_MISSING")
-    if observation.remote_git_oid == observation.desired_oid or observation.remote_api_oid == observation.desired_oid:
-        return ReconciliationDecision(ReconciliationAction.VERIFY_REMOTE, "REMOTE_VERIFY_PENDING", "REMOTE_PROOF_PARTIAL")
-    if observation.expected_oid is not None and observation.remote_git_oid == observation.expected_oid and observation.remote_api_oid == observation.expected_oid:
-        return ReconciliationDecision(ReconciliationAction.PUSH_EXACT, "REMOTE_PUSH_PENDING", "SAFE_EXACT_FAST_FORWARD_RETRY", retry_safe=True)
-    if not observation.commit_visible:
-        return ReconciliationDecision(ReconciliationAction.VERIFY_REMOTE, "COMMIT_VISIBILITY_PENDING", "COMMIT_VISIBILITY_LAG")
-    return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "PARTIAL_REMOTE_OBSERVATION")
-
-
-def reconcile_observation(**kwargs: object) -> ReconciliationDecision:
-    return decide_reconciliation(RemoteObservation(**kwargs))
@@ -1,100 +0,0 @@
-"""Single supervised socket-activated worker for durable GitOps Jobs.
-
-The worker consumes durable requests and reconciliation queries. Repository
-mutation is a separate injected executor and remains impossible while the
-legacy global write gate is false.
-"""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-from pathlib import Path
-import signal
-import socket
-import threading
-from typing import Any, Mapping
-
-from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore, ServiceUnavailable
-
-
-def runtime_policy(environment: Mapping[str, str] | None = None) -> dict[str, bool]:
-    env = environment or os.environ
-    legacy = env.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() in {"1", "true", "yes", "on"}
-    durable = env.get("AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED", "false").lower() in {"1", "true", "yes", "on"}
-    # Legacy direct Git mutation remains disabled. Authorized durable Jobs use
-    # their own campaign/task capability and may mutate only through the
-    # worker's lease/CAS path while the legacy gate stays false.
-    return {"legacy_global_write": legacy, "durable_job_execution": durable, "repository_mutation_allowed": durable}
-
-
-def handle_request(controller: GitOpsJobController, request: Mapping[str, Any], executor: Any | None = None) -> dict[str, Any]:
-    job_id = str(request.get("job_id") or "")
-    if not job_id:
-        raise JobError("JOB_ID_REQUIRED")
-    if request.get("action") == "execute":
-        if executor is None:
-            raise JobError("JOB_EXECUTOR_UNAVAILABLE")
-        result = executor.execute(job_id, dry_run=bool(request.get("dry_run", False)))
-        receipt = controller.store._receipt(controller.store.read(job_id), duplicate=True)
-        return {"job": result, **receipt.as_dict()}
-    if request.get("action") == "resume":
-        receipt = controller.resume(job_id)
-    else:
-        row = controller.store.read(job_id)
-        receipt = controller.store._receipt(row, duplicate=True)
-    return receipt.as_dict()
-
-
-def serve_socket(sock: socket.socket, controller: GitOpsJobController, stopping: threading.Event, executor: Any | None = None) -> None:
-    sock.listen(32)
-    sock.settimeout(1.0)
-    while not stopping.is_set():
-        try:
-            connection, _ = sock.accept()
-        except socket.timeout:
-            continue
-        with connection:
-            try:
-                raw = connection.makefile("rb").readline(1_048_576)
-                request = json.loads(raw.decode("utf-8"))
-                response = {"status": "ok", **handle_request(controller, request, executor)}
-            except ServiceUnavailable as exc:
-                response = {"status": "error", "error": str(exc), "retryable": True, "side_effect_state": "UNKNOWN"}
-            except Exception as exc:
-                response = {"status": "error", "error": type(exc).__name__, "retryable": False}
-            connection.sendall((json.dumps(response, sort_keys=True) + "\n").encode("utf-8"))
-
-
-def socket_from_systemd() -> socket.socket:
-    if os.environ.get("LISTEN_FDS") != "1":
-        raise RuntimeError("SOCKET_ACTIVATION_REQUIRED")
-    return socket.fromfd(3, socket.AF_UNIX, socket.SOCK_STREAM)
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--job-root", required=True, type=Path)
-    args = parser.parse_args(argv)
-    policy = runtime_policy()
-    if policy["legacy_global_write"]:
-        raise RuntimeError("LEGACY_GLOBAL_WRITES_MUST_REMAIN_FALSE")
-    if not policy["durable_job_execution"]:
-        raise RuntimeError("DURABLE_JOB_EXECUTION_GATE_CLOSED")
-    controller = GitOpsJobController(JobStore(args.job_root))
-    from aios_gitops_job_executor import build_from_environment
-    executor = build_from_environment(args.job_root)
-    stopping = threading.Event()
-    signal.signal(signal.SIGTERM, lambda *_: stopping.set())
-    signal.signal(signal.SIGINT, lambda *_: stopping.set())
-    sock = socket_from_systemd()
-    try:
-        serve_socket(sock, controller, stopping, executor)
-    finally:
-        sock.close()
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,69 +0,0 @@
-"""CLI client for the governed local writer service."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import socket
-import sys
-
-
-def _parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="Send one governed-local-writer request")
-    parser.add_argument("--socket", required=True, help="AF_UNIX socket path")
-    group = parser.add_mutually_exclusive_group(required=True)
-    group.add_argument("--request", help="Request JSON string")
-    group.add_argument("--request-file", help="Path to JSON request file")
-    return parser.parse_args()
-
-
-def _load_request_text(args: argparse.Namespace) -> str:
-    if args.request is not None:
-        return args.request
-    request_path = os.fspath(args.request_file)
-    with open(request_path, "r", encoding="utf-8") as request_file:
-        return request_file.read()
-
-
-def send_request(socket_path: str, request_text: str) -> dict[str, object]:
-    """Open one Unix socket, send one NDJSON request, and parse one NDJSON response."""
-    payload = json.loads(request_text)
-    if not isinstance(payload, dict):
-        raise ValueError("request must be a JSON object")
-
-    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
-        client.connect(socket_path)
-        client.sendall((json.dumps(payload) + "\n").encode("utf-8"))
-        response_chunks: list[str] = []
-        while True:
-            chunk = client.recv(1024 * 1024).decode("utf-8")
-            if not chunk:
-                break
-            response_chunks.append(chunk)
-            if "\n" in chunk:
-                break
-        response_text = "".join(response_chunks)
-
-    response_line = response_text.split("\n", 1)[0].strip()
-    if not response_line:
-        raise RuntimeError("empty response")
-    response = json.loads(response_line)
-    if not isinstance(response, dict):
-        raise RuntimeError("invalid response")
-    return response
-
-
-def main() -> None:
-    args = _parse_args()
-    request_text = _load_request_text(args)
-    response = send_request(args.socket, request_text)
-    print(json.dumps(response, separators=(",", ":"), sort_keys=True))
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except Exception as exc:  # pragma: no cover - CLI entrypoint behavior
-        print(json.dumps({"status": "error", "error": str(exc)}), file=sys.stderr)
-        raise SystemExit(1)
@@ -1,931 +0,0 @@
-"""Unix-socket service for governed local writer operations."""
-
-from __future__ import annotations
-
-import json
-import hashlib
-import argparse
-import importlib.util
-import os
-import re
-import socket
-import subprocess
-import sys
-import tempfile
-import uuid
-from dataclasses import dataclass, field
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol
-
-from governed_local_writer import (
-    AppendCommitRequest,
-    AuthorizationError,
-    BranchPolicy,
-    CreateBranchRequest,
-    GovernedAuthorization,
-    PeerIdentity,
-    PRINCIPAL,
-    TASK_ID,
-    extract_peer_identity,
-    contains_secret_like_content,
-    load_authorization_file,
-    validate_file_changes,
-)
-
-
-class ExistingGitOpsHandler:
-    """Delegate repository mutations to the installed GitOps handler seam."""
-
-    def __init__(
-        self,
-        *,
-        workspace_by_branch: Mapping[str, str | os.PathLike[str]],
-        bare_repo: str | os.PathLike[str],
-        api_source: str | os.PathLike[str],
-    ) -> None:
-        self.workspace_by_branch = {str(k): Path(v) for k, v in workspace_by_branch.items()}
-        self.bare_repo = Path(bare_repo)
-        self.api_source = Path(api_source)
-
-    @staticmethod
-    def _restore_env(previous: Mapping[str, str | None]) -> None:
-        for key, value in previous.items():
-            if value is None:
-                os.environ.pop(key, None)
-            else:
-                os.environ[key] = value
-
-    def _load_api(self, workspace: Path):
-        if not self.api_source.is_file() or self.api_source.is_symlink():
-            raise RuntimeError("installed GitOps handler source is unavailable")
-        keys = (
-            "AIOS_GITOPS_WORKSPACE",
-            "AIOS_GITOPS_BARE_REPO",
-            "AIOS_GITOPS_WRITES_ENABLED",
-            "PYTHONDONTWRITEBYTECODE",
-            "GIT_CONFIG_COUNT",
-            "GIT_CONFIG_KEY_0",
-            "GIT_CONFIG_VALUE_0",
-            "GIT_CONFIG_KEY_1",
-            "GIT_CONFIG_VALUE_1",
-        )
-        previous = {key: os.environ.get(key) for key in keys}
-        os.environ.update(
-            {
-                "AIOS_GITOPS_WORKSPACE": str(workspace),
-                "AIOS_GITOPS_BARE_REPO": str(self.bare_repo),
-                "AIOS_GITOPS_WRITES_ENABLED": "true",
-                "PYTHONDONTWRITEBYTECODE": "1",
-                "GIT_CONFIG_COUNT": "2",
-                "GIT_CONFIG_KEY_0": "safe.directory",
-                "GIT_CONFIG_VALUE_0": str(workspace),
-                "GIT_CONFIG_KEY_1": "safe.directory",
-                "GIT_CONFIG_VALUE_1": str(self.bare_repo),
-            }
-        )
-        module_name = f"_governed_gitops_api_{uuid.uuid4().hex}"
-        try:
-            spec = importlib.util.spec_from_file_location(module_name, self.api_source)
-            if spec is None or spec.loader is None:
-                raise RuntimeError("unable to load installed GitOps handler")
-            module = importlib.util.module_from_spec(spec)
-            sys.modules[module_name] = module
-            spec.loader.exec_module(module)
-            decision = module.evaluate_git_write(module.WS)
-            if not decision.allowed:
-                raise RuntimeError("existing GitOps write gate denied bootstrap")
-            return module, previous, module_name
-        except Exception:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-            raise
-
-    def _workspace(self, branch: str) -> Path:
-        workspace = self.workspace_by_branch.get(branch)
-        if workspace is None or not workspace.is_dir():
-            raise RuntimeError("branch workspace is not authorized")
-        return workspace
-
-    @staticmethod
-    def _git(workspace: Path, args: list[str]) -> str:
-        result = subprocess.run(
-            ["git", *args], cwd=workspace, text=True, capture_output=True, check=False
-        )
-        if result.returncode != 0:
-            raise RuntimeError("governed handler git probe failed")
-        return result.stdout.strip()
-
-    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
-        workspace = self._workspace(request.branch)
-        # A prior handler call may have completed the fast-forward sync before
-        # the process observed a post-commit error. Reconcile only an exact,
-        # metadata-only result; never overwrite or move an existing ref here.
-        try:
-            existing = self._git(
-                workspace,
-                [
-                    "--git-dir",
-                    str(self.bare_repo),
-                    "rev-parse",
-                    f"refs/heads/{request.branch}",
-                ],
-            )
-        except RuntimeError:
-            existing = ""
-        if existing:
-            parent = self._git(workspace, ["--git-dir", str(self.bare_repo), "rev-parse", f"{existing}^1"])
-            changed = self._git(
-                workspace,
-                [
-                    "--git-dir",
-                    str(self.bare_repo),
-                    "diff-tree",
-                    "--no-commit-id",
-                    "--name-only",
-                    "-r",
-                    existing,
-                ],
-            ).splitlines()
-            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
-            if parent != request.base_oid or changed != [f"patches/{safe_branch}.branch.json"]:
-                raise RuntimeError("existing branch is not an exact metadata-only bootstrap")
-            return {"head_oid": existing, "parent_oid": parent, "handler_status": "reconciled"}
-        module, previous, module_name = self._load_api(workspace)
-        phase = "loaded"
-        try:
-            phase = "verify_base"
-            parent = self._git(
-                workspace,
-                ["--git-dir", str(self.bare_repo), "rev-parse", "refs/heads/main"],
-            )
-            if parent != request.base_oid:
-                raise RuntimeError("authorized base OID drift")
-            phase = "checkout"
-            module.checkout(request.branch, base=request.base_oid, create=True)
-            phase = "write_metadata"
-            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
-            metadata_path = f"patches/{safe_branch}.branch.json"
-            module.write_json(
-                metadata_path,
-                {
-                    "schema": "aios.governed-local-writer-bootstrap.v1",
-                    "task_id": TASK_ID,
-                    "principal": PRINCIPAL,
-                    "branch": request.branch,
-                    "parent_oid": request.base_oid,
-                    "authorization_sha256": request.authorization_digest,
-                },
-            )
-            phase = "commit_and_sync"
-            result = module.commit(
-                [metadata_path], "chore(governance): bootstrap repair lease branch"
-            )
-            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
-            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
-            if first_parent != request.base_oid or (request.head_oid and head_oid != request.head_oid):
-                raise RuntimeError("bootstrap branch lineage check failed")
-            return {
-                "head_oid": head_oid,
-                "parent_oid": first_parent,
-                "handler_status": str(result.get("status")),
-            }
-        except Exception as exc:
-            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
-        finally:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-
-    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
-        workspace = self._workspace(request.branch)
-        module, previous, module_name = self._load_api(workspace)
-        phase = "loaded"
-        try:
-            phase = "verify_head"
-            current = self._git(workspace, ["rev-parse", "HEAD"])
-            if current != request.expected_head_oid:
-                raise RuntimeError("branch head advanced or is stale")
-            phase = "checkout"
-            module.checkout(request.branch, base=request.expected_head_oid, create=False)
-            phase = "write_files"
-            paths: list[str] = []
-            for change in request.changes:
-                paths.append(module.write_file(change.path, change.content))
-            phase = "commit_and_sync"
-            result = module.commit(paths, request.commit_message)
-            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
-            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
-            if first_parent != request.expected_head_oid or head_oid == first_parent:
-                raise RuntimeError("append commit lineage check failed")
-            return {
-                "head_oid": head_oid,
-                "parent_oid": first_parent,
-                "handler_status": str(result.get("status")),
-            }
-        except Exception as exc:
-            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
-        finally:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-
-
-class GovernedWriterHandler(Protocol):
-    """Small adapter interface for real writer backend handlers."""
-
-    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
-        """Create a branch using internal repo services."""
-
-    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
-        """Append a commit using internal repo services."""
-
-
-class AuditSink(Protocol):
-    """Pluggable sink for sanitized audit records."""
-
-    def append(self, record: "AuditRecord") -> None:
-        """Persist one audit record."""
-
-
-@dataclass
-class AuditRecord:
-    """Sanitized audit log entry."""
-
-    authorization_digest: str
-    peer_pid: int
-    peer_uid: int
-    peer_gid: int
-    peer_executable: str | None
-    timestamp: datetime
-    operation: str
-    branch: str
-    result: str
-
-
-class InMemoryAuditSink:
-    """Simple in-memory audit log used by tests."""
-
-    def __init__(self) -> None:
-        self.records: list[AuditRecord] = []
-
-    def append(self, record: AuditRecord) -> None:
-        self.records.append(record)
-
-
-@dataclass
-class _AuthorizationState:
-    """Tracks one-shot operation consumption."""
-
-    create_done: set[str] = field(default_factory=set)
-    append_done: set[str] = field(default_factory=set)
-    consumed: bool = False
-
-
-class GovernedLocalWriterService:
-    """Policy-aware AF_UNIX service that calls an injected handler."""
-
-    def __init__(
-        self,
-        socket_path: str | os.PathLike[str],
-        authorization: GovernedAuthorization,
-        handler: GovernedWriterHandler,
-        *,
-        audit_sink: AuditSink | None = None,
-        peer_identity_fn: Callable[[socket.socket], PeerIdentity] | None = None,
-        state_path: str | os.PathLike[str] | None = None,
-    ) -> None:
-        self.socket_path = Path(socket_path)
-        self.authorization = authorization
-        self.handler = handler
-        self.peer_identity_fn = peer_identity_fn or extract_peer_identity
-        self.state = _AuthorizationState()
-        self.audit_sink = audit_sink or InMemoryAuditSink()
-        self.state_path = Path(state_path) if state_path is not None else None
-        self._load_state()
-
-    def _load_state(self) -> None:
-        """Restore one-shot state without restoring request or secret material."""
-        if self.state_path is None or not self.state_path.exists():
-            return
-        try:
-            raw = json.loads(self.state_path.read_text(encoding="utf-8"))
-            if not isinstance(raw, dict):
-                raise ValueError("state must be an object")
-            if raw.get("authorization_sha256") != self.authorization.authorization_sha256:
-                raise ValueError("state authorization digest mismatch")
-            self.state.create_done = {str(v) for v in raw.get("create_done", [])}
-            self.state.append_done = {str(v) for v in raw.get("append_done", [])}
-            self.state.consumed = bool(raw.get("consumed", False))
-        except (OSError, ValueError, TypeError, json.JSONDecodeError) as exc:
-            raise AuthorizationError("authorization state is invalid") from exc
-
-    def _persist_state(self) -> None:
-        if self.state_path is None:
-            return
-        self.state_path.parent.mkdir(parents=True, exist_ok=True)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "create_done": sorted(self.state.create_done),
-            "append_done": sorted(self.state.append_done),
-            "consumed": self.state.consumed,
-        }
-        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            os.replace(temp_name, self.state_path)
-            os.chmod(self.state_path, 0o600)
-        finally:
-            if os.path.exists(temp_name):
-                os.unlink(temp_name)
-
-    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> None:
-        self.audit_sink.append(
-            AuditRecord(
-                authorization_digest=self.authorization.authorization_sha256,
-                peer_pid=peer.pid,
-                peer_uid=peer.uid,
-                peer_gid=peer.gid,
-                peer_executable=peer.executable,
-                timestamp=datetime.now(tz=timezone.utc),
-                operation=operation,
-                branch=branch,
-                result=result,
-            )
-        )
-
-    def _require_request_field(self, request: Mapping[str, Any], field_name: str) -> str:
-        value = request.get(field_name)
-        if not isinstance(value, str) or not value:
-            raise AuthorizationError(f"{field_name} must be a non-empty string")
-        return value
-
-    def _branch_policy(self, branch: str) -> BranchPolicy:
-        policy = self.authorization.branch_operations.get(branch)
-        if policy is None:
-            raise AuthorizationError("branch is not authorized")
-        return policy
-
-    def _ensure_not_consumed(self) -> None:
-        if self.state.consumed:
-            raise AuthorizationError("authorization consumed")
-        if datetime.now(tz=timezone.utc) >= self.authorization.expires_at:
-            raise AuthorizationError("authorization expired")
-
-    def _mark_success(self, op: str, branch: str) -> None:
-        if op == "create_branch":
-            self.state.create_done.add(branch)
-        elif op == "append_commit":
-            self.state.append_done.add(branch)
-
-        if self.state.create_done.issuperset(self.authorization.create_branches) and self.state.append_done.issuperset(
-            self.authorization.append_branches
-        ):
-            self.state.consumed = True
-        self._persist_state()
-
-    def _validate_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        task_id = self._require_request_field(request, "task_id")
-        if task_id != TASK_ID:
-            raise AuthorizationError("invalid task_id")
-
-        principal = self._require_request_field(request, "principal")
-        if principal != PRINCIPAL:
-            raise AuthorizationError("invalid principal")
-
-        operation = self._require_request_field(request, "op")
-        if operation not in {"create_branch", "append_commit"}:
-            raise AuthorizationError("unsupported operation")
-        if operation in self.authorization.denied_operations:
-            raise AuthorizationError("operation denied by policy")
-
-        branch = self._require_request_field(request, "branch")
-        self._ensure_not_consumed()
-        policy = self._branch_policy(branch)
-
-        if operation == "create_branch":
-            if policy.create_branch is None:
-                raise AuthorizationError("branch does not allow create_branch")
-            if branch in self.state.create_done:
-                raise AuthorizationError("create_branch already used for this branch")
-
-            base_oid = self._require_request_field(request, "base_oid")
-            raw_head_oid = request.get("head_oid")
-            if raw_head_oid is not None and (not isinstance(raw_head_oid, str) or not raw_head_oid):
-                raise AuthorizationError("head_oid must be a non-empty string when supplied")
-            head_oid = str(raw_head_oid) if raw_head_oid is not None else None
-            if base_oid != policy.create_branch.base_oid:
-                raise AuthorizationError("base_oid mismatch")
-            if policy.create_branch.head_oid is not None and head_oid != policy.create_branch.head_oid:
-                raise AuthorizationError("head_oid mismatch")
-
-            return {
-                "operation": operation,
-                "branch": branch,
-                "base_oid": base_oid,
-                "head_oid": head_oid,
-            }
-
-        if policy.append_commit is None:
-            raise AuthorizationError("branch does not allow append_commit")
-        if policy.create_branch is not None and branch not in self.state.create_done:
-            raise AuthorizationError("append_commit requires prior successful create_branch")
-        if branch in self.state.append_done:
-            raise AuthorizationError("append_commit already used for this branch")
-
-        expected_head = policy.append_commit.expected_head_oid
-        if "expected_head_oid" in request:
-            supplied_head = self._require_request_field(request, "expected_head_oid")
-        elif "current_head_oid" in request:
-            supplied_head = self._require_request_field(request, "current_head_oid")
-        else:
-            raise AuthorizationError("expected_head_oid or current_head_oid required")
-        if not re.fullmatch(r"[0-9a-fA-F]{40}", supplied_head):
-            raise AuthorizationError("head check must be a full commit OID")
-        if expected_head is not None and supplied_head != expected_head:
-            raise AuthorizationError("head check failed")
-
-        if request.get("force") is True or request.get("non_fast_forward") is True:
-            raise AuthorizationError("non-fast-forward operations are not allowed")
-        if request.get("history_rewrite") is True:
-            raise AuthorizationError("history rewrite is not allowed")
-        parent_oids = request.get("parent_oids")
-        if parent_oids is not None:
-            if not isinstance(parent_oids, list) or parent_oids != [supplied_head]:
-                raise AuthorizationError("parent_oids must contain exactly expected_head_oid")
-
-        changes = request.get("changes")
-        if not isinstance(changes, list):
-            raise AuthorizationError("changes must be a list")
-        validated_changes = validate_file_changes(changes, policy.append_commit.allowed_paths)
-        commit_message = request.get("commit_message", "chore(governance): append governed commit")
-        if not isinstance(commit_message, str) or not commit_message.strip() or len(commit_message) > 200:
-            raise AuthorizationError("commit_message must be a short non-empty string")
-        if "\n" in commit_message or "\r" in commit_message or contains_secret_like_content(commit_message):
-            raise AuthorizationError("commit_message failed policy")
-
-        return {
-            "operation": operation,
-            "branch": branch,
-            "expected_head_oid": supplied_head,
-            "changes": validated_changes,
-            "commit_message": commit_message.strip(),
-        }
-
-    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
-        """Run one request through policy checks and handler adapter."""
-        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
-        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
-        try:
-            details = self._validate_request(raw_request)
-            operation = str(details["operation"])
-            branch = str(details["branch"])
-
-            if operation == "create_branch":
-                self.handler.create_branch(
-                    CreateBranchRequest(
-                        branch=branch,
-                        base_oid=str(details["base_oid"]),
-                        head_oid=(
-                            str(details["head_oid"])
-                            if details.get("head_oid") is not None
-                            else None
-                        ),
-                        authorization_digest=self.authorization.authorization_sha256,
-                    )
-                )
-                self._mark_success("create_branch", branch)
-                self._new_audit(peer, operation, branch, "ok")
-                return {
-                    "status": "ok",
-                    "operation": operation,
-                    "branch": branch,
-                    "result": "applied",
-                }
-
-            self.handler.append_commit(
-                AppendCommitRequest(
-                    branch=branch,
-                    expected_head_oid=str(details["expected_head_oid"]),
-                    changes=tuple(details["changes"]),
-                    authorization_digest=self.authorization.authorization_sha256,
-                    commit_message=str(details["commit_message"]),
-                )
-            )
-            self._mark_success("append_commit", branch)
-            self._new_audit(peer, operation, branch, "ok")
-            return {
-                "status": "ok",
-                "operation": operation,
-                "branch": branch,
-                "result": "applied",
-            }
-        except Exception as error:
-            self._new_audit(peer, operation or "unknown", branch, f"error:{error.__class__.__name__}")
-            if isinstance(error, PermissionError):
-                code = "permission_denied"
-            elif isinstance(error, AuthorizationError):
-                code = "request_denied"
-            else:
-                code = "handler_failed"
-            if code == "handler_failed" and str(error).startswith("handler_phase="):
-                code = str(error)
-            return {
-                "status": "error",
-                "operation": operation or "unknown",
-                "branch": branch,
-                "error": code,
-            }
-
-    def _write_json(self, connection: socket.socket, payload: Mapping[str, Any]) -> None:
-        connection.sendall((json.dumps(payload) + "\n").encode("utf-8"))
-
-    def _handle_client(self, connection: socket.socket) -> None:
-        with connection:
-            try:
-                peer = self.peer_identity_fn(connection)
-            except Exception:
-                self._write_json(
-                    connection,
-                    {
-                        "status": "error",
-                        "operation": "connection",
-                        "branch": "",
-                        "error": "peer identity validation failed",
-                    },
-                )
-                return
-
-            with connection.makefile("r", encoding="utf-8") as stream:
-                for raw_line in stream:
-                    line = raw_line.strip()
-                    if not line:
-                        continue
-                    try:
-                        request = json.loads(line)
-                    except json.JSONDecodeError:
-                        self._write_json(
-                            connection,
-                            {
-                                "status": "error",
-                                "operation": "request",
-                                "branch": "",
-                                "error": "invalid json",
-                            },
-                        )
-                        continue
-                    if not isinstance(request, Mapping):
-                        self._write_json(
-                            connection,
-                            {
-                                "status": "error",
-                                "operation": "request",
-                                "branch": "",
-                                "error": "request must be a JSON object",
-                            },
-                        )
-                        continue
-                    self._write_json(connection, self.process_request(request, peer))
-
-    def _bind_socket(self) -> socket.socket:
-        if self.socket_path.exists():
-            raise RuntimeError("governed writer socket already exists")
-        parent = self.socket_path.parent
-        if not parent.is_dir():
-            raise RuntimeError("governed writer socket parent is missing")
-        if parent.is_symlink():
-            raise RuntimeError("governed writer socket parent must not be a symlink")
-        server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        server.bind(str(self.socket_path))
-        os.chmod(self.socket_path, 0o600)
-        server.listen(16)
-        return server
-
-    def serve(self) -> None:
-        """Serve newline-delimited JSON over a filesystem AF_UNIX socket."""
-        server = self._bind_socket()
-        try:
-            while True:
-                connection, _ = server.accept()
-                self._handle_client(connection)
-        finally:
-            server.close()
-            if self.socket_path.exists():
-                self.socket_path.unlink()
-
-
-class JsonAuditSink:
-    """Append-only root-owned audit sink containing no request payloads."""
-
-    def __init__(self, path: str | os.PathLike[str]) -> None:
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-
-    def append(self, record: AuditRecord) -> None:
-        payload = {
-            "authorization_sha256": record.authorization_digest,
-            "peer_pid": record.peer_pid,
-            "peer_uid": record.peer_uid,
-            "peer_gid": record.peer_gid,
-            "peer_executable": record.peer_executable,
-            "timestamp": record.timestamp.isoformat(),
-            "operation": record.operation,
-            "branch": record.branch,
-            "result": record.result,
-        }
-        line = (json.dumps(payload, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
-        fd = os.open(self.path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
-        try:
-            os.fchmod(fd, 0o600)
-            os.write(fd, line)
-        finally:
-            os.close(fd)
-
-
-
-# V2R1C6 durable receipt overlay.  This subclasses the original root-only
-# writer in-place so the existing AF_UNIX/SO_PEERCRED and handler policy remain
-# the only mutation path.
-_LegacyGovernedLocalWriterService = GovernedLocalWriterService
-
-class GovernedLocalWriterService(_LegacyGovernedLocalWriterService):
-    """Existing writer with durable request receipts and safe recovery."""
-
-    def _load_state(self) -> None:
-        super()._load_state()
-        self.state.receipts = {}
-        if self.state_path is None or not self.state_path.exists():
-            return
-        raw = json.loads(self.state_path.read_text(encoding="utf-8"))
-        if not isinstance(raw, dict):
-            raise AuthorizationError("authorization state is invalid")
-        receipts = raw.get("receipts", {})
-        if not isinstance(receipts, dict):
-            raise AuthorizationError("authorization receipts are invalid")
-        self.state.receipts = {
-            str(key): dict(value)
-            for key, value in receipts.items()
-            if isinstance(value, dict)
-        }
-
-    def _persist_state(self) -> None:
-        if self.state_path is None:
-            return
-        self.state_path.parent.mkdir(parents=True, exist_ok=True)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "create_done": sorted(self.state.create_done),
-            "append_done": sorted(self.state.append_done),
-            "consumed": bool(self.state.consumed),
-            "receipts": self.state.receipts,
-        }
-        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            os.replace(temp_name, self.state_path)
-            os.chmod(self.state_path, 0o600)
-        finally:
-            if os.path.exists(temp_name):
-                os.unlink(temp_name)
-
-    def _request_identity(self, request: Mapping[str, Any]) -> dict[str, str]:
-        canonical = json.dumps(dict(request), sort_keys=True, separators=(",", ":"), ensure_ascii=True)
-        fallback = hashlib.sha256(canonical.encode("utf-8")).hexdigest()
-        request_id = request.get("request_id")
-        idempotency_key = request.get("idempotency_key")
-        request_id = request_id.strip() if isinstance(request_id, str) and request_id.strip() else "legacy-" + fallback
-        idempotency_key = idempotency_key.strip() if isinstance(idempotency_key, str) and idempotency_key.strip() else "legacy-" + fallback
-        for field_name, value in (("request_id", request_id), ("idempotency_key", idempotency_key)):
-            if len(value) > 200 or "\n" in value or "\r" in value:
-                raise AuthorizationError(field_name + " is invalid")
-        return {
-            "request_id": request_id,
-            "idempotency_key": idempotency_key,
-            "request_fingerprint": fallback,
-        }
-
-    def _find_receipt(self, details: Mapping[str, Any], compare_fingerprint: bool = True):
-        request_id = str(details["request_id"])
-        idempotency_key = str(details["idempotency_key"])
-        fingerprint = str(details.get("request_fingerprint", ""))
-        for receipt in self.state.receipts.values():
-            if receipt.get("request_id") == request_id or receipt.get("idempotency_key") == idempotency_key:
-                if compare_fingerprint and receipt.get("request_fingerprint") != fingerprint:
-                    raise AuthorizationError("idempotency key reused with different request")
-                return receipt
-        return None
-
-    @staticmethod
-    def _receipt_response(receipt: Mapping[str, object], status: str = "receipt") -> dict[str, object]:
-        response = {
-            "status": status,
-            "request_id": receipt.get("request_id"),
-            "idempotency_key": receipt.get("idempotency_key"),
-            "operation": receipt.get("operation"),
-            "branch": receipt.get("branch", ""),
-            "receipt_status": receipt.get("status"),
-        }
-        for field_name in ("commit_oid", "final_head", "parent_oid", "audit_sha256", "error_code", "safe_to_retry"):
-            if field_name in receipt:
-                response[field_name] = receipt[field_name]
-        return response
-
-    def _new_receipt(self, details: Mapping[str, Any]) -> dict[str, object]:
-        return {
-            "request_id": str(details["request_id"]),
-            "idempotency_key": str(details["idempotency_key"]),
-            "request_fingerprint": str(details["request_fingerprint"]),
-            "operation": str(details["operation"]),
-            "branch": str(details.get("branch", "")),
-            "expected_head_oid": str(details.get("expected_head_oid", "")),
-            "status": "accepted",
-            "created_at": datetime.now(tz=timezone.utc).isoformat(),
-            "safe_to_retry": False,
-        }
-
-    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> str:
-        super()._new_audit(peer, operation, branch, result)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "peer_pid": peer.pid,
-            "peer_uid": peer.uid,
-            "peer_gid": peer.gid,
-            "peer_executable": peer.executable,
-            "operation": operation,
-            "branch": branch,
-            "result": result,
-        }
-        return hashlib.sha256(json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
-
-    def _mark_success(self, op: str, branch: str) -> None:
-        if op == "create_branch":
-            self.state.create_done.add(branch)
-        elif op in {"append_commit", "append_files", "append_batch"}:
-            self.state.append_done.add(branch)
-        # The provisioning grant is one-shot; the task writer lease itself must
-        # support multiple append receipts for the exact authorized branches.
-        self.state.consumed = False
-        self._persist_state()
-
-    def _validate_durable(self, raw_request: Mapping[str, Any]) -> dict[str, Any]:
-        operation = self._require_request_field(raw_request, "op")
-        identity = self._request_identity(raw_request)
-        if operation == "query_receipt":
-            return {"operation": operation, **identity}
-        if operation == "recover_request":
-            branch = self._require_request_field(raw_request, "branch")
-            policy = self._branch_policy(branch)
-            if policy.append_commit is None:
-                raise AuthorizationError("branch does not allow recovery")
-            expected = raw_request.get("expected_head_oid") or policy.append_commit.expected_head_oid
-            if not isinstance(expected, str) or not re.fullmatch(r"[0-9a-fA-F]{40}", expected):
-                raise AuthorizationError("recovery requires expected_head_oid")
-            return {"operation": operation, "branch": branch, "expected_head_oid": expected.lower(), **identity}
-        if operation not in {"create_branch", "append_commit", "append_files", "append_batch"}:
-            raise AuthorizationError("unsupported operation")
-        request = dict(raw_request)
-        if operation in {"append_files", "append_batch"}:
-            request["op"] = "append_commit"
-        if operation in {"append_commit", "append_files", "append_batch"}:
-            self.state.consumed = False
-        branch = request.get("branch")
-        removed = False
-        dynamic_expected = False
-        if isinstance(branch, str) and branch in self.state.append_done:
-            self.state.append_done.remove(branch)
-            removed = True
-            policy = self.authorization.branch_operations.get(branch)
-            if policy is not None and policy.append_commit is not None and policy.append_commit.expected_head_oid is not None:
-                from governed_local_writer import BranchAppendPolicy, BranchPolicy
-                self.authorization.branch_operations[branch] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=branch, expected_head_oid=None, allowed_paths=policy.append_commit.allowed_paths))
-                dynamic_expected = True
-        try:
-            details = super()._validate_request(request)
-        finally:
-            if dynamic_expected:
-                policy = self.authorization.branch_operations.get(str(branch))
-                if policy is not None and policy.append_commit is not None:
-                    from governed_local_writer import BranchAppendPolicy, BranchPolicy
-                    self.authorization.branch_operations[str(branch)] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=str(branch), expected_head_oid=str(raw_request.get("expected_head_oid") or ""), allowed_paths=policy.append_commit.allowed_paths))
-            if removed:
-                self.state.append_done.add(str(branch))
-        details.update(identity)
-        details["operation"] = operation
-        return details
-
-    def _recover_backend(self, details: Mapping[str, Any]) -> dict[str, object]:
-        if not hasattr(self.handler, "_workspace") or not hasattr(self.handler, "_git"):
-            raise RuntimeError("recovery backend unavailable")
-        workspace = self.handler._workspace(str(details["branch"]))
-        expected = str(details["expected_head_oid"])
-        current = self.handler._git(workspace, ["rev-parse", "HEAD"])
-        if current == expected:
-            return {"status": "not_started", "final_head": current}
-        parent = self.handler._git(workspace, ["rev-parse", "HEAD^1"])
-        if parent != expected:
-            raise RuntimeError("external branch advance during recovery")
-        return {"status": "applied", "commit_oid": current, "final_head": current, "parent_oid": parent}
-
-    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
-        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
-        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
-        try:
-            details = self._validate_durable(raw_request)
-            operation = str(details["operation"])
-            branch = str(details.get("branch", ""))
-            if operation == "query_receipt":
-                receipt = self._find_receipt(details, compare_fingerprint=False)
-                return self._receipt_response(receipt) if receipt is not None else {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"]}
-            if operation == "recover_request":
-                receipt = self._find_receipt(details, compare_fingerprint=False)
-                if receipt is None:
-                    return {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"], "safe_to_retry": True}
-                if receipt.get("status") == "applied":
-                    return self._receipt_response(receipt)
-                recovered = self._recover_backend(details)
-                if recovered.get("status") == "applied":
-                    receipt.update({"status": "applied", "commit_oid": recovered.get("commit_oid"), "final_head": recovered.get("final_head"), "parent_oid": recovered.get("parent_oid"), "safe_to_retry": False})
-                    self._mark_success("append_commit", branch)
-                    return self._receipt_response(receipt)
-                receipt["safe_to_retry"] = True
-                self._persist_state()
-                return self._receipt_response(receipt)
-            receipt = self._find_receipt(details)
-            if receipt is not None:
-                return self._receipt_response(receipt)
-            receipt = self._new_receipt(details)
-            self.state.receipts[str(details["request_id"])] = receipt
-            self._persist_state()
-            if operation == "create_branch":
-                result = self.handler.create_branch(CreateBranchRequest(branch=branch, base_oid=str(details["base_oid"]), head_oid=str(details["head_oid"]) if details.get("head_oid") is not None else None, authorization_digest=self.authorization.authorization_sha256))
-                commit_oid = str(result.get("head_oid", ""))
-                parent_oid = str(result.get("parent_oid", ""))
-                audit_sha = self._new_audit(peer, operation, branch, "ok")
-                receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
-                self._mark_success("create_branch", branch)
-                return self._receipt_response(receipt, status="ok") | {"result": "applied"}
-            result = self.handler.append_commit(AppendCommitRequest(branch=branch, expected_head_oid=str(details["expected_head_oid"]), changes=tuple(details["changes"]), authorization_digest=self.authorization.authorization_sha256, commit_message=str(details["commit_message"])))
-            commit_oid = str(result.get("head_oid", ""))
-            parent_oid = str(result.get("parent_oid", ""))
-            audit_sha = self._new_audit(peer, operation, branch, "ok")
-            receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
-            self._mark_success("append_commit", branch)
-            return self._receipt_response(receipt, status="ok") | {"result": "applied"}
-        except Exception as error:
-            try:
-                identity = self._request_identity(raw_request)
-                receipt = self.state.receipts.get(identity["request_id"])
-                if receipt is not None and receipt.get("status") == "accepted":
-                    receipt.update({"status": "failed", "error_code": error.__class__.__name__, "safe_to_retry": False})
-                    self._persist_state()
-            except Exception:
-                pass
-            self._new_audit(peer, operation, branch, "error:" + error.__class__.__name__)
-            return {"status": "error", "operation": operation, "branch": branch, "error": "request_denied" if isinstance(error, AuthorizationError) else "handler_failed"}
-
-def _parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="AIOS governed local writer")
-    parser.add_argument("--socket", required=True)
-    parser.add_argument("--authorization", required=True)
-    parser.add_argument("--state", required=True)
-    parser.add_argument("--audit", required=True)
-    parser.add_argument("--repair-branch", required=True)
-    parser.add_argument("--repair-workspace", required=True)
-    parser.add_argument("--candidate-branch", required=True)
-    parser.add_argument("--candidate-workspace", required=True)
-    parser.add_argument("--bare-repo", required=True)
-    parser.add_argument("--api-source", required=True)
-    return parser.parse_args()
-
-
-def main() -> int:
-    if hasattr(os, "geteuid") and os.geteuid() != 0:
-        print("governed local writer requires uid 0", file=sys.stderr)
-        return 2
-    args = _parse_args()
-    authorization = load_authorization_file(args.authorization)
-    handler = ExistingGitOpsHandler(
-        workspace_by_branch={
-            args.repair_branch: args.repair_workspace,
-            args.candidate_branch: args.candidate_workspace,
-        },
-        bare_repo=args.bare_repo,
-        api_source=args.api_source,
-    )
-    service = GovernedLocalWriterService(
-        args.socket,
-        authorization,
-        handler,
-        audit_sink=JsonAuditSink(args.audit),
-        state_path=args.state,
-    )
-    service.serve()
-    return 0
-
-
-if __name__ == "__main__":  # pragma: no cover - systemd entrypoint
-    raise SystemExit(main())
@@ -1,59 +0,0 @@
-"""Central fail-closed policy seam for governed task and continuation requests."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import re
-from typing import Any, Mapping
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedPolicyInput:
-    identity: str
-    task_id: str
-    repository: str
-    operation: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    generation: int
-    risk: str = "engineering"
-    requested_capabilities: tuple[str, ...] = ()
-    previous_generation: int | None = None
-
-
-@dataclass(frozen=True, slots=True)
-class PolicyDecision:
-    decision: str
-    reason: str
-
-    def as_dict(self) -> dict[str, str]:
-        return {"decision": self.decision, "reason": self.reason}
-
-
-def evaluate_policy(value: GovernedPolicyInput | Mapping[str, Any]) -> PolicyDecision:
-    if isinstance(value, Mapping):
-        value = GovernedPolicyInput(**value)
-    if value.repository != "aios/aios":
-        return PolicyDecision("DENY", "REPOSITORY_IDENTITY_MISMATCH")
-    if not OID_RE.fullmatch(value.base_oid) or not OID_RE.fullmatch(value.expected_branch_oid):
-        return PolicyDecision("DENY", "OID_INVALID")
-    if not value.target_branch.startswith("agent/") or value.target_branch in {"main", "master"}:
-        return PolicyDecision("DENY", "BRANCH_SCOPE_DENIED")
-    if "force_push" in value.requested_capabilities or "force" in value.operation.lower():
-        return PolicyDecision("DENY", "FORCE_PUSH_DENIED")
-    if {"main_write", "tag_write", "baseline_write", "production_write", "production_deploy", "tag_mutation", "baseline_mutation"}.intersection(value.requested_capabilities):
-        return PolicyDecision("DENY", "MUTATION_SCOPE_DENIED")
-    if not isinstance(value.generation, int) or isinstance(value.generation, bool) or value.generation < 1:
-        return PolicyDecision("DENY", "GENERATION_INVALID")
-    if value.previous_generation is not None and value.generation <= value.previous_generation:
-        return PolicyDecision("MANUAL_OWNER_REVIEW_REQUIRED", "GENERATION_NOT_MONOTONIC")
-    if not value.task_id:
-        return PolicyDecision("DENY", "TASK_ID_INVALID")
-    return PolicyDecision("ALLOW", "GOVERNED_ENGINEERING_SCOPE")
-
-
-class GovernedPolicy:
-    def decide(self, request: GovernedPolicyInput | Mapping[str, Any]) -> PolicyDecision:
-        return evaluate_policy(request)
@@ -1,270 +0,0 @@
-"""Durable governed task binding for CREATE_NEW and CONTINUE_EXISTING."""
-from __future__ import annotations
-
-from dataclasses import dataclass, asdict
-from contextlib import contextmanager
-import fcntl
-import hashlib
-import json
-from pathlib import Path
-import re
-from typing import Any, Mapping
-
-from aios_gitops_job_controller import GitOpsJobController, JobStore, sha256_json
-from aios_online_agent_execution import (
-    GovernedExecutionBinding,
-    project_execution_envelope,
-    project_online_task,
-)
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-
-
-class BootstrapError(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedTaskBinding:
-    task_id: str
-    repository: str
-    base_oid: str
-    target_branch: str
-    risk: str
-    description: str
-    idempotency_key: str
-    expected_branch_oid: str
-    branch_mode: str
-    generation: int
-    job_id: str | None = None
-
-    def response(self, *, idempotent: bool = False) -> dict[str, Any]:
-        return {"task_id": self.task_id, "repository": self.repository, "base_oid": self.base_oid, "target_branch": self.target_branch, "expected_branch_oid": self.expected_branch_oid, "generation": self.generation, "branch_mode": self.branch_mode, "create_target_branch": self.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if self.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True, "idempotent": idempotent, "state": "BOUND", "job_id": self.job_id}
-
-
-def _legacy_safe(value: str) -> str:
-    return re.sub(r"[^A-Za-z0-9_.-]+", "-", value).strip("-")[:120] or "task"
-
-
-def _task_key(value: str) -> str:
-    readable = _legacy_safe(value)[:72]
-    return f"{readable}-{hashlib.sha256(value.encode('utf-8')).hexdigest()[:24]}"
-
-
-class GovernedTaskBootstrap:
-    def __init__(self, authority: Any, root: Path, *, remote_name: str, token_path: Path, ssh_key_path: Path, api_base: str = "https://g.cnnetmkt.top/git/api/v1") -> None:
-        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.lock_root = self.root / "task-locks"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True); self.lock_root.mkdir(parents=True, exist_ok=True)
-
-    def _store(self, task_id: str) -> tuple[JobStore, GitOpsJobController]:
-        legacy = self.job_root / _legacy_safe(task_id)
-        keyed = self.job_root / _task_key(task_id)
-        root = legacy if legacy.is_dir() and not keyed.exists() else keyed
-        store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
-
-    def _metadata(self, task_id: str) -> Path:
-        return self.task_meta_root / (_task_key(task_id) + ".json")
-
-    def _legacy_metadata(self, task_id: str) -> Path:
-        return self.task_meta_root / (_legacy_safe(task_id) + ".json")
-
-    @contextmanager
-    def _task_lock(self, task_id: str):
-        path = self.lock_root / (_task_key(task_id) + ".lock")
-        with path.open("a+b") as handle:
-            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-            try:
-                yield
-            finally:
-                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
-
-    @contextmanager
-    def _branch_lock(self, repository: str, target_branch: str):
-        key = hashlib.sha256((repository + "\0" + target_branch).encode("utf-8")).hexdigest()
-        path = self.lock_root / ("branch-" + key + ".lock")
-        with path.open("a+b") as handle:
-            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-            try:
-                yield
-            finally:
-                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
-
-    def _read_existing(self, task_id: str) -> GovernedTaskBinding | None:
-        path = self._metadata(task_id)
-        if not path.exists():
-            path = self._legacy_metadata(task_id)
-        if not path.is_file() or path.is_symlink(): return None
-        binding = GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
-        if binding.task_id != task_id:
-            raise BootstrapError("TASK_BINDING_KEY_COLLISION")
-        return binding
-
-    def get_binding(self, task_id: str) -> GovernedTaskBinding:
-        """Return the exact durable binding; never synthesize missing lineage."""
-        existing = self._read_existing(str(task_id))
-        if existing is None or not existing.job_id:
-            raise BootstrapError("TASK_EXECUTION_PROJECTION_MISSING")
-        return existing
-
-    def execution_binding(self, binding: GovernedTaskBinding) -> GovernedExecutionBinding:
-        expected = binding.expected_branch_oid
-        mode = binding.branch_mode
-        if mode == "CREATE_NEW":
-            current = self.authority.read_ref("refs/heads/" + binding.target_branch)
-            if current is not None:
-                store, _ = self._store(binding.task_id)
-                with store._connect() as connection:
-                    rows = connection.execute(
-                        "SELECT current_head_oid,generation,state,lineage_anchor_oid "
-                        "FROM branch_leases WHERE job_id=? AND branch=? AND state='ACTIVE' "
-                        "ORDER BY revision DESC",
-                        (binding.job_id, binding.target_branch),
-                    ).fetchall()
-                if len(rows) != 1:
-                    raise BootstrapError("SAME_JOB_CONTINUATION_LEASE_INVALID")
-                row = rows[0]
-                if (
-                    str(row["current_head_oid"] or "") != current
-                    or int(row["generation"] or 0) != binding.generation
-                    or str(row["lineage_anchor_oid"] or "") != binding.base_oid
-                ):
-                    raise BootstrapError("SAME_JOB_CONTINUATION_BINDING_INVALID")
-                expected = current
-                mode = "CONTINUE_EXISTING"
-        return GovernedExecutionBinding.from_mapping(
-            {
-                "task_id": binding.task_id,
-                "job_id": binding.job_id,
-                "repository": binding.repository,
-                "base_oid": binding.base_oid,
-                "expected_branch_oid": expected,
-                "target_branch": binding.target_branch,
-                "branch_mode": mode,
-                "generation": binding.generation,
-                "idempotency_key": binding.idempotency_key,
-            }
-        )
-
-    def execution_envelope(
-        self,
-        task_id: str,
-        execution_request: Mapping[str, Any] | None = None,
-        *,
-        required_capabilities: tuple[str, ...] = (),
-        expected_job_id: str | None = None,
-    ) -> dict[str, Any]:
-        binding = self.get_binding(task_id)
-        if expected_job_id and binding.job_id != expected_job_id:
-            raise BootstrapError("JOB_BINDING_CONFLICT")
-        return project_execution_envelope(
-            self.execution_binding(binding),
-            execution_request,
-            required_capabilities=required_capabilities,
-        )
-
-    def online_task_projection(
-        self,
-        task_id: str,
-        task_request: Mapping[str, Any],
-        execution_request: Mapping[str, Any] | None = None,
-        *,
-        expected_job_id: str | None = None,
-    ) -> dict[str, Any]:
-        binding = self.get_binding(task_id)
-        if expected_job_id and binding.job_id != expected_job_id:
-            raise BootstrapError("JOB_BINDING_CONFLICT")
-        return project_online_task(self.execution_binding(binding), task_request, execution_request)
-
-    def _write(self, binding: GovernedTaskBinding) -> None:
-        path = self._metadata(binding.task_id); temporary = path.with_suffix(".tmp"); temporary.write_text(json.dumps(asdict(binding), sort_keys=True), encoding="utf-8"); temporary.replace(path)
-
-    def create(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        task_id = str(request.get("task_id") or "")
-        if not task_id:
-            raise BootstrapError("TASK_BINDING_INVALID")
-        repository = str(request.get("repository") or "")
-        target_branch = str(request.get("target_branch") or "")
-        with self._task_lock(task_id):
-            with self._branch_lock(repository, target_branch):
-                return self._create_locked(request)
-
-    def _create_locked(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        values = {key: str(request[key]) for key in ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")}
-        if values["repository"] != "aios/aios" or not OID_RE.fullmatch(values["base_oid"]): raise BootstrapError("TASK_BINDING_INVALID")
-        if not BRANCH_RE.fullmatch(values["target_branch"]): raise BootstrapError("TARGET_BRANCH_INVALID")
-        existing = self._read_existing(values["task_id"])
-        if existing is not None:
-            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")): raise BootstrapError("TASK_BINDING_CONFLICT")
-            optional = {"expected_branch_oid": existing.expected_branch_oid, "branch_mode": existing.branch_mode, "generation": existing.generation}
-            for key, durable in optional.items():
-                if key in request and str(request[key]) != str(durable): raise BootstrapError("TASK_BINDING_CONFLICT")
-            return existing.response(idempotent=True)
-        if not self.authority.commit_exists(values["base_oid"]): raise BootstrapError("BASE_COMMIT_NOT_FOUND")
-        current = self.authority.read_ref("refs/heads/" + values["target_branch"])
-        expected = str(request.get("expected_branch_oid") or values["base_oid"])
-        if current is None:
-            mode, generation = "CREATE_NEW", 1
-            if expected != values["base_oid"]: raise BootstrapError("EXPECTED_BASE_CONFLICT")
-        else:
-            if expected != current: raise BootstrapError("EXISTING_BRANCH_OID_CONFLICT")
-            parent_task_id = str(request.get("parent_task_id") or "")
-            parent_job_id = str(request.get("parent_job_id") or "")
-            if not parent_task_id or not parent_job_id:
-                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_REQUIRED")
-            parent = self._read_existing(parent_task_id)
-            if parent is None or parent.job_id != parent_job_id or parent.repository != values["repository"] or parent.target_branch != values["target_branch"]:
-                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_CONFLICT")
-            store, _ = self._store(parent_task_id)
-            with store._connect() as connection:
-                rows = connection.execute(
-                    "SELECT current_head_oid,generation,state FROM branch_leases WHERE job_id=? AND branch=? AND state='ACTIVE' ORDER BY revision DESC",
-                    (parent_job_id, values["target_branch"]),
-                ).fetchall()
-            if len(rows) != 1 or str(rows[0]["current_head_oid"] or "") != current:
-                raise BootstrapError("EXISTING_BRANCH_OWNERSHIP_CONFLICT")
-            mode, generation = "CONTINUE_EXISTING", int(rows[0]["generation"]) + 1
-            if "generation" in request and int(request["generation"]) != generation:
-                raise BootstrapError("GENERATION_BINDING_CONFLICT")
-        online_request = request.get("online_task")
-        execution_request = request.get("execution")
-        projection_required = (
-            online_request is not None
-            or execution_request is not None
-            or request.get("require_online_task_projection") is True
-        )
-        if projection_required:
-            if not isinstance(online_request, Mapping):
-                raise BootstrapError("ONLINE_TASK_REQUEST_INVALID")
-            if execution_request is not None and not isinstance(execution_request, Mapping):
-                raise BootstrapError("EXECUTION_REQUEST_INVALID")
-            provisional_job_id = "job-" + sha256_json(
-                {"client_idempotency_key": values["idempotency_key"]}
-            )[:32]
-            try:
-                provisional_binding = GovernedExecutionBinding.from_mapping(
-                    {
-                        "task_id": values["task_id"],
-                        "job_id": provisional_job_id,
-                        "repository": values["repository"],
-                        "base_oid": values["base_oid"],
-                        "expected_branch_oid": expected,
-                        "target_branch": values["target_branch"],
-                        "branch_mode": mode,
-                        "generation": generation,
-                        "idempotency_key": values["idempotency_key"],
-                    }
-                )
-                project_online_task(
-                    provisional_binding,
-                    dict(online_request),
-                    dict(execution_request or {}),
-                )
-            except Exception as exc:
-                raise BootstrapError("EXECUTION_BINDING_INVALID") from exc
-
-        payload = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
-        _, controller = self._store(values["task_id"])
-        receipt = controller.submit({"idempotency_key": values["idempotency_key"], "campaign_id": values["task_id"], "task_id": values["task_id"], "repository": values["repository"], "operation": "GOVERNED_TASK_CREATE", "branch": values["target_branch"], "expected_branch_oid": expected, "payload_digest": hashlib.sha256(payload).hexdigest(), "lineage_anchor_oid": values["base_oid"]}, payload=payload)
-        binding = GovernedTaskBinding(**values, expected_branch_oid=expected, branch_mode=mode, generation=generation, job_id=receipt.job_id)
-        self._write(binding)
-        return binding.response()
@@ -1,456 +0,0 @@
-#!/usr/bin/env python3
-"""Disabled-by-default TLS edge for the read-only GPT Online Task ingress.
-
-The internal AIOS ingress remains loopback-only. This service is a separate edge
-that may bind non-loopback only when the owner explicitly approves it. It
-forwards only the tiny read-only ingress API and never proxies the canonical
-Bridge or Task API.
-"""
-
-from __future__ import annotations
-
-from collections import defaultdict, deque
-from dataclasses import dataclass
-import hashlib
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import secrets
-import ssl
-import sys
-import threading
-import time
-import urllib.error
-import urllib.request
-from typing import Any, Mapping
-from urllib.parse import urlsplit
-
-UPSTREAM = "http://127.0.0.1:18945"
-MAX_BODY = 64 * 1024
-MAX_RESPONSE = 256 * 1024
-MAX_CONCURRENT_REQUESTS = 32
-REQUEST_TIMEOUT_SECONDS = 20
-RATE_WINDOW_SECONDS = 60
-RATE_LIMIT_REQUESTS = 60
-RATE_BURST_REQUESTS = 15
-RATE_MAX_CLIENTS = 4096
-_AUDIT_SALT = secrets.token_bytes(32)
-PUBLIC_APPROVAL_ENV = "AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED"
-PUBLIC_DOMAIN_ENV = "AIOS_GPT_EDGE_PUBLIC_DOMAIN"
-TASK_PATH_RE = re.compile(r"^/v1/read-only-tasks(?:/[A-Za-z0-9][A-Za-z0-9._:-]{7,127})?$")
-
-
-def _client_pseudonym(value: str) -> str:
-    return hashlib.sha256(_AUDIT_SALT + value.encode("utf-8", "replace")).hexdigest()[:16]
-
-
-def audit(event: str, **fields: object) -> None:
-    safe = {
-        "event": event,
-        "ts_unix_ms": int(time.time() * 1000),
-    }
-    for key, value in fields.items():
-        if key in {"authorization", "body", "token", "cookie", "client_ip"}:
-            continue
-        safe[key] = value
-    print(
-        json.dumps(safe, sort_keys=True, separators=(",", ":")),
-        file=sys.stderr,
-        flush=True,
-    )
-
-
-class EdgeError(RuntimeError):
-    def __init__(self, code: str, status: int = 400) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def public_bind_allowed(host: str, approval: str) -> str:
-    value = host.strip()
-    if value in {"127.0.0.1", "::1", "localhost"}:
-        return value
-    if approval != "1":
-        raise RuntimeError("GPT_EDGE_PUBLIC_BIND_OWNER_APPROVAL_REQUIRED")
-    if value not in {"0.0.0.0", "::"}:
-        raise RuntimeError("GPT_EDGE_BIND_ADDRESS_INVALID")
-    return value
-
-
-def validated_public_domain(value: str) -> str:
-    domain = value.strip().lower()
-    if not domain:
-        return ""
-    if len(domain) > 253 or re.fullmatch(
-        r"(?=.{1,253}\Z)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?",
-        domain,
-    ) is None:
-        raise RuntimeError("GPT_EDGE_PUBLIC_DOMAIN_INVALID")
-    return domain
-
-
-def validated_edge_identity(host: str, approval: str, domain: str) -> tuple[str, str]:
-    bind_host = public_bind_allowed(host, approval)
-    public_domain = validated_public_domain(domain)
-    if bind_host not in {"127.0.0.1", "::1", "localhost"} and not public_domain:
-        raise RuntimeError("GPT_EDGE_PUBLIC_DOMAIN_REQUIRED")
-    return bind_host, public_domain
-
-
-def validate_tls_file(path: Path, *, key: bool) -> Path:
-    if path.is_symlink() or not path.is_file():
-        raise RuntimeError("GPT_EDGE_TLS_FILE_INVALID")
-    size = path.stat().st_size
-    if size < 16 or size > 256 * 1024:
-        raise RuntimeError("GPT_EDGE_TLS_FILE_INVALID")
-    if key and (path.stat().st_mode & 0o077):
-        raise RuntimeError("GPT_EDGE_TLS_KEY_MODE_INVALID")
-    return path
-
-
-def build_tls_context(cert_path: Path, key_path: Path) -> ssl.SSLContext:
-    cert = validate_tls_file(cert_path, key=False)
-    key = validate_tls_file(key_path, key=True)
-    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-    context.minimum_version = ssl.TLSVersion.TLSv1_2
-    context.options |= ssl.OP_NO_COMPRESSION
-    context.load_cert_chain(certfile=str(cert), keyfile=str(key))
-    return context
-
-
-def allowed_route(method: str, raw_path: str) -> str:
-    parsed = urlsplit(raw_path)
-    if parsed.query or parsed.fragment:
-        raise EdgeError("QUERY_OR_FRAGMENT_DENY", 400)
-    path = parsed.path
-    if method == "GET" and path in {"/health", "/openapi.json"}:
-        return path
-    if method == "POST" and path == "/v1/read-only-tasks":
-        return path
-    if method == "GET" and TASK_PATH_RE.fullmatch(path):
-        return path
-    raise EdgeError("ROUTE_DENY", 404)
-
-
-def route_label(method: str, path: str) -> str:
-    if method == "GET" and path == "/health":
-        return "health"
-    if method == "GET" and path == "/openapi.json":
-        return "openapi"
-    if method == "POST" and path == "/v1/read-only-tasks":
-        return "task_create"
-    if method == "GET" and path.startswith("/v1/read-only-tasks/"):
-        return "task_status"
-    return "unknown"
-
-
-def forwarded_headers(headers: Mapping[str, str], *, body: bool) -> dict[str, str]:
-    result = {"Accept": "application/json"}
-    authorization = headers.get("Authorization")
-    if not isinstance(authorization, str) or not authorization.startswith("Bearer "):
-        raise EdgeError("AUTHORIZATION_REQUIRED", 401)
-    token = authorization[7:]
-    if len(token) < 32 or len(token) > 4096 or any(ch.isspace() for ch in token):
-        raise EdgeError("AUTHORIZATION_INVALID", 401)
-    result["Authorization"] = authorization
-    if body:
-        content_type = headers.get("Content-Type", "")
-        if content_type.split(";", 1)[0].strip().lower() != "application/json":
-            raise EdgeError("CONTENT_TYPE_INVALID", 415)
-        result["Content-Type"] = "application/json"
-    return result
-
-
-class RateLimiter:
-    def __init__(
-        self,
-        *,
-        window_seconds: int = RATE_WINDOW_SECONDS,
-        limit: int = RATE_LIMIT_REQUESTS,
-        burst: int = RATE_BURST_REQUESTS,
-        max_clients: int = RATE_MAX_CLIENTS,
-        now_fn=time.monotonic,
-    ) -> None:
-        self.window_seconds = window_seconds
-        self.limit = limit
-        self.burst = burst
-        self.max_clients = max_clients
-        self.now_fn = now_fn
-        self._lock = threading.Lock()
-        self._events: dict[str, deque[float]] = defaultdict(deque)
-
-    def _prune_stale(self, cutoff: float) -> None:
-        stale = [
-            key
-            for key, events in self._events.items()
-            if not events or events[-1] <= cutoff
-        ]
-        for key in stale:
-            self._events.pop(key, None)
-
-    def allowed(self, key: str) -> bool:
-        now = self.now_fn()
-        cutoff = now - self.window_seconds
-        with self._lock:
-            if key not in self._events and len(self._events) >= self.max_clients:
-                self._prune_stale(cutoff)
-                if len(self._events) >= self.max_clients:
-                    return False
-            events = self._events[key]
-            while events and events[0] <= cutoff:
-                events.popleft()
-            if len(events) >= self.limit + self.burst:
-                return False
-            events.append(now)
-            return True
-
-
-@dataclass(frozen=True)
-class Proxy:
-    upstream: str = UPSTREAM
-    timeout: int = REQUEST_TIMEOUT_SECONDS
-
-    def request(
-        self,
-        method: str,
-        path: str,
-        headers: Mapping[str, str],
-        body: bytes | None,
-    ) -> tuple[int, bytes, str]:
-        if self.upstream != UPSTREAM:
-            raise EdgeError("UPSTREAM_DRIFT_DENY", 503)
-        req = urllib.request.Request(
-            self.upstream + path,
-            method=method,
-            data=body,
-            headers=dict(headers),
-        )
-        try:
-            with urllib.request.urlopen(req, timeout=self.timeout) as response:
-                raw = response.read(MAX_RESPONSE + 1)
-                status = response.status
-                content_type = response.headers.get("Content-Type", "application/json")
-        except urllib.error.HTTPError as exc:
-            raw = exc.read(MAX_RESPONSE + 1)
-            status = exc.code
-            content_type = exc.headers.get("Content-Type", "application/json")
-        except Exception as exc:
-            raise EdgeError("UPSTREAM_UNAVAILABLE", 502) from exc
-        if len(raw) > MAX_RESPONSE:
-            raise EdgeError("UPSTREAM_RESPONSE_TOO_LARGE", 502)
-        if content_type.split(";", 1)[0].strip().lower() != "application/json":
-            raise EdgeError("UPSTREAM_CONTENT_TYPE_INVALID", 502)
-        return status, raw, "application/json"
-
-
-class EdgeServer(ThreadingHTTPServer):
-    daemon_threads = True
-    request_queue_size = 64
-    allow_reuse_address = True
-
-
-class Handler(BaseHTTPRequestHandler):
-    proxy = Proxy()
-    limiter = RateLimiter()
-    concurrency = threading.BoundedSemaphore(MAX_CONCURRENT_REQUESTS)
-    expected_domain = ""
-
-    server_version = "AIOSGPTIngressEdge/1.0"
-    sys_version = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def respond_json(self, value: Mapping[str, Any], status: int) -> None:
-        raw = canonical(value)
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("X-Content-Type-Options", "nosniff")
-        self.send_header("Referrer-Policy", "no-referrer")
-        self.send_header("Content-Security-Policy", "default-src 'none'")
-        self.send_header("Strict-Transport-Security", "max-age=31536000")
-        self.send_header("Content-Length", str(len(raw)))
-        self.end_headers()
-        self.wfile.write(raw)
-
-    def send_proxy_response(self, status: int, raw: bytes, content_type: str) -> None:
-        self.send_response(status)
-        self.send_header("Content-Type", content_type)
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("X-Content-Type-Options", "nosniff")
-        self.send_header("Referrer-Policy", "no-referrer")
-        self.send_header("Content-Security-Policy", "default-src 'none'")
-        self.send_header("Strict-Transport-Security", "max-age=31536000")
-        self.send_header("Content-Length", str(len(raw)))
-        self.end_headers()
-        self.wfile.write(raw)
-
-    def client_key(self) -> str:
-        return str(self.client_address[0])
-
-    def validate_host(self) -> None:
-        if not self.expected_domain:
-            return
-        host = self.headers.get("Host", "").split(":", 1)[0].lower()
-        if not hmac.compare_digest(host, self.expected_domain):
-            raise EdgeError("HOST_HEADER_DENY", 421)
-
-    def body(self) -> bytes:
-        try:
-            length = int(self.headers.get("Content-Length", "-1"))
-        except ValueError as exc:
-            raise EdgeError("CONTENT_LENGTH_INVALID") from exc
-        if length < 1 or length > MAX_BODY:
-            raise EdgeError("REQUEST_SIZE_INVALID", 413)
-        raw = self.rfile.read(length)
-        if len(raw) != length:
-            raise EdgeError("REQUEST_BODY_TRUNCATED", 400)
-        # Validate JSON at the edge so malformed bodies do not consume upstream work.
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except Exception as exc:
-            raise EdgeError("REQUEST_JSON_INVALID", 400) from exc
-        if not isinstance(value, Mapping):
-            raise EdgeError("REQUEST_JSON_OBJECT_REQUIRED", 400)
-        return canonical(value)
-
-    def handle_proxy(self, method: str) -> None:
-        client_id = _client_pseudonym(self.client_key())
-        started = time.monotonic()
-        acquired = self.concurrency.acquire(blocking=False)
-        if not acquired:
-            audit("EDGE_BUSY", client_id=client_id, method=method)
-            self.respond_json({"error": "EDGE_BUSY"}, 503)
-            return
-        label = "unknown"
-        try:
-            self.validate_host()
-            path = allowed_route(method, self.path)
-            label = route_label(method, path)
-            if path == "/health" and method == "GET":
-                self.respond_json(
-                    {
-                        "status": "ok",
-                        "service": "aios-gpt-https-edge",
-                        "upstream": "loopback-readonly-ingress",
-                    },
-                    200,
-                )
-                audit(
-                    "EDGE_REQUEST",
-                    client_id=client_id,
-                    method=method,
-                    route=label,
-                    status=200,
-                    duration_ms=int((time.monotonic() - started) * 1000),
-                )
-                return
-            if not self.limiter.allowed(self.client_key()):
-                audit(
-                    "EDGE_RATE_LIMIT",
-                    client_id=client_id,
-                    method=method,
-                    route=label,
-                )
-                self.respond_json({"error": "RATE_LIMITED"}, 429)
-                return
-            has_body = method == "POST"
-            headers = forwarded_headers(self.headers, body=has_body)
-            body = self.body() if has_body else None
-            status, raw, content_type = self.proxy.request(
-                method,
-                path,
-                headers,
-                body,
-            )
-            self.send_proxy_response(status, raw, content_type)
-            audit(
-                "EDGE_REQUEST",
-                client_id=client_id,
-                method=method,
-                route=label,
-                status=status,
-                duration_ms=int((time.monotonic() - started) * 1000),
-            )
-        except EdgeError as exc:
-            audit(
-                "EDGE_REJECT",
-                client_id=client_id,
-                method=method,
-                route=label,
-                status=exc.status,
-                error=exc.code,
-            )
-            self.respond_json({"error": exc.code}, exc.status)
-        finally:
-            self.concurrency.release()
-
-    def do_GET(self) -> None:
-        self.handle_proxy("GET")
-
-    def do_POST(self) -> None:
-        self.handle_proxy("POST")
-
-    def do_PUT(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-    def do_PATCH(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-    def do_DELETE(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-    def do_CONNECT(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-    def do_OPTIONS(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-
-def serve() -> None:
-    host, public_domain = validated_edge_identity(
-        os.environ.get("AIOS_GPT_EDGE_HOST", "127.0.0.1"),
-        os.environ.get(PUBLIC_APPROVAL_ENV, "0"),
-        os.environ.get(PUBLIC_DOMAIN_ENV, ""),
-    )
-    port = int(os.environ.get("AIOS_GPT_EDGE_PORT", "18443"))
-    if not 1024 <= port <= 65535:
-        raise RuntimeError("GPT_EDGE_PORT_INVALID")
-    Handler.expected_domain = public_domain
-
-    credentials = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-    cert_path = Path(
-        os.environ.get(
-            "AIOS_GPT_EDGE_TLS_CERT_FILE",
-            str(credentials / "tls_cert"),
-        )
-    )
-    key_path = Path(
-        os.environ.get(
-            "AIOS_GPT_EDGE_TLS_KEY_FILE",
-            str(credentials / "tls_key"),
-        )
-    )
-    context = build_tls_context(cert_path, key_path)
-
-    server = EdgeServer((host, port), Handler)
-    server.socket = context.wrap_socket(server.socket, server_side=True)
-    server.serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,561 +0,0 @@
-#!/usr/bin/env python3
-"""Owner-approved activation/rollback controller for the AIOS GPT HTTPS edge.
-
-This controller never creates approval, TLS, or ingress credentials. It consumes
-owner-managed inputs, applies one exact public-bind overlay, verifies the live
-edge, and provides an idempotent rollback path.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import argparse
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import socket
-import ssl
-import stat
-import subprocess
-import tempfile
-import time
-import urllib.request
-from typing import Any, Mapping
-
-APPROVAL_SCHEMA = "aios.gpt-https-edge.public-approval.v1"
-STATE_SCHEMA = "aios.gpt-https-edge.activation-state.v1"
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-APPROVAL_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$")
-DOMAIN_RE = re.compile(
-    r"(?=.{1,253}\Z)"
-    r"(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+"
-    r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?"
-)
-
-EDGE_UNIT = "aios-gpt-https-edge.service"
-INGRESS_UNIT = "aios-gpt-online-task-ingress.service"
-PUBLIC_HOST = "0.0.0.0"
-PUBLIC_PORT = 18443
-INGRESS_HEALTH = "http://127.0.0.1:18945/health"
-DROPIN_NAME = "zzzzzzzzzz-owner-approved-public.conf"
-
-
-class ActivationError(RuntimeError):
-    pass
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def sha256_bytes(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-
-def sha256_file(path: Path) -> str:
-    return sha256_bytes(path.read_bytes())
-
-
-def parse_time(value: object, *, field: str) -> datetime:
-    if not isinstance(value, str) or not value.strip():
-        raise ActivationError("APPROVAL_" + field.upper() + "_INVALID")
-    text = value.strip()
-    if text.endswith("Z"):
-        text = text[:-1] + "+00:00"
-    try:
-        parsed = datetime.fromisoformat(text)
-    except ValueError as exc:
-        raise ActivationError("APPROVAL_" + field.upper() + "_INVALID") from exc
-    if parsed.tzinfo is None:
-        raise ActivationError("APPROVAL_" + field.upper() + "_INVALID")
-    return parsed.astimezone(timezone.utc)
-
-
-def validate_domain(value: object) -> str:
-    if not isinstance(value, str):
-        raise ActivationError("APPROVAL_DOMAIN_INVALID")
-    domain = value.strip().lower()
-    if DOMAIN_RE.fullmatch(domain) is None:
-        raise ActivationError("APPROVAL_DOMAIN_INVALID")
-    return domain
-
-
-def validate_root_file(
-    path: Path,
-    *,
-    exact_mode: int | None = None,
-    max_size: int = 256 * 1024,
-) -> Path:
-    if path.is_symlink() or not path.is_file():
-        raise ActivationError("OWNER_FILE_INVALID")
-    info = path.stat()
-    if info.st_uid != 0 or info.st_gid != 0:
-        raise ActivationError("OWNER_FILE_OWNERSHIP_INVALID")
-    mode = stat.S_IMODE(info.st_mode)
-    if exact_mode is not None and mode != exact_mode:
-        raise ActivationError("OWNER_FILE_MODE_INVALID")
-    if info.st_size < 16 or info.st_size > max_size:
-        raise ActivationError("OWNER_FILE_SIZE_INVALID")
-    return path
-
-
-def certificate_dns_names(cert_path: Path) -> tuple[str, ...]:
-    try:
-        decoded = ssl._ssl._test_decode_cert(str(cert_path))
-    except Exception as exc:
-        raise ActivationError("TLS_CERT_DECODE_INVALID") from exc
-    names = [
-        value
-        for kind, value in decoded.get("subjectAltName", ())
-        if kind == "DNS"
-    ]
-    if not names:
-        for rdn in decoded.get("subject", ()):
-            for key, value in rdn:
-                if key == "commonName":
-                    names.append(value)
-    return tuple(names)
-
-
-def cert_matches_domain(cert_path: Path, domain: str) -> bool:
-    names = certificate_dns_names(cert_path)
-    try:
-        return bool(names) and any(ssl._dnsname_match(name, domain) for name in names)
-    except ssl.CertificateError:
-        return False
-
-
-def validate_tls_pair(
-    cert_path: Path,
-    key_path: Path,
-    domain: str,
-    *,
-    now_fn=time.time,
-) -> dict[str, Any]:
-    validate_root_file(cert_path)
-    validate_root_file(key_path, exact_mode=0o600)
-    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-    context.minimum_version = ssl.TLSVersion.TLSv1_2
-    context.options |= ssl.OP_NO_COMPRESSION
-    try:
-        context.load_cert_chain(str(cert_path), str(key_path))
-    except Exception as exc:
-        raise ActivationError("TLS_CERT_KEY_PAIR_INVALID") from exc
-    if not cert_matches_domain(cert_path, domain):
-        raise ActivationError("TLS_CERT_DOMAIN_MISMATCH")
-    decoded = ssl._ssl._test_decode_cert(str(cert_path))
-    not_after = decoded.get("notAfter")
-    if not not_after:
-        raise ActivationError("TLS_CERT_EXPIRY_MISSING")
-    remaining = ssl.cert_time_to_seconds(not_after) - now_fn()
-    if remaining < 7 * 86400:
-        raise ActivationError("TLS_CERT_EXPIRY_TOO_CLOSE")
-    return {
-        "cert_sha256": sha256_file(cert_path),
-        "remaining_days": int(remaining // 86400),
-    }
-
-
-@dataclass(frozen=True)
-class Approval:
-    approval_id: str
-    candidate_oid: str
-    domain: str
-    bind_host: str
-    port: int
-    tls_cert_sha256: str
-    owner: str
-    issued_at: datetime
-    not_before: datetime
-    expires_at: datetime
-    raw_sha256: str
-
-    @classmethod
-    def load(
-        cls,
-        path: Path,
-        *,
-        candidate_oid: str,
-        cert_path: Path,
-        now: datetime | None = None,
-    ) -> "Approval":
-        validate_root_file(path, exact_mode=0o600, max_size=64 * 1024)
-        try:
-            value = json.loads(path.read_text(encoding="utf-8"))
-        except Exception as exc:
-            raise ActivationError("APPROVAL_JSON_INVALID") from exc
-        if not isinstance(value, Mapping):
-            raise ActivationError("APPROVAL_JSON_INVALID")
-        allowed = {
-            "schema",
-            "approval_id",
-            "candidate_oid",
-            "domain",
-            "public_bind",
-            "bind_host",
-            "port",
-            "tls_cert_sha256",
-            "issued_at",
-            "not_before",
-            "expires_at",
-            "owner",
-        }
-        if set(value) != allowed or value.get("schema") != APPROVAL_SCHEMA:
-            raise ActivationError("APPROVAL_FIELDS_INVALID")
-
-        approval_id = value.get("approval_id")
-        if not isinstance(approval_id, str) or APPROVAL_ID_RE.fullmatch(approval_id) is None:
-            raise ActivationError("APPROVAL_ID_INVALID")
-        if not OID_RE.fullmatch(str(value.get("candidate_oid") or "")):
-            raise ActivationError("APPROVAL_CANDIDATE_INVALID")
-        if value["candidate_oid"] != candidate_oid:
-            raise ActivationError("APPROVAL_CANDIDATE_MISMATCH")
-        if value.get("public_bind") is not True:
-            raise ActivationError("APPROVAL_PUBLIC_BIND_REQUIRED")
-        if value.get("bind_host") != PUBLIC_HOST or value.get("port") != PUBLIC_PORT:
-            raise ActivationError("APPROVAL_BINDING_INVALID")
-
-        cert_sha = str(value.get("tls_cert_sha256") or "")
-        if SHA_RE.fullmatch(cert_sha) is None:
-            raise ActivationError("APPROVAL_CERT_SHA_INVALID")
-        if not cert_path.is_file() or sha256_file(cert_path) != cert_sha:
-            raise ActivationError("APPROVAL_CERT_SHA_MISMATCH")
-
-        domain = validate_domain(value.get("domain"))
-        owner = value.get("owner")
-        if not isinstance(owner, str) or not owner.strip() or len(owner) > 255:
-            raise ActivationError("APPROVAL_OWNER_INVALID")
-
-        issued_at = parse_time(value.get("issued_at"), field="issued_at")
-        not_before = parse_time(value.get("not_before"), field="not_before")
-        expires_at = parse_time(value.get("expires_at"), field="expires_at")
-        current = now or datetime.now(timezone.utc)
-        if not (issued_at <= not_before <= expires_at):
-            raise ActivationError("APPROVAL_TIME_ORDER_INVALID")
-        if current < not_before:
-            raise ActivationError("APPROVAL_NOT_YET_VALID")
-        if current >= expires_at:
-            raise ActivationError("APPROVAL_EXPIRED")
-        if expires_at - issued_at > __import__("datetime").timedelta(days=7):
-            raise ActivationError("APPROVAL_VALIDITY_TOO_LONG")
-
-        return cls(
-            approval_id=approval_id,
-            candidate_oid=candidate_oid,
-            domain=domain,
-            bind_host=PUBLIC_HOST,
-            port=PUBLIC_PORT,
-            tls_cert_sha256=cert_sha,
-            owner=owner.strip(),
-            issued_at=issued_at,
-            not_before=not_before,
-            expires_at=expires_at,
-            raw_sha256=sha256_file(path),
-        )
-
-
-def validate_release(release_root: Path) -> dict[str, Path]:
-    if release_root.is_symlink() or not release_root.is_dir():
-        raise ActivationError("IMMUTABLE_RELEASE_INVALID")
-    edge = release_root / "active-runtime/app/aios_gpt_https_edge.py"
-    controller = release_root / "active-runtime/app/aios_gpt_https_edge_activation.py"
-    for path in (edge, controller):
-        if path.is_symlink() or not path.is_file():
-            raise ActivationError("IMMUTABLE_RELEASE_INVALID")
-    return {"edge": edge, "controller": controller}
-
-
-def render_dropin(approval: Approval, release_root: Path) -> str:
-    app = release_root / "active-runtime/app/aios_gpt_https_edge.py"
-    return (
-        "[Service]\n"
-        f"Environment=AIOS_GPT_EDGE_HOST={approval.bind_host}\n"
-        f"Environment=AIOS_GPT_EDGE_PORT={approval.port}\n"
-        "Environment=AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=1\n"
-        f"Environment=AIOS_GPT_EDGE_PUBLIC_DOMAIN={approval.domain}\n"
-        "ExecStart=\n"
-        f"ExecStart=/usr/bin/python3 -B {app}\n"
-        f"ReadOnlyPaths={release_root}\n"
-    )
-
-
-def atomic_write(path: Path, data: str, mode: int = 0o600) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, name = tempfile.mkstemp(prefix="." + path.name + ".", dir=path.parent)
-    try:
-        os.fchmod(fd, mode)
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            handle.write(data)
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(name, path)
-    finally:
-        if os.path.exists(name):
-            os.unlink(name)
-
-
-class Systemd:
-    def run(self, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-        return subprocess.run(
-            ["/usr/bin/systemctl", *args],
-            check=check,
-            text=True,
-            capture_output=True,
-            timeout=30,
-        )
-
-    def active(self, unit: str) -> bool:
-        return self.run("is-active", "--quiet", unit, check=False).returncode == 0
-
-    def enabled(self, unit: str) -> bool:
-        return self.run("is-enabled", "--quiet", unit, check=False).returncode == 0
-
-    def show(self, unit: str, prop: str) -> str:
-        return self.run("show", unit, f"--property={prop}", "--value").stdout.strip()
-
-
-def require_ingress_ready(systemd: Systemd) -> None:
-    if not systemd.active(INGRESS_UNIT):
-        raise ActivationError("INGRESS_SERVICE_NOT_ACTIVE")
-    try:
-        with urllib.request.urlopen(INGRESS_HEALTH, timeout=5) as response:
-            if response.status != 200:
-                raise ActivationError("INGRESS_HEALTH_FAILED")
-            value = json.loads(response.read().decode())
-    except ActivationError:
-        raise
-    except Exception as exc:
-        raise ActivationError("INGRESS_HEALTH_FAILED") from exc
-    if value.get("status") != "ok":
-        raise ActivationError("INGRESS_HEALTH_FAILED")
-
-
-def tls_probe(domain: str, cert_path: Path, *, port: int = PUBLIC_PORT) -> None:
-    context = ssl.create_default_context(cafile=str(cert_path))
-    context.check_hostname = True
-    context.verify_mode = ssl.CERT_REQUIRED
-    try:
-        with socket.create_connection(("127.0.0.1", port), timeout=5) as sock:
-            with context.wrap_socket(sock, server_hostname=domain) as tls_sock:
-                if tls_sock.version() not in {"TLSv1.2", "TLSv1.3"}:
-                    raise ActivationError("EDGE_TLS_VERSION_INVALID")
-    except ActivationError:
-        raise
-    except Exception as exc:
-        raise ActivationError("EDGE_TLS_PROBE_FAILED") from exc
-
-
-def receipt_for(
-    approval: Approval,
-    release_root: Path,
-    *,
-    state: str,
-) -> dict[str, Any]:
-    return {
-        "schema": STATE_SCHEMA,
-        "state": state,
-        "approval_id": approval.approval_id,
-        "approval_sha256": approval.raw_sha256,
-        "candidate_oid": approval.candidate_oid,
-        "domain": approval.domain,
-        "bind_host": approval.bind_host,
-        "port": approval.port,
-        "tls_cert_sha256": approval.tls_cert_sha256,
-        "release_root": str(release_root),
-        "updated_at": datetime.now(timezone.utc).isoformat(),
-    }
-
-
-def activate(
-    *,
-    approval: Approval,
-    release_root: Path,
-    cert_path: Path,
-    key_path: Path,
-    dropin_path: Path,
-    state_path: Path,
-    systemd: Systemd,
-) -> dict[str, Any]:
-    if os.geteuid() != 0:
-        raise ActivationError("ROOT_REQUIRED")
-    release = validate_release(release_root)
-    app = release["edge"]
-    require_ingress_ready(systemd)
-    validate_tls_pair(cert_path, key_path, approval.domain)
-
-    if state_path.is_file():
-        try:
-            existing = json.loads(state_path.read_text(encoding="utf-8"))
-        except Exception:
-            existing = {}
-        if (
-            existing.get("schema") == STATE_SCHEMA
-            and existing.get("state") == "ACTIVE"
-            and existing.get("approval_sha256") == approval.raw_sha256
-            and existing.get("candidate_oid") == approval.candidate_oid
-            and systemd.active(EDGE_UNIT)
-        ):
-            return existing
-
-    dropin = render_dropin(approval, release_root)
-    modified = False
-    try:
-        atomic_write(dropin_path, dropin, mode=0o644)
-        modified = True
-        systemd.run("daemon-reload")
-        systemd.run("enable", EDGE_UNIT)
-        systemd.run("restart", EDGE_UNIT)
-        if not systemd.active(EDGE_UNIT):
-            raise ActivationError("EDGE_SERVICE_NOT_ACTIVE")
-        exec_start = systemd.show(EDGE_UNIT, "ExecStart")
-        environment = systemd.show(EDGE_UNIT, "Environment")
-        if str(app) not in exec_start:
-            raise ActivationError("EDGE_EFFECTIVE_EXECSTART_INVALID")
-        for expected in (
-            f"AIOS_GPT_EDGE_HOST={approval.bind_host}",
-            f"AIOS_GPT_EDGE_PORT={approval.port}",
-            "AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=1",
-            f"AIOS_GPT_EDGE_PUBLIC_DOMAIN={approval.domain}",
-        ):
-            if expected not in environment:
-                raise ActivationError("EDGE_EFFECTIVE_ENVIRONMENT_INVALID")
-        tls_probe(approval.domain, cert_path, port=approval.port)
-        receipt = receipt_for(approval, release_root, state="ACTIVE")
-        atomic_write(state_path, json.dumps(receipt, indent=2, sort_keys=True) + "\n")
-        return receipt
-    except Exception:
-        if modified:
-            rollback(
-                dropin_path=dropin_path,
-                state_path=state_path,
-                systemd=systemd,
-                reason="activation_failed",
-            )
-        raise
-
-
-def rollback(
-    *,
-    dropin_path: Path,
-    state_path: Path,
-    systemd: Systemd,
-    reason: str,
-) -> dict[str, Any]:
-    if os.geteuid() != 0:
-        raise ActivationError("ROOT_REQUIRED")
-    systemd.run("stop", EDGE_UNIT, check=False)
-    systemd.run("disable", EDGE_UNIT, check=False)
-    dropin_path.unlink(missing_ok=True)
-    systemd.run("daemon-reload")
-    if systemd.active(EDGE_UNIT):
-        raise ActivationError("EDGE_ROLLBACK_SERVICE_STILL_ACTIVE")
-    previous: dict[str, Any] = {}
-    if state_path.is_file():
-        try:
-            previous = json.loads(state_path.read_text(encoding="utf-8"))
-        except Exception:
-            previous = {}
-    receipt = {
-        "schema": STATE_SCHEMA,
-        "state": "ROLLED_BACK",
-        "reason": reason[:255],
-        "candidate_oid": previous.get("candidate_oid"),
-        "approval_id": previous.get("approval_id"),
-        "domain": previous.get("domain"),
-        "updated_at": datetime.now(timezone.utc).isoformat(),
-    }
-    atomic_write(state_path, json.dumps(receipt, indent=2, sort_keys=True) + "\n")
-    return receipt
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("command", choices=("check", "activate", "rollback"))
-    parser.add_argument("--candidate")
-    parser.add_argument("--approval", default="/etc/aios-gitops/gpt-https-edge.approved")
-    parser.add_argument("--tls-cert", default="/etc/aios-gitops/gpt-https-edge-tls.crt")
-    parser.add_argument("--tls-key", default="/etc/aios-gitops/gpt-https-edge-tls.key")
-    parser.add_argument("--release-root")
-    parser.add_argument(
-        "--dropin",
-        default=f"/etc/systemd/system/{EDGE_UNIT}.d/{DROPIN_NAME}",
-    )
-    parser.add_argument(
-        "--state",
-        default="/var/lib/aios-gpt-https-edge-activation/state.json",
-    )
-    parser.add_argument("--reason", default="owner_requested")
-    args = parser.parse_args()
-
-    systemd = Systemd()
-    if args.command == "rollback":
-        value = rollback(
-            dropin_path=Path(args.dropin),
-            state_path=Path(args.state),
-            systemd=systemd,
-            reason=args.reason,
-        )
-        print(json.dumps(value, indent=2, sort_keys=True))
-        return 0
-
-    candidate = str(args.candidate or "")
-    if OID_RE.fullmatch(candidate) is None:
-        raise SystemExit("CANDIDATE_REQUIRED")
-    release_root = (
-        Path(args.release_root)
-        if args.release_root
-        else Path(f"/opt/aios/releases/{candidate}-gpt-https-edge-public")
-    )
-    cert_path = Path(args.tls_cert)
-    key_path = Path(args.tls_key)
-    approval = Approval.load(
-        Path(args.approval),
-        candidate_oid=candidate,
-        cert_path=cert_path,
-    )
-    tls = validate_tls_pair(cert_path, key_path, approval.domain)
-    release = validate_release(release_root)
-    require_ingress_ready(systemd)
-
-    if args.command == "check":
-        value = {
-            "status": "READY",
-            "candidate_oid": candidate,
-            "approval_id": approval.approval_id,
-            "approval_sha256": approval.raw_sha256,
-            "domain": approval.domain,
-            "bind_host": approval.bind_host,
-            "port": approval.port,
-            "edge_sha256": sha256_file(release["edge"]),
-            "controller_sha256": sha256_file(release["controller"]),
-            **tls,
-            "public_network_mutation": False,
-        }
-        print(json.dumps(value, indent=2, sort_keys=True))
-        return 0
-
-    value = activate(
-        approval=approval,
-        release_root=release_root,
-        cert_path=cert_path,
-        key_path=key_path,
-        dropin_path=Path(args.dropin),
-        state_path=Path(args.state),
-        systemd=systemd,
-    )
-    print(json.dumps(value, indent=2, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,816 +0,0 @@
-#!/usr/bin/env python3
-"""Credential-isolated host-side ingress for externally scheduled read-only Online Tasks.
-
-This service is intentionally not a public AIOS control plane. It accepts a tiny,
-authenticated external intent and translates it to the canonical loopback Bridge.
-Callers cannot select repository coordinates, capabilities, execution action,
-worker, branch policy, credentials, verification decisions, or write permissions.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import sqlite3
-import threading
-import urllib.error
-import urllib.request
-from typing import Any, Mapping
-
-SCHEMA = "aios.gpt-online-task-ingress.request.v1"
-RESPONSE_SCHEMA = "aios.gpt-online-task-ingress.response.v1"
-OPENAPI_VERSION = "3.1.0"
-
-REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$")
-TASK_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-JOB_ID_RE = re.compile(r"^job-[0-9a-f]{32}$")
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-MAX_BODY = 64 * 1024
-MAX_GOAL = 12_000
-MAX_INSTRUCTIONS = 24_000
-MAX_CRITERIA = 16
-MAX_CRITERION_TEXT = 1_000
-
-READONLY_CAPABILITIES = ("git.read", "git.test")
-REPOSITORY = "aios/aios"
-
-
-class IngressError(RuntimeError):
-    def __init__(self, code: str, status: int = 400) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def digest(value: object) -> str:
-    return hashlib.sha256(canonical(value)).hexdigest()
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def load_secret(path: Path, *, code: str) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise RuntimeError(code + "_UNAVAILABLE")
-    value = path.read_text(encoding="utf-8").strip()
-    if len(value) < 32 or "\n" in value or "\r" in value:
-        raise RuntimeError(code + "_INVALID")
-    return value
-
-
-def normalized_request(value: Mapping[str, Any]) -> dict[str, Any]:
-    allowed = {
-        "schema",
-        "request_id",
-        "goal",
-        "instructions",
-        "success_criteria",
-        "constraints",
-    }
-    if set(value) - allowed:
-        raise IngressError("UNKNOWN_FIELDS")
-    if value.get("schema") != SCHEMA:
-        raise IngressError("SCHEMA_INVALID")
-
-    request_id = value.get("request_id")
-    if not isinstance(request_id, str) or REQUEST_ID_RE.fullmatch(request_id) is None:
-        raise IngressError("REQUEST_ID_INVALID")
-
-    goal = value.get("goal")
-    if not isinstance(goal, str) or not goal.strip() or len(goal) > MAX_GOAL:
-        raise IngressError("GOAL_INVALID")
-    instructions = value.get("instructions", "")
-    if not isinstance(instructions, str) or len(instructions) > MAX_INSTRUCTIONS:
-        raise IngressError("INSTRUCTIONS_INVALID")
-
-    criteria = value.get("success_criteria") or []
-    if not isinstance(criteria, list) or len(criteria) > MAX_CRITERIA:
-        raise IngressError("SUCCESS_CRITERIA_INVALID")
-    normalized_criteria = []
-    for item in criteria:
-        if not isinstance(item, Mapping) or set(item) != {"id", "description"}:
-            raise IngressError("SUCCESS_CRITERIA_INVALID")
-        criterion_id = item.get("id")
-        description = item.get("description")
-        if (
-            not isinstance(criterion_id, str)
-            or not criterion_id.strip()
-            or len(criterion_id) > 120
-            or not isinstance(description, str)
-            or not description.strip()
-            or len(description) > MAX_CRITERION_TEXT
-        ):
-            raise IngressError("SUCCESS_CRITERIA_INVALID")
-        normalized_criteria.append(
-            {"id": criterion_id.strip(), "description": description.strip()}
-        )
-
-    constraints = value.get("constraints") or {}
-    if not isinstance(constraints, Mapping):
-        raise IngressError("CONSTRAINTS_INVALID")
-    allowed_constraints = {
-        "max_files",
-        "focus_paths",
-        "notes",
-    }
-    if set(constraints) - allowed_constraints:
-        raise IngressError("CONSTRAINTS_FIELDS_INVALID")
-    normalized_constraints: dict[str, Any] = {}
-    if "max_files" in constraints:
-        max_files = constraints["max_files"]
-        if (
-            not isinstance(max_files, int)
-            or isinstance(max_files, bool)
-            or not 1 <= max_files <= 500
-        ):
-            raise IngressError("MAX_FILES_INVALID")
-        normalized_constraints["max_files"] = max_files
-    if "focus_paths" in constraints:
-        paths = constraints["focus_paths"]
-        if (
-            not isinstance(paths, list)
-            or len(paths) > 32
-            or not all(
-                isinstance(path, str)
-                and path
-                and len(path) <= 512
-                and not path.startswith("/")
-                and ".." not in Path(path).parts
-                for path in paths
-            )
-        ):
-            raise IngressError("FOCUS_PATHS_INVALID")
-        normalized_constraints["focus_paths"] = paths
-    if "notes" in constraints:
-        notes = constraints["notes"]
-        if not isinstance(notes, str) or len(notes) > 4_000:
-            raise IngressError("CONSTRAINT_NOTES_INVALID")
-        normalized_constraints["notes"] = notes
-
-    return {
-        "schema": SCHEMA,
-        "request_id": request_id,
-        "goal": goal.strip(),
-        "instructions": instructions,
-        "success_criteria": normalized_criteria,
-        "constraints": normalized_constraints,
-    }
-
-
-def validated_bind_host(value: str) -> str:
-    host = value.strip()
-    if host not in {"127.0.0.1", "::1", "localhost"}:
-        raise RuntimeError("GPT_INGRESS_NON_LOOPBACK_BIND_DENY")
-    return host
-
-
-def task_id_for(request_id: str) -> str:
-    suffix = hashlib.sha256(request_id.encode("utf-8")).hexdigest()[:24]
-    return "gpt-readonly-" + suffix
-
-
-def branch_for(task_id: str) -> str:
-    return "agent/external-gpt-readonly/" + task_id[-24:]
-
-
-@dataclass(frozen=True)
-class Upstream:
-    bridge_base: str
-    task_base: str
-    control_token: str
-    timeout: int = 20
-
-    def _request(
-        self,
-        base: str,
-        method: str,
-        path: str,
-        body: Mapping[str, Any] | None = None,
-    ) -> tuple[int, dict[str, Any]]:
-        raw_body = None if body is None else canonical(body)
-        headers = {
-            "Authorization": "Bearer " + self.control_token,
-            "Accept": "application/json",
-        }
-        if raw_body is not None:
-            headers["Content-Type"] = "application/json"
-        req = urllib.request.Request(
-            base.rstrip("/") + path,
-            method=method,
-            data=raw_body,
-            headers=headers,
-        )
-        try:
-            with urllib.request.urlopen(req, timeout=self.timeout) as response:
-                raw = response.read()
-                status = response.status
-        except urllib.error.HTTPError as exc:
-            raw = exc.read()
-            status = exc.code
-        except Exception as exc:
-            raise IngressError("UPSTREAM_TRANSPORT_FAILED", 503) from exc
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except Exception as exc:
-            raise IngressError("UPSTREAM_RESPONSE_INVALID", 502) from exc
-        if not isinstance(value, Mapping):
-            raise IngressError("UPSTREAM_RESPONSE_INVALID", 502)
-        return status, dict(value)
-
-    def control_snapshot(self) -> dict[str, Any]:
-        status, value = self._request(
-            self.bridge_base,
-            "GET",
-            "/v2/control-plane-snapshot",
-        )
-        if status != 200:
-            raise IngressError("CONTROL_SNAPSHOT_UNAVAILABLE", 503)
-        return value
-
-    def create_governed_task(
-        self,
-        body: Mapping[str, Any],
-    ) -> tuple[int, dict[str, Any]]:
-        return self._request(
-            self.bridge_base,
-            "POST",
-            "/v2/governed-task",
-            body,
-        )
-
-    def execution_envelope(
-        self,
-        body: Mapping[str, Any],
-    ) -> tuple[int, dict[str, Any]]:
-        return self._request(
-            self.bridge_base,
-            "POST",
-            "/v2/execution-envelope",
-            body,
-        )
-
-    def get_task(self, task_id: str) -> tuple[int, dict[str, Any]]:
-        return self._request(
-            self.task_base,
-            "GET",
-            "/v1/tasks/" + task_id,
-        )
-
-
-class Store:
-    def __init__(self, path: Path) -> None:
-        self.path = Path(path)
-        self._lock = threading.RLock()
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        with self._connect() as con:
-            con.execute(
-                """
-                CREATE TABLE IF NOT EXISTS external_task_requests(
-                  request_id TEXT PRIMARY KEY,
-                  request_sha256 TEXT NOT NULL,
-                  task_id TEXT NOT NULL UNIQUE,
-                  job_id TEXT,
-                  base_oid TEXT,
-                  state TEXT NOT NULL,
-                  created_at TEXT NOT NULL,
-                  updated_at TEXT NOT NULL,
-                  response_json TEXT
-                )
-                """
-            )
-            con.commit()
-
-    def _connect(self) -> sqlite3.Connection:
-        con = sqlite3.connect(self.path, timeout=30)
-        con.row_factory = sqlite3.Row
-        con.execute("PRAGMA busy_timeout=30000")
-        return con
-
-    def get(self, request_id: str) -> sqlite3.Row | None:
-        with self._connect() as con:
-            return con.execute(
-                "SELECT * FROM external_task_requests WHERE request_id=?",
-                (request_id,),
-            ).fetchone()
-
-    def reserve(self, request: Mapping[str, Any], task_id: str) -> sqlite3.Row:
-        request_sha = digest(request)
-        timestamp = now()
-        with self._lock, self._connect() as con:
-            con.execute("BEGIN IMMEDIATE")
-            row = con.execute(
-                "SELECT * FROM external_task_requests WHERE request_id=?",
-                (request["request_id"],),
-            ).fetchone()
-            if row is not None:
-                if row["request_sha256"] != request_sha:
-                    raise IngressError("IDEMPOTENCY_CONFLICT", 409)
-                con.commit()
-                return row
-            con.execute(
-                """
-                INSERT INTO external_task_requests(
-                  request_id,request_sha256,task_id,state,created_at,updated_at
-                ) VALUES(?,?,?,?,?,?)
-                """,
-                (
-                    request["request_id"],
-                    request_sha,
-                    task_id,
-                    "PENDING",
-                    timestamp,
-                    timestamp,
-                ),
-            )
-            con.commit()
-        row = self.get(request["request_id"])
-        assert row is not None
-        return row
-
-    def bound(
-        self,
-        request_id: str,
-        *,
-        job_id: str,
-        base_oid: str,
-        response: Mapping[str, Any],
-    ) -> None:
-        with self._lock, self._connect() as con:
-            con.execute(
-                """
-                UPDATE external_task_requests
-                   SET job_id=?,base_oid=?,state='BOUND',response_json=?,updated_at=?
-                 WHERE request_id=?
-                """,
-                (
-                    job_id,
-                    base_oid,
-                    json.dumps(response, sort_keys=True, separators=(",", ":")),
-                    now(),
-                    request_id,
-                ),
-            )
-            con.commit()
-
-
-class IngressService:
-    def __init__(self, upstream: Upstream, store: Store) -> None:
-        self.upstream = upstream
-        self.store = store
-
-    @staticmethod
-    def _main_oid(snapshot: Mapping[str, Any]) -> str:
-        candidates = [
-            snapshot.get("authoritative_head_oid"),
-            snapshot.get("head"),
-            (snapshot.get("aggregate") or {}).get("authoritative_head_oid")
-            if isinstance(snapshot.get("aggregate"), Mapping)
-            else None,
-        ]
-        for candidate in candidates:
-            if isinstance(candidate, str) and OID_RE.fullmatch(candidate):
-                return candidate
-        raise IngressError("AUTHORITATIVE_HEAD_UNAVAILABLE", 503)
-
-    @staticmethod
-    def _public_response(
-        request_id: str,
-        task_id: str,
-        job_id: str,
-        state: str,
-    ) -> dict[str, Any]:
-        return {
-            "schema": RESPONSE_SCHEMA,
-            "request_id": request_id,
-            "task_id": task_id,
-            "job_id": job_id,
-            "state": state,
-            "execution_mode": "source_capture",
-            "capabilities": list(READONLY_CAPABILITIES),
-            "write_access": False,
-            "official_verification_required": True,
-        }
-
-    def _recover_existing(
-        self,
-        request: Mapping[str, Any],
-        row: sqlite3.Row,
-    ) -> dict[str, Any] | None:
-        task_id = str(row["task_id"])
-        status, task = self.upstream.get_task(task_id)
-        if status == 404:
-            return None
-        if status != 200:
-            raise IngressError("TASK_RECOVERY_FAILED", 503)
-        metadata = task.get("metadata")
-        execution = (
-            metadata.get("execution")
-            if isinstance(metadata, Mapping)
-            and isinstance(metadata.get("execution"), Mapping)
-            else {}
-        )
-        job_id = str(execution.get("job_id") or row["job_id"] or "")
-        base_oid = str(execution.get("base_oid") or row["base_oid"] or "")
-        if (
-            task.get("task_id") != task_id
-            or not JOB_ID_RE.fullmatch(job_id)
-            or not OID_RE.fullmatch(base_oid)
-            or execution.get("action") != "source_capture"
-            or sorted(execution.get("capability_scope") or [])
-            != sorted(READONLY_CAPABILITIES)
-            or (execution.get("governance") or {}).get("writer_lease") is not False
-        ):
-            raise IngressError("TASK_RECOVERY_BINDING_INVALID", 409)
-        response = self._public_response(
-            request["request_id"],
-            task_id,
-            job_id,
-            str(task.get("status") or "BOUND"),
-        )
-        self.store.bound(
-            request["request_id"],
-            job_id=job_id,
-            base_oid=base_oid,
-            response=response,
-        )
-        return response
-
-    def create(self, raw: Mapping[str, Any]) -> dict[str, Any]:
-        request = normalized_request(raw)
-        task_id = task_id_for(request["request_id"])
-        row = self.store.reserve(request, task_id)
-        if row["state"] == "BOUND" and row["response_json"]:
-            return json.loads(row["response_json"])
-
-        recovered = self._recover_existing(request, row)
-        if recovered is not None:
-            return recovered
-
-        snapshot = self.upstream.control_snapshot()
-        base_oid = self._main_oid(snapshot)
-        target_branch = branch_for(task_id)
-        binding_key = "gpt-readonly-binding-" + digest(
-            {"request_id": request["request_id"], "base_oid": base_oid}
-        )[:24]
-        constraints = {
-            **request["constraints"],
-            "repository_mutation": "forbidden",
-            "control_plane_side_effects": "forbidden",
-            "credential_access": "forbidden",
-        }
-        body = {
-            "task_id": task_id,
-            "repository": REPOSITORY,
-            "base_oid": base_oid,
-            "expected_branch_oid": base_oid,
-            "target_branch": target_branch,
-            "branch_mode": "CREATE_NEW",
-            "generation": 1,
-            "risk": "low",
-            "description": "Externally requested read-only governed Online Task.",
-            "idempotency_key": binding_key,
-            "priority": 0,
-            "max_attempts": 3,
-            "require_online_task_projection": True,
-            "online_task": {
-                "goal": request["goal"],
-                "instructions": request["instructions"],
-                "success_criteria": request["success_criteria"],
-                "constraints": constraints,
-                "required_capabilities": list(READONLY_CAPABILITIES),
-                "priority": 0,
-                "max_attempts": 3,
-            },
-            "execution": {
-                "action": "source_capture",
-                "adapter": "source_capture",
-                "capability_scope": list(READONLY_CAPABILITIES),
-                "source_signals": [
-                    "external read-only source analysis request",
-                    "no repository mutation no credential access no control-plane side effects",
-                ],
-            },
-        }
-        status, value = self.upstream.create_governed_task(body)
-        if status not in {200, 201, 202}:
-            if status == 409:
-                recovered = self._recover_existing(request, row)
-                if recovered is not None:
-                    return recovered
-            raise IngressError(
-                "GOVERNED_TASK_CREATE_FAILED",
-                409 if status == 409 else 503,
-            )
-        job_id = str(value.get("job_id") or "")
-        if value.get("task_id") != task_id or JOB_ID_RE.fullmatch(job_id) is None:
-            raise IngressError("GOVERNED_TASK_RESPONSE_INVALID", 502)
-
-        envelope_status, envelope = self.upstream.execution_envelope(
-            {
-                "task_id": task_id,
-                "job_id": job_id,
-                "required_capabilities": list(READONLY_CAPABILITIES),
-                "execution": body["execution"],
-            }
-        )
-        if envelope_status != 200:
-            raise IngressError("EXECUTION_PROJECTION_FAILED", 503)
-        if (
-            envelope.get("task_id") != task_id
-            or envelope.get("job_id") != job_id
-            or envelope.get("base_oid") != base_oid
-            or envelope.get("action") != "source_capture"
-            or sorted(envelope.get("capability_scope") or [])
-            != sorted(READONLY_CAPABILITIES)
-            or (envelope.get("governance") or {}).get("writer_lease") is not False
-        ):
-            raise IngressError("EXECUTION_PROJECTION_INVALID", 502)
-
-        response = self._public_response(
-            request["request_id"],
-            task_id,
-            job_id,
-            "BOUND",
-        )
-        self.store.bound(
-            request["request_id"],
-            job_id=job_id,
-            base_oid=base_oid,
-            response=response,
-        )
-        return response
-
-    def status(self, request_id: str) -> dict[str, Any]:
-        if REQUEST_ID_RE.fullmatch(request_id) is None:
-            raise IngressError("REQUEST_ID_INVALID")
-        row = self.store.get(request_id)
-        if row is None:
-            raise IngressError("REQUEST_NOT_FOUND", 404)
-        task_id = str(row["task_id"])
-        status, task = self.upstream.get_task(task_id)
-        if status == 200 and not row["job_id"]:
-            metadata = task.get("metadata")
-            execution = (
-                metadata.get("execution")
-                if isinstance(metadata, Mapping)
-                and isinstance(metadata.get("execution"), Mapping)
-                else {}
-            )
-            job_id = str(execution.get("job_id") or "")
-            base_oid = str(execution.get("base_oid") or "")
-            if (
-                JOB_ID_RE.fullmatch(job_id)
-                and OID_RE.fullmatch(base_oid)
-                and execution.get("action") == "source_capture"
-                and sorted(execution.get("capability_scope") or [])
-                == sorted(READONLY_CAPABILITIES)
-                and (execution.get("governance") or {}).get("writer_lease") is False
-            ):
-                recovered = self._public_response(
-                    request_id,
-                    task_id,
-                    job_id,
-                    str(task.get("status") or "BOUND"),
-                )
-                self.store.bound(
-                    request_id,
-                    job_id=job_id,
-                    base_oid=base_oid,
-                    response=recovered,
-                )
-                row = self.store.get(request_id) or row
-        if status == 404:
-            return {
-                "schema": RESPONSE_SCHEMA,
-                "request_id": request_id,
-                "task_id": task_id,
-                "state": "PENDING",
-                "official_verification_required": True,
-            }
-        if status != 200:
-            raise IngressError("TASK_STATUS_UNAVAILABLE", 503)
-
-        result = task.get("result") if isinstance(task.get("result"), Mapping) else {}
-        verification = (
-            task.get("verification")
-            if isinstance(task.get("verification"), Mapping)
-            else {}
-        )
-        safe = {
-            "schema": RESPONSE_SCHEMA,
-            "request_id": request_id,
-            "task_id": task_id,
-            "job_id": str(row["job_id"] or ""),
-            "state": str(task.get("status") or "UNKNOWN"),
-            "attempt": int(task.get("attempt") or 0),
-            "claimed": bool(task.get("claimed_by")),
-            "result_status": result.get("status"),
-            "result_classification": result.get("classification"),
-            "official_verification": verification.get("decision"),
-            "official_classification": verification.get("classification"),
-            "write_access": False,
-        }
-        if result.get("execution_mode") == "source_capture":
-            snapshot = result.get("source_snapshot")
-            if isinstance(snapshot, Mapping):
-                safe["source_snapshot_sha256"] = snapshot.get("payload_sha256")
-                safe["source_snapshot_file_count"] = snapshot.get("file_count")
-        return safe
-
-
-def openapi_document() -> dict[str, Any]:
-    return {
-        "openapi": OPENAPI_VERSION,
-        "info": {
-            "title": "AIOS Read-Only Online Task Ingress",
-            "version": "1.0.0",
-        },
-        "paths": {
-            "/v1/read-only-tasks": {
-                "post": {
-                    "operationId": "createReadOnlyOnlineTask",
-                    "security": [{"bearerAuth": []}],
-                    "requestBody": {"required": True},
-                    "responses": {"200": {"description": "Task accepted"}},
-                }
-            },
-            "/v1/read-only-tasks/{request_id}": {
-                "get": {
-                    "operationId": "getReadOnlyOnlineTaskStatus",
-                    "security": [{"bearerAuth": []}],
-                    "responses": {"200": {"description": "Sanitized task status"}},
-                }
-            },
-        },
-        "components": {
-            "securitySchemes": {
-                "bearerAuth": {
-                    "type": "http",
-                    "scheme": "bearer",
-                }
-            }
-        },
-    }
-
-
-class Handler(BaseHTTPRequestHandler):
-    service: IngressService | None = None
-    ingress_token: str = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def respond(self, value: Mapping[str, Any], status: int) -> None:
-        raw = canonical(value)
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("Content-Length", str(len(raw)))
-        self.end_headers()
-        self.wfile.write(raw)
-
-    def authorized(self) -> bool:
-        header = self.headers.get("Authorization", "")
-        return (
-            header.startswith("Bearer ")
-            and bool(self.ingress_token)
-            and hmac.compare_digest(header[7:], self.ingress_token)
-        )
-
-    def body(self) -> dict[str, Any]:
-        try:
-            length = int(self.headers.get("Content-Length", "-1"))
-        except ValueError as exc:
-            raise IngressError("CONTENT_LENGTH_INVALID") from exc
-        if length < 1 or length > MAX_BODY:
-            raise IngressError("REQUEST_SIZE_INVALID", 413)
-        try:
-            value = json.loads(self.rfile.read(length).decode("utf-8"))
-        except Exception as exc:
-            raise IngressError("REQUEST_JSON_INVALID") from exc
-        if not isinstance(value, Mapping):
-            raise IngressError("REQUEST_OBJECT_REQUIRED")
-        return dict(value)
-
-    def do_GET(self) -> None:
-        if self.path == "/health":
-            self.respond(
-                {
-                    "status": "ok",
-                    "service": "aios-gpt-online-task-ingress",
-                    "mode": "read-only",
-                },
-                200,
-            )
-            return
-        if self.path == "/openapi.json":
-            self.respond(openapi_document(), 200)
-            return
-        if not self.authorized():
-            self.respond({"error": "UNAUTHORIZED"}, 401)
-            return
-        match = re.fullmatch(r"/v1/read-only-tasks/([^/?#]+)", self.path)
-        if match is None:
-            self.respond({"error": "NOT_FOUND"}, 404)
-            return
-        try:
-            if self.service is None:
-                raise IngressError("RUNTIME_UNAVAILABLE", 503)
-            self.respond(self.service.status(match.group(1)), 200)
-        except IngressError as exc:
-            self.respond({"error": exc.code}, exc.status)
-
-    def do_POST(self) -> None:
-        if self.path != "/v1/read-only-tasks":
-            self.respond({"error": "NOT_FOUND"}, 404)
-            return
-        if not self.authorized():
-            self.respond({"error": "UNAUTHORIZED"}, 401)
-            return
-        try:
-            if self.service is None:
-                raise IngressError("RUNTIME_UNAVAILABLE", 503)
-            value = self.service.create(self.body())
-            self.respond(value, 200)
-        except IngressError as exc:
-            self.respond({"error": exc.code}, exc.status)
-
-
-def serve() -> None:
-    ingress_token_path = Path(
-        os.environ.get(
-            "AIOS_GPT_INGRESS_TOKEN_FILE",
-            str(
-                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-                / "gpt_ingress_token"
-            ),
-        )
-    )
-    control_token_path = Path(
-        os.environ.get(
-            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-            str(
-                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-                / "agent_task_control_token"
-            ),
-        )
-    )
-    ingress_token = load_secret(
-        ingress_token_path,
-        code="GPT_INGRESS_CREDENTIAL",
-    )
-    control_token = load_secret(
-        control_token_path,
-        code="CONTROL_PLANE_CREDENTIAL",
-    )
-
-    state_root = Path(
-        os.environ.get(
-            "AIOS_GPT_INGRESS_STATE_ROOT",
-            "/var/lib/aios-gpt-online-task-ingress",
-        )
-    )
-    host = validated_bind_host(
-        os.environ.get("AIOS_GPT_INGRESS_HOST", "127.0.0.1")
-    )
-    port = int(os.environ.get("AIOS_GPT_INGRESS_PORT", "18945"))
-    if not 1024 <= port <= 65535:
-        raise RuntimeError("GPT_INGRESS_PORT_INVALID")
-
-    Handler.service = IngressService(
-        Upstream(
-            bridge_base=os.environ.get(
-                "AIOS_GOVERNED_WRITE_API_URL",
-                "http://127.0.0.1:18892",
-            ),
-            task_base=os.environ.get(
-                "AIOS_AGENT_TASK_API_URL",
-                "http://127.0.0.1:18940",
-            ),
-            control_token=control_token,
-        ),
-        Store(state_root / "state.sqlite3"),
-    )
-    Handler.ingress_token = ingress_token
-    ThreadingHTTPServer((host, port), Handler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -0,0 +1,27 @@
+"""AIOS-managed Hermes runtime boundary."""
+
+from .adapter import (
+    HermesAdapter,
+    HermesConflict,
+    HermesNotFound,
+    HermesRuntimeError,
+    InMemoryHermesStore,
+    SQLiteHermesStore,
+)
+from .contract import HermesHealth, HermesJob, HermesJobState, HermesResult
+from .worker import HermesWorker, WorkerRunResult
+
+__all__ = [
+    "HermesAdapter",
+    "HermesConflict",
+    "HermesHealth",
+    "HermesJob",
+    "HermesJobState",
+    "HermesNotFound",
+    "HermesResult",
+    "HermesRuntimeError",
+    "HermesWorker",
+    "InMemoryHermesStore",
+    "SQLiteHermesStore",
+    "WorkerRunResult",
+]
@@ -0,0 +1,593 @@
+"""Tenant-partitioned Hermes queue and worker lease boundary."""
+from __future__ import annotations
+
+import hashlib
+import json
+import sqlite3
+import threading
+from dataclasses import asdict, replace
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Iterable, Mapping
+
+from .contract import (
+    ALLOWED_TRANSITIONS,
+    TERMINAL_STATES,
+    HermesHealth,
+    HermesJob,
+    HermesJobState,
+    HermesResult,
+    utc_now,
+)
+
+
+class HermesRuntimeError(RuntimeError):
+    """Base Hermes runtime-boundary failure."""
+
+
+class HermesNotFound(HermesRuntimeError):
+    """A tenant-scoped job was not found."""
+
+
+class HermesConflict(HermesRuntimeError):
+    """A state, lease, idempotency, or revision conflict occurred."""
+
+
+class InMemoryHermesStore:
+    """Thread-safe reference store; production backends implement this contract."""
+
+    def __init__(self) -> None:
+        self.lock = threading.RLock()
+        self.jobs: dict[str, HermesJob] = {}
+        self.results: dict[str, HermesResult] = {}
+        self.idempotency: dict[tuple[str, str], tuple[str, str]] = {}
+        self.worker_heartbeats: dict[str, tuple[str, str | None]] = {}
+
+    def persist_locked(self) -> None:
+        """Persist a mutation while ``lock`` is held; memory stores are a no-op."""
+
+
+class SQLiteHermesStore(InMemoryHermesStore):
+    """Durable snapshot for the existing Hermes queue state machine.
+
+    The adapter remains the sole owner of transitions and lease rules. This
+    store only makes its jobs, results, idempotency keys and worker heartbeats
+    survive a process restart.
+    """
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        super().__init__()
+        with self._connect() as connection:
+            connection.execute(
+                """
+                CREATE TABLE IF NOT EXISTS hermes_state (
+                    singleton INTEGER PRIMARY KEY CHECK (singleton = 1),
+                    payload TEXT NOT NULL
+                )
+                """
+            )
+        self._load()
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(str(self.path), timeout=30)
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        return connection
+
+    @staticmethod
+    def _record(value: HermesJob | HermesResult) -> dict[str, object]:
+        record = asdict(value)
+        record["state"] = value.state.value
+        return record
+
+    def _load(self) -> None:
+        with self.lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT payload FROM hermes_state WHERE singleton = 1"
+            ).fetchone()
+            if row is None:
+                return
+            payload = json.loads(str(row[0]))
+            self.jobs = {
+                str(item["job_id"]): HermesJob(**item)
+                for item in payload.get("jobs", [])
+            }
+            self.results = {
+                str(item["job_id"]): HermesResult(**item)
+                for item in payload.get("results", [])
+            }
+            self.idempotency = {
+                (str(item["tenant_id"]), str(item["idempotency_key"])): (
+                    str(item["job_id"]),
+                    str(item["digest"]),
+                )
+                for item in payload.get("idempotency", [])
+            }
+            self.worker_heartbeats = {
+                str(item["worker_id"]): (
+                    str(item["heartbeat_at"]),
+                    str(item["job_id"]) if item.get("job_id") is not None else None,
+                )
+                for item in payload.get("worker_heartbeats", [])
+            }
+
+    def persist_locked(self) -> None:
+        payload = {
+            "version": 1,
+            "jobs": [self._record(item) for item in self.jobs.values()],
+            "results": [self._record(item) for item in self.results.values()],
+            "idempotency": [
+                {
+                    "tenant_id": tenant_id,
+                    "idempotency_key": idempotency_key,
+                    "job_id": job_id,
+                    "digest": digest,
+                }
+                for (tenant_id, idempotency_key), (job_id, digest)
+                in self.idempotency.items()
+            ],
+            "worker_heartbeats": [
+                {
+                    "worker_id": worker_id,
+                    "heartbeat_at": heartbeat_at,
+                    "job_id": job_id,
+                }
+                for worker_id, (heartbeat_at, job_id)
+                in self.worker_heartbeats.items()
+            ],
+        }
+        encoded = json.dumps(
+            payload,
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+        with self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            connection.execute(
+                """
+                INSERT INTO hermes_state(singleton, payload) VALUES(1, ?)
+                ON CONFLICT(singleton) DO UPDATE SET payload=excluded.payload
+                """,
+                (encoded,),
+            )
+            connection.commit()
+
+
+class HermesAdapter:
+    """Queue and reconcile Hermes jobs without owning AIOS policy."""
+
+    def __init__(
+        self,
+        store: InMemoryHermesStore | None = None,
+        *,
+        runtime_id: str = "hermes-runtime",
+        runtime_version: str = "v1",
+        default_lease_seconds: int = 60,
+    ) -> None:
+        if default_lease_seconds < 5:
+            raise ValueError("default_lease_seconds must be >= 5")
+        self.store = store or InMemoryHermesStore()
+        self.runtime_id = runtime_id
+        self.runtime_version = runtime_version
+        self.default_lease_seconds = int(default_lease_seconds)
+
+    @staticmethod
+    def _digest(job: HermesJob) -> str:
+        raw = json.dumps(
+            {
+                "tenant_id": job.tenant_id,
+                "cell_id": job.cell_id,
+                "profile_id": job.profile_id,
+                "task_id": job.task_id,
+                "trace_id": job.trace_id,
+                "action": job.action,
+                "payload": dict(job.payload),
+                "priority": job.priority,
+            },
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+            default=str,
+        ).encode("utf-8")
+        return hashlib.sha256(raw).hexdigest()
+
+    @staticmethod
+    def _parse(value: str | None) -> datetime | None:
+        if value is None:
+            return None
+        normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
+        parsed = datetime.fromisoformat(normalized)
+        if parsed.tzinfo is None:
+            raise ValueError("timestamp must include timezone")
+        return parsed.astimezone(timezone.utc)
+
+    @staticmethod
+    def _format(value: datetime) -> str:
+        return value.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
+
+    @staticmethod
+    def _assert_tenant(job: HermesJob, tenant_id: str) -> None:
+        if job.tenant_id != tenant_id:
+            raise HermesNotFound("job not found")
+
+    def enqueue(self, job: HermesJob) -> HermesJob:
+        if job.state != HermesJobState.QUEUED or job.revision != 1:
+            raise HermesConflict("new job must be QUEUED at revision 1")
+        digest = self._digest(job)
+        idem_ref = (job.tenant_id, job.idempotency_key)
+        with self.store.lock:
+            existing = self.store.jobs.get(job.job_id)
+            if existing is not None:
+                if self._digest(existing) != digest:
+                    raise HermesConflict("job_id reused with different content")
+                return existing
+            prior = self.store.idempotency.get(idem_ref)
+            if prior is not None:
+                prior_id, prior_digest = prior
+                if prior_digest != digest:
+                    raise HermesConflict("idempotency key reused with different content")
+                return self.store.jobs[prior_id]
+            self.store.jobs[job.job_id] = job
+            self.store.idempotency[idem_ref] = (job.job_id, digest)
+            self.store.persist_locked()
+            return job
+
+    def get(self, job_id: str, *, tenant_id: str) -> HermesJob:
+        with self.store.lock:
+            job = self.store.jobs.get(job_id)
+            if job is None:
+                raise HermesNotFound("job not found")
+            self._assert_tenant(job, tenant_id)
+            return job
+
+    def list_jobs(
+        self,
+        *,
+        tenant_id: str,
+        cell_id: str | None = None,
+        profile_id: str | None = None,
+        states: Iterable[HermesJobState | str] | None = None,
+    ) -> list[HermesJob]:
+        state_filter = {HermesJobState(item) for item in states} if states else None
+        with self.store.lock:
+            if self._requeue_expired_locked():
+                self.store.persist_locked()
+            jobs = [
+                job
+                for job in self.store.jobs.values()
+                if job.tenant_id == tenant_id
+                and (cell_id is None or job.cell_id == cell_id)
+                and (profile_id is None or job.profile_id == profile_id)
+                and (state_filter is None or job.state in state_filter)
+            ]
+        return sorted(jobs, key=lambda item: (item.priority, item.created_at, item.job_id))
+
+    def claim(
+        self,
+        *,
+        tenant_id: str,
+        cell_id: str,
+        profile_id: str,
+        worker_id: str,
+        lease_seconds: int | None = None,
+        job_id: str | None = None,
+    ) -> HermesJob | None:
+        worker_id = str(worker_id or "").strip()
+        if not worker_id:
+            raise ValueError("worker_id is required")
+        duration = int(lease_seconds or self.default_lease_seconds)
+        if duration < 5:
+            raise ValueError("lease_seconds must be >= 5")
+        with self.store.lock:
+            self._requeue_expired_locked()
+            candidates = [
+                job
+                for job in self.store.jobs.values()
+                if job.tenant_id == tenant_id
+                and job.cell_id == cell_id
+                and job.profile_id == profile_id
+                and (job_id is None or job.job_id == job_id)
+                and job.state == HermesJobState.QUEUED
+            ]
+            self.store.worker_heartbeats[worker_id] = (utc_now(), None)
+            if not candidates:
+                self.store.persist_locked()
+                return None
+            current = sorted(
+                candidates,
+                key=lambda item: (item.priority, item.created_at, item.job_id),
+            )[0]
+            claimed = self._transition_locked(
+                current,
+                HermesJobState.CLAIMED,
+                assigned_worker_id=worker_id,
+                lease_expires_at=self._format(
+                    datetime.now(timezone.utc) + timedelta(seconds=duration)
+                ),
+            )
+            self.store.worker_heartbeats[worker_id] = (utc_now(), claimed.job_id)
+            self.store.persist_locked()
+            return claimed
+
+    def start(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        expected_revision: int | None = None,
+    ) -> HermesJob:
+        with self.store.lock:
+            self._requeue_expired_locked()
+            current = self._owned_job_locked(job_id, tenant_id, worker_id)
+            self._assert_revision(current, expected_revision)
+            updated = self._transition_locked(current, HermesJobState.RUNNING)
+            self.store.persist_locked()
+            return updated
+
+    def heartbeat(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        lease_seconds: int | None = None,
+    ) -> HermesJob:
+        duration = int(lease_seconds or self.default_lease_seconds)
+        if duration < 5:
+            raise ValueError("lease_seconds must be >= 5")
+        with self.store.lock:
+            self._requeue_expired_locked()
+            current = self._owned_job_locked(job_id, tenant_id, worker_id)
+            if current.state not in {HermesJobState.CLAIMED, HermesJobState.RUNNING}:
+                raise HermesConflict("job does not accept heartbeat")
+            updated = replace(
+                current,
+                revision=current.revision + 1,
+                lease_expires_at=self._format(
+                    datetime.now(timezone.utc) + timedelta(seconds=duration)
+                ),
+                updated_at=utc_now(),
+            )
+            self.store.jobs[job_id] = updated
+            self.store.worker_heartbeats[worker_id] = (utc_now(), job_id)
+            self.store.persist_locked()
+            return updated
+
+    def complete(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        output: Mapping[str, object],
+        expected_revision: int | None = None,
+    ) -> HermesResult:
+        return self._finish(
+            job_id,
+            tenant_id=tenant_id,
+            worker_id=worker_id,
+            state=HermesJobState.COMPLETED,
+            output=output,
+            expected_revision=expected_revision,
+        )
+
+    def fail(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        error: Mapping[str, object],
+        expected_revision: int | None = None,
+    ) -> HermesResult:
+        return self._finish(
+            job_id,
+            tenant_id=tenant_id,
+            worker_id=worker_id,
+            state=HermesJobState.FAILED,
+            error=error,
+            expected_revision=expected_revision,
+        )
+
+    def cancel(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        expected_revision: int | None = None,
+    ) -> HermesResult:
+        with self.store.lock:
+            current = self.store.jobs.get(job_id)
+            if current is None:
+                raise HermesNotFound("job not found")
+            self._assert_tenant(current, tenant_id)
+            self._assert_revision(current, expected_revision)
+            if current.state in TERMINAL_STATES:
+                result = self.store.results.get(job_id)
+                if result is None:
+                    raise HermesConflict("terminal result missing")
+                if result.state != HermesJobState.CANCELLED:
+                    raise HermesConflict("job already has a different terminal result")
+                return result
+            updated = self._transition_locked(current, HermesJobState.CANCELLED)
+            result = HermesResult(
+                job_id=updated.job_id,
+                tenant_id=updated.tenant_id,
+                task_id=updated.task_id,
+                trace_id=updated.trace_id,
+                state=HermesJobState.CANCELLED,
+                worker_id=updated.assigned_worker_id,
+                error={"code": "cancelled", "message": "cancelled by AIOS"},
+                finished_at=utc_now(),
+            )
+            self.store.results[job_id] = result
+            self.store.persist_locked()
+            return result
+
+    def result(self, job_id: str, *, tenant_id: str) -> HermesResult:
+        with self.store.lock:
+            job = self.store.jobs.get(job_id)
+            if job is None:
+                raise HermesNotFound("job not found")
+            self._assert_tenant(job, tenant_id)
+            result = self.store.results.get(job_id)
+            if result is None:
+                raise HermesConflict("job has no terminal result")
+            return result
+
+    def requeue_expired(self) -> tuple[str, ...]:
+        """Persistently release expired leases without changing policy state."""
+        with self.store.lock:
+            changed = self._requeue_expired_locked()
+            if changed:
+                self.store.persist_locked()
+            return tuple(sorted(changed))
+
+    def health(self) -> HermesHealth:
+        with self.store.lock:
+            if self._requeue_expired_locked():
+                self.store.persist_locked()
+            active_jobs = sum(
+                1 for job in self.store.jobs.values()
+                if job.state in {HermesJobState.CLAIMED, HermesJobState.RUNNING}
+            )
+            queued_jobs = sum(
+                1 for job in self.store.jobs.values()
+                if job.state == HermesJobState.QUEUED
+            )
+            partitions = {
+                (job.tenant_id, job.cell_id, job.profile_id)
+                for job in self.store.jobs.values()
+            }
+            active_workers = sum(
+                1 for heartbeat, _ in self.store.worker_heartbeats.values()
+                if self._parse(heartbeat)
+                and self._parse(heartbeat) >= datetime.now(timezone.utc) - timedelta(seconds=120)
+            )
+        return HermesHealth(
+            runtime_id=self.runtime_id,
+            status="healthy",
+            version=self.runtime_version,
+            heartbeat_at=utc_now(),
+            active_workers=active_workers,
+            active_jobs=active_jobs,
+            queued_jobs=queued_jobs,
+            tenant_partitions=len(partitions),
+            profile_isolation_enforced=True,
+            details={"store": type(self.store).__name__},
+        )
+
+    def _finish(
+        self,
+        job_id: str,
+        *,
+        tenant_id: str,
+        worker_id: str,
+        state: HermesJobState,
+        output: Mapping[str, object] | None = None,
+        error: Mapping[str, object] | None = None,
+        expected_revision: int | None,
+    ) -> HermesResult:
+        with self.store.lock:
+            self._requeue_expired_locked()
+            current = self._owned_job_locked(job_id, tenant_id, worker_id)
+            if current.state in TERMINAL_STATES:
+                existing = self.store.results.get(job_id)
+                if existing is None:
+                    raise HermesConflict("terminal result missing")
+                if (
+                    existing.state == state
+                    and existing.worker_id == worker_id
+                    and existing.output == output
+                    and existing.error == error
+                ):
+                    return existing
+                raise HermesConflict("job already has a different terminal result")
+            self._assert_revision(current, expected_revision)
+            updated = self._transition_locked(current, state)
+            result = HermesResult(
+                job_id=updated.job_id,
+                tenant_id=updated.tenant_id,
+                task_id=updated.task_id,
+                trace_id=updated.trace_id,
+                state=state,
+                worker_id=worker_id,
+                output=output,
+                error=error,
+                started_at=current.updated_at,
+                finished_at=utc_now(),
+            )
+            self.store.results[job_id] = result
+            self.store.worker_heartbeats[worker_id] = (utc_now(), None)
+            self.store.persist_locked()
+            return result
+
+    def _owned_job_locked(self, job_id: str, tenant_id: str, worker_id: str) -> HermesJob:
+        current = self.store.jobs.get(job_id)
+        if current is None:
+            raise HermesNotFound("job not found")
+        self._assert_tenant(current, tenant_id)
+        if current.assigned_worker_id != worker_id:
+            raise HermesConflict("worker does not own job lease")
+        return current
+
+    @staticmethod
+    def _assert_revision(job: HermesJob, expected: int | None) -> None:
+        if expected is not None and job.revision != expected:
+            raise HermesConflict("job revision changed")
+
+    def _transition_locked(
+        self,
+        current: HermesJob,
+        target: HermesJobState,
+        *,
+        assigned_worker_id: str | None = None,
+        lease_expires_at: str | None = None,
+    ) -> HermesJob:
+        if target not in ALLOWED_TRANSITIONS[current.state]:
+            raise HermesConflict(
+                f"invalid transition {current.state.value} -> {target.value}"
+            )
+        updated = replace(
+            current,
+            state=target,
+            revision=current.revision + 1,
+            assigned_worker_id=(
+                assigned_worker_id
+                if assigned_worker_id is not None
+                else current.assigned_worker_id
+            ),
+            lease_expires_at=(
+                lease_expires_at
+                if lease_expires_at is not None
+                else (None if target in TERMINAL_STATES else current.lease_expires_at)
+            ),
+            updated_at=utc_now(),
+        )
+        self.store.jobs[current.job_id] = updated
+        return updated
+
+    def _requeue_expired_locked(self) -> set[str]:
+        now = datetime.now(timezone.utc)
+        changed: set[str] = set()
+        for current in list(self.store.jobs.values()):
+            expiry = self._parse(current.lease_expires_at)
+            if (
+                current.state in {HermesJobState.CLAIMED, HermesJobState.RUNNING}
+                and expiry is not None
+                and expiry <= now
+            ):
+                self.store.jobs[current.job_id] = replace(
+                    current,
+                    state=HermesJobState.QUEUED,
+                    revision=current.revision + 1,
+                    assigned_worker_id=None,
+                    lease_expires_at=None,
+                    updated_at=utc_now(),
+                )
+                changed.add(current.job_id)
+        return changed
@@ -0,0 +1,153 @@
+"""Tenant-scoped Hermes runtime contracts."""
+from __future__ import annotations
+
+import json
+import uuid
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from enum import Enum
+from typing import Any, Mapping
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def _safe_mapping(value: Mapping[str, Any] | None) -> dict[str, Any]:
+    return json.loads(json.dumps(dict(value or {}), ensure_ascii=False, sort_keys=True, default=str))
+
+
+class HermesJobState(str, Enum):
+    QUEUED = "QUEUED"
+    CLAIMED = "CLAIMED"
+    RUNNING = "RUNNING"
+    COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+
+
+ALLOWED_TRANSITIONS: Mapping[HermesJobState, frozenset[HermesJobState]] = {
+    HermesJobState.QUEUED: frozenset({HermesJobState.CLAIMED, HermesJobState.CANCELLED}),
+    HermesJobState.CLAIMED: frozenset({HermesJobState.RUNNING, HermesJobState.CANCELLED}),
+    HermesJobState.RUNNING: frozenset(
+        {HermesJobState.COMPLETED, HermesJobState.FAILED, HermesJobState.CANCELLED}
+    ),
+    HermesJobState.COMPLETED: frozenset(),
+    HermesJobState.FAILED: frozenset(),
+    HermesJobState.CANCELLED: frozenset(),
+}
+TERMINAL_STATES = frozenset(
+    {HermesJobState.COMPLETED, HermesJobState.FAILED, HermesJobState.CANCELLED}
+)
+
+
+@dataclass(frozen=True)
+class HermesJob:
+    job_id: str
+    tenant_id: str
+    cell_id: str
+    profile_id: str
+    task_id: str
+    trace_id: str
+    action: str
+    payload: Mapping[str, Any] = field(default_factory=dict)
+    idempotency_key: str = ""
+    priority: int = 100
+    state: HermesJobState = HermesJobState.QUEUED
+    revision: int = 1
+    assigned_worker_id: str | None = None
+    lease_expires_at: str | None = None
+    created_at: str = field(default_factory=utc_now)
+    updated_at: str = field(default_factory=utc_now)
+
+    def __post_init__(self) -> None:
+        for name in (
+            "job_id", "tenant_id", "cell_id", "profile_id", "task_id",
+            "trace_id", "action", "idempotency_key", "created_at", "updated_at",
+        ):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        object.__setattr__(self, "payload", _safe_mapping(self.payload))
+        object.__setattr__(self, "state", HermesJobState(self.state))
+        if not 0 <= int(self.priority) <= 1000:
+            raise ValueError("priority must be between 0 and 1000")
+        if self.revision < 1:
+            raise ValueError("revision must be >= 1")
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        tenant_id: str,
+        cell_id: str,
+        profile_id: str,
+        task_id: str,
+        trace_id: str,
+        action: str,
+        payload: Mapping[str, Any] | None,
+        idempotency_key: str,
+        priority: int = 100,
+    ) -> "HermesJob":
+        return cls(
+            job_id=f"hermes_{uuid.uuid4().hex}",
+            tenant_id=tenant_id,
+            cell_id=cell_id,
+            profile_id=profile_id,
+            task_id=task_id,
+            trace_id=trace_id,
+            action=action,
+            payload=_safe_mapping(payload),
+            idempotency_key=idempotency_key,
+            priority=priority,
+        )
+
+
+@dataclass(frozen=True)
+class HermesResult:
+    job_id: str
+    tenant_id: str
+    task_id: str
+    trace_id: str
+    state: HermesJobState
+    worker_id: str | None = None
+    output: Mapping[str, Any] | None = None
+    error: Mapping[str, Any] | None = None
+    started_at: str | None = None
+    finished_at: str | None = None
+
+    def __post_init__(self) -> None:
+        for name in ("job_id", "tenant_id", "task_id", "trace_id"):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        object.__setattr__(self, "state", HermesJobState(self.state))
+        if self.output is not None:
+            object.__setattr__(self, "output", _safe_mapping(self.output))
+        if self.error is not None:
+            object.__setattr__(self, "error", _safe_mapping(self.error))
+
+
+@dataclass(frozen=True)
+class HermesHealth:
+    runtime_id: str
+    status: str
+    version: str
+    heartbeat_at: str
+    active_workers: int = 0
+    active_jobs: int = 0
+    queued_jobs: int = 0
+    tenant_partitions: int = 0
+    profile_isolation_enforced: bool = True
+    details: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        for name in ("runtime_id", "status", "version", "heartbeat_at"):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        for name in ("active_workers", "active_jobs", "queued_jobs", "tenant_partitions"):
+            if int(getattr(self, name)) < 0:
+                raise ValueError(f"{name} must be >= 0")
+        object.__setattr__(self, "details", _safe_mapping(self.details))
@@ -0,0 +1,155 @@
+"""Hermes worker loop with lease renewal and bounded recovery."""
+from __future__ import annotations
+
+import threading
+from dataclasses import dataclass
+from typing import Any, Callable, Mapping
+
+from .adapter import HermesAdapter, HermesConflict
+from .contract import HermesJob, HermesJobState
+
+
+JobHandler = Callable[[HermesJob], Mapping[str, Any]]
+
+
+@dataclass(frozen=True)
+class WorkerRunResult:
+    claimed: bool
+    job_id: str | None = None
+    state: str | None = None
+    error: str | None = None
+
+
+class HermesWorker:
+    """Poll one tenant/cell/profile partition and execute jobs safely."""
+
+    def __init__(
+        self,
+        adapter: HermesAdapter,
+        handler: JobHandler,
+        *,
+        worker_id: str,
+        tenant_id: str,
+        cell_id: str,
+        profile_id: str,
+        poll_seconds: float = 1.0,
+        heartbeat_seconds: float = 10.0,
+    ) -> None:
+        if poll_seconds <= 0 or heartbeat_seconds <= 0:
+            raise ValueError("poll_seconds and heartbeat_seconds must be positive")
+        for name, value in {
+            "worker_id": worker_id,
+            "tenant_id": tenant_id,
+            "cell_id": cell_id,
+            "profile_id": profile_id,
+        }.items():
+            if not str(value or "").strip():
+                raise ValueError(f"{name} is required")
+        self.adapter = adapter
+        self.handler = handler
+        self.worker_id = worker_id
+        self.tenant_id = tenant_id
+        self.cell_id = cell_id
+        self.profile_id = profile_id
+        self.poll_seconds = float(poll_seconds)
+        self.heartbeat_seconds = float(heartbeat_seconds)
+        self._stop = threading.Event()
+
+    def stop(self) -> None:
+        self._stop.set()
+
+    def run_once(self) -> WorkerRunResult:
+        job = self.adapter.claim(
+            tenant_id=self.tenant_id,
+            cell_id=self.cell_id,
+            profile_id=self.profile_id,
+            worker_id=self.worker_id,
+        )
+        if job is None:
+            return WorkerRunResult(claimed=False)
+
+        running = self.adapter.start(
+            job.job_id,
+            tenant_id=self.tenant_id,
+            worker_id=self.worker_id,
+            expected_revision=job.revision,
+        )
+
+        heartbeat_stop = threading.Event()
+        heartbeat_thread = threading.Thread(
+            target=self._heartbeat_loop,
+            args=(running.job_id, heartbeat_stop),
+            name=f"hermes-heartbeat-{self.worker_id}",
+            daemon=True,
+        )
+        heartbeat_thread.start()
+
+        output: Mapping[str, Any] | None = None
+        execution_error: Exception | None = None
+        try:
+            output = dict(self.handler(running))
+        except Exception as exc:  # runtime boundary: normalize below
+            execution_error = exc
+        finally:
+            # Stop the lease heartbeat before reading the final revision. This
+            # prevents a revision increment racing with complete/fail.
+            heartbeat_stop.set()
+            heartbeat_thread.join(timeout=max(self.heartbeat_seconds * 2, 1.0))
+
+        try:
+            current = self.adapter.get(running.job_id, tenant_id=self.tenant_id)
+            if execution_error is None:
+                result = self.adapter.complete(
+                    running.job_id,
+                    tenant_id=self.tenant_id,
+                    worker_id=self.worker_id,
+                    output=dict(output or {}),
+                    expected_revision=current.revision,
+                )
+                return WorkerRunResult(
+                    claimed=True,
+                    job_id=result.job_id,
+                    state=result.state.value,
+                )
+
+            result = self.adapter.fail(
+                running.job_id,
+                tenant_id=self.tenant_id,
+                worker_id=self.worker_id,
+                error={
+                    "code": "worker_error",
+                    "message": str(execution_error),
+                },
+                expected_revision=current.revision,
+            )
+            return WorkerRunResult(
+                claimed=True,
+                job_id=result.job_id,
+                state=result.state.value,
+                error=str(execution_error),
+            )
+        except HermesConflict as exc:
+            return WorkerRunResult(
+                claimed=True,
+                job_id=running.job_id,
+                state=HermesJobState.FAILED.value,
+                error=f"reconciliation_conflict: {exc}",
+            )
+
+    def run_forever(self) -> None:
+        while not self._stop.is_set():
+            result = self.run_once()
+            if not result.claimed:
+                self._stop.wait(self.poll_seconds)
+
+    def _heartbeat_loop(self, job_id: str, stop_event: threading.Event) -> None:
+        while not stop_event.wait(self.heartbeat_seconds):
+            try:
+                self.adapter.heartbeat(
+                    job_id,
+                    tenant_id=self.tenant_id,
+                    worker_id=self.worker_id,
+                )
+            except Exception:
+                stop_event.set()
+                return
@@ -1,306 +0,0 @@
-"""Uncredentialed deterministic executor for governed Online Agent changes.
-
-This process never receives Agent/Owner/Bridge credentials and never writes Git refs.
-It operates only on an exchange bundle and returns hash-bound changed files + test evidence.
-"""
-from __future__ import annotations
-
-import base64
-from dataclasses import dataclass
-import errno
-import hashlib
-import io
-import json
-import os
-from pathlib import Path
-import re
-import shutil
-import socket
-import subprocess
-import tarfile
-import tempfile
-import time
-from typing import Any, Mapping, Sequence
-
-ALLOWED_PROGRAMS = {"/usr/bin/python3", "/usr/bin/git", "/bin/true", "/usr/bin/true"}
-MAX_ARCHIVE_BYTES = 64 * 1024 * 1024
-MAX_FILE_BYTES = 4 * 1024 * 1024
-SECRET_ENV_TOKENS = ("TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "AUTHORIZATION", "PRIVATE_KEY")
-REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{15,254}$")
-SENSITIVE_VALUE_RE = re.compile(
-    r"(?i)(authorization\s*[:=]\s*bearer\s+\S+|authorization\s+bearer\s+\S+|"
-    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)"
-)
-
-
-class IsolatedExecutorError(RuntimeError):
-    pass
-
-
-def sha256(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def safe_relative(value: object) -> str:
-    if not isinstance(value, str) or not value or value.startswith("/"):
-        raise IsolatedExecutorError("PATH_INVALID")
-    path = Path(value)
-    if ".." in path.parts or "." in path.parts or any(part in {"", ".git"} for part in path.parts):
-        raise IsolatedExecutorError("PATH_INVALID")
-    return path.as_posix()
-
-
-def resolve_under(root: Path, relative: str) -> Path:
-    root = root.resolve()
-    path = (root / safe_relative(relative)).resolve(strict=False)
-    if path == root or root not in path.parents:
-        raise IsolatedExecutorError("PATH_ESCAPE")
-    return path
-
-
-def _credential_exposure(directory: Path) -> str | None:
-    """Return an exposure code; EACCES is the intended credential isolation proof."""
-    try:
-        if not directory.exists():
-            return None
-        if directory.is_symlink():
-            return "CREDENTIAL_MOUNT_SYMLINK"
-        if os.access(directory, os.R_OK):
-            return "CREDENTIAL_MOUNT_ACCESSIBLE"
-        if directory.is_dir():
-            for child in directory.iterdir():
-                if child.is_file() and os.access(child, os.R_OK):
-                    return "CREDENTIAL_FILE_ACCESSIBLE"
-    except PermissionError:
-        return None
-    return None
-
-
-def assert_uncredentialed() -> None:
-    credentials = Path("/run/credentials")
-    candidates = {credentials}
-    credentials_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-    candidates.add(credentials_directory)
-    leaked = sorted(
-        key for key, value in os.environ.items()
-        if value
-        and (any(token in key.upper() for token in SECRET_ENV_TOKENS) or SENSITIVE_VALUE_RE.search(str(value)))
-    )
-    if leaked:
-        raise IsolatedExecutorError("CREDENTIAL_ENV_EXPOSED:" + ",".join(leaked))
-    for directory in candidates:
-        exposure = _credential_exposure(directory)
-        if exposure is not None:
-            raise IsolatedExecutorError(exposure)
-    # In the intended PrivateNetwork namespace host loopback services are unreachable.
-    try:
-        probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-    except OSError as exc:
-        if exc.errno in {errno.EACCES, errno.EPERM, errno.EAFNOSUPPORT}:
-            return
-        raise IsolatedExecutorError("NETWORK_ISOLATION_PROBE_FAILED") from exc
-    probe.settimeout(0.15)
-    try:
-        if probe.connect_ex(("127.0.0.1", 18892)) == 0:
-            raise IsolatedExecutorError("GOVERNED_BRIDGE_REACHABLE")
-    finally:
-        probe.close()
-
-
-def extract_source(archive: Path, root: Path) -> None:
-    if archive.is_symlink() or not archive.is_file() or archive.stat().st_size > MAX_ARCHIVE_BYTES:
-        raise IsolatedExecutorError("SOURCE_ARCHIVE_INVALID")
-    with tarfile.open(archive, "r:gz") as tf:
-        for member in tf.getmembers():
-            path = Path(member.name)
-            if path.is_absolute() or ".." in path.parts or ".git" in path.parts:
-                raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
-            if member.issym() or member.islnk():
-                raise IsolatedExecutorError("SOURCE_ARCHIVE_LINK_DENY")
-        tf.extractall(root, filter="data")
-
-
-def run_command(item: Mapping[str, Any], root: Path) -> dict[str, Any]:
-    argv = item.get("argv")
-    if not isinstance(argv, Sequence) or isinstance(argv, (str, bytes)) or not argv:
-        raise IsolatedExecutorError("COMMAND_INVALID")
-    argv = [str(part) for part in argv]
-    if argv[0] not in ALLOWED_PROGRAMS:
-        raise IsolatedExecutorError("COMMAND_PROGRAM_DENY")
-    if argv[0] == "/usr/bin/python3" and "-m" in argv:
-        index = argv.index("-m")
-        if index + 1 >= len(argv) or argv[index + 1] not in {"pytest", "py_compile"}:
-            raise IsolatedExecutorError("PYTHON_MODULE_DENY")
-    if argv[0] == "/usr/bin/git" and any(
-        token in {"push", "update-ref", "commit", "merge", "rebase", "reset", "clean", "branch"}
-        for token in argv[1:]
-    ):
-        raise IsolatedExecutorError("GIT_MUTATION_DENY")
-    timeout = int(item.get("timeout_seconds") or 300)
-    if not 1 <= timeout <= 1800:
-        raise IsolatedExecutorError("COMMAND_TIMEOUT_INVALID")
-    cwd = root if item.get("cwd", ".") == "." else resolve_under(root, str(item.get("cwd")))
-    started = time.monotonic()
-    completed = subprocess.run(
-        argv,
-        cwd=cwd,
-        capture_output=True,
-        text=True,
-        check=False,
-        timeout=timeout,
-        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
-    )
-    result = {
-        "label": str(item.get("label") or "command"),
-        "exit_code": completed.returncode,
-        "stdout_sha256": sha256(completed.stdout.encode("utf-8", "replace")),
-        "stderr_sha256": sha256(completed.stderr.encode("utf-8", "replace")),
-        "duration_ms": int((time.monotonic() - started) * 1000),
-    }
-    if completed.returncode != 0:
-        raise IsolatedExecutorError(
-            "COMMAND_FAILED:" + result["label"] + ":" + str(completed.returncode)
-        )
-    return result
-
-
-def apply_changes(request: Mapping[str, Any], root: Path) -> list[str]:
-    changes = request.get("change_set")
-    if not isinstance(changes, list) or not changes:
-        raise IsolatedExecutorError("CHANGE_SET_INVALID")
-    changed: list[str] = []
-    for change in changes:
-        if not isinstance(change, Mapping):
-            raise IsolatedExecutorError("CHANGE_INVALID")
-        relative = safe_relative(change.get("path"))
-        path = resolve_under(root, relative)
-        current = path.read_bytes() if path.is_file() else None
-        expected = change.get("expected_sha256")
-        if expected is not None and (current is None or sha256(current) != expected):
-            raise IsolatedExecutorError("SOURCE_DRIFT:" + relative)
-        operation = change.get("operation")
-        if operation == "write_file":
-            content = change.get("content")
-            if not isinstance(content, str):
-                raise IsolatedExecutorError("WRITE_CONTENT_INVALID")
-            path.parent.mkdir(parents=True, exist_ok=True)
-            path.write_text(content, encoding="utf-8")
-        elif operation == "replace_text":
-            if current is None:
-                raise IsolatedExecutorError("REPLACE_SOURCE_MISSING")
-            old = str(change.get("old"))
-            new = str(change.get("new"))
-            count = int(change.get("count", 1))
-            text = current.decode("utf-8")
-            if text.count(old) != count:
-                raise IsolatedExecutorError("REPLACE_COUNT_INVALID:" + relative)
-            path.write_text(text.replace(old, new), encoding="utf-8")
-        elif operation == "delete_file":
-            if path.exists():
-                path.unlink()
-        else:
-            raise IsolatedExecutorError("CHANGE_OPERATION_INVALID")
-        changed.append(relative)
-    return sorted(set(changed))
-
-
-def changed_bundle(root: Path, changed: list[str]) -> list[dict[str, Any]]:
-    files = []
-    for relative in changed:
-        path = resolve_under(root, relative)
-        if path.exists():
-            data = path.read_bytes()
-            if len(data) > MAX_FILE_BYTES:
-                raise IsolatedExecutorError("CHANGED_FILE_TOO_LARGE:" + relative)
-            files.append({
-                "path": relative,
-                "deleted": False,
-                "sha256": sha256(data),
-                "content_b64": base64.b64encode(data).decode("ascii"),
-            })
-        else:
-            files.append({"path": relative, "deleted": True, "sha256": None, "content_b64": None})
-    return files
-
-
-def execute_request(request_path: Path, result_path: Path) -> None:
-    assert_uncredentialed()
-    request = json.loads(request_path.read_text(encoding="utf-8"))
-    if request.get("schema") != "aios.isolated-execution.request.v1":
-        raise IsolatedExecutorError("REQUEST_SCHEMA_INVALID")
-    request_id = request.get("request_id")
-    if not isinstance(request_id, str) or not REQUEST_ID_RE.fullmatch(request_id):
-        raise IsolatedExecutorError("REQUEST_ID_INVALID")
-    source_archive = Path(str(request.get("source_archive") or ""))
-    if not source_archive.is_absolute():
-        raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
-    expected_archive_sha = str(request.get("source_archive_sha256") or "")
-    if sha256(source_archive.read_bytes()) != expected_archive_sha:
-        raise IsolatedExecutorError("SOURCE_ARCHIVE_SHA_MISMATCH")
-    with tempfile.TemporaryDirectory(prefix="aios-isolated-executor-") as temporary:
-        root = Path(temporary) / "workspace"
-        root.mkdir()
-        extract_source(source_archive, root)
-        changed = apply_changes(request, root)
-        commands = [
-            run_command(item, root)
-            for item in request.get("verification", [])
-            if isinstance(item, Mapping)
-        ]
-        result = {
-            "schema": "aios.isolated-execution.result.v1",
-            "request_id": request_id,
-            "request_sha256": sha256(canonical(request)),
-            "changed_files": changed_bundle(root, changed),
-            "verification": commands,
-            "credential_isolation": {
-                "credential_env_absent": True,
-                "credential_mount_inaccessible": True,
-                "governed_bridge_unreachable": True,
-            },
-        }
-        result["result_sha256"] = sha256(canonical(result))
-        temporary_result = result_path.with_suffix(".tmp")
-        temporary_result.write_text(json.dumps(result, sort_keys=True, separators=(",", ":")), encoding="utf-8")
-        os.replace(temporary_result, result_path)
-
-
-def serve(root: Path) -> None:
-    assert_uncredentialed()
-    requests = root / "requests"
-    results = root / "results"
-    failed = root / "failed"
-    for path in (requests, results, failed):
-        path.mkdir(parents=True, exist_ok=True)
-    while True:
-        for request in sorted(requests.glob("*.json")):
-            if request.is_symlink():
-                continue
-            result = results / request.name
-            try:
-                execute_request(request, result)
-                request.unlink()
-            except Exception as exc:
-                (failed / request.name).write_text(
-                    json.dumps({"error": str(exc) or type(exc).__name__}, sort_keys=True),
-                    encoding="utf-8",
-                )
-                request.unlink(missing_ok=True)
-        time.sleep(0.5)
-
-
-if __name__ == "__main__":
-    import argparse
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--root", default="/var/lib/aios-online-agent-executor")
-    parser.add_argument("--request")
-    parser.add_argument("--result")
-    args = parser.parse_args()
-    if args.request and args.result:
-        execute_request(Path(args.request), Path(args.result))
-    else:
-        serve(Path(args.root))
@@ -1,232 +0,0 @@
-#!/usr/bin/env python3
-"""Root-owned Model Governance configuration reconciler.
-
-The config contains provider/model/policy metadata only. Raw credentials are rejected by
-aios_model_governance and never stored in the governance database.
-"""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_model_governance import (
-    ModelGovernanceError,
-    ModelGovernanceStore,
-    ModelRecord,
-    ProviderRecord,
-    ScopePolicy,
-)
-
-SCHEMA = "aios.model-governance.bootstrap.v1"
-MAX_CONFIG_BYTES = 512 * 1024
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
-    ).encode("utf-8")
-
-
-def fail(code: str) -> None:
-    raise SystemExit(code)
-
-
-def _load(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file() or path.stat().st_size > MAX_CONFIG_BYTES:
-        fail("MODEL_GOVERNANCE_CONFIG_INVALID")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except json.JSONDecodeError:
-        fail("MODEL_GOVERNANCE_CONFIG_INVALID")
-    if not isinstance(value, Mapping) or value.get("schema") != SCHEMA:
-        fail("MODEL_GOVERNANCE_CONFIG_SCHEMA_INVALID")
-    return dict(value)
-
-
-def _provider_desired(value: Mapping[str, Any]) -> ProviderRecord:
-    return ProviderRecord(
-        provider_id=str(value.get("provider_id") or ""),
-        credential_ref=value.get("credential_ref"),
-        enabled=bool(value.get("enabled", True)),
-        failure_domain=str(value.get("failure_domain") or "default"),
-        max_failures=int(value.get("max_failures") or 3),
-        cooldown_seconds=int(value.get("cooldown_seconds") or 60),
-    )
-
-
-def _model_desired(value: Mapping[str, Any]) -> ModelRecord:
-    return ModelRecord(
-        model_id=str(value.get("model_id") or ""),
-        provider_id=str(value.get("provider_id") or ""),
-        version=str(value.get("version") or ""),
-        capabilities=tuple(value.get("capabilities") or ()),
-        input_cost_micros_per_1k=int(value.get("input_cost_micros_per_1k") or 0),
-        output_cost_micros_per_1k=int(value.get("output_cost_micros_per_1k") or 0),
-        max_input_tokens=int(value.get("max_input_tokens") or 0),
-        max_output_tokens=int(value.get("max_output_tokens") or 0),
-        evaluation_state=str(value.get("evaluation_state") or "APPROVED"),
-        evaluation_sha256=str(value.get("evaluation_sha256") or ""),
-        enabled=bool(value.get("enabled", True)),
-        priority=int(value.get("priority") or 100),
-    )
-
-
-def _policy_desired(value: Mapping[str, Any]) -> ScopePolicy:
-    return ScopePolicy(
-        scope_type=str(value.get("scope_type") or ""),
-        tenant_id=value.get("tenant_id"),
-        project_id=value.get("project_id"),
-        allowed_models=tuple(value.get("allowed_models") or ()),
-        denied_providers=tuple(value.get("denied_providers") or ()),
-        required_capabilities=tuple(value.get("required_capabilities") or ()),
-        pinned_model_id=value.get("pinned_model_id"),
-        pinned_model_version=value.get("pinned_model_version"),
-        max_input_tokens_per_request=int(value.get("max_input_tokens_per_request") or 0),
-        max_output_tokens_per_request=int(value.get("max_output_tokens_per_request") or 0),
-        daily_token_budget=int(value.get("daily_token_budget") or 0),
-        daily_cost_budget_micros=int(value.get("daily_cost_budget_micros") or 0),
-        fallback_limit=int(value.get("fallback_limit") or 0),
-    )
-
-
-def _row_dict(row: object) -> dict[str, Any] | None:
-    return dict(row) if row is not None else None
-
-
-def _provider_matches(row: Mapping[str, Any], desired: ProviderRecord) -> bool:
-    return (
-        row["credential_ref"] == desired.credential_ref
-        and bool(row["enabled"]) == desired.enabled
-        and row["failure_domain"] == desired.failure_domain
-        and int(row["max_failures"]) == desired.max_failures
-        and int(row["cooldown_seconds"]) == desired.cooldown_seconds
-    )
-
-
-def _model_matches(row: Mapping[str, Any], desired: ModelRecord) -> bool:
-    return (
-        row["provider_id"] == desired.provider_id
-        and row["version"] == desired.version
-        and tuple(json.loads(row["capabilities_json"])) == tuple(sorted(set(desired.capabilities)))
-        and int(row["input_cost_micros_per_1k"]) == desired.input_cost_micros_per_1k
-        and int(row["output_cost_micros_per_1k"]) == desired.output_cost_micros_per_1k
-        and int(row["max_input_tokens"]) == desired.max_input_tokens
-        and int(row["max_output_tokens"]) == desired.max_output_tokens
-        and row["evaluation_state"] == desired.evaluation_state
-        and row["evaluation_sha256"] == desired.evaluation_sha256
-        and bool(row["enabled"]) == desired.enabled
-        and int(row["priority"]) == desired.priority
-    )
-
-
-def _policy_matches(row: Mapping[str, Any], desired: ScopePolicy) -> bool:
-    return (
-        row["scope_type"] == desired.scope_type
-        and row["tenant_id"] == desired.tenant_id
-        and row["project_id"] == desired.project_id
-        and tuple(json.loads(row["allowed_models_json"])) == tuple(sorted(set(desired.allowed_models)))
-        and tuple(json.loads(row["denied_providers_json"])) == tuple(sorted(set(desired.denied_providers)))
-        and tuple(json.loads(row["required_capabilities_json"])) == tuple(sorted(set(desired.required_capabilities)))
-        and row["pinned_model_id"] == desired.pinned_model_id
-        and row["pinned_model_version"] == desired.pinned_model_version
-        and int(row["max_input_tokens_per_request"]) == desired.max_input_tokens_per_request
-        and int(row["max_output_tokens_per_request"]) == desired.max_output_tokens_per_request
-        and int(row["daily_token_budget"]) == desired.daily_token_budget
-        and int(row["daily_cost_budget_micros"]) == desired.daily_cost_budget_micros
-        and int(row["fallback_limit"]) == desired.fallback_limit
-    )
-
-
-def apply_config(db_path: Path, config_path: Path) -> dict[str, Any]:
-    config = _load(config_path)
-    config_sha = hashlib.sha256(canonical(config)).hexdigest()
-    providers = config.get("providers") or []
-    models = config.get("models") or []
-    policies = config.get("policies") or []
-    if not all(isinstance(value, list) for value in (providers, models, policies)):
-        fail("MODEL_GOVERNANCE_CONFIG_COLLECTION_INVALID")
-
-    store = ModelGovernanceStore(db_path)
-    changes = {"providers": 0, "models": 0, "policies": 0, "unchanged": 0}
-    try:
-        for item in providers:
-            if not isinstance(item, Mapping):
-                fail("MODEL_GOVERNANCE_PROVIDER_CONFIG_INVALID")
-            desired = _provider_desired(item)
-            row = store.conn.execute(
-                "SELECT * FROM model_governance_providers WHERE provider_id=?",
-                (desired.provider_id,),
-            ).fetchone()
-            if row is not None and _provider_matches(row, desired):
-                changes["unchanged"] += 1
-                continue
-            expected = int(row["revision"]) if row is not None else 0
-            store.register_provider(desired, expected_revision=expected)
-            changes["providers"] += 1
-
-        for item in models:
-            if not isinstance(item, Mapping):
-                fail("MODEL_GOVERNANCE_MODEL_CONFIG_INVALID")
-            desired = _model_desired(item)
-            row = store.conn.execute(
-                "SELECT * FROM model_governance_models WHERE model_id=?",
-                (desired.model_id,),
-            ).fetchone()
-            if row is not None and _model_matches(row, desired):
-                changes["unchanged"] += 1
-                continue
-            expected = int(row["revision"]) if row is not None else 0
-            store.register_model(desired, expected_revision=expected)
-            changes["models"] += 1
-
-        for item in policies:
-            if not isinstance(item, Mapping):
-                fail("MODEL_GOVERNANCE_POLICY_CONFIG_INVALID")
-            desired = _policy_desired(item)
-            row = store.conn.execute(
-                "SELECT * FROM model_governance_scope_policies WHERE scope_key=?",
-                (desired.scope_key,),
-            ).fetchone()
-            if row is not None and _policy_matches(row, desired):
-                changes["unchanged"] += 1
-                continue
-            expected = int(row["revision"]) if row is not None else 0
-            store.set_scope_policy(desired, expected_revision=expected)
-            changes["policies"] += 1
-
-        if not store.verify_audit_chain():
-            fail("MODEL_GOVERNANCE_AUDIT_CHAIN_INVALID")
-        return {
-            "schema": "aios.model-governance.bootstrap-result.v1",
-            "database": str(db_path),
-            "config_sha256": config_sha,
-            "changes": changes,
-            "audit_chain_valid": True,
-        }
-    finally:
-        store.close()
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--db", required=True)
-    parser.add_argument("--config", required=True)
-    parser.add_argument("--output")
-    args = parser.parse_args()
-    try:
-        result = apply_config(Path(args.db), Path(args.config))
-    except ModelGovernanceError as exc:
-        print(json.dumps({"status": "FAILED", "error": exc.code}, sort_keys=True))
-        return 20
-    data = json.dumps(result, indent=2, sort_keys=True) + "\n"
-    if args.output:
-        Path(args.output).write_text(data, encoding="utf-8")
-    print(data, end="")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,302 +0,0 @@
-"""Durable checkpoint journal for the generic Online Agent worker.
-
-The JSON task state remains a fast cache.  This SQLite journal is the durable,
-append-only evidence used for restart/resume/replay decisions.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import json
-from pathlib import Path
-import sqlite3
-from typing import Any, Mapping
-
-PHASE_ORDER = {
-    "claimed": 10,
-    "workspace_prepared": 20,
-    "verification_passed": 30,
-    "agent_runtime_done": 40,
-    "source_capture_done": 40,
-    "commit_done": 40,
-    "reconciliation_required": 45,
-    "result_pending": 50,
-    "result_submitted": 60,
-}
-
-
-class CheckpointError(RuntimeError):
-    pass
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str).encode("utf-8")
-
-
-def sha256_json(value: object) -> str:
-    return hashlib.sha256(canonical(value)).hexdigest()
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-@dataclass(frozen=True)
-class CheckpointBinding:
-    task_id: str
-    attempt: int
-    execution_digest: str
-    job_id: str
-    repository: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    generation: int
-
-    def material(self) -> dict[str, Any]:
-        return {
-            "task_id": self.task_id,
-            "attempt": self.attempt,
-            "execution_digest": self.execution_digest,
-            "job_id": self.job_id,
-            "repository": self.repository,
-            "base_oid": self.base_oid,
-            "expected_branch_oid": self.expected_branch_oid,
-            "target_branch": self.target_branch,
-            "generation": self.generation,
-        }
-
-    @property
-    def binding_sha256(self) -> str:
-        return sha256_json(self.material())
-
-
-class CheckpointStore:
-    def __init__(self, path: Path) -> None:
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        with self._connect() as connection:
-            connection.executescript(
-                """
-                CREATE TABLE IF NOT EXISTS checkpoints(
-                  task_id TEXT NOT NULL,
-                  attempt INTEGER NOT NULL,
-                  sequence INTEGER NOT NULL,
-                  phase TEXT NOT NULL,
-                  phase_order INTEGER NOT NULL,
-                  execution_digest TEXT NOT NULL,
-                  job_id TEXT NOT NULL,
-                  repository TEXT NOT NULL,
-                  base_oid TEXT NOT NULL,
-                  expected_branch_oid TEXT NOT NULL,
-                  target_branch TEXT NOT NULL,
-                  generation INTEGER NOT NULL,
-                  binding_sha256 TEXT NOT NULL,
-                  payload_json TEXT NOT NULL,
-                  payload_sha256 TEXT NOT NULL,
-                  created_at TEXT NOT NULL,
-                  PRIMARY KEY(task_id, attempt, sequence)
-                );
-                CREATE INDEX IF NOT EXISTS idx_checkpoints_task_latest
-                  ON checkpoints(task_id, attempt DESC, sequence DESC);
-                CREATE UNIQUE INDEX IF NOT EXISTS idx_checkpoints_exact_replay
-                  ON checkpoints(task_id, attempt, phase, payload_sha256);
-                CREATE TABLE IF NOT EXISTS checkpoint_heads(
-                  task_id TEXT PRIMARY KEY,
-                  attempt INTEGER NOT NULL,
-                  sequence INTEGER NOT NULL,
-                  phase TEXT NOT NULL,
-                  phase_order INTEGER NOT NULL,
-                  execution_digest TEXT NOT NULL,
-                  binding_sha256 TEXT NOT NULL,
-                  payload_sha256 TEXT NOT NULL,
-                  updated_at TEXT NOT NULL
-                );
-                """
-            )
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA journal_mode=WAL")
-        connection.execute("PRAGMA synchronous=FULL")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _phase_order(phase: str) -> int:
-        try:
-            return PHASE_ORDER[phase]
-        except KeyError as exc:
-            raise CheckpointError("CHECKPOINT_PHASE_INVALID") from exc
-
-    def append(
-        self,
-        binding: CheckpointBinding,
-        phase: str,
-        payload: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        order = self._phase_order(phase)
-        payload_value = dict(payload)
-        payload_sha = sha256_json(payload_value)
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            replay = connection.execute(
-                """
-                SELECT * FROM checkpoints
-                 WHERE task_id=? AND attempt=? AND phase=? AND payload_sha256=?
-                """,
-                (binding.task_id, binding.attempt, phase, payload_sha),
-            ).fetchone()
-            if replay is not None:
-                connection.commit()
-                return dict(replay)
-
-            head = connection.execute(
-                "SELECT * FROM checkpoint_heads WHERE task_id=?",
-                (binding.task_id,),
-            ).fetchone()
-            if head is not None:
-                head_attempt = int(head["attempt"])
-                head_order = int(head["phase_order"])
-                if binding.attempt < head_attempt:
-                    raise CheckpointError("CHECKPOINT_ATTEMPT_REGRESSION")
-                if binding.attempt == head_attempt:
-                    if head["execution_digest"] != binding.execution_digest:
-                        raise CheckpointError("CHECKPOINT_EXECUTION_DIGEST_CONFLICT")
-                    if head["binding_sha256"] != binding.binding_sha256:
-                        raise CheckpointError("CHECKPOINT_SCOPE_MISMATCH_DENY")
-                    if order < head_order and phase != "reconciliation_required":
-                        raise CheckpointError("CHECKPOINT_PHASE_REGRESSION")
-                    sequence = int(head["sequence"]) + 1
-                else:
-                    sequence = 1
-            else:
-                sequence = 1
-
-            created_at = now()
-            connection.execute(
-                """
-                INSERT INTO checkpoints(
-                  task_id,attempt,sequence,phase,phase_order,execution_digest,job_id,
-                  repository,base_oid,expected_branch_oid,target_branch,generation,
-                  binding_sha256,payload_json,payload_sha256,created_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    binding.task_id,
-                    binding.attempt,
-                    sequence,
-                    phase,
-                    order,
-                    binding.execution_digest,
-                    binding.job_id,
-                    binding.repository,
-                    binding.base_oid,
-                    binding.expected_branch_oid,
-                    binding.target_branch,
-                    binding.generation,
-                    binding.binding_sha256,
-                    canonical(payload_value).decode("utf-8"),
-                    payload_sha,
-                    created_at,
-                ),
-            )
-            connection.execute(
-                """
-                INSERT INTO checkpoint_heads(
-                  task_id,attempt,sequence,phase,phase_order,execution_digest,
-                  binding_sha256,payload_sha256,updated_at
-                ) VALUES (?,?,?,?,?,?,?,?,?)
-                ON CONFLICT(task_id) DO UPDATE SET
-                  attempt=excluded.attempt,
-                  sequence=excluded.sequence,
-                  phase=excluded.phase,
-                  phase_order=excluded.phase_order,
-                  execution_digest=excluded.execution_digest,
-                  binding_sha256=excluded.binding_sha256,
-                  payload_sha256=excluded.payload_sha256,
-                  updated_at=excluded.updated_at
-                """,
-                (
-                    binding.task_id,
-                    binding.attempt,
-                    sequence,
-                    phase,
-                    order,
-                    binding.execution_digest,
-                    binding.binding_sha256,
-                    payload_sha,
-                    created_at,
-                ),
-            )
-            connection.commit()
-            row = connection.execute(
-                "SELECT * FROM checkpoints WHERE task_id=? AND attempt=? AND sequence=?",
-                (binding.task_id, binding.attempt, sequence),
-            ).fetchone()
-            return dict(row)
-
-    def latest(self, task_id: str) -> dict[str, Any] | None:
-        with self._connect() as connection:
-            row = connection.execute(
-                """
-                SELECT * FROM checkpoints
-                 WHERE task_id=?
-                 ORDER BY attempt DESC, sequence DESC
-                 LIMIT 1
-                """,
-                (task_id,),
-            ).fetchone()
-            if row is None:
-                return None
-            value = dict(row)
-            value["payload"] = json.loads(value.pop("payload_json"))
-            return value
-
-    def latest_for_attempt(self, task_id: str, attempt: int) -> dict[str, Any] | None:
-        with self._connect() as connection:
-            row = connection.execute(
-                """
-                SELECT * FROM checkpoints
-                 WHERE task_id=? AND attempt=?
-                 ORDER BY sequence DESC
-                 LIMIT 1
-                """,
-                (task_id, attempt),
-            ).fetchone()
-            if row is None:
-                return None
-            value = dict(row)
-            value["payload"] = json.loads(value.pop("payload_json"))
-            return value
-
-    def verify_latest_binding(self, binding: CheckpointBinding) -> dict[str, Any] | None:
-        value = self.latest(binding.task_id)
-        if value is None:
-            return None
-        if int(value["attempt"]) > binding.attempt:
-            raise CheckpointError("CHECKPOINT_FUTURE_ATTEMPT")
-        # A previous attempt may be reused only when the immutable execution/scope binding matches.
-        if value["execution_digest"] != binding.execution_digest:
-            return None
-        expected = CheckpointBinding(
-            task_id=value["task_id"],
-            attempt=int(value["attempt"]),
-            execution_digest=value["execution_digest"],
-            job_id=value["job_id"],
-            repository=value["repository"],
-            base_oid=value["base_oid"],
-            expected_branch_oid=value["expected_branch_oid"],
-            target_branch=value["target_branch"],
-            generation=int(value["generation"]),
-        )
-        current_scope = binding.material()
-        historical_scope = expected.material()
-        current_scope.pop("attempt", None)
-        historical_scope.pop("attempt", None)
-        if sha256_json(current_scope) != sha256_json(historical_scope):
-            raise CheckpointError("CHECKPOINT_SCOPE_MISMATCH_DENY")
-        return value
@@ -1,463 +0,0 @@
-"""Bounded read-only repository interface map for governed Online Agent analysis.
-
-The compact map intentionally returns symbols and short source excerpts rather than a
-source archive. It is designed for control-plane consumers that cannot safely ingest a
-multi-megabyte repository snapshot.
-"""
-from __future__ import annotations
-
-import ast
-import hashlib
-import json
-from pathlib import Path
-import re
-from typing import Any, Iterable, Mapping, Sequence
-
-
-SCHEMA = "aios.engineering.interface-map.v1"
-MAX_RESULT_BYTES = 120 * 1024
-TARGET_RESULT_BYTES = 108 * 1024
-MAX_MODULES = 40
-MAX_SYMBOLS = 80
-MAX_TESTS = 40
-MAX_EXCERPTS = 25
-MAX_EXCERPT_CHARS = 1200
-MAX_FILE_BYTES = 2 * 1024 * 1024
-
-ROOTS = (
-    "active-runtime/app",
-    "runtime/agent-os",
-    "tests",
-    "db/migrations",
-    "migrations",
-    "deploy/systemd",
-    "docs/task-plane",
-    "docs/superpowers/specs",
-)
-SUFFIXES = {".py", ".sql", ".service", ".md", ".json", ".yaml", ".yml"}
-
-DEFAULT_TERMS = {
-    "agent", "worker", "fleet", "scheduler", "scheduling", "task", "claim", "lease",
-    "heartbeat", "capacity", "concurrency", "priority", "fairness", "queue", "retry",
-    "backoff", "circuit", "health", "liveness", "scope", "tenant", "project", "trace",
-    "message", "checkpoint", "recovery", "idempotency", "dispatch", "assignment",
-}
-FLEET_CONTRACT_TERMS: dict[str, tuple[str, ...]] = {
-    "FLEET_AGENT_REGISTRATION": ("agent", "register", "worker", "capability", "version"),
-    "FLEET_CAPACITY_SCHEDULING": ("capacity", "slot", "concurrency", "scheduler", "queue"),
-    "FLEET_FAIRNESS": ("fair", "priority", "queue", "tenant", "project", "starvation"),
-    "FLEET_FAULT_ISOLATION": ("failure", "health", "liveness", "timeout", "circuit", "poison"),
-    "FLEET_WORKER_REASSIGNMENT": ("reassign", "assignment", "claim", "lease", "retry", "worker"),
-    "FLEET_SCOPE_ISOLATION": ("tenant", "project", "scope", "conversation", "task", "run"),
-    "FLEET_IDEMPOTENT_DISPATCH": ("idempot", "dispatch", "claim", "lease", "result", "attempt"),
-    "FLEET_FAILURE_RECOVERY": ("checkpoint", "resume", "recover", "retry", "cleanup", "receipt"),
-}
-
-MODEL_GOVERNANCE_CONTRACT_TERMS: dict[str, tuple[str, ...]] = {
-    "MODEL_PROVIDER_REGISTRY": ("model", "provider", "registry", "endpoint", "capability"),
-    "MODEL_SELECTION_POLICY": ("model", "select", "route", "policy", "capability"),
-    "MODEL_VERSION_PINNING": ("model", "version", "pin", "revision", "snapshot"),
-    "MODEL_BUDGET_ACCOUNTING": ("budget", "token", "cost", "quota", "usage"),
-    "MODEL_FALLBACK_POLICY": ("fallback", "retry", "route", "provider", "model"),
-    "MODEL_SCOPE_ISOLATION": ("tenant", "project", "scope", "policy", "model"),
-    "MODEL_CREDENTIAL_BOUNDARY": ("credential", "secret", "provider", "tool", "token"),
-    "MODEL_TRACE_AUDIT": ("trace", "audit", "model", "provider", "request"),
-    "MODEL_EVALUATION_GATE": ("eval", "evaluation", "approval", "quality", "gate"),
-    "MODEL_ROUTING_RESILIENCE": ("route", "retry", "fallback", "timeout", "health"),
-}
-
-PROFILE_CLASSIFICATION = {
-    "fleet": "P2_INTERFACE_MAP_CAPTURED",
-    "model_governance": "MODEL_GOVERNANCE_INTERFACE_MAP_CAPTURED",
-}
-
-MODEL_PROFILE_MARKERS = {
-    "model", "provider", "llm", "inference", "routing", "router", "budget",
-    "token", "cost", "quota", "fallback", "evaluation", "eval", "approval",
-    "version", "pinning",
-}
-SENSITIVE_RE = re.compile(
-    r"(?i)(authorization\s*:\s*bearer\s+\S+|"
-    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*['\"]?[^'\"\s,;]+)"
-)
-SQL_TABLE_RE = re.compile(
-    r"(?is)\bcreate\s+table\s+(?:if\s+not\s+exists\s+)?[\"`[]?([A-Za-z_][A-Za-z0-9_.-]*)"
-)
-
-
-class CompactInterfaceMapError(RuntimeError):
-    pass
-
-
-def _sha(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-
-def _bounded_excerpt(text: str, start_line: int, end_line: int) -> str:
-    lines = text.splitlines()
-    start = max(0, start_line - 2)
-    end = min(len(lines), max(end_line + 1, start + 1))
-    excerpt = "\n".join(lines[start:end])
-    excerpt = SENSITIVE_RE.sub("<redacted-sensitive-source-pattern>", excerpt)
-    if len(excerpt) > MAX_EXCERPT_CHARS:
-        excerpt = excerpt[: MAX_EXCERPT_CHARS - 1] + "…"
-    return excerpt
-
-
-def _signal_terms(signals: Sequence[str]) -> set[str]:
-    terms = set(DEFAULT_TERMS)
-    for signal in signals:
-        if not isinstance(signal, str):
-            continue
-        terms.update(
-            token.lower()
-            for token in re.findall(r"[A-Za-z][A-Za-z0-9_.-]{2,63}", signal)
-        )
-    return set(sorted(terms)[:96])
-
-
-def _profile(source_signals: Sequence[str]) -> str:
-    tokens: set[str] = set()
-    for signal in source_signals:
-        if not isinstance(signal, str):
-            continue
-        tokens.update(
-            token.lower()
-            for token in re.findall(r"[A-Za-z][A-Za-z0-9_.-]{2,63}", signal)
-        )
-    model_score = len(tokens & MODEL_PROFILE_MARKERS)
-    return "model_governance" if model_score >= 2 else "fleet"
-
-
-def _contract_terms(profile: str) -> Mapping[str, tuple[str, ...]]:
-    if profile == "model_governance":
-        return MODEL_GOVERNANCE_CONTRACT_TERMS
-    if profile == "fleet":
-        return FLEET_CONTRACT_TERMS
-    raise CompactInterfaceMapError("INTERFACE_MAP_PROFILE_INVALID")
-
-
-def _candidate_files(root: Path, terms: set[str]) -> list[dict[str, Any]]:
-    root = root.resolve()
-    candidates: list[dict[str, Any]] = []
-    for relative_root in ROOTS:
-        directory = (root / relative_root).resolve(strict=False)
-        if directory == root or root not in directory.parents:
-            raise CompactInterfaceMapError("INTERFACE_MAP_SCOPE_INVALID")
-        if not directory.is_dir() or directory.is_symlink():
-            continue
-        for path in sorted(directory.rglob("*")):
-            if path.is_symlink() or not path.is_file() or path.suffix.lower() not in SUFFIXES:
-                continue
-            resolved = path.resolve(strict=True)
-            if root not in resolved.parents:
-                raise CompactInterfaceMapError("INTERFACE_MAP_PATH_ESCAPE")
-            data = path.read_bytes()
-            if len(data) > MAX_FILE_BYTES:
-                continue
-            relative = path.relative_to(root).as_posix()
-            text = data.decode("utf-8", "ignore")
-            searchable = (relative + "\n" + text[:384000]).lower()
-            matched = sorted(term for term in terms if term in searchable)
-            if not matched:
-                continue
-            path_bonus = sum(3 for term in terms if term in relative.lower())
-            test_bonus = 3 if relative.startswith("tests/") else 0
-            score = min(250, len(matched) + path_bonus + test_bonus)
-            candidates.append(
-                {
-                    "path": relative,
-                    "sha256": _sha(data),
-                    "bytes": len(data),
-                    "score": score,
-                    "text": text,
-                    "suffix": path.suffix.lower(),
-                }
-            )
-    candidates.sort(key=lambda item: (-item["score"], item["path"]))
-    return candidates
-
-
-def _python_symbols(item: Mapping[str, Any], terms: set[str]) -> list[dict[str, Any]]:
-    try:
-        tree = ast.parse(str(item["text"]), filename=str(item["path"]))
-    except SyntaxError:
-        return []
-    result: list[dict[str, Any]] = []
-
-    class Visitor(ast.NodeVisitor):
-        def __init__(self) -> None:
-            self.stack: list[str] = []
-
-        def _record(self, node: ast.AST, kind: str, name: str) -> None:
-            qualified = ".".join([*self.stack, name]) if self.stack else name
-            haystack = f"{item['path']} {qualified}".lower()
-            score = sum(3 if term in haystack else 0 for term in terms)
-            if name.startswith("test_"):
-                score += 12
-            result.append(
-                {
-                    "path": item["path"],
-                    "symbol": qualified,
-                    "kind": kind,
-                    "line": int(getattr(node, "lineno", 1)),
-                    "end_line": int(getattr(node, "end_lineno", getattr(node, "lineno", 1))),
-                    "score": score + int(item["score"]),
-                }
-            )
-
-        def visit_ClassDef(self, node: ast.ClassDef) -> Any:
-            self._record(node, "class", node.name)
-            self.stack.append(node.name)
-            self.generic_visit(node)
-            self.stack.pop()
-
-        def visit_FunctionDef(self, node: ast.FunctionDef) -> Any:
-            self._record(node, "function", node.name)
-            self.stack.append(node.name)
-            self.generic_visit(node)
-            self.stack.pop()
-
-        def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef) -> Any:
-            self._record(node, "async_function", node.name)
-            self.stack.append(node.name)
-            self.generic_visit(node)
-            self.stack.pop()
-
-    Visitor().visit(tree)
-    return result
-
-
-def _surface_ref(symbol: Mapping[str, Any]) -> str:
-    return f"{symbol['path']}::{symbol['symbol']}"
-
-
-def _contract_map(
-    symbols: Sequence[Mapping[str, Any]],
-    modules: Sequence[Mapping[str, Any]],
-    contract_terms: Mapping[str, tuple[str, ...]],
-) -> dict[str, Any]:
-    result: dict[str, Any] = {}
-    module_paths = [str(item["path"]) for item in modules]
-    for contract, terms in contract_terms.items():
-        scored: list[tuple[int, str]] = []
-        for symbol in symbols:
-            haystack = _surface_ref(symbol).lower()
-            score = sum(1 for term in terms if term in haystack)
-            if score:
-                scored.append((score, _surface_ref(symbol)))
-        scored.sort(key=lambda item: (-item[0], item[1]))
-        surfaces = [value for _, value in scored[:6]]
-        if not surfaces:
-            for path in module_paths:
-                score = sum(1 for term in terms if term in path.lower())
-                if score:
-                    surfaces.append(path)
-                if len(surfaces) == 6:
-                    break
-        result[contract] = {
-            "status": "PARTIAL" if surfaces else "GAP",
-            "surfaces": surfaces,
-        }
-    return result
-
-
-def _gap_evidence(
-    symbols: Sequence[Mapping[str, Any]],
-    profile: str,
-) -> tuple[list[str], list[str], list[str]]:
-    haystack = "\n".join(_surface_ref(item).lower() for item in symbols)
-
-    if profile == "model_governance":
-        invariants = [
-            "Online Task claim/heartbeat remains the authoritative worker ownership boundary.",
-            "Provider/model credentials remain outside uncredentialed planner/executor processes.",
-            "P0-A tenant/project scope and P0-C trace/audit lineage must constrain model routing.",
-            "P1 retry/checkpoint semantics remain authoritative for model-call execution recovery.",
-        ]
-        failure_windows: list[str] = []
-        if "provider" not in haystack and "model" not in haystack:
-            failure_windows.append("No first-class model/provider registry surface detected.")
-        if "budget" not in haystack and "cost" not in haystack and "quota" not in haystack:
-            failure_windows.append("No explicit durable model budget/cost/quota accounting surface detected.")
-        if "fallback" not in haystack and "route" not in haystack:
-            failure_windows.append("No explicit model fallback/routing policy surface detected.")
-        if "eval" not in haystack and "approval" not in haystack:
-            failure_windows.append("No explicit evaluation/approval gate surface detected for model changes.")
-        if "version" not in haystack and "pin" not in haystack:
-            failure_windows.append("No explicit model-version pinning surface detected.")
-        desired = (
-            ("trace", "P0-C trace/audit lineage"),
-            ("scope", "P0-A tenant/project scope isolation"),
-            ("credential", "P0-C credential governance"),
-            ("checkpoint", "P1 durable execution recovery"),
-            ("message", "P0-B MessageEnvelope/handoff"),
-            ("retry", "P1 retry/idempotency"),
-        )
-    else:
-        invariants = [
-            "Online Task claim/heartbeat remains the authoritative worker ownership boundary.",
-            "Governed mutation remains separated from read-only analysis and requires WriterLease.",
-            "P1 attempt-aware result idempotency and durable checkpoint recovery are reusable fleet primitives.",
-            "Scope/trace/message lineage must remain attached when work is scheduled or reassigned.",
-        ]
-        failure_windows = []
-        if "scheduler" not in haystack:
-            failure_windows.append("No first-class durable fleet scheduler symbol detected; worker-local polling may still be the scheduling mechanism.")
-        if "capacity" not in haystack and "slot" not in haystack:
-            failure_windows.append("No explicit durable worker-capacity/slot primitive detected.")
-        if "fair" not in haystack and "starvation" not in haystack:
-            failure_windows.append("No explicit fairness/starvation policy symbol detected.")
-        if "circuit" not in haystack:
-            failure_windows.append("No explicit circuit-breaker primitive detected for repeated worker/task failures.")
-        if "reassign" not in haystack:
-            failure_windows.append("No explicit worker-reassignment primitive detected beyond lease expiry/retry semantics.")
-        desired = (
-            ("checkpoint", "P1 durable checkpoint/resume"),
-            ("message", "P0-B MessageEnvelope/handoff"),
-            ("trace", "P0-C trace correlation"),
-            ("scope", "P0-A scope isolation"),
-            ("lease", "claim/WriterLease ownership"),
-            ("heartbeat", "worker liveness"),
-            ("idempot", "retry-safe dispatch/result"),
-        )
-
-    reuse_points: list[str] = []
-    for token, label in desired:
-        match = next((item for item in symbols if token in _surface_ref(item).lower()), None)
-        if match is not None:
-            reuse_points.append(f"{label}: {_surface_ref(match)}")
-    return invariants, failure_windows, reuse_points
-
-
-def _trim_to_budget(value: dict[str, Any]) -> dict[str, Any]:
-    def size() -> int:
-        return len(json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8"))
-
-    while size() > TARGET_RESULT_BYTES and value["bounded_excerpts"]:
-        value["bounded_excerpts"].pop()
-    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["functions"]) > 20:
-        value["implementation_map"]["functions"].pop()
-    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["classes"]) > 15:
-        value["implementation_map"]["classes"].pop()
-    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["tests"]) > 15:
-        value["implementation_map"]["tests"].pop()
-    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["modules"]) > 20:
-        value["implementation_map"]["modules"].pop()
-    final_size = size()
-    if final_size > MAX_RESULT_BYTES:
-        raise CompactInterfaceMapError("INTERFACE_MAP_RESULT_TOO_LARGE")
-    value["result_bytes"] = final_size
-    return value
-
-
-def build_compact_interface_map(
-    worktree: Path,
-    source_signals: Sequence[str],
-    *,
-    source_commit: str,
-) -> dict[str, Any]:
-    root = Path(worktree)
-    if not root.is_dir() or root.is_symlink():
-        raise CompactInterfaceMapError("INTERFACE_MAP_WORKTREE_INVALID")
-    if re.fullmatch(r"[0-9a-f]{40}", source_commit) is None:
-        raise CompactInterfaceMapError("INTERFACE_MAP_SOURCE_COMMIT_INVALID")
-
-    profile = _profile(source_signals)
-    terms = _signal_terms(source_signals)
-    candidates = _candidate_files(root, terms)
-    if not candidates:
-        raise CompactInterfaceMapError("INTERFACE_MAP_EMPTY")
-
-    module_candidates = candidates[:MAX_MODULES]
-    modules = [
-        {
-            "path": item["path"],
-            "sha256": item["sha256"],
-            "bytes": item["bytes"],
-            "score": item["score"],
-        }
-        for item in module_candidates
-    ]
-
-    symbols: list[dict[str, Any]] = []
-    tables: list[dict[str, Any]] = []
-    systemd_units: list[dict[str, Any]] = []
-    for item in candidates:
-        if item["suffix"] == ".py":
-            symbols.extend(_python_symbols(item, terms))
-        elif item["suffix"] == ".sql":
-            for table in SQL_TABLE_RE.findall(str(item["text"])):
-                tables.append({"path": item["path"], "table": table, "sha256": item["sha256"]})
-        elif item["suffix"] == ".service":
-            systemd_units.append({"path": item["path"], "unit": Path(str(item["path"])).name, "sha256": item["sha256"]})
-
-    symbols.sort(key=lambda item: (-int(item["score"]), str(item["path"]), str(item["symbol"])))
-    all_symbols = list(symbols)
-    test_symbols = [
-        item for item in all_symbols
-        if str(item["path"]).startswith("tests/") or str(item["symbol"]).split(".")[-1].startswith("test_")
-    ][: min(MAX_TESTS, 24)]
-    non_test_symbols = [
-        item for item in all_symbols
-        if item not in test_symbols
-    ][: max(0, MAX_SYMBOLS - len(test_symbols))]
-    symbols = [*test_symbols, *non_test_symbols]
-    symbols.sort(key=lambda item: (-int(item["score"]), str(item["path"]), str(item["symbol"])))
-    classes = [
-        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
-        for item in symbols
-        if item["kind"] == "class"
-    ]
-    functions = [
-        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
-        for item in symbols
-        if item["kind"] in {"function", "async_function"} and not str(item["symbol"]).split(".")[-1].startswith("test_")
-    ]
-    tests = [
-        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
-        for item in symbols
-        if str(item["path"]).startswith("tests/") or str(item["symbol"]).split(".")[-1].startswith("test_")
-    ][:MAX_TESTS]
-
-    excerpts: list[dict[str, Any]] = []
-    by_path = {str(item["path"]): item for item in candidates}
-    for symbol in symbols:
-        if len(excerpts) == MAX_EXCERPTS:
-            break
-        item = by_path.get(str(symbol["path"]))
-        if item is None:
-            continue
-        excerpt = _bounded_excerpt(str(item["text"]), int(symbol["line"]), int(symbol["end_line"]))
-        if not excerpt.strip():
-            continue
-        excerpts.append(
-            {
-                "path": symbol["path"],
-                "symbol": symbol["symbol"],
-                "sha256": item["sha256"],
-                "excerpt": excerpt,
-            }
-        )
-
-    invariants, failure_windows, reuse_points = _gap_evidence(all_symbols, profile)
-    result = {
-        "schema": SCHEMA,
-        "profile": profile,
-        "classification": PROFILE_CLASSIFICATION[profile],
-        "source_commit": source_commit,
-        "implementation_map": {
-            "modules": modules,
-            "classes": classes[:MAX_SYMBOLS],
-            "functions": functions[:MAX_SYMBOLS],
-            "tables": tables[:40],
-            "systemd_units": systemd_units[:20],
-            "tests": tests,
-            "current_invariants": invariants,
-            "failure_windows": failure_windows,
-            "reuse_points": reuse_points,
-        },
-        "bounded_excerpts": excerpts,
-        "contracts": _contract_map(all_symbols, modules, _contract_terms(profile)),
-    }
-    return _trim_to_budget(result)
@@ -1,482 +0,0 @@
-"""Canonical governed execution projection for Online Agent Tasks.
-
-The durable governed binding is authoritative.  Natural-language task fields and
-worker configuration are never allowed to invent repository, ref, generation, or
-idempotency coordinates.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-import hashlib
-import json
-import re
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-import urllib.error
-import urllib.request
-
-
-EXECUTION_SCHEMA = "aios.online-agent.execution.v2"
-PROJECTION_SCHEMA = "aios.online-agent.task-projection.v1"
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
-PROTECTED_PREFIXES = ("main", "master", "refs/", "tags/", "tag/", "release/", "baseline/", "production/")
-MUTATION_ACTIONS = frozenset({"deterministic"})
-READ_ONLY_ACTIONS = frozenset({"source_capture", "agent_runtime"})
-SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture", "agent_runtime"})
-AGENT_RUNTIME_ADAPTERS = frozenset({"hermes", "openclaw"})
-MAX_AGENT_RUNTIME_INPUT_BYTES = 64 * 1024
-
-
-class ExecutionProjectionError(RuntimeError):
-    """A canonical fail-closed projection or validation error."""
-
-
-class OnlineTaskProjectionClient:
-    """Official HTTP projection client using only a control credential reference."""
-
-    def __init__(self, api_base: str, control_token_path: Path) -> None:
-        self.api_base = api_base.rstrip("/")
-        self.control_token_path = Path(control_token_path)
-
-    def _token(self) -> str:
-        path = self.control_token_path
-        if path.is_symlink() or not path.is_file():
-            _error("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
-        value = path.read_text(encoding="utf-8").strip()
-        if len(value) < 32:
-            _error("ONLINE_TASK_PROJECTION_CONTROL_INVALID")
-        return value
-
-    def create(
-        self,
-        projected_task: Mapping[str, Any],
-        *,
-        binding: "GovernedExecutionBinding",
-    ) -> dict[str, Any]:
-        body = dict(projected_task)
-        payload = _canonical(body).encode("utf-8")
-        request = urllib.request.Request(
-            self.api_base + "/v1/tasks",
-            method="POST",
-            data=payload,
-            headers={
-                "Authorization": "Bearer " + self._token(),
-                "Content-Type": "application/json",
-                "Accept": "application/json",
-            },
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=15) as response:
-                result = json.loads(response.read().decode("utf-8"))
-                status = response.status
-        except urllib.error.HTTPError as exc:
-            raw = exc.read(8192).decode("utf-8", "replace")
-            try:
-                error = json.loads(raw).get("error")
-            except (AttributeError, json.JSONDecodeError):
-                error = "HTTP_ERROR"
-            raise ExecutionProjectionError(f"ONLINE_TASK_PROJECTION_FAILED:{exc.code}:{error}") from exc
-        except (OSError, urllib.error.URLError, TimeoutError) as exc:
-            raise ExecutionProjectionError("ONLINE_TASK_PROJECTION_UNAVAILABLE") from exc
-        if status not in {200, 201} or not isinstance(result, dict):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        if result.get("task_id") != binding.task_id or result.get("status") not in {"QUEUED", "VERIFYING", "SUCCEEDED"}:
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        metadata = result.get("metadata")
-        if not isinstance(metadata, Mapping):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        returned_execution = validate_execution_envelope(
-            _object(metadata.get("execution"), "ONLINE_TASK_PROJECTION_RESPONSE_INVALID"),
-            binding=binding,
-        )
-        submitted_metadata = _object(body.get("metadata"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID")
-        submitted_execution = validate_execution_envelope(
-            _object(submitted_metadata.get("execution"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID"),
-            binding=binding,
-        )
-        if _canonical(returned_execution) != _canonical(submitted_execution):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID")
-        return result
-
-
-def _error(code: str) -> None:
-    raise ExecutionProjectionError(code)
-
-
-def _object(value: object, code: str) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        _error(code)
-    return dict(value)
-
-
-def _string(value: object, code: str) -> str:
-    if not isinstance(value, str) or not value.strip():
-        _error(code)
-    return value.strip()
-
-
-def _task_id(value: object) -> str:
-    value = _string(value, "TASK_ID_INVALID")
-    if TASK_RE.fullmatch(value) is None:
-        _error("TASK_ID_INVALID")
-    return value
-
-
-def _oid(value: object, code: str) -> str:
-    value = _string(value, code)
-    if OID_RE.fullmatch(value) is None:
-        _error(code)
-    return value
-
-
-def _branch(value: object) -> str:
-    value = _string(value, "TARGET_BRANCH_INVALID")
-    if BRANCH_RE.fullmatch(value) is None or value.startswith(PROTECTED_PREFIXES):
-        _error("TARGET_BRANCH_INVALID")
-    return value
-
-
-def _generation(value: object) -> int:
-    if not isinstance(value, int) or isinstance(value, bool) or value < 1:
-        _error("GENERATION_INVALID")
-    return value
-
-
-def _canonical(value: object) -> str:
-    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-
-
-def _digest(value: object) -> str:
-    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
-
-
-def _source_signals(value: object) -> tuple[str, ...]:
-    """Normalize untrusted natural-language hints before they enter a signed envelope."""
-    if value is None:
-        return ()
-    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
-        _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-    result: list[str] = []
-    for item in value:
-        if not isinstance(item, str):
-            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-        text = " ".join(item.split()).strip()
-        if not text:
-            continue
-        # Projection may accept long task prose, but execution envelopes stay bounded.
-        text = text[:512].rstrip()
-        if text not in result:
-            result.append(text)
-        if len(result) == 16:
-            break
-    return tuple(result)
-
-
-def _agent_runtime_input(value: object) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        _error("AGENT_RUNTIME_INPUT_REQUIRED")
-    raw = dict(value)
-    allowed = {"goal", "instructions", "success_criteria", "constraints"}
-    if set(raw) - allowed:
-        _error("AGENT_RUNTIME_INPUT_FIELDS_INVALID")
-    goal = _string(raw.get("goal"), "AGENT_RUNTIME_GOAL_REQUIRED")
-    instructions = raw.get("instructions", "")
-    if not isinstance(instructions, str):
-        _error("AGENT_RUNTIME_INSTRUCTIONS_INVALID")
-    criteria = raw.get("success_criteria", [])
-    if not isinstance(criteria, list) or len(criteria) > 32:
-        _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-    normalized_criteria: list[dict[str, str]] = []
-    for item in criteria:
-        if not isinstance(item, Mapping):
-            _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-        criterion_id = _string(item.get("id"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-        description = _string(
-            item.get("description"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID"
-        )
-        normalized_criteria.append(
-            {"id": criterion_id[:120], "description": description[:1000]}
-        )
-    constraints = raw.get("constraints", {})
-    if not isinstance(constraints, Mapping):
-        _error("AGENT_RUNTIME_CONSTRAINTS_INVALID")
-    sensitive_markers = ("token", "secret", "password", "credential", "authorization", "api_key", "apikey")
-    for key in constraints:
-        lowered = str(key).lower()
-        if any(marker in lowered for marker in sensitive_markers):
-            _error("AGENT_RUNTIME_SECRET_FIELD_DENY")
-    normalized = {
-        "goal": goal[:12000],
-        "instructions": instructions[:32000],
-        "success_criteria": normalized_criteria,
-        "constraints": dict(constraints),
-    }
-    if len(_canonical(normalized).encode("utf-8")) > MAX_AGENT_RUNTIME_INPUT_BYTES:
-        _error("AGENT_RUNTIME_INPUT_TOO_LARGE")
-    return normalized
-
-
-def _capabilities(value: object) -> tuple[str, ...]:
-    if value is None:
-        return ()
-    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
-        _error("CAPABILITY_SCOPE_INVALID")
-    result = tuple(sorted({_string(item, "CAPABILITY_SCOPE_INVALID") for item in value}))
-    if any(len(item) > 120 for item in result):
-        _error("CAPABILITY_SCOPE_INVALID")
-    return result
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedExecutionBinding:
-    task_id: str
-    job_id: str
-    repository: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    branch_mode: str
-    generation: int
-    idempotency_key: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedExecutionBinding":
-        data = dict(value)
-        task_id = _task_id(data.get("task_id"))
-        job_id = _string(data.get("job_id"), "JOB_ID_REQUIRED")
-        if TASK_RE.fullmatch(job_id) is None:
-            _error("JOB_ID_INVALID")
-        repository = _string(data.get("repository"), "REPOSITORY_INVALID")
-        if repository != "aios/aios":
-            _error("WRONG_REPOSITORY_ENVELOPE_DENY")
-        base_oid = _oid(data.get("base_oid"), "BASE_OID_INVALID")
-        expected = _oid(data.get("expected_branch_oid"), "EXPECTED_BRANCH_OID_INVALID")
-        target = _branch(data.get("target_branch"))
-        mode = _string(data.get("branch_mode"), "BRANCH_MODE_MISSING")
-        if mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
-            _error("BRANCH_MODE_INVALID")
-        generation = _generation(data.get("generation"))
-        if mode == "CREATE_NEW" and expected != base_oid:
-            _error("EXPECTED_BASE_CONFLICT")
-        key = _string(data.get("idempotency_key"), "IDEMPOTENCY_KEY_INVALID")
-        if KEY_RE.fullmatch(key) is None:
-            _error("IDEMPOTENCY_KEY_INVALID")
-        return cls(task_id, job_id, repository, base_oid, expected, target, mode, generation, key)
-
-    def public(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-def binding_from_bootstrap(value: Mapping[str, Any]) -> GovernedExecutionBinding:
-    return GovernedExecutionBinding.from_mapping(value)
-
-
-def validate_execution_envelope(
-    value: Mapping[str, Any],
-    *,
-    binding: GovernedExecutionBinding | None = None,
-    worker_capabilities: Sequence[str] | None = None,
-) -> dict[str, Any]:
-    envelope = dict(value)
-    if envelope.get("schema") != EXECUTION_SCHEMA:
-        _error("EXECUTION_ENVELOPE_SCHEMA_VALIDATION")
-    candidate = GovernedExecutionBinding.from_mapping(envelope)
-    if binding is not None and candidate != binding:
-        comparisons = (
-            (candidate.task_id, binding.task_id, "TASK_BINDING_CONFLICT"),
-            (candidate.job_id, binding.job_id, "JOB_BINDING_CONFLICT"),
-            (candidate.repository, binding.repository, "WRONG_REPOSITORY_ENVELOPE_DENY"),
-            (candidate.base_oid, binding.base_oid, "WRONG_BASE_ENVELOPE_DENY"),
-            (candidate.expected_branch_oid, binding.expected_branch_oid, "WRONG_EXPECTED_HEAD_ENVELOPE_DENY"),
-            (candidate.target_branch, binding.target_branch, "WRONG_BRANCH_ENVELOPE_DENY"),
-            (candidate.generation, binding.generation, "WRONG_GENERATION_ENVELOPE_DENY"),
-            (candidate.branch_mode, binding.branch_mode, "BRANCH_MODE_BINDING_CONFLICT"),
-            (candidate.idempotency_key, binding.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
-        )
-        for actual, expected, code in comparisons:
-            if actual != expected:
-                _error(code)
-    action = _string(envelope.get("action"), "EXECUTION_ACTION_MISSING")
-    if action not in SUPPORTED_ACTIONS:
-        _error("EXECUTION_ACTION_UNSUPPORTED")
-    capability_scope = _capabilities(envelope.get("capability_scope"))
-    if worker_capabilities is not None and not set(capability_scope).issubset(set(worker_capabilities)):
-        _error("CAPABILITY_MISMATCH_DENY")
-    workspace = _object(envelope.get("workspace"), "WORKSPACE_POLICY_REQUIRED")
-    if workspace.get("authority_git_dir") != "/data/aios-gitops/repo.git" or workspace.get("read_only_repository") is not True:
-        _error("WORKSPACE_POLICY_DENY")
-    governance = _object(envelope.get("governance"), "GOVERNANCE_POLICY_REQUIRED")
-    governed_coordinates = (
-        (governance.get("task_id"), candidate.task_id, "TASK_BINDING_CONFLICT"),
-        (governance.get("job_id"), candidate.job_id, "JOB_BINDING_CONFLICT"),
-        (governance.get("idempotency_key"), candidate.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
-    )
-    for actual_coordinate, expected_coordinate, code in governed_coordinates:
-        if actual_coordinate != expected_coordinate:
-            _error(code)
-    commit_key = _string(governance.get("commit_idempotency_key"), "COMMIT_IDEMPOTENCY_KEY_INVALID")
-    if KEY_RE.fullmatch(commit_key) is None:
-        _error("COMMIT_IDEMPOTENCY_KEY_INVALID")
-    if governance.get("writer_lease") is not (action in MUTATION_ACTIONS):
-        _error("WRITER_LEASE_POLICY_DENY")
-    for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"):
-        if governance.get(field, False) is not False:
-            _error("POLICY_DENY")
-    changes = envelope.get("change_set")
-    verification = envelope.get("verification")
-    if not isinstance(changes, list) or not isinstance(verification, list):
-        _error("EXECUTION_OPERATIONS_INVALID")
-    if action == "source_capture":
-        if changes or verification:
-            _error("SOURCE_CAPTURE_MUTATION_DENY")
-        signals = list(_source_signals(envelope.get("source_signals") or []))
-        if envelope.get("source_signals") != signals:
-            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-        if envelope.get("runtime_input") not in (None, {}):
-            _error("SOURCE_CAPTURE_RUNTIME_INPUT_DENY")
-    elif action == "agent_runtime":
-        if changes or verification:
-            _error("AGENT_RUNTIME_MUTATION_DENY")
-        adapter = str(envelope.get("adapter") or "")
-        if adapter not in AGENT_RUNTIME_ADAPTERS:
-            _error("AGENT_RUNTIME_ADAPTER_INVALID")
-        runtime_input = _agent_runtime_input(envelope.get("runtime_input"))
-        if envelope.get("runtime_input") != runtime_input:
-            _error("AGENT_RUNTIME_INPUT_NOT_CANONICAL")
-        required_runtime_capability = f"agent.runtime.{adapter}"
-        if required_runtime_capability not in capability_scope:
-            _error("AGENT_RUNTIME_CAPABILITY_REQUIRED")
-        if envelope.get("source_signals") not in (None, []):
-            _error("AGENT_RUNTIME_SOURCE_SIGNALS_DENY")
-    elif not changes:
-        _error("CHANGE_SET_INVALID")
-    declared = str(envelope.get("execution_digest") or "")
-    material = {key: item for key, item in envelope.items() if key != "execution_digest"}
-    actual = _digest(material)
-    if declared != actual:
-        _error("EXECUTION_DIGEST_INVALID")
-    return {**material, "execution_digest": actual}
-
-
-def project_execution_envelope(
-    binding: GovernedExecutionBinding,
-    execution_request: Mapping[str, Any] | None = None,
-    *,
-    required_capabilities: Sequence[str] = (),
-) -> dict[str, Any]:
-    request = dict(execution_request or {})
-    action = str(request.get("action") or "source_capture")
-    if action not in SUPPORTED_ACTIONS:
-        _error("EXECUTION_ACTION_UNSUPPORTED")
-    capabilities = _capabilities(request.get("capability_scope", required_capabilities))
-    governance = {
-        "task_id": binding.task_id,
-        "job_id": binding.job_id,
-        "idempotency_key": binding.idempotency_key,
-        "commit_idempotency_key": str(request.get("commit_idempotency_key") or f"{binding.task_id}-commit-g{binding.generation}"),
-        "writer_lease": action in MUTATION_ACTIONS,
-        "main_write": False,
-        "production_write": False,
-        "tag_write": False,
-        "baseline_write": False,
-        "force_push": False,
-        "protected_ref_bypass": False,
-    }
-    supplied_governance = request.get("governance")
-    if supplied_governance is not None:
-        governance.update(_object(supplied_governance, "GOVERNANCE_POLICY_REQUIRED"))
-    material: dict[str, Any] = {
-        "schema": EXECUTION_SCHEMA,
-        **binding.public(),
-        "action": action,
-        "adapter": str(
-            request.get("adapter")
-            or ("deterministic" if action == "deterministic" else "source_capture")
-        ),
-        "capability_scope": list(capabilities),
-        "change_set": list(request.get("change_set") or []),
-        "verification": list(request.get("verification") or []),
-        "source_signals": list(_source_signals(request.get("source_signals") or [])) if action == "source_capture" else [],
-        "runtime_input": _agent_runtime_input(request.get("runtime_input")) if action == "agent_runtime" else {},
-        "governance": governance,
-        "workspace": {
-            "authority_git_dir": "/data/aios-gitops/repo.git",
-            "read_only_repository": True,
-            "cleanup_policy": "always",
-        },
-    }
-    envelope = {**material, "execution_digest": _digest(material)}
-    return validate_execution_envelope(envelope, binding=binding)
-
-
-def project_online_task(
-    binding: GovernedExecutionBinding,
-    task_request: Mapping[str, Any],
-    execution_request: Mapping[str, Any] | None = None,
-) -> dict[str, Any]:
-    request = dict(task_request)
-    required = _capabilities(request.get("required_capabilities"))
-    execution_value = dict(execution_request or {})
-    if str(execution_value.get("action") or "source_capture") == "agent_runtime":
-        adapter = str(execution_value.get("adapter") or "")
-        if adapter not in AGENT_RUNTIME_ADAPTERS:
-            _error("AGENT_RUNTIME_ADAPTER_INVALID")
-        runtime_input = execution_value.get("runtime_input")
-        if runtime_input is None:
-            runtime_input = {
-                "goal": request.get("goal"),
-                "instructions": request.get("instructions") or "",
-                "success_criteria": request.get("success_criteria") or [],
-                "constraints": request.get("constraints") or {},
-            }
-        execution_value["runtime_input"] = runtime_input
-    execution = project_execution_envelope(
-        binding,
-        execution_value,
-        required_capabilities=required,
-    )
-    metadata = dict(request.get("metadata") or {})
-    if "execution" in metadata:
-        validate_execution_envelope(_object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"), binding=binding)
-        if metadata["execution"] != execution:
-            _error("EXECUTION_PROJECTION_CONFLICT")
-    metadata["execution"] = execution
-    metadata["execution_projection"] = {
-        "schema": PROJECTION_SCHEMA,
-        "task_id": binding.task_id,
-        "job_id": binding.job_id,
-        "execution_digest": execution["execution_digest"],
-    }
-    return {
-        **request,
-        "task_id": binding.task_id,
-        "metadata": metadata,
-        "required_capabilities": list(required),
-        "idempotency_key": str(request.get("idempotency_key") or f"online-task:{binding.idempotency_key}"),
-    }
-
-
-def resolve_task_execution(
-    task: Mapping[str, Any],
-    binding: GovernedExecutionBinding,
-    *,
-    worker_capabilities: Sequence[str] | None = None,
-) -> tuple[dict[str, Any], str]:
-    metadata = task.get("metadata")
-    if isinstance(metadata, Mapping) and "execution" in metadata:
-        value = validate_execution_envelope(
-            _object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"),
-            binding=binding,
-            worker_capabilities=worker_capabilities,
-        )
-        return value, "persisted"
-    projected = project_execution_envelope(
-        binding,
-        {"action": "source_capture", "capability_scope": task.get("required_capabilities") or []},
-        required_capabilities=task.get("required_capabilities") or [],
-    )
-    validate_execution_envelope(projected, binding=binding, worker_capabilities=worker_capabilities)
-    return projected, "recovered_projection"
@@ -1,187 +0,0 @@
-"""Durable, authority-bound deterministic execution plans for Online Agent Tasks."""
-from __future__ import annotations
-
-from contextlib import contextmanager
-from dataclasses import dataclass
-import fcntl
-import hashlib
-import json
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_online_agent_execution import (
-    GovernedExecutionBinding,
-    project_execution_envelope,
-)
-
-
-class ExecutionPlanError(RuntimeError):
-    pass
-
-
-def _canonical(value: object) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def _digest(value: object) -> str:
-    return hashlib.sha256(_canonical(value)).hexdigest()
-
-
-def _task_key(task_id: str) -> str:
-    readable = "".join(ch if ch.isalnum() or ch in "._-" else "-" for ch in task_id).strip("-")[:72] or "task"
-    return readable + "-" + hashlib.sha256(task_id.encode("utf-8")).hexdigest()[:24]
-
-
-@dataclass(frozen=True)
-class ExecutionPlanRecord:
-    task_id: str
-    job_id: str
-    source_head_oid: str
-    generation: int
-    idempotency_key: str
-    plan_digest: str
-    execution: dict[str, Any]
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "schema": "aios.online-agent.plan-record.v1",
-            "task_id": self.task_id,
-            "job_id": self.job_id,
-            "source_head_oid": self.source_head_oid,
-            "generation": self.generation,
-            "idempotency_key": self.idempotency_key,
-            "plan_digest": self.plan_digest,
-            "execution": dict(self.execution),
-        }
-
-
-class ExecutionPlanStore:
-    def __init__(self, root: Path) -> None:
-        self.root = Path(root)
-        self.root.mkdir(parents=True, exist_ok=True)
-
-    def _path(self, task_id: str) -> Path:
-        return self.root / (_task_key(task_id) + ".json")
-
-    @contextmanager
-    def _lock(self, task_id: str):
-        path = self.root / (_task_key(task_id) + ".lock")
-        with path.open("a+b") as handle:
-            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-            try:
-                yield
-            finally:
-                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
-
-    @staticmethod
-    def _source_head(binding: GovernedExecutionBinding) -> str:
-        return binding.expected_branch_oid if binding.branch_mode == "CONTINUE_EXISTING" else binding.base_oid
-
-    def _read(self, task_id: str) -> ExecutionPlanRecord | None:
-        path = self._path(task_id)
-        if not path.is_file() or path.is_symlink():
-            return None
-        value = json.loads(path.read_text(encoding="utf-8"))
-        if not isinstance(value, Mapping) or value.get("schema") != "aios.online-agent.plan-record.v1":
-            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
-        execution = value.get("execution")
-        if not isinstance(execution, Mapping):
-            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
-        return ExecutionPlanRecord(
-            task_id=str(value.get("task_id") or ""),
-            job_id=str(value.get("job_id") or ""),
-            source_head_oid=str(value.get("source_head_oid") or ""),
-            generation=int(value.get("generation") or 0),
-            idempotency_key=str(value.get("idempotency_key") or ""),
-            plan_digest=str(value.get("plan_digest") or ""),
-            execution=dict(execution),
-        )
-
-    def register(
-        self,
-        binding: GovernedExecutionBinding,
-        request: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        with self._lock(binding.task_id):
-            return self._register_locked(binding, request)
-
-    def _register_locked(
-        self,
-        binding: GovernedExecutionBinding,
-        request: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        if request.get("schema") != "aios.online-agent.plan.v1":
-            raise ExecutionPlanError("EXECUTION_PLAN_SCHEMA_INVALID")
-        if request.get("task_id") != binding.task_id or request.get("job_id") != binding.job_id:
-            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
-        if int(request.get("generation") or 0) != binding.generation:
-            raise ExecutionPlanError("EXECUTION_PLAN_GENERATION_CONFLICT")
-        source_head = str(request.get("source_head_oid") or "")
-        if source_head != self._source_head(binding):
-            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_CONFLICT")
-        key = str(request.get("idempotency_key") or "")
-        if len(key) < 8:
-            raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_INVALID")
-        execution_request = request.get("execution")
-        if not isinstance(execution_request, Mapping) or execution_request.get("action") != "deterministic":
-            raise ExecutionPlanError("EXECUTION_PLAN_DETERMINISTIC_REQUIRED")
-        envelope = project_execution_envelope(binding, execution_request)
-        material = {
-            "task_id": binding.task_id,
-            "job_id": binding.job_id,
-            "source_head_oid": source_head,
-            "generation": binding.generation,
-            "idempotency_key": key,
-            "execution": dict(execution_request),
-        }
-        plan_digest = _digest(material)
-        existing = self._read(binding.task_id)
-        expected_previous = request.get("expected_previous_plan_digest")
-        if existing is not None:
-            if existing.idempotency_key == key:
-                if existing.plan_digest != plan_digest:
-                    raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_CONFLICT")
-                return {**existing.public(), "idempotent": True, "execution_digest": envelope["execution_digest"]}
-            if expected_previous != existing.plan_digest:
-                raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
-            if existing.source_head_oid != source_head:
-                raise ExecutionPlanError("EXECUTION_PLAN_STALE_REPLACEMENT_DENY")
-        elif expected_previous not in (None, ""):
-            raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
-
-        record = ExecutionPlanRecord(
-            task_id=binding.task_id,
-            job_id=binding.job_id,
-            source_head_oid=source_head,
-            generation=binding.generation,
-            idempotency_key=key,
-            plan_digest=plan_digest,
-            execution=dict(execution_request),
-        )
-        path = self._path(binding.task_id)
-        temporary = path.with_suffix(".tmp")
-        temporary.write_text(
-            json.dumps(record.public(), sort_keys=True, separators=(",", ":")),
-            encoding="utf-8",
-        )
-        temporary.replace(path)
-        return {**record.public(), "idempotent": False, "execution_digest": envelope["execution_digest"]}
-
-    def resolve(self, binding: GovernedExecutionBinding) -> dict[str, Any] | None:
-        record = self._read(binding.task_id)
-        if record is None:
-            return None
-        if (
-            record.task_id != binding.task_id
-            or record.job_id != binding.job_id
-            or record.generation != binding.generation
-        ):
-            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
-        if record.source_head_oid != self._source_head(binding):
-            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_DRIFT")
-        envelope = project_execution_envelope(binding, record.execution)
-        return {
-            "execution": dict(record.execution),
-            "plan_digest": record.plan_digest,
-            "execution_digest": envelope["execution_digest"],
-        }
@@ -0,0 +1,45 @@
+"""AIOS-managed OpenClaw Ed25519 execution adapter."""
+
+from .adapter import (
+    AdapterError,
+    CommandConflict,
+    CommandNotFound,
+    CommandRejected,
+    InMemoryCallbackSink,
+    OpenClawAdapter,
+)
+from .contract import (
+    CONTRACT_VERSION,
+    SIGNATURE_ALGORITHM,
+    CommandState,
+    Ed25519CommandSigner,
+    Ed25519CommandVerifier,
+    OpenClawCommand,
+    OpenClawResult,
+    RuntimeHealth,
+    sign_command,
+    verify_command_signature,
+)
+from .transport import HTTPRuntimeTransport, InProcessRuntimeTransport, RuntimeTransport
+
+__all__ = [
+    "AdapterError",
+    "CONTRACT_VERSION",
+    "CommandConflict",
+    "CommandNotFound",
+    "CommandRejected",
+    "CommandState",
+    "Ed25519CommandSigner",
+    "Ed25519CommandVerifier",
+    "HTTPRuntimeTransport",
+    "InMemoryCallbackSink",
+    "InProcessRuntimeTransport",
+    "OpenClawAdapter",
+    "OpenClawCommand",
+    "OpenClawResult",
+    "RuntimeHealth",
+    "RuntimeTransport",
+    "SIGNATURE_ALGORITHM",
+    "sign_command",
+    "verify_command_signature",
+]
@@ -0,0 +1,228 @@
+"""Signed, tenant-isolated execution adapter for OpenClaw runtimes."""
+from __future__ import annotations
+
+import threading
+from dataclasses import replace
+from typing import Callable, Mapping, Protocol
+
+from .contract import (
+    CommandState,
+    OpenClawCommand,
+    OpenClawResult,
+    RuntimeHealth,
+    utc_now,
+    verify_command_signature,
+)
+
+
+class AdapterError(RuntimeError):
+    """Base adapter failure."""
+
+
+class CommandRejected(AdapterError):
+    """A command failed signature or contract validation."""
+
+
+class CommandNotFound(AdapterError):
+    """A tenant-scoped command is not visible."""
+
+
+class CommandConflict(AdapterError):
+    """A command or idempotency key conflicts with an existing execution."""
+
+
+class RuntimeTransport(Protocol):
+    def execute(self, command: OpenClawCommand, timeout_seconds: float) -> OpenClawResult: ...
+    def cancel(self, command_id: str) -> bool: ...
+    def health(self) -> RuntimeHealth: ...
+
+
+class CallbackSink(Protocol):
+    def on_started(self, result: OpenClawResult) -> None: ...
+    def on_completed(self, result: OpenClawResult) -> None: ...
+    def on_failed(self, result: OpenClawResult) -> None: ...
+
+
+class InMemoryCallbackSink:
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self.started: list[OpenClawResult] = []
+        self.completed: list[OpenClawResult] = []
+        self.failed: list[OpenClawResult] = []
+
+    def on_started(self, result: OpenClawResult) -> None:
+        with self._lock:
+            self.started.append(result)
+
+    def on_completed(self, result: OpenClawResult) -> None:
+        with self._lock:
+            self.completed.append(result)
+
+    def on_failed(self, result: OpenClawResult) -> None:
+        with self._lock:
+            self.failed.append(result)
+
+
+SigningMaterialResolver = Callable[[str, str], bytes | str]
+
+
+class OpenClawAdapter:
+    """Verify, de-duplicate, execute, cancel and reconcile commands."""
+
+    def __init__(
+        self,
+        transport: RuntimeTransport,
+        signing_material_resolver: SigningMaterialResolver,
+        *,
+        callback_sink: CallbackSink | None = None,
+        default_timeout_seconds: float = 300.0,
+    ) -> None:
+        if default_timeout_seconds <= 0:
+            raise ValueError("default_timeout_seconds must be positive")
+        self.transport = transport
+        self.signing_material_resolver = signing_material_resolver
+        self.callback_sink = callback_sink or InMemoryCallbackSink()
+        self.default_timeout_seconds = float(default_timeout_seconds)
+        self._lock = threading.RLock()
+        self._commands: dict[str, OpenClawCommand] = {}
+        self._results: dict[str, OpenClawResult] = {}
+        self._idempotency: dict[tuple[str, str], tuple[str, str]] = {}
+
+    def _verify(self, command: OpenClawCommand) -> None:
+        try:
+            key_material = self.signing_material_resolver(command.tenant_id, command.key_id)
+        except Exception as exc:
+            raise CommandRejected("signing material unavailable") from exc
+        if not verify_command_signature(command, key_material):
+            raise CommandRejected("invalid or expired command signature")
+
+    @staticmethod
+    def _validate_result(command: OpenClawCommand, result: OpenClawResult) -> None:
+        if (
+            result.command_id != command.command_id
+            or result.tenant_id != command.tenant_id
+            or result.task_id != command.task_id
+            or result.trace_id != command.trace_id
+        ):
+            raise AdapterError("runtime returned mismatched command identity")
+        if result.state not in {
+            CommandState.COMPLETED,
+            CommandState.FAILED,
+            CommandState.CANCELLED,
+            CommandState.TIMED_OUT,
+        }:
+            raise AdapterError("runtime returned a non-terminal result")
+
+    def execute(
+        self,
+        command: OpenClawCommand,
+        *,
+        timeout_seconds: float | None = None,
+    ) -> OpenClawResult:
+        timeout = self.default_timeout_seconds if timeout_seconds is None else float(timeout_seconds)
+        if timeout <= 0:
+            raise ValueError("timeout_seconds must be positive")
+        self._verify(command)
+        digest = command.signature
+        idem_ref = (command.tenant_id, command.idempotency_key)
+
+        with self._lock:
+            prior_command = self._commands.get(command.command_id)
+            if prior_command is not None:
+                if prior_command.signature != command.signature:
+                    raise CommandConflict("command_id reused with different content")
+                return self._results[command.command_id]
+            prior_idem = self._idempotency.get(idem_ref)
+            if prior_idem is not None:
+                prior_id, prior_digest = prior_idem
+                if prior_digest != digest:
+                    raise CommandConflict("idempotency key reused with different content")
+                return self._results[prior_id]
+            running = OpenClawResult(
+                command_id=command.command_id,
+                tenant_id=command.tenant_id,
+                task_id=command.task_id,
+                trace_id=command.trace_id,
+                state=CommandState.RUNNING,
+                started_at=utc_now(),
+            )
+            self._commands[command.command_id] = command
+            self._results[command.command_id] = running
+            self._idempotency[idem_ref] = (command.command_id, digest)
+
+        self.callback_sink.on_started(running)
+        try:
+            result = self.transport.execute(command, timeout)
+            self._validate_result(command, result)
+        except TimeoutError as exc:
+            result = replace(
+                running,
+                state=CommandState.TIMED_OUT,
+                error={"code": "runtime_timeout", "message": str(exc) or "runtime timeout"},
+                finished_at=utc_now(),
+            )
+        except Exception as exc:
+            result = replace(
+                running,
+                state=CommandState.FAILED,
+                error={"code": "runtime_error", "message": str(exc)},
+                finished_at=utc_now(),
+            )
+
+        if result.started_at is None:
+            result = replace(result, started_at=running.started_at)
+        if result.finished_at is None:
+            result = replace(result, finished_at=utc_now())
+        with self._lock:
+            self._results[command.command_id] = result
+        if result.state == CommandState.COMPLETED:
+            self.callback_sink.on_completed(result)
+        else:
+            self.callback_sink.on_failed(result)
+        return result
+
+    def status(self, command_id: str, *, tenant_id: str) -> OpenClawResult:
+        with self._lock:
+            command = self._commands.get(command_id)
+            result = self._results.get(command_id)
+            if command is None or result is None or command.tenant_id != tenant_id:
+                raise CommandNotFound("command not found")
+            return result
+
+    def cancel(self, command_id: str, *, tenant_id: str) -> OpenClawResult:
+        with self._lock:
+            command = self._commands.get(command_id)
+            current = self._results.get(command_id)
+            if command is None or current is None or command.tenant_id != tenant_id:
+                raise CommandNotFound("command not found")
+            if current.state in {
+                CommandState.COMPLETED,
+                CommandState.FAILED,
+                CommandState.CANCELLED,
+                CommandState.TIMED_OUT,
+                CommandState.REJECTED,
+            }:
+                return current
+        if not self.transport.cancel(command_id):
+            raise AdapterError("runtime rejected cancellation")
+        cancelled = replace(
+            current,
+            state=CommandState.CANCELLED,
+            error={"code": "cancelled", "message": "cancelled by AIOS"},
+            finished_at=utc_now(),
+        )
+        with self._lock:
+            self._results[command_id] = cancelled
+        self.callback_sink.on_failed(cancelled)
+        return cancelled
+
+    def health(self) -> RuntimeHealth:
+        return self.transport.health()
+
+    def snapshot(self, *, tenant_id: str) -> Mapping[str, OpenClawResult]:
+        with self._lock:
+            return {
+                command_id: result
+                for command_id, result in self._results.items()
+                if self._commands[command_id].tenant_id == tenant_id
+            }
@@ -0,0 +1,97 @@
+"""Audit-oriented lifecycle callbacks for OpenClaw execution."""
+from __future__ import annotations
+
+import json
+import threading
+from dataclasses import dataclass, field
+from typing import Any, Mapping, Protocol
+
+from .contract import OpenClawResult, utc_now
+
+
+class EventPublisher(Protocol):
+    def publish(self, event: Mapping[str, Any]) -> None: ...
+
+
+@dataclass(frozen=True)
+class ExecutionEvent:
+    event_type: str
+    tenant_id: str
+    task_id: str
+    trace_id: str
+    command_id: str
+    state: str
+    created_at: str = field(default_factory=utc_now)
+    details: Mapping[str, Any] = field(default_factory=dict)
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "event_type": self.event_type,
+            "tenant_id": self.tenant_id,
+            "task_id": self.task_id,
+            "trace_id": self.trace_id,
+            "command_id": self.command_id,
+            "state": self.state,
+            "created_at": self.created_at,
+            "details": json.loads(
+                json.dumps(dict(self.details), ensure_ascii=False, default=str)
+            ),
+        }
+
+
+class InMemoryEventPublisher:
+    """Thread-safe publisher used by tests and first integration slice."""
+
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self.events: list[dict[str, Any]] = []
+
+    def publish(self, event: Mapping[str, Any]) -> None:
+        with self._lock:
+            self.events.append(
+                json.loads(json.dumps(dict(event), ensure_ascii=False, default=str))
+            )
+
+
+class AuditCallbackSink:
+    """Convert runtime callbacks into tenant-scoped audit events."""
+
+    def __init__(self, publisher: EventPublisher) -> None:
+        self.publisher = publisher
+
+    @staticmethod
+    def _event(
+        event_type: str,
+        result: OpenClawResult,
+    ) -> ExecutionEvent:
+        details: dict[str, Any] = {
+            "runtime_id": result.runtime_id,
+            "attempts": result.attempts,
+        }
+        if result.error:
+            details["error"] = dict(result.error)
+        if result.output:
+            details["output_present"] = True
+        return ExecutionEvent(
+            event_type=event_type,
+            tenant_id=result.tenant_id,
+            task_id=result.task_id,
+            trace_id=result.trace_id,
+            command_id=result.command_id,
+            state=result.state.value,
+            details=details,
+        )
+
+    def on_started(self, result: OpenClawResult) -> None:
+        self.publisher.publish(self._event("OPENCLAW_STARTED", result).as_dict())
+
+    def on_completed(self, result: OpenClawResult) -> None:
+        self.publisher.publish(self._event("OPENCLAW_COMPLETED", result).as_dict())
+
+    def on_failed(self, result: OpenClawResult) -> None:
+        event_type = {
+            "CANCELLED": "OPENCLAW_CANCELLED",
+            "TIMED_OUT": "OPENCLAW_TIMED_OUT",
+            "REJECTED": "OPENCLAW_REJECTED",
+        }.get(result.state.value, "OPENCLAW_FAILED")
+        self.publisher.publish(self._event(event_type, result).as_dict())
@@ -0,0 +1,383 @@
+"""AIOS 到 OpenClaw 的 Ed25519 执行合同。"""
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import json
+import uuid
+from dataclasses import dataclass, field, replace
+from datetime import datetime, timezone
+from enum import Enum
+from typing import Any, Mapping, Protocol
+
+CONTRACT_VERSION = "aios.openclaw.command.v2"
+SIGNATURE_ALGORITHM = "Ed25519"
+DEFAULT_CLOCK_SKEW_SECONDS = 300
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _parse_timestamp(value: str) -> datetime:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError("timestamp is required")
+    if normalized.endswith("Z"):
+        normalized = normalized[:-1] + "+00:00"
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("timestamp must include a timezone")
+    return parsed.astimezone(timezone.utc)
+
+
+def _required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def _safe_mapping(value: Mapping[str, Any] | None) -> dict[str, Any]:
+    return json.loads(
+        json.dumps(dict(value or {}), ensure_ascii=False, sort_keys=True, default=str)
+    )
+
+
+def _load_crypto() -> tuple[Any, Any, Any]:
+    try:
+        from cryptography.hazmat.primitives import serialization
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+            Ed25519PrivateKey,
+            Ed25519PublicKey,
+        )
+    except ImportError as exc:  # pragma: no cover
+        raise RuntimeError("cryptography with Ed25519 support is required") from exc
+    return serialization, Ed25519PrivateKey, Ed25519PublicKey
+
+
+class CommandSigner(Protocol):
+    key_id: str
+    fingerprint: str
+
+    def sign(self, payload: bytes) -> bytes: ...
+
+
+class CommandVerifier(Protocol):
+    key_id: str
+    fingerprint: str
+
+    def verify(self, payload: bytes, signature: bytes) -> bool: ...
+
+
+class Ed25519CommandSigner:
+    def __init__(self, private_key: Any, *, key_id: str) -> None:
+        serialization, private_cls, _ = _load_crypto()
+        if not isinstance(private_key, private_cls):
+            raise ValueError("private key is not Ed25519")
+        self.private_key = private_key
+        self.key_id = _required(key_id, "key_id")
+        raw = private_key.public_key().public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+        self.fingerprint = hashlib.sha256(raw).hexdigest()
+
+    @classmethod
+    def from_bytes(cls, value: bytes | str, *, key_id: str) -> "Ed25519CommandSigner":
+        serialization, private_cls, _ = _load_crypto()
+        raw = value.encode("utf-8") if isinstance(value, str) else bytes(value)
+        if raw.startswith(b"-----BEGIN"):
+            key = serialization.load_pem_private_key(raw, password=None)
+        elif len(raw) == 32:
+            key = private_cls.from_private_bytes(raw)
+        else:
+            raise ValueError("Ed25519 private key must be PEM or a raw 32-byte seed")
+        return cls(key, key_id=key_id)
+
+    def sign(self, payload: bytes) -> bytes:
+        return self.private_key.sign(bytes(payload))
+
+    def verifier(self) -> "Ed25519CommandVerifier":
+        return Ed25519CommandVerifier(self.private_key.public_key(), key_id=self.key_id)
+
+
+class Ed25519CommandVerifier:
+    def __init__(self, public_key: Any, *, key_id: str) -> None:
+        serialization, _, public_cls = _load_crypto()
+        if not isinstance(public_key, public_cls):
+            raise ValueError("public key is not Ed25519")
+        self.public_key = public_key
+        self.key_id = _required(key_id, "key_id")
+        raw = public_key.public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+        self.fingerprint = hashlib.sha256(raw).hexdigest()
+
+    @classmethod
+    def from_bytes(cls, value: bytes | str, *, key_id: str) -> "Ed25519CommandVerifier":
+        serialization, private_cls, public_cls = _load_crypto()
+        raw = value.encode("utf-8") if isinstance(value, str) else bytes(value)
+        if raw.startswith(b"-----BEGIN"):
+            try:
+                key = serialization.load_pem_public_key(raw)
+            except ValueError:
+                private = serialization.load_pem_private_key(raw, password=None)
+                if not isinstance(private, private_cls):
+                    raise ValueError("key is not Ed25519")
+                key = private.public_key()
+        elif len(raw) == 32:
+            key = public_cls.from_public_bytes(raw)
+        else:
+            raise ValueError("Ed25519 public key must be PEM or raw 32-byte key")
+        return cls(key, key_id=key_id)
+
+    def verify(self, payload: bytes, signature: bytes) -> bool:
+        try:
+            self.public_key.verify(bytes(signature), bytes(payload))
+            return True
+        except Exception:
+            return False
+
+
+class CommandState(str, Enum):
+    ACCEPTED = "ACCEPTED"
+    RUNNING = "RUNNING"
+    COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+    TIMED_OUT = "TIMED_OUT"
+    REJECTED = "REJECTED"
+
+
+@dataclass(frozen=True)
+class OpenClawCommand:
+    command_id: str
+    tenant_id: str
+    task_id: str
+    trace_id: str
+    action: str
+    payload: Mapping[str, Any] = field(default_factory=dict)
+    idempotency_key: str = ""
+    created_at: str = field(default_factory=utc_now)
+    expires_at: str | None = None
+    contract_version: str = CONTRACT_VERSION
+    signature_algorithm: str = SIGNATURE_ALGORITHM
+    key_id: str = "default"
+    public_key_fingerprint: str = ""
+    signature: str = ""
+
+    def __post_init__(self) -> None:
+        for field_name in (
+            "command_id",
+            "tenant_id",
+            "task_id",
+            "trace_id",
+            "action",
+            "idempotency_key",
+            "created_at",
+            "contract_version",
+            "signature_algorithm",
+            "key_id",
+        ):
+            object.__setattr__(
+                self, field_name, _required(getattr(self, field_name), field_name)
+            )
+        if self.contract_version != CONTRACT_VERSION:
+            raise ValueError(f"unsupported contract_version: {self.contract_version}")
+        if self.signature_algorithm != SIGNATURE_ALGORITHM:
+            raise ValueError(
+                f"unsupported signature_algorithm: {self.signature_algorithm}"
+            )
+        object.__setattr__(self, "payload", _safe_mapping(self.payload))
+        object.__setattr__(
+            self, "public_key_fingerprint", str(self.public_key_fingerprint or "").strip()
+        )
+        object.__setattr__(self, "signature", str(self.signature or "").strip())
+        _parse_timestamp(self.created_at)
+        if self.expires_at is not None:
+            object.__setattr__(self, "expires_at", _required(self.expires_at, "expires_at"))
+            if _parse_timestamp(self.expires_at) <= _parse_timestamp(self.created_at):
+                raise ValueError("expires_at must be later than created_at")
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        tenant_id: str,
+        task_id: str,
+        trace_id: str,
+        action: str,
+        payload: Mapping[str, Any] | None,
+        idempotency_key: str,
+        expires_at: str | None = None,
+        key_id: str = "default",
+        command_id: str | None = None,
+    ) -> "OpenClawCommand":
+        return cls(
+            command_id=command_id or f"cmd_{uuid.uuid4().hex}",
+            tenant_id=tenant_id,
+            task_id=task_id,
+            trace_id=trace_id,
+            action=action,
+            payload=_safe_mapping(payload),
+            idempotency_key=idempotency_key,
+            expires_at=expires_at,
+            key_id=key_id,
+        )
+
+    def unsigned_dict(self) -> dict[str, Any]:
+        return {
+            "command_id": self.command_id,
+            "tenant_id": self.tenant_id,
+            "task_id": self.task_id,
+            "trace_id": self.trace_id,
+            "action": self.action,
+            "payload": _safe_mapping(self.payload),
+            "idempotency_key": self.idempotency_key,
+            "created_at": self.created_at,
+            "expires_at": self.expires_at,
+            "contract_version": self.contract_version,
+            "signature_algorithm": self.signature_algorithm,
+            "key_id": self.key_id,
+            "public_key_fingerprint": self.public_key_fingerprint,
+        }
+
+
+@dataclass(frozen=True)
+class OpenClawResult:
+    command_id: str
+    tenant_id: str
+    task_id: str
+    trace_id: str
+    state: CommandState
+    output: Mapping[str, Any] | None = None
+    error: Mapping[str, Any] | None = None
+    started_at: str | None = None
+    finished_at: str | None = None
+    runtime_id: str | None = None
+    attempts: int = 1
+
+    def __post_init__(self) -> None:
+        for field_name in ("command_id", "tenant_id", "task_id", "trace_id"):
+            object.__setattr__(
+                self, field_name, _required(getattr(self, field_name), field_name)
+            )
+        object.__setattr__(self, "state", CommandState(self.state))
+        if self.output is not None:
+            object.__setattr__(self, "output", _safe_mapping(self.output))
+        if self.error is not None:
+            object.__setattr__(self, "error", _safe_mapping(self.error))
+        if self.started_at is not None:
+            _parse_timestamp(self.started_at)
+        if self.finished_at is not None:
+            _parse_timestamp(self.finished_at)
+        if self.attempts < 1:
+            raise ValueError("attempts must be >= 1")
+
+
+@dataclass(frozen=True)
+class RuntimeHealth:
+    runtime: str
+    runtime_id: str
+    status: str
+    version: str
+    heartbeat_at: str
+    active_tasks: int = 0
+    workspace_isolated: bool = False
+    credential_ref_configured: bool = False
+    details: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        for field_name in (
+            "runtime",
+            "runtime_id",
+            "status",
+            "version",
+            "heartbeat_at",
+        ):
+            object.__setattr__(
+                self, field_name, _required(getattr(self, field_name), field_name)
+            )
+        _parse_timestamp(self.heartbeat_at)
+        if self.active_tasks < 0:
+            raise ValueError("active_tasks must be >= 0")
+        object.__setattr__(self, "details", _safe_mapping(self.details))
+
+
+def canonical_command_bytes(command: OpenClawCommand) -> bytes:
+    return json.dumps(
+        command.unsigned_dict(),
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+    ).encode("utf-8")
+
+
+def _as_signer(command: OpenClawCommand, value: Any) -> CommandSigner:
+    if hasattr(value, "sign") and hasattr(value, "fingerprint") and hasattr(value, "key_id"):
+        return value
+    return Ed25519CommandSigner.from_bytes(value, key_id=command.key_id)
+
+
+def _as_verifier(command: OpenClawCommand, value: Any) -> CommandVerifier:
+    if isinstance(value, Ed25519CommandSigner):
+        return value.verifier()
+    if hasattr(value, "verify") and hasattr(value, "fingerprint") and hasattr(value, "key_id"):
+        return value
+    return Ed25519CommandVerifier.from_bytes(value, key_id=command.key_id)
+
+
+def sign_command(command: OpenClawCommand, signing_key: Any) -> OpenClawCommand:
+    signer = _as_signer(command, signing_key)
+    if signer.key_id != command.key_id:
+        raise ValueError("command key_id does not match signer")
+    prepared = replace(
+        command,
+        signature_algorithm=SIGNATURE_ALGORITHM,
+        public_key_fingerprint=signer.fingerprint,
+        signature="",
+    )
+    signature = base64.b64encode(
+        signer.sign(canonical_command_bytes(prepared))
+    ).decode("ascii")
+    return replace(prepared, signature=signature)
+
+
+def verify_command_signature(
+    command: OpenClawCommand,
+    verification_key: Any,
+    *,
+    now: datetime | None = None,
+    clock_skew_seconds: int = DEFAULT_CLOCK_SKEW_SECONDS,
+) -> bool:
+    if (
+        not command.signature
+        or command.contract_version != CONTRACT_VERSION
+        or command.signature_algorithm != SIGNATURE_ALGORITHM
+    ):
+        return False
+    try:
+        verifier = _as_verifier(command, verification_key)
+        signature = base64.b64decode(command.signature, validate=True)
+    except Exception:
+        return False
+    if verifier.key_id != command.key_id:
+        return False
+    if not command.public_key_fingerprint or not hmac.compare_digest(
+        command.public_key_fingerprint, verifier.fingerprint
+    ):
+        return False
+    if not verifier.verify(canonical_command_bytes(command), signature):
+        return False
+    current = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+    created = _parse_timestamp(command.created_at)
+    if created.timestamp() - current.timestamp() > clock_skew_seconds:
+        return False
+    if command.expires_at is not None:
+        expires = _parse_timestamp(command.expires_at)
+        if current.timestamp() - expires.timestamp() > clock_skew_seconds:
+            return False
+    return True
@@ -0,0 +1,103 @@
+"""Health policy and self-healing decisions for OpenClaw runtimes."""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Mapping
+
+from .contract import RuntimeHealth
+
+
+def _parse(value: str) -> datetime:
+    normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
+    parsed = datetime.fromisoformat(normalized)
+    if parsed.tzinfo is None:
+        raise ValueError("heartbeat timestamp must include timezone")
+    return parsed.astimezone(timezone.utc)
+
+
+@dataclass(frozen=True)
+class HealthPolicy:
+    max_heartbeat_age_seconds: int = 90
+    require_workspace_isolation: bool = True
+    require_credential_ref: bool = True
+    accepted_statuses: frozenset[str] = field(
+        default_factory=lambda: frozenset({"healthy", "ready"})
+    )
+
+    def __post_init__(self) -> None:
+        if self.max_heartbeat_age_seconds < 5:
+            raise ValueError("max_heartbeat_age_seconds must be >= 5")
+        if not self.accepted_statuses:
+            raise ValueError("accepted_statuses must not be empty")
+
+
+@dataclass(frozen=True)
+class HealthAssessment:
+    healthy: bool
+    reasons: tuple[str, ...]
+    recoverable: bool
+    recommended_action: str
+    details: Mapping[str, object] = field(default_factory=dict)
+
+
+class RuntimeHealthMonitor:
+    """Evaluate runtime health and recommend bounded recovery actions."""
+
+    def __init__(self, policy: HealthPolicy | None = None) -> None:
+        self.policy = policy or HealthPolicy()
+
+    def assess(
+        self,
+        health: RuntimeHealth,
+        *,
+        now: datetime | None = None,
+    ) -> HealthAssessment:
+        current = (now or datetime.now(timezone.utc)).astimezone(timezone.utc)
+        heartbeat = _parse(health.heartbeat_at)
+        age = max(0.0, current.timestamp() - heartbeat.timestamp())
+        reasons: list[str] = []
+
+        if health.status.lower() not in self.policy.accepted_statuses:
+            reasons.append("runtime_status_unhealthy")
+        if age > self.policy.max_heartbeat_age_seconds:
+            reasons.append("heartbeat_stale")
+        if self.policy.require_workspace_isolation and not health.workspace_isolated:
+            reasons.append("workspace_not_isolated")
+        if self.policy.require_credential_ref and not health.credential_ref_configured:
+            reasons.append("credential_reference_missing")
+
+        if not reasons:
+            return HealthAssessment(
+                healthy=True,
+                reasons=(),
+                recoverable=True,
+                recommended_action="none",
+                details={"heartbeat_age_seconds": age},
+            )
+
+        non_recoverable = {
+            "workspace_not_isolated",
+            "credential_reference_missing",
+        }.intersection(reasons)
+        if non_recoverable:
+            action = "quarantine_runtime"
+            recoverable = False
+        elif "heartbeat_stale" in reasons:
+            action = "restart_runtime"
+            recoverable = True
+        else:
+            action = "drain_and_restart"
+            recoverable = True
+
+        return HealthAssessment(
+            healthy=False,
+            reasons=tuple(reasons),
+            recoverable=recoverable,
+            recommended_action=action,
+            details={
+                "heartbeat_age_seconds": age,
+                "runtime_id": health.runtime_id,
+                "active_tasks": health.active_tasks,
+            },
+        )
@@ -0,0 +1,214 @@
+"""Runtime transport implementations for the OpenClaw adapter."""
+from __future__ import annotations
+
+import json
+import threading
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any, Callable, Mapping, Protocol
+
+from .contract import (
+    CommandState,
+    OpenClawCommand,
+    OpenClawResult,
+    RuntimeHealth,
+    utc_now,
+)
+
+
+class RuntimeTransport(Protocol):
+    def execute(self, command: OpenClawCommand, timeout_seconds: float) -> OpenClawResult: ...
+    def cancel(self, command_id: str) -> bool: ...
+    def health(self) -> RuntimeHealth: ...
+
+
+class TransportError(RuntimeError):
+    """Runtime transport or protocol failure."""
+
+
+RuntimeHandler = Callable[[OpenClawCommand], Mapping[str, Any] | OpenClawResult]
+
+
+class InProcessRuntimeTransport:
+    """Deterministic runtime used by tests and controlled local integrations."""
+
+    def __init__(
+        self,
+        handler: RuntimeHandler,
+        *,
+        runtime_id: str = "openclaw-in-process",
+        version: str = "v1",
+        workspace_isolated: bool = True,
+        credential_ref_configured: bool = True,
+    ) -> None:
+        self.handler = handler
+        self.runtime_id = runtime_id
+        self.version = version
+        self.workspace_isolated = workspace_isolated
+        self.credential_ref_configured = credential_ref_configured
+        self._lock = threading.RLock()
+        self._running: set[str] = set()
+        self._cancelled: set[str] = set()
+
+    def execute(self, command: OpenClawCommand, timeout_seconds: float) -> OpenClawResult:
+        if timeout_seconds <= 0:
+            raise ValueError("timeout_seconds must be positive")
+        with self._lock:
+            if command.command_id in self._cancelled:
+                return OpenClawResult(
+                    command_id=command.command_id,
+                    tenant_id=command.tenant_id,
+                    task_id=command.task_id,
+                    trace_id=command.trace_id,
+                    state=CommandState.CANCELLED,
+                    error={"code": "cancelled", "message": "cancelled before execution"},
+                    finished_at=utc_now(),
+                    runtime_id=self.runtime_id,
+                )
+            self._running.add(command.command_id)
+        try:
+            raw = self.handler(command)
+            if isinstance(raw, OpenClawResult):
+                return raw
+            if not isinstance(raw, Mapping):
+                raise TransportError("runtime handler must return a mapping or OpenClawResult")
+            return OpenClawResult(
+                command_id=command.command_id,
+                tenant_id=command.tenant_id,
+                task_id=command.task_id,
+                trace_id=command.trace_id,
+                state=CommandState(str(raw.get("state", "COMPLETED"))),
+                output=raw.get("output"),
+                error=raw.get("error"),
+                started_at=str(raw.get("started_at") or utc_now()),
+                finished_at=str(raw.get("finished_at") or utc_now()),
+                runtime_id=str(raw.get("runtime_id") or self.runtime_id),
+                attempts=int(raw.get("attempts", 1)),
+            )
+        finally:
+            with self._lock:
+                self._running.discard(command.command_id)
+
+    def cancel(self, command_id: str) -> bool:
+        with self._lock:
+            self._cancelled.add(command_id)
+            return command_id in self._running
+
+    def health(self) -> RuntimeHealth:
+        with self._lock:
+            active = len(self._running)
+        return RuntimeHealth(
+            runtime="openclaw",
+            runtime_id=self.runtime_id,
+            status="healthy",
+            version=self.version,
+            heartbeat_at=utc_now(),
+            active_tasks=active,
+            workspace_isolated=self.workspace_isolated,
+            credential_ref_configured=self.credential_ref_configured,
+            details={"transport": "in_process"},
+        )
+
+
+class HTTPRuntimeTransport:
+    """Private HTTP transport for an OpenClaw runtime service."""
+
+    def __init__(
+        self,
+        base_url: str,
+        *,
+        runtime_id: str = "openclaw-http",
+        credential_ref: str | None = None,
+        max_response_bytes: int = 2_097_152,
+    ) -> None:
+        normalized = str(base_url).rstrip("/")
+        if not normalized.startswith(("http://", "https://")):
+            raise ValueError("base_url must use http or https")
+        self.base_url = normalized
+        self.runtime_id = runtime_id
+        self.credential_ref = credential_ref
+        self.max_response_bytes = int(max_response_bytes)
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        *,
+        payload: Mapping[str, Any] | None,
+        timeout_seconds: float,
+    ) -> Mapping[str, Any]:
+        body = None
+        headers = {"Accept": "application/json", "User-Agent": "AIOS-OpenClaw/1"}
+        if payload is not None:
+            body = json.dumps(dict(payload), separators=(",", ":")).encode("utf-8")
+            headers["Content-Type"] = "application/json"
+        if self.credential_ref:
+            headers["X-AIOS-Credential-Ref"] = self.credential_ref
+        request = urllib.request.Request(
+            f"{self.base_url}{path}",
+            data=body,
+            method=method,
+            headers=headers,
+        )
+        try:
+            with urllib.request.urlopen(request, timeout=timeout_seconds) as response:
+                raw = response.read(self.max_response_bytes + 1)
+        except urllib.error.HTTPError as exc:
+            raise TransportError(f"runtime returned HTTP {exc.code}") from exc
+        except urllib.error.URLError as exc:
+            raise TransportError(f"runtime unavailable: {exc.reason}") from exc
+        if len(raw) > self.max_response_bytes:
+            raise TransportError("runtime response exceeded size limit")
+        decoded = json.loads(raw.decode("utf-8"))
+        if not isinstance(decoded, Mapping):
+            raise TransportError("runtime response must be a JSON object")
+        return decoded
+
+    @staticmethod
+    def _command_payload(command: OpenClawCommand) -> dict[str, Any]:
+        return {**command.unsigned_dict(), "signature": command.signature}
+
+    def execute(self, command: OpenClawCommand, timeout_seconds: float) -> OpenClawResult:
+        value = self._request(
+            "POST",
+            "/v1/execute",
+            payload=self._command_payload(command),
+            timeout_seconds=timeout_seconds,
+        )
+        return OpenClawResult(
+            command_id=str(value["command_id"]),
+            tenant_id=str(value["tenant_id"]),
+            task_id=str(value["task_id"]),
+            trace_id=str(value["trace_id"]),
+            state=CommandState(str(value["state"])),
+            output=value.get("output"),
+            error=value.get("error"),
+            started_at=value.get("started_at"),
+            finished_at=value.get("finished_at"),
+            runtime_id=str(value.get("runtime_id") or self.runtime_id),
+            attempts=int(value.get("attempts", 1)),
+        )
+
+    def cancel(self, command_id: str) -> bool:
+        value = self._request(
+            "POST",
+            f"/v1/commands/{urllib.parse.quote(command_id, safe='')}/cancel",
+            payload={},
+            timeout_seconds=10.0,
+        )
+        return bool(value.get("accepted"))
+
+    def health(self) -> RuntimeHealth:
+        value = self._request("GET", "/v1/health", payload=None, timeout_seconds=5.0)
+        return RuntimeHealth(
+            runtime=str(value.get("runtime") or "openclaw"),
+            runtime_id=str(value.get("runtime_id") or self.runtime_id),
+            status=str(value.get("status") or "unknown"),
+            version=str(value.get("version") or "unknown"),
+            heartbeat_at=str(value.get("heartbeat_at") or utc_now()),
+            active_tasks=int(value.get("active_tasks", 0)),
+            workspace_isolated=bool(value.get("workspace_isolated", False)),
+            credential_ref_configured=bool(value.get("credential_ref_configured", False)),
+            details=value.get("details") if isinstance(value.get("details"), Mapping) else {},
+        )
@@ -1,144 +0,0 @@
-"""HTTP adapter for audited Owner authorization and writer provisioning.
-
-This module layers on top of ``aios_authorized_task_writer_api`` so existing
-routes and the legacy exact ``writer:provision`` route remain available. The
-new endpoint does not mint or modify bearer credentials. It authenticates an
-existing, non-wildcard, explicitly allow-listed Owner credential and then
-invokes the audited broker.
-
-Endpoint:
-    POST /api/governance/owner-authorizations
-"""
-from __future__ import annotations
-
-import os
-import urllib.parse
-from typing import Any, Mapping
-
-import aios_authorized_task_writer_api as bridge_api
-from authorized_task_writer_provisioning import ProvisioningError
-from owner_authorization_broker import (
-    OwnerAuthorizationBroker,
-    OwnerAuthorizationError,
-    OwnerPrincipal,
-)
-
-
-api = bridge_api.api
-_original_do_post = api.H.do_POST
-_ENDPOINT = "/api/governance/owner-authorizations"
-
-
-def _enabled() -> bool:
-    return os.getenv(
-        "AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED", ""
-    ).strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _configured_intake_scope() -> str:
-    scopes = [
-        item.strip()
-        for item in os.getenv(
-            "AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES", ""
-        ).split(",")
-        if item.strip()
-    ]
-    if len(scopes) != 1:
-        raise OwnerAuthorizationError(
-            "EXACTLY_ONE_HTTP_INTAKE_SCOPE_REQUIRED", 503
-        )
-    scope = scopes[0]
-    if scope == "writer:provision" or scope == "*" or scope.endswith(":*"):
-        raise OwnerAuthorizationError("HTTP_INTAKE_SCOPE_REJECTED", 503)
-    return scope
-
-
-def _scope_set(auth: Mapping[str, Any]) -> frozenset[str]:
-    raw = auth.get("scopes")
-    if raw is None:
-        raw = auth.get("scope")
-    if raw is None:
-        return frozenset()
-    if isinstance(raw, str):
-        candidates = raw.replace(",", " ").split()
-    elif isinstance(raw, (list, tuple, set, frozenset)):
-        candidates = [str(item) for item in raw]
-    else:
-        raise OwnerAuthorizationError("OWNER_SCOPE_EVIDENCE_INVALID", 403)
-    return frozenset(item.strip() for item in candidates if item.strip())
-
-
-def _credential_id(auth: Mapping[str, Any]) -> str:
-    for name in (
-        "credential_id",
-        "token_id",
-        "key_id",
-        "auth_id",
-    ):
-        value = str(auth.get(name) or "").strip()
-        if value:
-            return value
-    return ""
-
-
-def _authenticate_existing_owner(handler) -> OwnerPrincipal | None:
-    scope = _configured_intake_scope()
-    auth = handler.need(scope)
-    if not auth:
-        return None
-    if auth.get("role") != "owner":
-        handler.sendj({"error": "OWNER_ROLE_REQUIRED"}, 403)
-        return None
-    identity = str(auth.get("account") or auth.get("identity") or "").strip()
-    if not identity:
-        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
-        return None
-    scopes = _scope_set(auth)
-    if any(item == "*" or item.endswith(":*") for item in scopes):
-        handler.sendj(
-            {"error": "WILDCARD_OWNER_CREDENTIAL_REJECTED"}, 403
-        )
-        return None
-    return OwnerPrincipal(
-        identity=identity,
-        role="owner",
-        authenticated_scope=scope,
-        token_scopes=scopes,
-        credential_id=_credential_id(auth),
-    )
-
-
-def _broker_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != _ENDPOINT:
-        return _original_do_post(self)
-    if not _enabled():
-        return self.sendj(
-            {"error": "OWNER_AUTHORIZATION_BROKER_DISABLED"}, 503
-        )
-    try:
-        principal = _authenticate_existing_owner(self)
-        if principal is None:
-            return
-        data = self.body()
-        result = OwnerAuthorizationBroker().authorize_and_provision(
-            data, principal
-        )
-        return self.sendj(result)
-    except (OwnerAuthorizationError, ProvisioningError) as exc:
-        body = {"error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        return self.sendj(body, exc.status)
-    except Exception:
-        # Never expose registry data, bearer tokens, signer output or traceback.
-        return self.sendj(
-            {"error": "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR"}, 500
-        )
-
-
-api.H.do_POST = _broker_do_post
-
-
-if __name__ == "__main__":
-    api.main()
@@ -1,82 +0,0 @@
-"""Immutable release-lineage contracts used by activation and recovery."""
-
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-from typing import Any, Mapping
-
-
-@dataclass(frozen=True)
-class ReleaseLineage:
-    task_id: str
-    candidate_id: str
-    source_commit: str
-    version: str
-    required_capabilities: tuple[str, ...]
-
-    def as_dict(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-FIXED_V2R2C2 = ReleaseLineage(
-    task_id="r42-release-candidate-v2r2c2-live-20260819",
-    candidate_id="r42-release-candidate-v2r2c2-20260819",
-    source_commit="71e736b05fab13efc06af7a4fe2dc022c1cf9a85",
-    version="V2R2C2",
-    required_capabilities=("release:candidate",),
-)
-
-
-class ReleaseLineageError(RuntimeError):
-    pass
-
-
-def validate_fixed_v2r2c2_task(task: Mapping[str, Any]) -> dict[str, Any]:
-    """Validate identity/source/version without mutating Task state.
-
-    This contract intentionally does not bind status/attempt/revision, because
-    those are lifecycle state and may change through governed retry/recovery.
-    """
-
-    if str(task.get("task_id") or "") != FIXED_V2R2C2.task_id:
-        raise ReleaseLineageError("FIXED_TASK_ID_DRIFT")
-
-    capabilities = task.get("required_capabilities")
-    if (
-        not isinstance(capabilities, list)
-        or tuple(capabilities) != FIXED_V2R2C2.required_capabilities
-    ):
-        raise ReleaseLineageError("FIXED_TASK_CAPABILITY_DRIFT")
-
-    constraints = task.get("constraints")
-    if not isinstance(constraints, Mapping):
-        raise ReleaseLineageError("FIXED_TASK_CONSTRAINTS_MISSING")
-    release = constraints.get("release_candidate")
-    if not isinstance(release, Mapping):
-        raise ReleaseLineageError("FIXED_RELEASE_BINDING_MISSING")
-
-    actual = {
-        "candidate_id": str(release.get("candidate_id") or ""),
-        "source_commit": str(release.get("source_commit") or ""),
-        "version": str(release.get("version") or ""),
-    }
-    expected = {
-        "candidate_id": FIXED_V2R2C2.candidate_id,
-        "source_commit": FIXED_V2R2C2.source_commit,
-        "version": FIXED_V2R2C2.version,
-    }
-    if actual != expected:
-        raise ReleaseLineageError(
-            "FIXED_RELEASE_LINEAGE_DRIFT:"
-            + repr({"expected": expected, "actual": actual})
-        )
-
-    return {
-        "schema": "aios.release-lineage.validation.v1",
-        "status": "VERIFIED",
-        "lineage": FIXED_V2R2C2.as_dict(),
-        "task_status": task.get("status"),
-        "attempt": task.get("attempt"),
-        "max_attempts": task.get("max_attempts"),
-        "revision": task.get("revision"),
-    }
@@ -1,714 +0,0 @@
-#!/usr/bin/env python3
-"""Persistent release-preparation Online Agent worker.
-
-The worker is intentionally narrower than the generic engineering worker:
-it can only consume tasks whose required capability set is exactly
-{"release:candidate"} and whose payload asks for immutable release-candidate
-creation. It never receives Owner signing, deployment, tag, baseline or Git
-write credentials.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import socket
-import threading
-import time
-import urllib.error
-import urllib.request
-from typing import Any, Mapping
-from aios_autonomous_control_plane import (
-    classify_failure,
-    repair_for_failure,
-    runtime_admission,
-)
-
-AGENT_ID = os.environ.get(
-    "AIOS_RELEASE_WORKER_AGENT_ID",
-    "online-release-worker-cn-network-mkt-20260819",
-).strip()
-AGENT_VERSION = os.environ.get(
-    "AIOS_RELEASE_WORKER_AGENT_VERSION",
-    "2026-08-19.1-release-candidate",
-).strip()
-TASK_API = os.environ.get(
-    "AIOS_AGENT_TASK_API_URL",
-    "http://127.0.0.1:18940",
-).rstrip("/")
-RELEASE_API = os.environ.get("AIOS_RELEASE_API_URL", "").rstrip("/")
-POLL_SECONDS = int(os.environ.get("AIOS_RELEASE_WORKER_POLL_SECONDS", "3"))
-LEASE_SECONDS = int(os.environ.get("AIOS_RELEASE_WORKER_LEASE_SECONDS", "60"))
-HEARTBEAT_SECONDS = int(
-    os.environ.get("AIOS_RELEASE_WORKER_HEARTBEAT_SECONDS", "15")
-)
-STATE_ROOT = Path(
-    os.environ.get(
-        "AIOS_RELEASE_WORKER_STATE_ROOT",
-        "/var/lib/aios-online-agent-release",
-    )
-)
-EXPECTED_CAPABILITIES = frozenset({"release:candidate"})
-LIVENESS_PATH = Path(
-    os.environ.get(
-        "AIOS_WORKER_LIVENESS_PATH",
-        str(STATE_ROOT / "worker-liveness.json"),
-    )
-)
-CANDIDATE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,255}$")
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-VERSION_RE = re.compile(r"^V[0-9]+R[0-9]+C[0-9]+$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-SECRET_MARKERS = (
-    "authorization",
-    "token",
-    "secret",
-    "credential",
-    "password",
-    "private_key",
-    "signature",
-)
-
-
-class ReleaseWorkerError(RuntimeError):
-    def __init__(self, code: str, *, phase: str) -> None:
-        super().__init__(code)
-        self.code = code
-        self.phase = phase
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def sha256(value: bytes) -> str:
-    return hashlib.sha256(value).hexdigest()
-
-
-def sanitized(value: Any) -> Any:
-    if isinstance(value, Mapping):
-        result: dict[str, Any] = {}
-        for key, inner in value.items():
-            lowered = str(key).lower()
-            if any(marker in lowered for marker in SECRET_MARKERS):
-                result[str(key)] = "[REDACTED]"
-            else:
-                result[str(key)] = sanitized(inner)
-        return result
-    if isinstance(value, list):
-        return [sanitized(item) for item in value]
-    return value
-
-
-def audit(event: str, **fields: Any) -> None:
-    STATE_ROOT.mkdir(parents=True, exist_ok=True, mode=0o750)
-    path = STATE_ROOT / "events.jsonl"
-    record = {
-        "schema": "aios.release-worker.event.v1",
-        "event": event,
-        "created_at": now(),
-        "agent_id": AGENT_ID,
-        **sanitized(fields),
-    }
-    with path.open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(record, sort_keys=True) + "\n")
-    os.chmod(path, 0o640)
-
-
-def sd_notify(message: str) -> None:
-    target = os.environ.get("NOTIFY_SOCKET", "")
-    if not target:
-        return
-    if target.startswith("@"):
-        address = "\0" + target[1:]
-    else:
-        address = target
-    sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
-    try:
-        sock.connect(address)
-        sock.sendall(message.encode("utf-8"))
-    except OSError:
-        # Liveness JSON remains the diagnostic source; systemd will enforce
-        # WatchdogSec if notify transport is persistently broken.
-        pass
-    finally:
-        sock.close()
-
-
-def write_liveness(
-    state: str,
-    *,
-    task_id: str | None = None,
-    stage: str | None = None,
-    error: str | None = None,
-    visible_count: int | None = None,
-) -> None:
-    STATE_ROOT.mkdir(parents=True, exist_ok=True, mode=0o750)
-    value = {
-        "schema": "aios.online-agent.worker-liveness.v1",
-        "agent_id": AGENT_ID,
-        "agent_type": "release-preparation-worker",
-        "agent_version": AGENT_VERSION,
-        "pid": os.getpid(),
-        "state": state,
-        "last_seen_epoch": time.time(),
-        "last_seen_at": now(),
-        "poll_seconds": POLL_SECONDS,
-        "heartbeat_seconds": HEARTBEAT_SECONDS,
-        "api_base": TASK_API,
-        "capabilities": sorted(EXPECTED_CAPABILITIES),
-        "task_id": task_id,
-        "stage": stage,
-        "error": error,
-        "visible_count": visible_count,
-    }
-    LIVENESS_PATH.parent.mkdir(parents=True, exist_ok=True, mode=0o750)
-    temporary = LIVENESS_PATH.with_name(
-        "." + LIVENESS_PATH.name + f".{os.getpid()}.tmp"
-    )
-    temporary.write_text(
-        json.dumps(value, ensure_ascii=False, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-    os.chmod(temporary, 0o640)
-    os.replace(temporary, LIVENESS_PATH)
-
-
-def load_credential(name: str) -> str:
-    directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", ""))
-    path = directory / name
-    if path.is_symlink() or not path.is_file():
-        raise ReleaseWorkerError(
-            "CREDENTIAL_UNAVAILABLE:" + name,
-            phase="startup",
-        )
-    value = path.read_text(encoding="utf-8").strip()
-    if len(value) < 24 or any(ch.isspace() for ch in value):
-        raise ReleaseWorkerError(
-            "CREDENTIAL_INVALID:" + name,
-            phase="startup",
-        )
-    return value
-
-
-def http_json(
-    base: str,
-    method: str,
-    route: str,
-    token: str,
-    body: Mapping[str, Any] | None = None,
-    *,
-    timeout: int = 30,
-) -> tuple[int, dict[str, Any]]:
-    data = None if body is None else canonical(body)
-    headers = {"Accept": "application/json"}
-    if token:
-        headers["Authorization"] = "Bearer " + token
-    if data is not None:
-        headers["Content-Type"] = "application/json"
-    request = urllib.request.Request(
-        base + route,
-        method=method,
-        data=data,
-        headers=headers,
-    )
-    try:
-        with urllib.request.urlopen(request, timeout=timeout) as response:
-            raw, status = response.read(), response.status
-    except urllib.error.HTTPError as exc:
-        raw, status = exc.read(), exc.code
-    except (urllib.error.URLError, TimeoutError) as exc:
-        raise ReleaseWorkerError(
-            "HTTP_TRANSPORT_UNAVAILABLE",
-            phase="network",
-        ) from exc
-    try:
-        value = json.loads(raw.decode())
-    except Exception as exc:
-        raise ReleaseWorkerError(
-            "HTTP_RESPONSE_INVALID",
-            phase="network",
-        ) from exc
-    return status, value if isinstance(value, dict) else {}
-
-
-@dataclass(frozen=True)
-class ReleaseRequest:
-    candidate_id: str
-    source_commit: str
-    version: str
-    projection_id: str | None
-
-    @classmethod
-    def from_task(cls, task: Mapping[str, Any]) -> "ReleaseRequest":
-        if not TASK_RE.fullmatch(str(task.get("task_id") or "")):
-            raise ReleaseWorkerError("TASK_ID_INVALID", phase="validation")
-        caps = task.get("required_capabilities")
-        if (
-            not isinstance(caps, list)
-            or frozenset(caps) != EXPECTED_CAPABILITIES
-            or len(caps) != 1
-        ):
-            raise ReleaseWorkerError(
-                "TASK_CAPABILITY_SCOPE_INVALID",
-                phase="validation",
-            )
-        metadata = task.get("metadata")
-        if not isinstance(metadata, Mapping):
-            metadata = {}
-        constraints = task.get("constraints")
-        if not isinstance(constraints, Mapping):
-            constraints = {}
-        release = constraints.get("release_candidate")
-        if not isinstance(release, Mapping):
-            release = metadata.get("release_candidate")
-        if not isinstance(release, Mapping):
-            release = task.get("release_candidate")
-        if not isinstance(release, Mapping):
-            raise ReleaseWorkerError(
-                "RELEASE_CANDIDATE_PAYLOAD_MISSING",
-                phase="validation",
-            )
-        allowed = {
-            "candidate_id",
-            "source_commit",
-            "version",
-            "projection_id",
-        }
-        if set(release) - allowed:
-            raise ReleaseWorkerError(
-                "RELEASE_CANDIDATE_PAYLOAD_FIELDS_INVALID",
-                phase="validation",
-            )
-        candidate_id = str(release.get("candidate_id") or "")
-        source_commit = str(release.get("source_commit") or "")
-        version = str(release.get("version") or "")
-        projection_id = release.get("projection_id")
-        if CANDIDATE_RE.fullmatch(candidate_id) is None:
-            raise ReleaseWorkerError(
-                "RELEASE_CANDIDATE_ID_INVALID",
-                phase="validation",
-            )
-        if OID_RE.fullmatch(source_commit) is None:
-            raise ReleaseWorkerError(
-                "RELEASE_SOURCE_COMMIT_INVALID",
-                phase="validation",
-            )
-        if VERSION_RE.fullmatch(version) is None:
-            raise ReleaseWorkerError(
-                "RELEASE_VERSION_INVALID",
-                phase="validation",
-            )
-        if projection_id is not None:
-            projection_id = str(projection_id)
-            if not re.fullmatch(r"projection-[0-9a-f]{32}", projection_id):
-                raise ReleaseWorkerError(
-                    "RELEASE_PROJECTION_ID_INVALID",
-                    phase="validation",
-                )
-        return cls(
-            candidate_id=candidate_id,
-            source_commit=source_commit,
-            version=version,
-            projection_id=projection_id,
-        )
-
-    def body(self) -> dict[str, str]:
-        return {
-            "candidate_id": self.candidate_id,
-            "source_commit": self.source_commit,
-            "version": self.version,
-        }
-
-
-class Heartbeat:
-    def __init__(
-        self,
-        agent_token: str,
-        task_id: str,
-        lease_token: str,
-    ) -> None:
-        self.agent_token = agent_token
-        self.task_id = task_id
-        self.lease_token = lease_token
-        self.stage = "claimed"
-        self.failure: str | None = None
-        self.stop = threading.Event()
-        self.thread = threading.Thread(
-            target=self._run,
-            name="release-worker-heartbeat",
-            daemon=True,
-        )
-
-    def first(self) -> None:
-        status, value = http_json(
-            TASK_API,
-            "POST",
-            f"/v1/tasks/{self.task_id}/heartbeat",
-            self.agent_token,
-            {
-                "lease_token": self.lease_token,
-                "lease_seconds": LEASE_SECONDS,
-                "progress": {
-                    "stage": self.stage,
-                    "worker_version": AGENT_VERSION,
-                },
-            },
-        )
-        if status != 200:
-            raise ReleaseWorkerError(
-                "TASK_HEARTBEAT_FAILED",
-                phase="heartbeat",
-            )
-        audit(
-            "TASK_HEARTBEAT",
-            task_id=self.task_id,
-            stage=self.stage,
-            api_status=status,
-        )
-        write_liveness(
-            "BUSY",
-            task_id=self.task_id,
-            stage=self.stage,
-        )
-        sd_notify("WATCHDOG=1")
-
-    def _run(self) -> None:
-        while not self.stop.wait(HEARTBEAT_SECONDS):
-            try:
-                status, value = http_json(
-                    TASK_API,
-                    "POST",
-                    f"/v1/tasks/{self.task_id}/heartbeat",
-                    self.agent_token,
-                    {
-                        "lease_token": self.lease_token,
-                        "lease_seconds": LEASE_SECONDS,
-                        "progress": {
-                            "stage": self.stage,
-                            "worker_version": AGENT_VERSION,
-                        },
-                    },
-                )
-                if status != 200:
-                    self.failure = str(value.get("error") or status)
-                    return
-                audit(
-                    "TASK_HEARTBEAT",
-                    task_id=self.task_id,
-                    stage=self.stage,
-                    api_status=status,
-                )
-                write_liveness(
-                    "BUSY",
-                    task_id=self.task_id,
-                    stage=self.stage,
-                )
-                sd_notify("WATCHDOG=1")
-            except Exception as exc:
-                self.failure = type(exc).__name__
-                return
-
-    def ensure(self) -> None:
-        if self.failure:
-            raise ReleaseWorkerError(
-                "TASK_LEASE_LOST",
-                phase="heartbeat",
-            )
-
-    def close(self) -> None:
-        self.stop.set()
-        if self.thread.ident is not None:
-            self.thread.join(timeout=2)
-
-
-def release_admission(
-    task: Mapping[str, Any],
-    *,
-    release_token: str,
-):
-    required = task.get("required_capabilities")
-    if not isinstance(required, list):
-        required = []
-
-    def release_api_health() -> bool:
-        status, value = http_json(
-            RELEASE_API,
-            "GET",
-            "/health",
-            "",
-            timeout=10,
-        )
-        return status == 200 and str(value.get("status") or "").lower() in {"ok", "healthy"}
-
-    def authenticated_probe() -> bool:
-        status, _ = http_json(
-            RELEASE_API,
-            "POST",
-            "/createReleaseCandidate",
-            release_token,
-            {},
-            timeout=10,
-        )
-        # Authentication + credential projection succeeded; the empty release
-        # request is intentionally rejected by request validation.
-        return status == 400
-
-    probes = {
-        "credential_projection": authenticated_probe,
-        "trusted_builder": release_api_health,
-        "authenticated_probe": authenticated_probe,
-        "release_api_health": release_api_health,
-        "worker_liveness": lambda: True,
-    }
-    return runtime_admission(
-        worker_capabilities=EXPECTED_CAPABILITIES,
-        required_capabilities=required,
-        requested_operations=("prepare_release",),
-        probes=probes,
-    )
-
-
-def result_payload(
-    task_id: str,
-    release: ReleaseRequest,
-    builder: Mapping[str, Any],
-) -> dict[str, Any]:
-    builder_candidate = builder.get("candidate_id")
-    if builder_candidate not in {None, release.candidate_id}:
-        raise ReleaseWorkerError(
-            "BUILDER_CANDIDATE_BINDING_INVALID",
-            phase="release",
-        )
-    immutable = {
-        "candidate_id": release.candidate_id,
-        "source_commit": release.source_commit,
-        "version": release.version,
-    }
-    return {
-        "status": "SUCCEEDED",
-        "classification": "RELEASE_CANDIDATE_CREATED",
-        "execution_mode": "release_candidate",
-        "adapter": "release_candidate",
-        "task_id": task_id,
-        "agent_id": AGENT_ID,
-        "release_candidate": immutable,
-        "release_candidate_request_sha256": sha256(canonical(immutable)),
-        "builder_response": sanitized(dict(builder)),
-        "projection_id": release.projection_id,
-        "writer_lease": "NONE",
-        "changed_files": [],
-        "direct_main_write": False,
-        "production_write": False,
-        "tag_write": False,
-        "baseline_write": False,
-        "runtime_switch": False,
-        "owner_approval_submitted": False,
-        "credential_material_exposed": False,
-    }
-
-
-def execute_task(
-    task: Mapping[str, Any],
-    *,
-    agent_token: str,
-    release_token: str,
-) -> bool:
-    task_id = str(task.get("task_id") or "")
-    release = ReleaseRequest.from_task(task)
-    admission = release_admission(
-        task,
-        release_token=release_token,
-    )
-    if not admission.admitted:
-        audit(
-            "TASK_ADMISSION_BLOCKED",
-            task_id=task_id,
-            admission=admission.as_dict(),
-        )
-        write_liveness(
-            "BLOCKED",
-            task_id=task_id,
-            stage="execution_ready",
-            error=admission.failure_class.value if admission.failure_class else "ADMISSION_FAILED",
-        )
-        return False
-    audit(
-        "TASK_ADMISSION_PASSED",
-        task_id=task_id,
-        admission=admission.as_dict(),
-    )
-    status, claimed = http_json(
-        TASK_API,
-        "POST",
-        f"/v1/tasks/{task_id}/claim",
-        agent_token,
-        {"lease_seconds": LEASE_SECONDS},
-    )
-    if status in {409, 423}:
-        return False
-    if status != 200:
-        raise ReleaseWorkerError(
-            "TASK_CLAIM_FAILED",
-            phase="claim",
-        )
-    lease_token = str(claimed.get("lease_token") or "")
-    if len(lease_token) < 16:
-        raise ReleaseWorkerError(
-            "TASK_LEASE_TOKEN_INVALID",
-            phase="claim",
-        )
-    attempt = int(claimed.get("attempt") or 0)
-    audit(
-        "TASK_CLAIMED",
-        task_id=task_id,
-        attempt=attempt,
-    )
-
-    heartbeat = Heartbeat(agent_token, task_id, lease_token)
-    heartbeat.first()
-    heartbeat.thread.start()
-    try:
-        heartbeat.stage = "release_candidate"
-        heartbeat.ensure()
-        status, builder = http_json(
-            RELEASE_API,
-            "POST",
-            "/createReleaseCandidate",
-            release_token,
-            release.body(),
-            timeout=120,
-        )
-        if status not in {200, 201, 202}:
-            raise ReleaseWorkerError(
-                "RELEASE_CANDIDATE_CREATE_FAILED:"
-                + str(builder.get("error") or status),
-                phase="release",
-            )
-        heartbeat.ensure()
-        result = result_payload(task_id, release, builder)
-        idempotency_key = (
-            f"{task_id}-attempt-{attempt}-release-result-v1"
-        )
-        status, submitted = http_json(
-            TASK_API,
-            "POST",
-            f"/v1/tasks/{task_id}/result",
-            agent_token,
-            {
-                "lease_token": lease_token,
-                "idempotency_key": idempotency_key,
-                "result": result,
-            },
-        )
-        if status not in {200, 201, 202}:
-            raise ReleaseWorkerError(
-                "TASK_RESULT_SUBMIT_FAILED",
-                phase="result",
-            )
-        audit(
-            "RESULT_SUBMITTED",
-            task_id=task_id,
-            attempt=attempt,
-            release_candidate_id=release.candidate_id,
-        )
-        return True
-    finally:
-        heartbeat.close()
-
-
-def main() -> int:
-    if not RELEASE_API:
-        raise SystemExit("FATAL:AIOS_RELEASE_API_URL_REQUIRED")
-    agent_token = load_credential("agent_token")
-    release_token = load_credential("release_candidate_token")
-    STATE_ROOT.mkdir(parents=True, exist_ok=True, mode=0o750)
-    audit(
-        "WORKER_STARTED",
-        capabilities=sorted(EXPECTED_CAPABILITIES),
-        release_api=RELEASE_API,
-    )
-    write_liveness("STARTING", stage="startup")
-    sd_notify("READY=1\nSTATUS=release worker ready")
-    while True:
-        try:
-            status, response = http_json(
-                TASK_API,
-                "POST",
-                "/v1/tasks/poll",
-                agent_token,
-                {"limit": 100},
-            )
-            if status != 200:
-                raise ReleaseWorkerError(
-                    "TASK_POLL_FAILED",
-                    phase="poll",
-                )
-            tasks = response.get("tasks")
-            if not isinstance(tasks, list):
-                tasks = []
-            write_liveness(
-                "IDLE",
-                stage="poll",
-                visible_count=len(tasks),
-            )
-            sd_notify("WATCHDOG=1\nSTATUS=release worker poll ok")
-            handled = False
-            for raw in tasks:
-                if not isinstance(raw, Mapping):
-                    continue
-                caps = raw.get("required_capabilities")
-                if (
-                    not isinstance(caps, list)
-                    or frozenset(caps) != EXPECTED_CAPABILITIES
-                ):
-                    continue
-                try:
-                    handled = execute_task(
-                        raw,
-                        agent_token=agent_token,
-                        release_token=release_token,
-                    ) or handled
-                except ReleaseWorkerError as exc:
-                    failure = classify_failure(exc.code, phase=exc.phase)
-                    repair = repair_for_failure(failure)
-                    audit(
-                        "TASK_EXECUTION_FAILED",
-                        task_id=raw.get("task_id"),
-                        phase=exc.phase,
-                        error=exc.code,
-                        failure_class=failure.value,
-                        repair=repair.as_dict(),
-                    )
-            time.sleep(0 if handled else POLL_SECONDS)
-        except KeyboardInterrupt:
-            return 0
-        except Exception as exc:
-            audit(
-                "WORKER_LOOP_ERROR",
-                error=type(exc).__name__,
-            )
-            write_liveness(
-                "DEGRADED",
-                stage="loop",
-                error=type(exc).__name__,
-            )
-            time.sleep(POLL_SECONDS)
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,287 +0,0 @@
-"""Credential-isolated durable coordinator for the release-preparation supervisor.
-
-The coordinator owns only its Online Task agent credential.  It never forwards
-that credential to Hermes/OpenClaw and never submits a Task result while the
-supervision goal is incomplete.  Its job is deliberately small: claim the one
-fixed supervisor Task after an exact coordinator projection and keep a durable
-heartbeat lease while later phases observe and repair through governed APIs.
-"""
-from __future__ import annotations
-
-from datetime import datetime, timezone
-import json
-import os
-from pathlib import Path
-import tempfile
-import time
-from typing import Any, Mapping
-import urllib.error
-import urllib.request
-
-
-API_BASE = os.environ.get(
-    "AIOS_AGENT_TASK_API_URL", "http://127.0.0.1:18940"
-).rstrip("/")
-AGENT_ID = os.environ.get(
-    "AIOS_AGENT_ID",
-    "online-engineering-worker-cn-network-mkt-autonomous-20260815",
-)
-TASK_ID = os.environ.get(
-    "AIOS_RELEASE_PREPARATION_SUPERVISOR_TASK_ID",
-    "r42-release-preparation-autonomous-supervisor-20260820",
-)
-EXPECTED_EXECUTION_DIGEST = os.environ.get(
-    "AIOS_RELEASE_PREPARATION_SUPERVISOR_EXECUTION_DIGEST", ""
-)
-RUNTIME_CAPABILITY = "agent.runtime.openclaw"
-COORDINATOR_CAPABILITY = "engineering.autonomous"
-REQUIRED_CAPABILITIES = [RUNTIME_CAPABILITY, COORDINATOR_CAPABILITY]
-POLL_SECONDS = int(os.environ.get("AIOS_SUPERVISOR_COORDINATOR_POLL_SECONDS", "5"))
-HEARTBEAT_SECONDS = int(
-    os.environ.get("AIOS_SUPERVISOR_COORDINATOR_HEARTBEAT_SECONDS", "10")
-)
-LEASE_SECONDS = int(os.environ.get("AIOS_SUPERVISOR_COORDINATOR_LEASE_SECONDS", "300"))
-STATE_ROOT = Path(
-    os.environ.get(
-        "AIOS_SUPERVISOR_COORDINATOR_STATE_ROOT",
-        "/var/lib/aios-release-preparation-supervisor-coordinator",
-    )
-)
-
-
-class CoordinatorError(RuntimeError):
-    def __init__(self, code: str) -> None:
-        super().__init__(code)
-        self.code = code
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value, sort_keys=True, separators=(",", ":"), ensure_ascii=False
-    ).encode("utf-8")
-
-
-def atomic_json(path: Path, value: Mapping[str, Any]) -> None:
-    path.parent.mkdir(parents=True, mode=0o750, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise CoordinatorError("COORDINATOR_STATE_SYMLINK_REJECTED")
-    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
-    try:
-        os.fchmod(fd, 0o640)
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            json.dump(dict(value), handle, ensure_ascii=False, sort_keys=True)
-            handle.write("\n")
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temporary, path)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def audit(event_type: str, **fields: Any) -> None:
-    record = {
-        "event_type": event_type,
-        "created_at": now(),
-        "agent_id": AGENT_ID,
-        "task_id": TASK_ID,
-        "credential_material_exposed": False,
-        "planner_credential_material_exposed": False,
-        "lease_material_exposed": False,
-        **fields,
-    }
-    STATE_ROOT.mkdir(parents=True, mode=0o750, exist_ok=True)
-    with (STATE_ROOT / "events.jsonl").open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(record, ensure_ascii=False, sort_keys=True) + "\n")
-    atomic_json(STATE_ROOT / "liveness.json", record)
-
-
-def api_call(
-    method: str,
-    route: str,
-    token: str,
-    body: Mapping[str, Any] | None = None,
-) -> tuple[int, dict[str, Any]]:
-    payload = None if body is None else canonical(dict(body))
-    headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
-    if payload is not None:
-        headers["Content-Type"] = "application/json"
-    request = urllib.request.Request(
-        API_BASE + route, data=payload, headers=headers, method=method
-    )
-    try:
-        with urllib.request.urlopen(request, timeout=20) as response:
-            value = json.loads(response.read().decode("utf-8"))
-            return response.status, value if isinstance(value, dict) else {}
-    except urllib.error.HTTPError as exc:
-        try:
-            value = json.loads(exc.read(4096).decode("utf-8", "replace"))
-        except Exception:
-            value = {"error": "HTTP_ERROR"}
-        return exc.code, value if isinstance(value, dict) else {"error": "HTTP_ERROR"}
-    except (urllib.error.URLError, TimeoutError):
-        return 599, {"error": "AGENT_TASK_API_UNAVAILABLE"}
-
-
-def load_agent_token() -> str:
-    path = Path(os.environ.get("CREDENTIALS_DIRECTORY", "")) / "agent_token"
-    if path.is_symlink() or not path.is_file():
-        raise CoordinatorError("COORDINATOR_AGENT_CREDENTIAL_UNAVAILABLE")
-    token = path.read_text(encoding="utf-8").strip()
-    if len(token) < 24 or any(character.isspace() for character in token):
-        raise CoordinatorError("COORDINATOR_AGENT_CREDENTIAL_INVALID")
-    return token
-
-
-def validate_task(task: Mapping[str, Any]) -> dict[str, Any]:
-    if task.get("task_id") != TASK_ID or task.get("status") != "QUEUED":
-        raise CoordinatorError("SUPERVISOR_TASK_STATE_INVALID")
-    if task.get("required_capabilities") != REQUIRED_CAPABILITIES:
-        raise CoordinatorError("SUPERVISOR_COORDINATOR_CAPABILITIES_INVALID")
-    metadata = task.get("metadata")
-    if not isinstance(metadata, Mapping):
-        raise CoordinatorError("SUPERVISOR_EXECUTION_METADATA_MISSING")
-    execution = metadata.get("execution")
-    if not isinstance(execution, Mapping):
-        raise CoordinatorError("SUPERVISOR_EXECUTION_METADATA_MISSING")
-    governance = execution.get("governance")
-    if (
-        execution.get("action") != "agent_runtime"
-        or execution.get("adapter") != "openclaw"
-        or execution.get("capability_scope") != REQUIRED_CAPABILITIES
-        or execution.get("execution_digest") != EXPECTED_EXECUTION_DIGEST
-        or execution.get("change_set") != []
-        or execution.get("verification") != []
-        or not isinstance(governance, Mapping)
-        or governance.get("writer_lease") is not False
-        or any(
-            governance.get(field) is not False
-            for field in (
-                "main_write",
-                "production_write",
-                "tag_write",
-                "baseline_write",
-                "force_push",
-                "protected_ref_bypass",
-            )
-        )
-    ):
-        raise CoordinatorError("SUPERVISOR_COORDINATOR_ENVELOPE_INVALID")
-    return dict(execution)
-
-
-def heartbeat_progress(sequence: int) -> dict[str, Any]:
-    return {
-        "stage": "supervisor_coordinator_active",
-        "phase": "external_caller_projection",
-        "state": "PENDING_EXTERNAL_CONNECTOR_ACK",
-        "sequence": sequence,
-        "control_plane_access_granted": True,
-        "external_planner_role": "UNPRIVILEGED_PLANNER",
-        "credential_forwarded_to_planner": False,
-        "main_write": False,
-        "production_write": False,
-        "owner_approval_submitted": False,
-    }
-
-
-def coordinate_claim(
-    claim: Mapping[str, Any],
-    token: str,
-    *,
-    max_heartbeats: int | None = None,
-) -> int:
-    lease_token = claim.get("lease_token")
-    if not isinstance(lease_token, str) or len(lease_token) < 24:
-        raise CoordinatorError("COORDINATOR_LEASE_TOKEN_MISSING")
-    sequence = 0
-    while max_heartbeats is None or sequence < max_heartbeats:
-        sequence += 1
-        status, response = api_call(
-            "POST",
-            f"/v1/tasks/{TASK_ID}/heartbeat",
-            token,
-            {
-                "lease_token": lease_token,
-                "lease_seconds": LEASE_SECONDS,
-                "progress": heartbeat_progress(sequence),
-            },
-        )
-        if status != 200:
-            raise CoordinatorError(
-                "COORDINATOR_HEARTBEAT_FAILED_" + str(response.get("error") or status)
-            )
-        audit(
-            "SUPERVISOR_COORDINATOR_HEARTBEAT",
-            sequence=sequence,
-            task_status=response.get("status"),
-            lease_expires_at=response.get("lease_expires_at"),
-            control_plane_access_granted=True,
-            external_planner_role="UNPRIVILEGED_PLANNER",
-        )
-        if max_heartbeats is None or sequence < max_heartbeats:
-            time.sleep(HEARTBEAT_SECONDS)
-    return sequence
-
-
-def worker_once(token: str) -> bool:
-    status, poll = api_call("POST", "/v1/tasks/poll", token, {"limit": 100})
-    if status != 200:
-        audit("SUPERVISOR_COORDINATOR_POLL_FAILED", error=poll.get("error") or status)
-        return False
-    task = next(
-        (
-            item
-            for item in poll.get("tasks", [])
-            if isinstance(item, Mapping) and item.get("task_id") == TASK_ID
-        ),
-        None,
-    )
-    if task is None:
-        audit("SUPERVISOR_COORDINATOR_WAITING_FOR_TASK")
-        return False
-    validate_task(task)
-    status, claim = api_call(
-        "POST", f"/v1/tasks/{TASK_ID}/claim", token, {"lease_seconds": LEASE_SECONDS}
-    )
-    if status != 200:
-        audit("SUPERVISOR_COORDINATOR_CLAIM_FAILED", error=claim.get("error") or status)
-        return False
-    audit(
-        "SUPERVISOR_COORDINATOR_CLAIMED",
-        attempt=claim.get("attempt"),
-        revision=claim.get("revision"),
-        claim_mode="server_atomic",
-        control_plane_access_granted=True,
-    )
-    coordinate_claim(claim, token)
-    return True
-
-
-def main() -> int:
-    if not EXPECTED_EXECUTION_DIGEST or len(EXPECTED_EXECUTION_DIGEST) != 64:
-        raise CoordinatorError("SUPERVISOR_EXECUTION_DIGEST_CONFIG_INVALID")
-    token = load_agent_token()
-    audit(
-        "SUPERVISOR_COORDINATOR_READY",
-        required_capabilities=REQUIRED_CAPABILITIES,
-        control_plane_access_granted=True,
-        external_planner_role="UNPRIVILEGED_PLANNER",
-    )
-    while True:
-        try:
-            worker_once(token)
-        except Exception as exc:
-            audit(
-                "SUPERVISOR_COORDINATOR_LOOP_ERROR",
-                error=exc.code if isinstance(exc, CoordinatorError) else type(exc).__name__,
-            )
-        time.sleep(POLL_SECONDS)
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,160 +0,0 @@
-#!/usr/bin/env python3
-"""Loopback-only HTTP API for the task identity overlay.
-
-Endpoints:
-  GET  /healthz
-  POST /api/governance/owner-authorizations
-
-The API authenticates only the short-lived overlay credential. It does not read
-or modify the global bearer-token registry.
-"""
-from __future__ import annotations
-
-import json
-import os
-import urllib.parse
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any
-
-from authorized_task_writer_provisioning import ProvisioningError
-from owner_authorization_broker import OwnerAuthorizationError
-from task_identity_overlay import (
-    MAX_BODY_BYTES,
-    IdentityOverlayConfig,
-    IdentityOverlayError,
-    TaskIdentityOverlayService,
-)
-
-
-_ENDPOINT = "/api/governance/owner-authorizations"
-
-
-def _enabled() -> bool:
-    return os.getenv(
-        "AIOS_GITOPS_IDENTITY_OVERLAY_ENABLED", ""
-    ).strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _bearer(header: str) -> str:
-    prefix = "Bearer "
-    if not header.startswith(prefix):
-        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-    token = header[len(prefix):].strip()
-    if not token or len(token) > 4096:
-        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-    return token
-
-
-class OverlayHandler(BaseHTTPRequestHandler):
-    server_version = "aios-task-identity-overlay/1"
-    sys_version = ""
-
-    @property
-    def overlay(self) -> TaskIdentityOverlayService:
-        return self.server.overlay  # type: ignore[attr-defined]
-
-    def log_message(self, format: str, *args: Any) -> None:
-        # Never log Authorization or request bodies.
-        return
-
-    def _send(self, status: int, value: dict[str, Any]) -> None:
-        payload = (
-            json.dumps(
-                value,
-                ensure_ascii=False,
-                sort_keys=True,
-                separators=(",", ":"),
-            )
-            + "\n"
-        ).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def _body(self) -> dict[str, Any]:
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError:
-            raise IdentityOverlayError("OVERLAY_CONTENT_LENGTH_INVALID") from None
-        if length <= 0 or length > MAX_BODY_BYTES:
-            raise IdentityOverlayError("OVERLAY_BODY_SIZE_REJECTED", 413)
-        raw = self.rfile.read(length)
-        try:
-            value = json.loads(raw)
-        except (UnicodeDecodeError, json.JSONDecodeError):
-            raise IdentityOverlayError("OVERLAY_BODY_JSON_INVALID") from None
-        if not isinstance(value, dict):
-            raise IdentityOverlayError("OVERLAY_BODY_OBJECT_REQUIRED")
-        return value
-
-    def do_GET(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != "/healthz":
-            self._send(404, {"error": "NOT_FOUND"})
-            return
-        self._send(
-            200,
-            {
-                "service": "aios-task-identity-overlay",
-                "status": "active" if _enabled() else "disabled",
-                "global_token_registry_used": False,
-                "loopback_only": True,
-            },
-        )
-
-    def do_POST(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != _ENDPOINT:
-            self._send(404, {"error": "NOT_FOUND"})
-            return
-        if not _enabled():
-            self._send(503, {"error": "IDENTITY_OVERLAY_DISABLED"})
-            return
-        try:
-            token = _bearer(self.headers.get("Authorization", ""))
-            result = self.overlay.provision(self._body(), token)
-            self._send(200, result)
-        except (IdentityOverlayError, OwnerAuthorizationError, ProvisioningError) as exc:
-            body: dict[str, Any] = {"error": exc.code}
-            if getattr(exc, "details", None):
-                body["details"] = exc.details
-            self._send(exc.status, body)
-        except Exception:
-            self._send(500, {"error": "IDENTITY_OVERLAY_API_INTERNAL_ERROR"})
-
-
-class OverlayServer(ThreadingHTTPServer):
-    allow_reuse_address = True
-
-    def __init__(
-        self,
-        address: tuple[str, int],
-        overlay: TaskIdentityOverlayService,
-    ) -> None:
-        super().__init__(address, OverlayHandler)
-        self.overlay = overlay
-
-
-def main() -> None:
-    host = os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_HOST", "127.0.0.1")
-    if host not in {"127.0.0.1", "::1", "localhost"}:
-        raise SystemExit("identity overlay must listen on loopback")
-    try:
-        port = int(os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_PORT", "19864"))
-    except ValueError:
-        raise SystemExit("invalid overlay port") from None
-    if not 1024 <= port <= 65535:
-        raise SystemExit("invalid overlay port")
-    config = IdentityOverlayConfig.from_environment()
-    server = OverlayServer(
-        (host, port),
-        TaskIdentityOverlayService(config),
-    )
-    server.serve_forever(poll_interval=0.25)
-
-
-if __name__ == "__main__":
-    main()
@@ -1,92 +0,0 @@
-#!/usr/bin/env python3
-"""Root-governed CLI for issuing and revoking task identity overlays.
-
-The CLI never prints the bearer token. It returns only the root-owned secret
-reference and non-secret metadata.
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-
-from task_identity_overlay import (
-    IdentityOverlayConfig,
-    IdentityOverlayError,
-    TaskIdentityOverlayStore,
-)
-
-
-def _write_result(path: str, value: dict) -> None:
-    data = json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n"
-    if path == "-":
-        sys.stdout.write(data)
-        return
-    target = Path(path)
-    target.parent.mkdir(parents=True, exist_ok=True)
-    target.write_text(data, encoding="utf-8")
-    os.chmod(target, 0o600)
-
-
-def parser() -> argparse.ArgumentParser:
-    value = argparse.ArgumentParser(
-        description="Issue/status/revoke a task-scoped identity overlay"
-    )
-    sub = value.add_subparsers(dest="command", required=True)
-
-    issue = sub.add_parser("issue")
-    issue.add_argument("--ttl-seconds", type=int, default=900)
-    issue.add_argument("--authorization-assertion-ref", required=True)
-    issue.add_argument(
-        "--operator-identity",
-        default=os.getenv("SUDO_USER") or os.getenv("USER") or "root",
-    )
-    issue.add_argument("--result-json", default="-")
-
-    status = sub.add_parser("status")
-    status.add_argument("--overlay-id", required=True)
-    status.add_argument("--result-json", default="-")
-
-    revoke = sub.add_parser("revoke")
-    revoke.add_argument("--overlay-id", required=True)
-    revoke.add_argument("--reason", required=True)
-    revoke.add_argument("--result-json", default="-")
-    return value
-
-
-def main() -> int:
-    args = parser().parse_args()
-    try:
-        store = TaskIdentityOverlayStore(
-            IdentityOverlayConfig.from_environment()
-        )
-        if args.command == "issue":
-            result = store.issue(
-                ttl_seconds=args.ttl_seconds,
-                authorization_assertion_ref=args.authorization_assertion_ref,
-                operator_identity=args.operator_identity,
-            )
-        elif args.command == "status":
-            result = store.status(args.overlay_id)
-        else:
-            result = store.revoke(args.overlay_id, reason=args.reason)
-        _write_result(args.result_json, result)
-        return 0
-    except IdentityOverlayError as exc:
-        body = {"status": "BLOCKED", "error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        _write_result(getattr(args, "result_json", "-"), body)
-        return 2
-    except Exception:
-        _write_result(
-            getattr(args, "result_json", "-"),
-            {"status": "FAILED", "error": "IDENTITY_OVERLAY_CLI_INTERNAL_ERROR"},
-        )
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -0,0 +1,110 @@
+"""AIOS V2 控制面、执行编排与可信运行来源证明。"""
+
+from .control_plane import (
+    AgentRecord,
+    AuditEvent,
+    ControlPlaneError,
+    ControlPlaneService,
+    IdempotencyConflict,
+    InMemoryControlPlaneStore,
+    InvalidTransition,
+    NotFound,
+    PolicyDenied,
+    RequestContext,
+    RevisionConflict,
+    TaskRecord,
+    TaskState,
+    TenantIsolationError,
+    TenantRecord,
+    Unauthorized,
+)
+from .execution_tracking import ExecutionEvidence, ExecutionTracker
+from .orchestrator import DispatchRecord, ExecutionOrchestrator, OrchestrationError
+from .provenance import (
+    Ed25519PrivateKeySigner,
+    Ed25519PublicKeyVerifier,
+    ExecutionPath,
+    GitOperation,
+    PRODUCTION_POLICY_VERSION,
+    ProvenanceAuthorization,
+    ProvenanceControlledWriter,
+    ProvenanceDenied,
+    ProvenanceError,
+    ProvenanceExpired,
+    ProvenanceIssuer,
+    ProvenanceNotFound,
+    ProvenanceReplay,
+    ProvenanceRevoked,
+    ProvenanceSignatureError,
+    ProvenanceStatus,
+    ProvenanceVerifier,
+    RunProvenance,
+    SQLiteProvenanceStore,
+    digest_payload,
+)
+from .provenance_git import (
+    GitCommandResult,
+    GitExecutionContext,
+    ProvenanceGitError,
+    ProvenanceGitWriter,
+)
+from .provenance_operations import (
+    OperationContext,
+    OperationReceipt,
+    ProvenanceOperationGate,
+    build_provenance_writer_from_env,
+    context_from_environment,
+)
+
+__all__ = [
+    "AgentRecord",
+    "AuditEvent",
+    "ControlPlaneError",
+    "ControlPlaneService",
+    "DispatchRecord",
+    "Ed25519PrivateKeySigner",
+    "Ed25519PublicKeyVerifier",
+    "ExecutionEvidence",
+    "ExecutionOrchestrator",
+    "ExecutionPath",
+    "ExecutionTracker",
+    "GitCommandResult",
+    "GitExecutionContext",
+    "GitOperation",
+    "IdempotencyConflict",
+    "InMemoryControlPlaneStore",
+    "InvalidTransition",
+    "NotFound",
+    "OperationContext",
+    "OperationReceipt",
+    "OrchestrationError",
+    "PRODUCTION_POLICY_VERSION",
+    "PolicyDenied",
+    "ProvenanceAuthorization",
+    "ProvenanceControlledWriter",
+    "ProvenanceDenied",
+    "ProvenanceError",
+    "ProvenanceExpired",
+    "ProvenanceGitError",
+    "ProvenanceGitWriter",
+    "ProvenanceIssuer",
+    "ProvenanceNotFound",
+    "ProvenanceOperationGate",
+    "ProvenanceReplay",
+    "ProvenanceRevoked",
+    "ProvenanceSignatureError",
+    "ProvenanceStatus",
+    "ProvenanceVerifier",
+    "RequestContext",
+    "RevisionConflict",
+    "RunProvenance",
+    "SQLiteProvenanceStore",
+    "TaskRecord",
+    "TaskState",
+    "TenantIsolationError",
+    "TenantRecord",
+    "Unauthorized",
+    "build_provenance_writer_from_env",
+    "context_from_environment",
+    "digest_payload",
+]
@@ -0,0 +1,807 @@
+"""AIOS V2 production-candidate application entrypoint."""
+from __future__ import annotations
+
+import dataclasses
+import json
+import os
+import stat
+import urllib.parse
+from enum import Enum
+from http import HTTPStatus
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+from typing import Any, Mapping
+
+from aios_hermes import HermesAdapter, HermesJobState, HermesResult, SQLiteHermesStore
+from aios_openclaw import (
+    Ed25519CommandSigner,
+    HTTPRuntimeTransport,
+    OpenClawAdapter,
+)
+from aios_openclaw.callback import AuditCallbackSink, EventPublisher
+
+from .console import CONSOLE_HTML
+from .control_plane import AuditEvent, RequestContext, Unauthorized
+from .dispatch_store import SQLiteDispatchRepository
+from .execution_tracking import ExecutionEvidence, ExecutionTracker
+from .gateway import GatewayApplication, error_response
+from .gitops_status import collect_gitops_status
+from .orchestrator import ExecutionOrchestrator
+from .persistence import DurableControlPlaneService, SQLiteSnapshotRepository
+from .provenance_operations import build_provenance_writer_from_env
+
+
+def _json_value(value: Any) -> Any:
+    if dataclasses.is_dataclass(value):
+        return {
+            item.name: _json_value(getattr(value, item.name))
+            for item in dataclasses.fields(value)
+        }
+    if isinstance(value, Enum):
+        return value.value
+    if isinstance(value, Mapping):
+        return {str(key): _json_value(item) for key, item in value.items()}
+    if isinstance(value, (list, tuple, set, frozenset)):
+        return [_json_value(item) for item in value]
+    return value
+
+
+def _enabled(value: str | None) -> bool:
+    return str(value or "").strip().lower() in {"1", "true", "yes", "on"}
+
+
+def _header(headers: Mapping[str, str], name: str) -> str | None:
+    target = name.lower()
+    for key, value in headers.items():
+        if str(key).lower() == target:
+            normalized = str(value or "").strip()
+            return normalized or None
+    return None
+
+
+def _provenance_context(
+    headers: Mapping[str, str],
+    payload: Mapping[str, Any],
+) -> tuple[str | None, str | None]:
+    header_provenance = _header(headers, "X-AIOS-Provenance-ID")
+    header_run = _header(headers, "X-AIOS-Run-ID")
+    body_provenance = str(payload.get("provenance_id") or "").strip() or None
+    body_run = str(payload.get("run_id") or "").strip() or None
+    if header_provenance and body_provenance and header_provenance != body_provenance:
+        raise ValueError("provenance_id header/body mismatch")
+    if header_run and body_run and header_run != body_run:
+        raise ValueError("run_id header/body mismatch")
+    return header_provenance or body_provenance, header_run or body_run
+
+
+def _read_protected_file(path: Path, *, private: bool) -> bytes:
+    flags = os.O_RDONLY
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    descriptor = os.open(str(path), flags)
+    try:
+        metadata = os.fstat(descriptor)
+        if not stat.S_ISREG(metadata.st_mode):
+            raise RuntimeError("key reference is not a regular file")
+        denied = 0o077 if private else 0o022
+        if metadata.st_mode & denied:
+            raise RuntimeError(
+                "private key file permissions must be 0600 or stricter"
+                if private
+                else "public key file must not be group/world writable"
+            )
+        chunks: list[bytes] = []
+        while True:
+            chunk = os.read(descriptor, 65536)
+            if not chunk:
+                break
+            chunks.append(chunk)
+        value = b"".join(chunks)
+        if not value:
+            raise RuntimeError("key file is empty")
+        return value
+    finally:
+        os.close(descriptor)
+
+
+class FileCommandSignerResolver:
+    """Resolve tenant/key-id scoped OpenClaw Ed25519 signing material."""
+
+    def __init__(self, path: str | Path, *, configured_key_id: str) -> None:
+        self.path = Path(path).resolve()
+        self.configured_key_id = str(configured_key_id or "").strip()
+        if not self.configured_key_id:
+            raise ValueError("configured_key_id is required")
+
+    def __call__(self, tenant_id: str, key_id: str) -> Ed25519CommandSigner:
+        if not str(tenant_id or "").strip():
+            raise RuntimeError("tenant_id is required for command signing")
+        if key_id != self.configured_key_id:
+            raise RuntimeError("OpenClaw signing key_id mismatch")
+        return Ed25519CommandSigner.from_bytes(
+            _read_protected_file(self.path, private=True),
+            key_id=key_id,
+        )
+
+
+class ControlPlaneEventPublisher(EventPublisher):
+    """Append Runtime callback events to the tenant audit stream.
+
+    Callback audit remains informational. Authoritative task reconciliation is
+    performed only by the orchestrator after dispatch/result validation.
+    """
+
+    def __init__(self, service: DurableControlPlaneService) -> None:
+        self.service = service
+
+    def publish(self, event: Mapping[str, Any]) -> None:
+        tenant_id = str(event.get("tenant_id") or "").strip()
+        trace_id = str(event.get("trace_id") or "").strip()
+        command_id = str(event.get("command_id") or "").strip()
+        event_type = str(event.get("event_type") or "OPENCLAW_EVENT").strip()
+        if not tenant_id or not trace_id or not command_id:
+            raise ValueError("runtime audit event is missing tenant identity")
+        state_value = str(event.get("state") or "unknown").lower()
+        outcome = "allowed" if state_value == "completed" else state_value
+        runtime = str(event.get("runtime") or "openclaw").strip().lower()
+        principal_id = str(
+            event.get("principal_id") or f"{runtime}-runtime"
+        ).strip()
+        audit = AuditEvent(
+            event_id=f"runtime_{command_id}_{len(self.service.store.audit_events) + 1}",
+            tenant_id=tenant_id,
+            principal_id=principal_id,
+            trace_id=trace_id,
+            action=event_type,
+            resource_type=f"{runtime}_execution",
+            resource_id=command_id,
+            outcome=outcome,
+            policy_version="runtime-v2",
+            details=dict(event.get("details") or {}),
+        )
+        with self.service.store.lock:
+            self.service.store.audit_events.append(audit)
+            self.service.repository.save(self.service._snapshot())
+
+
+class CandidateApplication:
+    def __init__(
+        self,
+        gateway: GatewayApplication,
+        orchestrator: ExecutionOrchestrator,
+        tracker: ExecutionTracker,
+        hermes: HermesAdapter,
+        openclaw: OpenClawAdapter | None,
+        *,
+        hermes_lifecycle_api_enabled: bool = False,
+    ) -> None:
+        self.gateway = gateway
+        self.orchestrator = orchestrator
+        self.tracker = tracker
+        self.hermes = hermes
+        self.openclaw = openclaw
+        self.hermes_lifecycle_api_enabled = bool(hermes_lifecycle_api_enabled)
+        self.runtime_events = ControlPlaneEventPublisher(orchestrator.control_plane)
+
+    def context(self, headers: Mapping[str, str]) -> RequestContext:
+        return self.gateway.context_from_headers(headers)
+
+    @staticmethod
+    def _require_runtime_role(context: RequestContext) -> None:
+        if not ({"runtime", "platform_admin"} & set(context.roles)):
+            raise Unauthorized("runtime reconciliation role is required")
+
+    @staticmethod
+    def _require_control_plane_cancel(context: RequestContext) -> None:
+        required = {"runtime", "platform_admin"}
+        if not required.issubset(set(context.roles)):
+            raise Unauthorized(
+                "Hermes cancellation requires trusted AIOS control-plane authority"
+            )
+
+    @staticmethod
+    def _required_identity(payload: Mapping[str, Any], name: str) -> str:
+        value = str(payload.get(name) or "").strip()
+        if not value:
+            raise ValueError(f"{name} is required")
+        return value
+
+    def _record_hermes_lifecycle(
+        self,
+        context: RequestContext,
+        dispatch: Any,
+        job: Any,
+        *,
+        action: str,
+        worker_id: str | None,
+        provenance_id: str,
+        run_id: str,
+    ) -> None:
+        executor = worker_id or "aios-control-plane"
+        evidence = ExecutionEvidence(
+            execution_id=job.job_id,
+            tenant_id=job.tenant_id,
+            task_id=job.task_id,
+            agent_id=dispatch.agent_id,
+            executor=executor,
+            branch="runtime/hermes",
+            status=job.state.value.lower(),
+            progress_completed=0,
+            progress_total=3,
+            current_step=action,
+            provenance_id=provenance_id,
+            run_id=run_id,
+        )
+        current_evidence = self.tracker.claim(
+            evidence,
+            principal_id=context.principal_id,
+            provenance_id=provenance_id,
+            run_id=run_id,
+        )
+        if job.state in {
+            HermesJobState.COMPLETED,
+            HermesJobState.FAILED,
+            HermesJobState.CANCELLED,
+        }:
+            if current_evidence.completed_at is None:
+                self.tracker.complete(
+                    tenant_id=job.tenant_id,
+                    execution_id=job.job_id,
+                    status=job.state.value.lower(),
+                    test_status="runtime_terminal",
+                    test_summary={"lifecycle_action": action},
+                    result_summary={
+                        "state": job.state.value,
+                        "worker_id": worker_id,
+                        "dispatch_id": dispatch.dispatch_id,
+                    },
+                    principal_id=context.principal_id,
+                    provenance_id=provenance_id,
+                    run_id=run_id,
+                )
+        else:
+            self.tracker.heartbeat(
+                tenant_id=job.tenant_id,
+                execution_id=job.job_id,
+                status=job.state.value.lower(),
+                current_step=action,
+                progress_completed=(1 if job.state == HermesJobState.RUNNING else 0),
+                progress_total=3,
+                principal_id=context.principal_id,
+                provenance_id=provenance_id,
+                run_id=run_id,
+            )
+        self.runtime_events.publish(
+            {
+                "runtime": "hermes",
+                "tenant_id": job.tenant_id,
+                "principal_id": context.principal_id,
+                "trace_id": job.trace_id,
+                "command_id": job.job_id,
+                "event_type": f"HERMES_{action.upper()}",
+                "state": job.state.value,
+                "details": {
+                    "dispatch_id": dispatch.dispatch_id,
+                    "task_id": job.task_id,
+                    "worker_id": worker_id,
+                    "cell_id": job.cell_id,
+                    "profile_id": job.profile_id,
+                    "revision": job.revision,
+                    "provenance_id": provenance_id,
+                    "run_id": run_id,
+                },
+            }
+        )
+
+    def handle_json(
+        self,
+        method: str,
+        raw_path: str,
+        headers: Mapping[str, str],
+        body: Any,
+    ) -> tuple[int, Mapping[str, Any]]:
+        parsed = urllib.parse.urlparse(raw_path)
+        path = parsed.path.rstrip("/") or "/"
+        method = method.upper()
+
+        if method == "GET" and path == "/api/v2/gitops":
+            context = self.context(headers)
+            return HTTPStatus.OK, {
+                "tenant_id": context.tenant_id,
+                "gitops": collect_gitops_status().as_dict(),
+            }
+
+        if method == "GET" and path == "/api/v2/runtime":
+            context = self.context(headers)
+            runtimes: list[dict[str, Any]] = []
+            if self.openclaw is None:
+                runtimes.append(
+                    {
+                        "name": "openclaw",
+                        "status": "disabled",
+                        "details": {"reason": "runtime_not_configured"},
+                    }
+                )
+            else:
+                try:
+                    health = self.openclaw.health()
+                    runtimes.append(
+                        {
+                            "name": "openclaw",
+                            "status": health.status,
+                            "details": _json_value(health),
+                        }
+                    )
+                except Exception as exc:
+                    runtimes.append(
+                        {
+                            "name": "openclaw",
+                            "status": "unavailable",
+                            "details": {"message": str(exc)},
+                        }
+                    )
+            hermes_health = self.hermes.health()
+            runtimes.append(
+                {
+                    "name": "hermes",
+                    "status": hermes_health.status,
+                    "details": _json_value(hermes_health),
+                }
+            )
+            return HTTPStatus.OK, {
+                "tenant_id": context.tenant_id,
+                "runtimes": runtimes,
+            }
+
+        if method == "GET" and path == "/api/v2/executions":
+            context = self.context(headers)
+            return HTTPStatus.OK, {
+                "executions": _json_value(
+                    self.tracker.list(tenant_id=context.tenant_id)
+                )
+            }
+
+        dispatch_match = __import__("re").fullmatch(
+            r"/api/v2/tasks/([^/]+)/dispatch", path
+        )
+        if method == "POST" and dispatch_match:
+            context = self.context(headers)
+            task_id = urllib.parse.unquote(dispatch_match.group(1))
+            payload = body if isinstance(body, Mapping) else {}
+            timeout = payload.get("timeout_seconds")
+            provenance_id, run_id = _provenance_context(headers, payload)
+            record = self.orchestrator.dispatch(
+                context,
+                task_id=task_id,
+                timeout_seconds=float(timeout) if timeout is not None else None,
+                provenance_id=provenance_id,
+                run_id=run_id,
+            )
+            return HTTPStatus.ACCEPTED, {"dispatch": _json_value(record)}
+
+        lifecycle_match = __import__("re").fullmatch(
+            r"/api/v2/internal/runtime/hermes/lifecycle/"
+            r"(claim|start|heartbeat|complete|fail|cancel|status)",
+            path,
+        )
+        if method == "POST" and lifecycle_match:
+            if not self.hermes_lifecycle_api_enabled:
+                return HTTPStatus.NOT_FOUND, {
+                    "error": "not_found",
+                    "message": "route not found",
+                }
+            context = self.context(headers)
+            self._require_runtime_role(context)
+            if not isinstance(body, Mapping):
+                raise ValueError("JSON body must be an object")
+            payload = body
+            action = lifecycle_match.group(1)
+            identity = {
+                name: self._required_identity(payload, name)
+                for name in (
+                    "dispatch_id",
+                    "job_id",
+                    "tenant_id",
+                    "task_id",
+                    "trace_id",
+                    "principal_id",
+                    "provenance_id",
+                    "run_id",
+                    "cell_id",
+                    "profile_id",
+                )
+            }
+            header_provenance, header_run = _provenance_context(headers, payload)
+            if header_provenance != identity["provenance_id"]:
+                raise ValueError("provenance_id context mismatch")
+            if header_run != identity["run_id"]:
+                raise ValueError("run_id context mismatch")
+            requeued_job_ids = self.hermes.requeue_expired()
+            dispatch, job = self.orchestrator.hermes_lifecycle_context(
+                context,
+                dispatch_id=identity["dispatch_id"],
+                job_id=identity["job_id"],
+                tenant_id=identity["tenant_id"],
+                task_id=identity["task_id"],
+                trace_id=identity["trace_id"],
+                principal_id=identity["principal_id"],
+                provenance_id=identity["provenance_id"],
+                run_id=identity["run_id"],
+            )
+            if job.cell_id != identity["cell_id"]:
+                raise ValueError("cell_id mismatch")
+            if job.profile_id != identity["profile_id"]:
+                raise ValueError("profile_id mismatch")
+
+            if action == "status":
+                if job.job_id in requeued_job_ids:
+                    self._record_hermes_lifecycle(
+                        context,
+                        dispatch,
+                        job,
+                        action="lease_expired_requeue",
+                        worker_id=None,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                    )
+                task = self.orchestrator.control_plane.get_task(
+                    context, dispatch.task_id
+                )
+                response: dict[str, Any] = {
+                    "job": _json_value(job),
+                    "dispatch": _json_value(dispatch),
+                    "task": _json_value(task),
+                }
+                if job.state in {
+                    HermesJobState.COMPLETED,
+                    HermesJobState.FAILED,
+                    HermesJobState.CANCELLED,
+                }:
+                    response["result"] = _json_value(
+                        self.hermes.result(job.job_id, tenant_id=job.tenant_id)
+                    )
+                return HTTPStatus.OK, response
+
+            expected_revision = payload.get("expected_revision")
+            expected = (
+                int(expected_revision) if expected_revision is not None else None
+            )
+            if action == "cancel":
+                self._require_control_plane_cancel(context)
+                if payload.get("worker_id") is not None:
+                    raise Unauthorized("Hermes workers may observe but not initiate cancel")
+                if payload.get("cancellation_source") != "aios-control-plane":
+                    raise ValueError(
+                        "cancellation_source must be aios-control-plane"
+                    )
+                result = self.hermes.cancel(
+                    job.job_id,
+                    tenant_id=job.tenant_id,
+                    expected_revision=expected,
+                )
+            else:
+                worker_id = self._required_identity(payload, "worker_id")
+                if action == "claim":
+                    claimed = self.hermes.claim(
+                        tenant_id=job.tenant_id,
+                        cell_id=job.cell_id,
+                        profile_id=job.profile_id,
+                        worker_id=worker_id,
+                        lease_seconds=(
+                            int(payload["lease_seconds"])
+                            if payload.get("lease_seconds") is not None
+                            else None
+                        ),
+                        job_id=job.job_id,
+                    )
+                    if claimed is None:
+                        raise ValueError("Hermes job is not claimable")
+                    bound = self.orchestrator.bind_hermes_worker(
+                        context,
+                        claimed,
+                        dispatch_id=dispatch.dispatch_id,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                        worker_id=worker_id,
+                    )
+                    self._record_hermes_lifecycle(
+                        context,
+                        bound,
+                        claimed,
+                        action="claim",
+                        worker_id=worker_id,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                    )
+                    return HTTPStatus.OK, {
+                        "job": _json_value(claimed),
+                        "dispatch": _json_value(bound),
+                    }
+                if action == "start":
+                    started = self.hermes.start(
+                        job.job_id,
+                        tenant_id=job.tenant_id,
+                        worker_id=worker_id,
+                        expected_revision=expected,
+                    )
+                    self._record_hermes_lifecycle(
+                        context,
+                        dispatch,
+                        started,
+                        action="start",
+                        worker_id=worker_id,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                    )
+                    return HTTPStatus.OK, {"job": _json_value(started)}
+                if action == "heartbeat":
+                    heartbeat = self.hermes.heartbeat(
+                        job.job_id,
+                        tenant_id=job.tenant_id,
+                        worker_id=worker_id,
+                        lease_seconds=(
+                            int(payload["lease_seconds"])
+                            if payload.get("lease_seconds") is not None
+                            else None
+                        ),
+                    )
+                    self._record_hermes_lifecycle(
+                        context,
+                        dispatch,
+                        heartbeat,
+                        action="heartbeat",
+                        worker_id=worker_id,
+                        provenance_id=identity["provenance_id"],
+                        run_id=identity["run_id"],
+                    )
+                    return HTTPStatus.OK, {"job": _json_value(heartbeat)}
+                if action == "complete":
+                    output = payload.get("output")
+                    if not isinstance(output, Mapping):
+                        raise ValueError("output must be an object")
+                    result = self.hermes.complete(
+                        job.job_id,
+                        tenant_id=job.tenant_id,
+                        worker_id=worker_id,
+                        output=output,
+                        expected_revision=expected,
+                    )
+                elif action == "fail":
+                    error = payload.get("error")
+                    if not isinstance(error, Mapping):
+                        raise ValueError("error must be an object")
+                    result = self.hermes.fail(
+                        job.job_id,
+                        tenant_id=job.tenant_id,
+                        worker_id=worker_id,
+                        error=error,
+                        expected_revision=expected,
+                    )
+                else:
+                    raise ValueError("unsupported Hermes lifecycle action")
+
+            task = self.orchestrator.reconcile_hermes(
+                context,
+                result,
+                dispatch_id=dispatch.dispatch_id,
+                provenance_id=identity["provenance_id"],
+                run_id=identity["run_id"],
+            )
+            updated_dispatch = self.orchestrator.dispatch_repository.get(
+                dispatch.dispatch_id, tenant_id=dispatch.tenant_id
+            )
+            terminal_job = self.hermes.get(job.job_id, tenant_id=job.tenant_id)
+            self._record_hermes_lifecycle(
+                context,
+                updated_dispatch,
+                terminal_job,
+                action=action,
+                worker_id=result.worker_id,
+                provenance_id=identity["provenance_id"],
+                run_id=identity["run_id"],
+            )
+            return HTTPStatus.OK, {
+                "result": _json_value(result),
+                "task": _json_value(task),
+                "dispatch": _json_value(updated_dispatch),
+            }
+
+        if method == "POST" and path == "/api/v2/internal/runtime/hermes/reconcile":
+            context = self.context(headers)
+            self._require_runtime_role(context)
+            if not isinstance(body, Mapping):
+                raise ValueError("JSON body must be an object")
+            provenance_id, run_id = _provenance_context(headers, body)
+            if not provenance_id or not run_id:
+                raise ValueError("provenance_id and run_id are required")
+            dispatch_id = str(body.get("dispatch_id") or "").strip()
+            if not dispatch_id:
+                raise ValueError("dispatch_id is required")
+            result = HermesResult(
+                job_id=str(body["job_id"]),
+                tenant_id=str(body["tenant_id"]),
+                task_id=str(body["task_id"]),
+                trace_id=str(body["trace_id"]),
+                state=HermesJobState(str(body["state"])),
+                worker_id=(
+                    str(body["worker_id"])
+                    if body.get("worker_id") is not None
+                    else None
+                ),
+                output=body.get("output"),
+                error=body.get("error"),
+                started_at=body.get("started_at"),
+                finished_at=body.get("finished_at"),
+            )
+            task = self.orchestrator.reconcile_hermes(
+                context,
+                result,
+                dispatch_id=dispatch_id,
+                provenance_id=provenance_id,
+                run_id=run_id,
+            )
+            return HTTPStatus.OK, {"task": _json_value(task)}
+
+        if method == "POST" and path == "/api/v2/hermes/results/reconcile":
+            return HTTPStatus.GONE, {
+                "error": "RuntimeReconcileEndpointMoved",
+                "message": "use /api/v2/internal/runtime/hermes/reconcile",
+            }
+
+        return self.gateway.handle(method, raw_path, headers, body)
+
+
+class CandidateRequestHandler(BaseHTTPRequestHandler):
+    server_version = "AIOSV2Candidate/2.0"
+    max_body_bytes = 1_048_576
+
+    @property
+    def application(self) -> CandidateApplication:
+        return self.server.application  # type: ignore[attr-defined]
+
+    def _read_body(self) -> Any:
+        length = int(self.headers.get("Content-Length", "0") or "0")
+        if length < 0 or length > self.max_body_bytes:
+            raise ValueError("request body is too large")
+        if length == 0:
+            return {}
+        content_type = self.headers.get("Content-Type", "").split(";", 1)[0].strip()
+        if content_type != "application/json":
+            raise ValueError("Content-Type must be application/json")
+        return json.loads(self.rfile.read(length).decode("utf-8"))
+
+    def _security_headers(self) -> None:
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("X-Content-Type-Options", "nosniff")
+        self.send_header("X-Frame-Options", "DENY")
+        self.send_header("Referrer-Policy", "no-referrer")
+        self.send_header(
+            "Content-Security-Policy",
+            "default-src 'self'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'",
+        )
+
+    def _send_json(self, status_code: int, payload: Mapping[str, Any]) -> None:
+        encoded = json.dumps(
+            _json_value(payload), ensure_ascii=False, separators=(",", ":")
+        ).encode("utf-8")
+        self.send_response(int(status_code))
+        self.send_header("Content-Type", "application/json; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self._security_headers()
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def _send_console(self) -> None:
+        encoded = CONSOLE_HTML.encode("utf-8")
+        self.send_response(HTTPStatus.OK)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.send_header("Content-Length", str(len(encoded)))
+        self._security_headers()
+        self.end_headers()
+        self.wfile.write(encoded)
+
+    def _dispatch(self, method: str) -> None:
+        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
+        if method == "GET" and path in {"/", "/console"}:
+            self._send_console()
+            return
+        try:
+            body = self._read_body() if method == "POST" else {}
+            status_code, payload = self.application.handle_json(
+                method,
+                self.path,
+                {key: value for key, value in self.headers.items()},
+                body,
+            )
+        except Exception as exc:
+            status_code, payload = error_response(exc)
+        self._send_json(status_code, payload)
+
+    def do_GET(self) -> None:  # noqa: N802
+        self._dispatch("GET")
+
+    def do_POST(self) -> None:  # noqa: N802
+        self._dispatch("POST")
+
+
+class CandidateHTTPServer(ThreadingHTTPServer):
+    daemon_threads = True
+    allow_reuse_address = True
+
+    def __init__(self, address: tuple[str, int], application: CandidateApplication) -> None:
+        self.application = application
+        super().__init__(address, CandidateRequestHandler)
+
+
+def build_application() -> CandidateApplication:
+    state_dir = Path(os.getenv("AIOS_V2_STATE_DIR", "/var/lib/aios-v2")).resolve()
+    state_dir.mkdir(parents=True, exist_ok=True)
+    repository = SQLiteSnapshotRepository(state_dir / "control-plane.sqlite3")
+    dispatch_repository = SQLiteDispatchRepository(state_dir / "dispatches.sqlite3")
+    service = DurableControlPlaneService(repository)
+    require_provenance = _enabled(os.getenv("AIOS_REQUIRE_RUN_PROVENANCE", "0"))
+    provenance_writer = build_provenance_writer_from_env(
+        state_dir=state_dir, required=require_provenance
+    )
+    tracker = ExecutionTracker(
+        state_dir / "executions",
+        provenance_writer=provenance_writer,
+        require_provenance=require_provenance,
+    )
+    hermes = HermesAdapter(store=SQLiteHermesStore(state_dir / "hermes.sqlite3"))
+
+    openclaw_url = os.getenv("AIOS_OPENCLAW_URL", "").strip()
+    signing_file = os.getenv("AIOS_OPENCLAW_SIGNING_MATERIAL_FILE", "").strip()
+    signing_key_id = os.getenv(
+        "AIOS_OPENCLAW_SIGNING_KEY_ID", "openclaw-v2r1-candidate-ed25519"
+    ).strip()
+    openclaw = None
+    resolver = None
+    if openclaw_url and signing_file:
+        resolver = FileCommandSignerResolver(
+            signing_file,
+            configured_key_id=signing_key_id,
+        )
+        transport = HTTPRuntimeTransport(
+            openclaw_url,
+            credential_ref=os.getenv("AIOS_OPENCLAW_CREDENTIAL_REF") or None,
+        )
+        openclaw = OpenClawAdapter(
+            transport,
+            resolver,
+            callback_sink=AuditCallbackSink(ControlPlaneEventPublisher(service)),
+        )
+
+    gateway = GatewayApplication(service)
+    orchestrator = ExecutionOrchestrator(
+        service,
+        openclaw=openclaw,
+        hermes=hermes,
+        openclaw_signing_material_resolver=resolver,
+        openclaw_key_id=signing_key_id,
+        provenance_writer=provenance_writer,
+        require_provenance=require_provenance,
+        dispatch_repository=dispatch_repository,
+    )
+    return CandidateApplication(
+        gateway,
+        orchestrator,
+        tracker,
+        hermes,
+        openclaw,
+        hermes_lifecycle_api_enabled=_enabled(
+            os.getenv("AIOS_HERMES_LIFECYCLE_API_ENABLED", "0")
+        ),
+    )
+
+
+def main() -> None:
+    host = os.getenv("AIOS_V2_HOST", "127.0.0.1")
+    port = int(os.getenv("AIOS_V2_PORT", "18920"))
+    server = CandidateHTTPServer((host, port), build_application())
+    print(f"AIOS V2 candidate listening on {host}:{port}")
+    server.serve_forever()
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,83 @@
+"""Dependency-free, role-aware AIOS unified portal.
+
+The browser receives only server-authorized capabilities and tenant-scoped data.
+It never selects a tenant, signs Provenance, mutates Git tags, or calls Runtime
+services directly.
+"""
+
+CONSOLE_HTML = r'''<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <meta name="referrer" content="no-referrer">
+  <title>AIOS Unified Portal</title>
+  <style>
+    :root{font-family:Inter,"PingFang SC","Microsoft YaHei",ui-sans-serif,system-ui,sans-serif;color:#172033;background:#eef2f7;--nav:#0f172a;--card:#fff;--line:#dfe6ef;--muted:#667085;--blue:#2563eb;--green:#047857;--red:#b42318;--amber:#b54708}
+    *{box-sizing:border-box}body{margin:0;min-height:100vh}button,input,textarea,select{font:inherit}
+    .shell{display:grid;grid-template-columns:250px minmax(0,1fr);min-height:100vh}.sidebar{background:var(--nav);color:#e2e8f0;padding:22px 16px;position:sticky;top:0;height:100vh;overflow:auto}.brand{font-weight:800;font-size:20px;letter-spacing:.2px}.version{font-size:12px;color:#94a3b8;margin:5px 0 22px}.identity{padding:12px;background:#182338;border:1px solid #2b3950;border-radius:12px;margin-bottom:18px}.identity strong{display:block;color:#fff}.identity span{font-size:12px;color:#aebbd0;display:block;margin-top:3px;overflow-wrap:anywhere}.nav button{width:100%;display:flex;gap:10px;align-items:center;border:0;background:transparent;color:#cbd5e1;padding:11px 12px;border-radius:9px;text-align:left;cursor:pointer;margin:2px 0}.nav button:hover,.nav button.active{background:#24324b;color:#fff}.nav .dot{width:8px;height:8px;border-radius:50%;background:#60a5fa}.main{min-width:0}.topbar{height:70px;background:#fff;border-bottom:1px solid var(--line);display:flex;align-items:center;justify-content:space-between;padding:0 26px;position:sticky;top:0;z-index:4}.topbar h1{font-size:19px;margin:0}.top-actions{display:flex;align-items:center;gap:10px}.timestamp{font-size:12px;color:var(--muted)}.content{padding:24px;max-width:1680px;margin:auto}.notice{background:#eff6ff;border:1px solid #bfdbfe;border-radius:12px;padding:12px 14px;color:#1e3a8a;font-size:13px;margin-bottom:18px}.error{background:#fef3f2;border:1px solid #fecdca;color:var(--red);border-radius:10px;padding:10px 12px;white-space:pre-wrap;margin-bottom:14px;display:none}.cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(170px,1fr));gap:14px;margin-bottom:18px}.card,.panel{background:var(--card);border:1px solid var(--line);border-radius:14px;box-shadow:0 1px 3px rgba(16,24,40,.05)}.card{padding:16px}.card small{color:var(--muted);font-weight:600}.card b{display:block;font-size:28px;margin-top:7px}.panel{padding:17px;margin-bottom:16px;overflow:auto}.panel h2{font-size:16px;margin:0}.panel-head{display:flex;align-items:center;justify-content:space-between;gap:12px;margin-bottom:13px}.grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(410px,1fr));gap:16px}.wide{grid-column:1/-1}.muted{color:var(--muted)}.good{color:var(--green);font-weight:700}.bad{color:var(--red);font-weight:700}.warn{color:var(--amber);font-weight:700}.pill{display:inline-block;border:1px solid #cbd5e1;border-radius:999px;padding:3px 8px;font-size:11px;margin:2px;background:#f8fafc}.pill.good{background:#ecfdf3;border-color:#a6f4c5}.pill.bad{background:#fef3f2;border-color:#fecdca}.toolbar{display:flex;gap:8px;align-items:center;flex-wrap:wrap}.btn{border:0;border-radius:9px;padding:9px 12px;background:var(--blue);color:#fff;cursor:pointer;font-weight:650}.btn.secondary{background:#fff;color:#344054;border:1px solid #d0d5dd}.btn.danger{background:#d92d20}.btn:disabled{opacity:.45;cursor:not-allowed}.icon-btn{padding:7px 10px}.view{display:none}.view.active{display:block}table{width:100%;border-collapse:collapse;font-size:12px}th,td{text-align:left;padding:9px 8px;border-bottom:1px solid #edf0f4;vertical-align:top}th{color:#667085;font-weight:700;white-space:nowrap}td{overflow-wrap:anywhere}.empty{padding:24px;text-align:center;color:var(--muted)}.timeline{border-left:2px solid #dbe4f0;margin-left:8px;padding-left:20px}.event{position:relative;padding:0 0 17px}.event:before{content:"";position:absolute;left:-27px;top:4px;width:11px;height:11px;border-radius:50%;background:#3b82f6;border:3px solid #fff;box-shadow:0 0 0 1px #93c5fd}.event strong{font-size:13px}.event p{margin:4px 0;color:var(--muted);font-size:12px}.chain{display:flex;align-items:stretch;gap:7px;overflow:auto;padding:5px 0}.chain-item{min-width:135px;border:1px solid var(--line);border-radius:10px;padding:10px;background:#f8fafc}.chain-arrow{display:flex;align-items:center;color:#94a3b8}.form-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(230px,1fr));gap:12px}.field label{font-size:12px;color:#475467;font-weight:650;display:block;margin-bottom:5px}.field input,.field textarea,.field select{width:100%;border:1px solid #d0d5dd;border-radius:9px;padding:9px;background:#fff}.field textarea{min-height:90px;resize:vertical}.dialog{border:0;border-radius:14px;padding:0;max-width:650px;width:calc(100% - 32px);box-shadow:0 20px 60px rgba(15,23,42,.28)}.dialog::backdrop{background:rgba(15,23,42,.6)}.dialog-head{padding:16px 18px;border-bottom:1px solid var(--line);font-weight:750}.dialog-body{padding:18px}.dialog-actions{padding:14px 18px;border-top:1px solid var(--line);display:flex;justify-content:flex-end;gap:8px}.kv{display:grid;grid-template-columns:150px minmax(0,1fr);gap:6px 12px;font-size:12px}.kv div:nth-child(odd){color:var(--muted)}pre{white-space:pre-wrap;word-break:break-word;font-size:11px;background:#0f172a;color:#dbeafe;border-radius:10px;padding:12px;max-height:300px;overflow:auto}
+    @media(max-width:900px){.shell{grid-template-columns:1fr}.sidebar{height:auto;position:static}.nav{display:flex;overflow:auto}.nav button{min-width:max-content}.topbar{position:static}.grid{grid-template-columns:1fr}.content{padding:16px}}
+  </style>
+</head>
+<body>
+<div class="shell">
+  <aside class="sidebar">
+    <div class="brand">AIOS Unified Portal</div><div class="version">V2R1C1 · Role-aware Control Plane</div>
+    <div class="identity"><strong id="principal">加载身份…</strong><span id="tenant"></span><span id="roles"></span></div>
+    <nav id="navigation" class="nav"></nav>
+  </aside>
+  <section class="main">
+    <header class="topbar"><h1 id="pageTitle">系统总览</h1><div class="top-actions"><span id="updated" class="timestamp">尚未加载</span><button class="btn secondary icon-btn" id="refresh">刷新</button></div></header>
+    <main class="content">
+      <div class="notice">身份、租户和角色由可信反向代理注入。门户只调用 AIOS Control Plane；Provenance 签发、Tag、生产部署与 Runtime 权威状态仍由受控流程执行。</div>
+      <div id="error" class="error"></div>
+      <section id="overview" class="view active"></section>
+      <section id="tasks" class="view"></section>
+      <section id="authorization" class="view"></section>
+      <section id="runtime" class="view"></section>
+      <section id="evidence" class="view"></section>
+      <section id="audit" class="view"></section>
+      <section id="release" class="view"></section>
+    </main>
+  </section>
+</div>
+<dialog id="taskDialog" class="dialog">
+  <div class="dialog-head">创建任务</div><form id="taskForm"><div class="dialog-body form-grid">
+    <div class="field"><label>Agent ID</label><input name="agent_id" required></div>
+    <div class="field"><label>Action</label><input name="action" required></div>
+    <div class="field"><label>Idempotency Key</label><input name="idempotency_key" required></div>
+    <div class="field wide"><label>Payload JSON</label><textarea name="payload">{}</textarea></div>
+  </div><div class="dialog-actions"><button type="button" class="btn secondary" data-close="taskDialog">取消</button><button class="btn">创建</button></div></form>
+</dialog>
+<dialog id="confirmDialog" class="dialog"><div class="dialog-head" id="confirmTitle">确认操作</div><form id="confirmForm"><div class="dialog-body"><p id="confirmText"></p><div class="field"><label>原因</label><textarea id="confirmReason" required></textarea></div></div><div class="dialog-actions"><button type="button" class="btn secondary" data-close="confirmDialog">取消</button><button class="btn danger">确认</button></div></form></dialog>
+<script>
+const $=s=>document.querySelector(s), esc=v=>String(v??'').replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+const state={identity:null,current:'overview',cache:{},confirm:null};
+const labels={overview:'系统总览',tasks:'任务中心',authorization:'授权中心',runtime:'运行与运维',evidence:'执行证据',audit:'审计中心',release:'GitOps 与发布'};
+function has(c){return !!state.identity?.capabilities?.includes(c)}
+async function api(path,options={}){const r=await fetch(path,{credentials:'same-origin',headers:{'Accept':'application/json','Content-Type':'application/json',...(options.headers||{})},...options});const d=await r.json().catch(()=>({}));if(!r.ok)throw new Error(`${r.status} ${d.message||d.error||path}`);return d}
+function err(e){const el=$('#error');el.textContent=e?.message||String(e);el.style.display='block'}function clearErr(){$('#error').style.display='none';$('#error').textContent=''}
+function pill(v){const s=String(v??'unknown'),c=/complete|pass|healthy|active|synced|approved|used/i.test(s)?'good':/fail|deny|reject|revoke|expire|cancel|unavailable/i.test(s)?'bad':'';return `<span class="pill ${c}">${esc(s)}</span>`}
+function table(cols,rows){if(!rows?.length)return '<div class="empty">暂无数据</div>';return `<table><thead><tr>${cols.map(x=>`<th>${esc(x[0])}</th>`).join('')}</tr></thead><tbody>${rows.map(r=>`<tr>${cols.map(x=>`<td>${x[1](r)}</td>`).join('')}</tr>`).join('')}</tbody></table>`}
+function card(label,value,detail=''){return `<div class="card"><small>${esc(label)}</small><b>${esc(value)}</b>${detail?`<span class="muted">${esc(detail)}</span>`:''}</div>`}
+function json(v){return `<pre>${esc(JSON.stringify(v,null,2))}</pre>`}
+function show(view){state.current=view;document.querySelectorAll('.view').forEach(x=>x.classList.toggle('active',x.id===view));document.querySelectorAll('.nav button').forEach(x=>x.classList.toggle('active',x.dataset.view===view));$('#pageTitle').textContent=labels[view]||view;load(view)}
+function navigation(){const nav=$('#navigation');nav.innerHTML=(state.identity.navigation||[]).map(x=>`<button data-view="${esc(x.id)}"><span class="dot"></span>${esc(x.label)}</button>`).join('');nav.querySelectorAll('button').forEach(b=>b.onclick=()=>show(b.dataset.view));}
+async function identity(){state.identity=await api('/api/v2/me/capabilities');$('#principal').textContent=state.identity.principal_id;$('#tenant').textContent=`租户：${state.identity.tenant_id}`;$('#roles').textContent=`角色：${state.identity.roles.join(', ')||'无'}`;navigation();if(!state.identity.navigation.some(x=>x.id===state.current))state.current=state.identity.navigation[0]?.id||'overview';show(state.current)}
+async function load(view){clearErr();try{if(view==='overview')await overview();if(view==='tasks')await tasks();if(view==='authorization')await authorizations();if(view==='runtime')await runtime();if(view==='evidence')await evidence();if(view==='audit')await audit();if(view==='release')await release();$('#updated').textContent=`更新于 ${new Date().toLocaleString()}`}catch(e){err(e)}}
+async function overview(){const d=await api('/api/v2/portal/overview');state.cache.overview=d;const s=d.summary||{},rt=d.sections?.runtime?.runtimes||[],rel=d.sections?.release||{};$('#overview').innerHTML=`<div class="cards">${card('任务',s.tasks||0)}${card('活动 Dispatch',s.active_dispatches||0,`总数 ${s.dispatches||0}`)}${card('执行证据',s.evidence||0)}${card('审计事件',s.audit_events||0)}${card('当前版本',rel.version||'—',rel.status||'')}${card('授权 Grant',d.sections?.authorization?.active_grants||0,`总数 ${d.sections?.authorization?.grants||0}`)}</div><div class="grid"><div class="panel"><div class="panel-head"><h2>Runtime 健康</h2></div>${table([['Runtime',x=>esc(x.name)],['状态',x=>pill(x.status)],['版本/详情',x=>esc(x.details?.version||x.details?.runtime_id||'—')]],rt)}</div><div class="panel"><div class="panel-head"><h2>任务状态</h2></div>${table([['状态',x=>pill(x[0])],['数量',x=>esc(x[1])]],Object.entries(s.task_states||{}))}</div><div class="panel wide"><div class="panel-head"><h2>最近任务</h2></div>${table([['任务',x=>esc(x.task_id)],['Agent',x=>esc(x.agent_id)],['动作',x=>esc(x.action)],['状态',x=>pill(x.state)],['更新时间',x=>esc(x.updated_at)]],d.recent?.tasks||[])}</div></div>`}
+async function tasks(){const d=await api('/api/v2/portal/tasks');state.cache.tasks=d.items||[];const create=has('task.create')?'<button class="btn" id="newTask">创建任务</button>':'';$('#tasks').innerHTML=`<div class="panel"><div class="panel-head"><h2>任务全链路</h2><div class="toolbar">${create}</div></div>${(d.items||[]).map(taskBlock).join('')||'<div class="empty">暂无任务</div>'}</div>`;$('#newTask')?.addEventListener('click',()=>$('#taskDialog').showModal());document.querySelectorAll('[data-task-action]').forEach(b=>b.onclick=()=>taskAction(b.dataset.taskId,b.dataset.taskAction,b.dataset.revision))}
+function taskBlock(x){const t=x.task||{},d=x.dispatch,e=x.evidence||[],a=x.audit||[],actions=(x.available_actions||[]).map(v=>`<button class="btn ${v==='cancel'?'danger':'secondary'}" data-task-action="${v}" data-task-id="${esc(t.task_id)}" data-revision="${esc(t.revision)}">${{approve:'审批',cancel:'取消',dispatch:'调度'}[v]||v}</button>`).join('');return `<div class="panel" style="background:#fbfcfe"><div class="panel-head"><h2>${esc(t.task_id)} · ${esc(t.action)}</h2><div class="toolbar">${pill(t.state)}${actions}</div></div><div class="chain"><div class="chain-item"><b>Task</b><div>${esc(t.agent_id)}</div><small>${esc(t.created_by)}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Approval</b><div>${esc(t.approved_by||'待审批')}</div><small>revision ${esc(t.revision)}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Provenance</b><div>${esc(d?.provenance_id||'未调度')}</div><small>${esc(d?.authorization_id||'')}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Dispatch</b><div>${esc(d?.dispatch_id||'—')}</div><small>${pill(d?.state||'not_created')}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Runtime</b><div>${esc(d?.runtime||'—')}</div><small>${esc(d?.runtime_execution_id||'')}</small></div><span class="chain-arrow">→</span><div class="chain-item"><b>Evidence</b><div>${e.length} 条</div><small>Audit ${a.length} 条</small></div></div></div>`}
+async function taskAction(id,action,revision){clearErr();try{let body={expected_revision:Number(revision)};if(action==='dispatch'){body={};const p=prompt('Provenance ID（生产调度必填）','');const r=prompt('Run ID（生产调度必填）','');if(p)body.provenance_id=p;if(r)body.run_id=r}await api(`/api/v2/portal/tasks/${encodeURIComponent(id)}/${action}`,{method:'POST',body:JSON.stringify(body)});await tasks()}catch(e){err(e)}}
+async function authorizations(){const d=await api('/api/v2/portal/authorizations');state.cache.authorization=d;const workflows=(d.workflows||[]),grants=(d.grants||[]);$('#authorization').innerHTML=`<div class="cards">${card('Workflow',d.summary?.workflows||0)}${card('Grant',d.summary?.grants||0)}${card('有效 Grant',d.summary?.active_grants||0)}${card('已撤销',d.summary?.revoked_grants||0)}</div><div class="panel"><div class="panel-head"><h2>Workflow Provenance</h2></div>${table([['ID',x=>esc(x.provenance_id)],['Run / Task',x=>`${esc(x.run_id)}<br>${esc(x.task_id)}`],['Principal / Agent',x=>`${esc(x.principal_id)}<br>${esc(x.agent_id)}`],['状态',x=>pill(x.status)],['有效期',x=>esc(x.expires_at)],['使用',x=>esc(x.usage_count)],['操作',x=>has('provenance.revoke')&&x.status!=='revoked'?`<button class="btn danger" data-revoke-workflow="${esc(x.provenance_id)}">撤销</button>`:'—']],workflows)}</div><div class="panel"><div class="panel-head"><h2>Child Grants</h2></div>${table([['Grant',x=>esc(x.grant_id)],['类型 / Scope',x=>`${esc(x.grant_type)}<br>${esc(x.execution_path)}`],['Git 操作',x=>esc((x.allowed_git_operations||[]).join(', ')||'—')],['状态',x=>pill(x.status)],['有效期',x=>esc(x.expires_at)],['使用',x=>esc(x.usage_count)],['操作',x=>has('provenance.revoke')&&x.status!=='revoked'?`<button class="btn danger" data-revoke-grant="${esc(x.grant_id)}">撤销</button>`:'—']],grants)}</div>`;document.querySelectorAll('[data-revoke-workflow]').forEach(b=>b.onclick=()=>confirmOp('撤销 Workflow',`撤销 ${b.dataset.revokeWorkflow} 将使所有子 Grant 失效。`,reason=>api(`/api/v2/portal/provenance/${encodeURIComponent(b.dataset.revokeWorkflow)}/revoke`,{method:'POST',body:JSON.stringify({reason})}).then(authorizations)));document.querySelectorAll('[data-revoke-grant]').forEach(b=>b.onclick=()=>confirmOp('撤销 Grant',`撤销 ${b.dataset.revokeGrant}。`,reason=>api(`/api/v2/portal/grants/${encodeURIComponent(b.dataset.revokeGrant)}/revoke`,{method:'POST',body:JSON.stringify({reason})}).then(authorizations)))}
+async function runtime(){const d=await api('/api/v2/portal/runtime');const runtimes=d.runtimes||[],dispatches=d.dispatches||[],jobs=d.hermes_jobs||[];$('#runtime').innerHTML=`<div class="grid"><div class="panel"><div class="panel-head"><h2>Runtime</h2></div>${table([['名称',x=>esc(x.name)],['状态',x=>pill(x.status)],['详情',x=>esc(JSON.stringify(x.details||{}))]],runtimes)}</div><div class="panel"><div class="panel-head"><h2>Hermes Queue / Lease</h2></div>${table([['Job',x=>esc(x.job_id)],['Cell / Profile',x=>`${esc(x.cell_id)} / ${esc(x.profile_id)}`],['Worker',x=>esc(x.assigned_worker_id||'—')],['状态',x=>pill(x.state)],['Lease',x=>esc(x.lease_expires_at||'—')]],jobs)}</div><div class="panel wide"><div class="panel-head"><h2>Dispatch</h2></div>${table([['Dispatch',x=>esc(x.dispatch_id)],['Task',x=>esc(x.task_id)],['Runtime',x=>esc(x.runtime)],['执行 ID',x=>esc(x.runtime_execution_id)],['Principal',x=>esc(x.principal_id)],['状态',x=>pill(x.state)]],dispatches)}</div></div>`}
+async function evidence(){const d=await api('/api/v2/portal/evidence');$('#evidence').innerHTML=`<div class="panel"><div class="panel-head"><h2>Execution Evidence</h2></div>${table([['Execution',x=>esc(x.execution_id)],['Task / Agent',x=>`${esc(x.task_id)}<br>${esc(x.agent_id)}`],['Executor',x=>esc(x.executor)],['状态',x=>pill(x.status)],['进度',x=>`${esc(x.progress_completed)}/${esc(x.progress_total)}`],['Test',x=>pill(x.test_status)],['Commit',x=>esc(x.last_commit||'—')],['授权',x=>esc(x.last_authorization_id||'—')]],d.executions||[])}</div>`}
+async function audit(){const d=await api('/api/v2/portal/audit');const events=(d.events||[]).slice().reverse();$('#audit').innerHTML=`<div class="panel"><div class="panel-head"><h2>统一审计时间线</h2></div><div class="timeline">${events.map(x=>`<div class="event"><strong>${esc(x.action)} · ${pill(x.outcome)}</strong><p>${esc(x.created_at)} · ${esc(x.principal_id)} · ${esc(x.resource_type)}/${esc(x.resource_id)}</p><div class="muted">Trace ${esc(x.trace_id)} · Policy ${esc(x.policy_version)}</div></div>`).join('')||'<div class="empty">暂无审计事件</div>'}</div></div>`}
+async function release(){const d=await api('/api/v2/portal/release');const g=d.gitops||{};$('#release').innerHTML=`<div class="cards">${card('版本',d.version||'—')}${card('Baseline',d.baseline||'—')}${card('发布状态',d.status||'—')}${card('Git 同步',g.sync_status||'unknown')}</div><div class="grid"><div class="panel"><div class="panel-head"><h2>当前 Release</h2></div><div class="kv"><div>Release OID</div><div>${esc(d.release_oid)}</div><div>Branch</div><div>${esc(g.workspace_branch||g.branch||'—')}</div><div>Workspace</div><div>${pill(g.workspace_clean===true?'clean':g.workspace_clean===false?'dirty':'unknown')}</div><div>Local Sync</div><div>${pill(g.local_sync||'unknown')}</div><div>Gitea Sync</div><div>${pill(g.gitea_sync||'unknown')}</div></div></div><div class="panel"><div class="panel-head"><h2>治理操作</h2></div><p class="muted">门户不直接移动 Tag、合并主线或部署生产。以下仅为可发起的 GitOps 请求目录。</p>${(d.operations||[]).map(x=>pill(x)).join('')||'<span class="muted">当前角色只读</span>'}</div><div class="panel wide"><div class="panel-head"><h2>原始 GitOps 状态</h2></div>${json(g)}</div></div>`}
+function confirmOp(title,text,fn){state.confirm=fn;$('#confirmTitle').textContent=title;$('#confirmText').textContent=text;$('#confirmReason').value='';$('#confirmDialog').showModal()}
+$('#taskForm').onsubmit=async e=>{e.preventDefault();clearErr();try{const fd=new FormData(e.target),payload=JSON.parse(fd.get('payload')||'{}');await api('/api/v2/portal/tasks',{method:'POST',body:JSON.stringify({agent_id:fd.get('agent_id'),action:fd.get('action'),idempotency_key:fd.get('idempotency_key'),payload})});$('#taskDialog').close();e.target.reset();await tasks()}catch(e){err(e)}};
+$('#confirmForm').onsubmit=async e=>{e.preventDefault();const fn=state.confirm;$('#confirmDialog').close();state.confirm=null;try{await fn?.($('#confirmReason').value)}catch(e){err(e)}};
+document.querySelectorAll('[data-close]').forEach(b=>b.onclick=()=>document.getElementById(b.dataset.close).close());$('#refresh').onclick=()=>load(state.current);
+identity().catch(err);setInterval(()=>load(state.current),30000);
+</script>
+</body></html>'''
@@ -0,0 +1,627 @@
+"""Tenant-isolated AIOS V2 control-plane domain service.
+
+This module deliberately contains no OpenClaw or Hermes implementation details.
+It owns authoritative tenant, agent, task-lifecycle, idempotency and audit state.
+Runtime adapters consume approved tasks through a separate boundary.
+"""
+from __future__ import annotations
+
+import copy
+import hashlib
+import json
+import threading
+import uuid
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from enum import Enum
+from typing import Any, Callable, Iterable, Mapping
+
+
+def _utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _new_id(prefix: str) -> str:
+    return f"{prefix}_{uuid.uuid4().hex}"
+
+
+def _canonical_digest(value: Mapping[str, Any]) -> str:
+    encoded = json.dumps(
+        value,
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+        default=str,
+    ).encode("utf-8")
+    return hashlib.sha256(encoded).hexdigest()
+
+
+class ControlPlaneError(RuntimeError):
+    """Base error returned by the control-plane domain."""
+
+
+class Unauthorized(ControlPlaneError):
+    """The caller is not authenticated or lacks the required role."""
+
+
+class TenantIsolationError(ControlPlaneError):
+    """A request attempted to cross a tenant boundary."""
+
+
+class NotFound(ControlPlaneError):
+    """A tenant-scoped resource does not exist or is not visible."""
+
+
+class InvalidTransition(ControlPlaneError):
+    """A task state transition violates the lifecycle contract."""
+
+
+class IdempotencyConflict(ControlPlaneError):
+    """An idempotency key was reused for a different command."""
+
+
+class RevisionConflict(ControlPlaneError):
+    """Optimistic task revision does not match current state."""
+
+
+class PolicyDenied(ControlPlaneError):
+    """The policy gate denied a control-plane operation."""
+
+
+@dataclass(frozen=True)
+class RequestContext:
+    """Authenticated request identity propagated across all AIOS layers."""
+
+    tenant_id: str
+    principal_id: str
+    trace_id: str
+    roles: frozenset[str] = field(default_factory=frozenset)
+    session_id: str | None = None
+    policy_version: str = "v1"
+
+    def __post_init__(self) -> None:
+        for name in ("tenant_id", "principal_id", "trace_id"):
+            if not str(getattr(self, name, "")).strip():
+                raise ValueError(f"{name} is required")
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        tenant_id: str,
+        principal_id: str,
+        roles: Iterable[str] = (),
+        trace_id: str | None = None,
+        session_id: str | None = None,
+        policy_version: str = "v1",
+    ) -> "RequestContext":
+        return cls(
+            tenant_id=tenant_id.strip(),
+            principal_id=principal_id.strip(),
+            trace_id=trace_id or _new_id("trace"),
+            roles=frozenset(str(role).strip() for role in roles if str(role).strip()),
+            session_id=session_id,
+            policy_version=policy_version,
+        )
+
+
+@dataclass(frozen=True)
+class TenantRecord:
+    tenant_id: str
+    display_name: str
+    status: str = "active"
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+    created_at: str = field(default_factory=_utc_now)
+    updated_at: str = field(default_factory=_utc_now)
+
+
+@dataclass(frozen=True)
+class AgentRecord:
+    agent_id: str
+    tenant_id: str
+    display_name: str
+    runtime: str
+    capabilities: tuple[str, ...] = field(default_factory=tuple)
+    enabled: bool = True
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+    created_at: str = field(default_factory=_utc_now)
+    updated_at: str = field(default_factory=_utc_now)
+
+
+class TaskState(str, Enum):
+    CREATED = "CREATED"
+    APPROVED = "APPROVED"
+    RUNNING = "RUNNING"
+    COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+
+
+TERMINAL_TASK_STATES = frozenset(
+    {TaskState.COMPLETED, TaskState.FAILED, TaskState.CANCELLED}
+)
+
+ALLOWED_TASK_TRANSITIONS: Mapping[TaskState, frozenset[TaskState]] = {
+    TaskState.CREATED: frozenset({TaskState.APPROVED, TaskState.CANCELLED}),
+    TaskState.APPROVED: frozenset({TaskState.RUNNING, TaskState.CANCELLED}),
+    TaskState.RUNNING: frozenset(
+        {TaskState.COMPLETED, TaskState.FAILED, TaskState.CANCELLED}
+    ),
+    TaskState.COMPLETED: frozenset(),
+    TaskState.FAILED: frozenset(),
+    TaskState.CANCELLED: frozenset(),
+}
+
+
+@dataclass(frozen=True)
+class TaskRecord:
+    task_id: str
+    tenant_id: str
+    agent_id: str
+    action: str
+    payload: Mapping[str, Any]
+    state: TaskState = TaskState.CREATED
+    revision: int = 1
+    idempotency_key: str | None = None
+    request_digest: str = ""
+    result: Mapping[str, Any] | None = None
+    error: Mapping[str, Any] | None = None
+    created_by: str = ""
+    approved_by: str | None = None
+    created_at: str = field(default_factory=_utc_now)
+    updated_at: str = field(default_factory=_utc_now)
+
+
+@dataclass(frozen=True)
+class AuditEvent:
+    event_id: str
+    tenant_id: str
+    principal_id: str
+    trace_id: str
+    action: str
+    resource_type: str
+    resource_id: str
+    outcome: str
+    policy_version: str
+    details: Mapping[str, Any] = field(default_factory=dict)
+    created_at: str = field(default_factory=_utc_now)
+
+
+@dataclass(frozen=True)
+class PolicyDecision:
+    allowed: bool
+    reason: str
+    policy_version: str
+
+
+PolicyEvaluator = Callable[[RequestContext, str, Mapping[str, Any]], PolicyDecision]
+
+
+class InMemoryControlPlaneStore:
+    """Thread-safe reference store used by tests and the first gateway slice.
+
+    Production backends must preserve the same tenant-scoped interface and add
+    database row-level security, migrations, backup and HA evidence.
+    """
+
+    def __init__(self) -> None:
+        self.lock = threading.RLock()
+        self.tenants: dict[str, TenantRecord] = {}
+        self.agents: dict[str, AgentRecord] = {}
+        self.tasks: dict[str, TaskRecord] = {}
+        self.idempotency: dict[tuple[str, str], tuple[str, str]] = {}
+        self.audit_events: list[AuditEvent] = []
+
+
+class ControlPlaneService:
+    """Authoritative tenant, agent and task lifecycle service."""
+
+    def __init__(
+        self,
+        store: InMemoryControlPlaneStore | None = None,
+        *,
+        policy_evaluator: PolicyEvaluator | None = None,
+    ) -> None:
+        self.store = store or InMemoryControlPlaneStore()
+        self.policy_evaluator = policy_evaluator or self._default_policy
+
+    @staticmethod
+    def _default_policy(
+        context: RequestContext,
+        action: str,
+        resource: Mapping[str, Any],
+    ) -> PolicyDecision:
+        del resource
+        role_requirements = {
+            "tenant.register": {"platform_admin"},
+            "tenant.read": {"tenant_admin", "operator", "auditor", "platform_admin"},
+            "agent.register": {"tenant_admin", "operator", "platform_admin"},
+            "agent.read": {"tenant_admin", "operator", "auditor", "platform_admin"},
+            "task.create": {"tenant_admin", "operator", "platform_admin"},
+            "task.read": {"tenant_admin", "operator", "auditor", "platform_admin"},
+            "task.approve": {"tenant_admin", "approver", "platform_admin"},
+            "task.start": {"runtime", "operator", "platform_admin"},
+            "task.complete": {"runtime", "operator", "platform_admin"},
+            "task.fail": {"runtime", "operator", "platform_admin"},
+            "task.cancel": {"tenant_admin", "operator", "approver", "platform_admin"},
+            "audit.read": {"tenant_admin", "auditor", "platform_admin"},
+        }
+        required = role_requirements.get(action, {"platform_admin"})
+        allowed = bool(context.roles.intersection(required))
+        return PolicyDecision(
+            allowed=allowed,
+            reason="role_allowed" if allowed else "required_role_missing",
+            policy_version=context.policy_version,
+        )
+
+    def _require_context(self, context: RequestContext) -> None:
+        if not context.principal_id or not context.tenant_id or not context.trace_id:
+            raise Unauthorized("authenticated tenant context is required")
+
+    def _authorize(
+        self,
+        context: RequestContext,
+        action: str,
+        resource: Mapping[str, Any],
+    ) -> PolicyDecision:
+        self._require_context(context)
+        decision = self.policy_evaluator(context, action, resource)
+        if not decision.allowed:
+            self._audit(
+                context,
+                action=action,
+                resource_type=str(resource.get("resource_type", "policy")),
+                resource_id=str(resource.get("resource_id", "unknown")),
+                outcome="denied",
+                details={"reason": decision.reason},
+            )
+            raise PolicyDenied(f"{action} denied: {decision.reason}")
+        return decision
+
+    @staticmethod
+    def _assert_same_tenant(context: RequestContext, tenant_id: str) -> None:
+        if context.tenant_id != tenant_id and "platform_admin" not in context.roles:
+            raise TenantIsolationError("cross-tenant access denied")
+
+    def _audit(
+        self,
+        context: RequestContext,
+        *,
+        action: str,
+        resource_type: str,
+        resource_id: str,
+        outcome: str,
+        details: Mapping[str, Any] | None = None,
+    ) -> AuditEvent:
+        event = AuditEvent(
+            event_id=_new_id("audit"),
+            tenant_id=context.tenant_id,
+            principal_id=context.principal_id,
+            trace_id=context.trace_id,
+            action=action,
+            resource_type=resource_type,
+            resource_id=resource_id,
+            outcome=outcome,
+            policy_version=context.policy_version,
+            details=copy.deepcopy(dict(details or {})),
+        )
+        self.store.audit_events.append(event)
+        return event
+
+    def register_tenant(
+        self,
+        context: RequestContext,
+        *,
+        tenant_id: str,
+        display_name: str,
+        metadata: Mapping[str, Any] | None = None,
+    ) -> TenantRecord:
+        tenant_id = tenant_id.strip()
+        if not tenant_id or not display_name.strip():
+            raise ValueError("tenant_id and display_name are required")
+        self._authorize(
+            context,
+            "tenant.register",
+            {"resource_type": "tenant", "resource_id": tenant_id},
+        )
+        self._assert_same_tenant(context, tenant_id)
+        with self.store.lock:
+            if tenant_id in self.store.tenants:
+                raise ControlPlaneError(f"tenant already exists: {tenant_id}")
+            tenant = TenantRecord(
+                tenant_id=tenant_id,
+                display_name=display_name.strip(),
+                metadata=copy.deepcopy(dict(metadata or {})),
+            )
+            self.store.tenants[tenant_id] = tenant
+            self._audit(
+                context,
+                action="tenant.register",
+                resource_type="tenant",
+                resource_id=tenant_id,
+                outcome="allowed",
+            )
+            return tenant
+
+    def get_tenant(self, context: RequestContext, tenant_id: str | None = None) -> TenantRecord:
+        tenant_id = tenant_id or context.tenant_id
+        self._authorize(
+            context,
+            "tenant.read",
+            {"resource_type": "tenant", "resource_id": tenant_id},
+        )
+        self._assert_same_tenant(context, tenant_id)
+        with self.store.lock:
+            tenant = self.store.tenants.get(tenant_id)
+            if tenant is None:
+                raise NotFound("tenant not found")
+            return tenant
+
+    def register_agent(
+        self,
+        context: RequestContext,
+        *,
+        agent_id: str,
+        display_name: str,
+        runtime: str,
+        capabilities: Iterable[str] = (),
+        metadata: Mapping[str, Any] | None = None,
+    ) -> AgentRecord:
+        self._authorize(
+            context,
+            "agent.register",
+            {"resource_type": "agent", "resource_id": agent_id},
+        )
+        tenant = self.get_tenant(context)
+        if tenant.status != "active":
+            raise ControlPlaneError("tenant is not active")
+        normalized_capabilities = tuple(
+            sorted({str(item).strip() for item in capabilities if str(item).strip()})
+        )
+        if not agent_id.strip() or not display_name.strip() or not runtime.strip():
+            raise ValueError("agent_id, display_name and runtime are required")
+        with self.store.lock:
+            existing = self.store.agents.get(agent_id)
+            if existing is not None and existing.tenant_id != context.tenant_id:
+                raise TenantIsolationError("agent id belongs to another tenant")
+            if existing is not None:
+                raise ControlPlaneError(f"agent already exists: {agent_id}")
+            agent = AgentRecord(
+                agent_id=agent_id.strip(),
+                tenant_id=context.tenant_id,
+                display_name=display_name.strip(),
+                runtime=runtime.strip(),
+                capabilities=normalized_capabilities,
+                metadata=copy.deepcopy(dict(metadata or {})),
+            )
+            self.store.agents[agent.agent_id] = agent
+            self._audit(
+                context,
+                action="agent.register",
+                resource_type="agent",
+                resource_id=agent.agent_id,
+                outcome="allowed",
+                details={"runtime": agent.runtime},
+            )
+            return agent
+
+    def get_agent(self, context: RequestContext, agent_id: str) -> AgentRecord:
+        self._authorize(
+            context,
+            "agent.read",
+            {"resource_type": "agent", "resource_id": agent_id},
+        )
+        with self.store.lock:
+            agent = self.store.agents.get(agent_id)
+            if agent is None:
+                raise NotFound("agent not found")
+            self._assert_same_tenant(context, agent.tenant_id)
+            return agent
+
+    def list_agents(self, context: RequestContext) -> list[AgentRecord]:
+        self._authorize(
+            context,
+            "agent.read",
+            {"resource_type": "agent_collection", "resource_id": context.tenant_id},
+        )
+        with self.store.lock:
+            return [
+                agent
+                for agent in self.store.agents.values()
+                if agent.tenant_id == context.tenant_id
+            ]
+
+    def create_task(
+        self,
+        context: RequestContext,
+        *,
+        agent_id: str,
+        action: str,
+        payload: Mapping[str, Any] | None = None,
+        idempotency_key: str | None = None,
+    ) -> TaskRecord:
+        self._authorize(
+            context,
+            "task.create",
+            {"resource_type": "task", "resource_id": idempotency_key or "new"},
+        )
+        agent = self.get_agent(context, agent_id)
+        if not agent.enabled:
+            raise ControlPlaneError("agent is disabled")
+        if action not in agent.capabilities and "*" not in agent.capabilities:
+            raise PolicyDenied(f"agent does not advertise capability: {action}")
+        normalized_payload = copy.deepcopy(dict(payload or {}))
+        request_digest = _canonical_digest(
+            {"agent_id": agent_id, "action": action, "payload": normalized_payload}
+        )
+        normalized_key = idempotency_key.strip() if idempotency_key else None
+        with self.store.lock:
+            if normalized_key:
+                idempotency_ref = (context.tenant_id, normalized_key)
+                existing = self.store.idempotency.get(idempotency_ref)
+                if existing is not None:
+                    existing_task_id, existing_digest = existing
+                    if existing_digest != request_digest:
+                        raise IdempotencyConflict(
+                            "idempotency key was reused with a different request"
+                        )
+                    return self.store.tasks[existing_task_id]
+            task = TaskRecord(
+                task_id=_new_id("task"),
+                tenant_id=context.tenant_id,
+                agent_id=agent_id,
+                action=action,
+                payload=normalized_payload,
+                idempotency_key=normalized_key,
+                request_digest=request_digest,
+                created_by=context.principal_id,
+            )
+            self.store.tasks[task.task_id] = task
+            if normalized_key:
+                self.store.idempotency[(context.tenant_id, normalized_key)] = (
+                    task.task_id,
+                    request_digest,
+                )
+            self._audit(
+                context,
+                action="task.create",
+                resource_type="task",
+                resource_id=task.task_id,
+                outcome="allowed",
+                details={"agent_id": agent_id, "action": action},
+            )
+            return task
+
+    def get_task(self, context: RequestContext, task_id: str) -> TaskRecord:
+        self._authorize(
+            context,
+            "task.read",
+            {"resource_type": "task", "resource_id": task_id},
+        )
+        with self.store.lock:
+            task = self.store.tasks.get(task_id)
+            if task is None:
+                raise NotFound("task not found")
+            self._assert_same_tenant(context, task.tenant_id)
+            return task
+
+    def list_tasks(
+        self,
+        context: RequestContext,
+        *,
+        states: Iterable[TaskState | str] | None = None,
+    ) -> list[TaskRecord]:
+        self._authorize(
+            context,
+            "task.read",
+            {"resource_type": "task_collection", "resource_id": context.tenant_id},
+        )
+        state_filter = (
+            {TaskState(item) for item in states}
+            if states is not None
+            else None
+        )
+        with self.store.lock:
+            return [
+                task
+                for task in self.store.tasks.values()
+                if task.tenant_id == context.tenant_id
+                and (state_filter is None or task.state in state_filter)
+            ]
+
+    def transition_task(
+        self,
+        context: RequestContext,
+        *,
+        task_id: str,
+        target_state: TaskState | str,
+        expected_revision: int | None = None,
+        result: Mapping[str, Any] | None = None,
+        error: Mapping[str, Any] | None = None,
+    ) -> TaskRecord:
+        target = TaskState(target_state)
+        action_name = {
+            TaskState.APPROVED: "task.approve",
+            TaskState.RUNNING: "task.start",
+            TaskState.COMPLETED: "task.complete",
+            TaskState.FAILED: "task.fail",
+            TaskState.CANCELLED: "task.cancel",
+        }.get(target)
+        if action_name is None:
+            raise InvalidTransition(f"cannot transition to {target.value}")
+        self._authorize(
+            context,
+            action_name,
+            {"resource_type": "task", "resource_id": task_id},
+        )
+        with self.store.lock:
+            current = self.store.tasks.get(task_id)
+            if current is None:
+                raise NotFound("task not found")
+            self._assert_same_tenant(context, current.tenant_id)
+            if expected_revision is not None and current.revision != expected_revision:
+                raise RevisionConflict(
+                    f"expected revision {expected_revision}, current {current.revision}"
+                )
+            if target not in ALLOWED_TASK_TRANSITIONS[current.state]:
+                raise InvalidTransition(
+                    f"invalid transition {current.state.value} -> {target.value}"
+                )
+            if target == TaskState.COMPLETED and result is None:
+                raise ValueError("completed task requires result")
+            if target == TaskState.FAILED and error is None:
+                raise ValueError("failed task requires error")
+            updated = TaskRecord(
+                task_id=current.task_id,
+                tenant_id=current.tenant_id,
+                agent_id=current.agent_id,
+                action=current.action,
+                payload=current.payload,
+                state=target,
+                revision=current.revision + 1,
+                idempotency_key=current.idempotency_key,
+                request_digest=current.request_digest,
+                result=copy.deepcopy(dict(result)) if result is not None else current.result,
+                error=copy.deepcopy(dict(error)) if error is not None else current.error,
+                created_by=current.created_by,
+                approved_by=(
+                    context.principal_id
+                    if target == TaskState.APPROVED
+                    else current.approved_by
+                ),
+                created_at=current.created_at,
+                updated_at=_utc_now(),
+            )
+            self.store.tasks[task_id] = updated
+            self._audit(
+                context,
+                action=action_name,
+                resource_type="task",
+                resource_id=task_id,
+                outcome="allowed",
+                details={
+                    "from": current.state.value,
+                    "to": target.value,
+                    "revision": updated.revision,
+                },
+            )
+            return updated
+
+    def list_audit_events(
+        self,
+        context: RequestContext,
+        *,
+        resource_id: str | None = None,
+    ) -> list[AuditEvent]:
+        self._authorize(
+            context,
+            "audit.read",
+            {"resource_type": "audit", "resource_id": resource_id or context.tenant_id},
+        )
+        with self.store.lock:
+            return [
+                event
+                for event in self.store.audit_events
+                if event.tenant_id == context.tenant_id
+                and (resource_id is None or event.resource_id == resource_id)
+            ]
@@ -0,0 +1,379 @@
+"""AIOS V2 持久化 Dispatch 记录。
+
+Dispatch 是 AIOS Task 与 Runtime command/job 之间的唯一可信绑定。所有结果回写
+必须匹配 tenant/task/trace/runtime_execution/provenance/run/principal。
+"""
+from __future__ import annotations
+
+import json
+import sqlite3
+import threading
+import uuid
+from dataclasses import asdict, dataclass, replace
+from datetime import datetime, timezone
+from enum import Enum
+from pathlib import Path
+from typing import Any, Mapping, Protocol
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+class DispatchState(str, Enum):
+    PREPARED = "PREPARED"
+    RUNNING = "RUNNING"
+    QUEUED = "QUEUED"
+    COMPLETED = "COMPLETED"
+    FAILED = "FAILED"
+    CANCELLED = "CANCELLED"
+
+
+TERMINAL_DISPATCH_STATES = frozenset(
+    {DispatchState.COMPLETED, DispatchState.FAILED, DispatchState.CANCELLED}
+)
+
+
+@dataclass(frozen=True)
+class DispatchRecord:
+    dispatch_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    principal_id: str
+    runtime: str
+    runtime_execution_id: str
+    trace_id: str
+    provenance_id: str
+    run_id: str
+    authorization_id: str
+    state: DispatchState = DispatchState.PREPARED
+    expected_worker_id: str | None = None
+    result_digest: str | None = None
+    created_at: str = ""
+    updated_at: str = ""
+    completed_at: str | None = None
+
+    def __post_init__(self) -> None:
+        for name in (
+            "dispatch_id",
+            "tenant_id",
+            "task_id",
+            "agent_id",
+            "principal_id",
+            "runtime",
+            "runtime_execution_id",
+            "trace_id",
+            "provenance_id",
+            "run_id",
+            "authorization_id",
+        ):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        object.__setattr__(self, "state", DispatchState(self.state))
+        now = utc_now()
+        object.__setattr__(self, "created_at", self.created_at or now)
+        object.__setattr__(self, "updated_at", self.updated_at or now)
+        if self.expected_worker_id is not None:
+            object.__setattr__(
+                self,
+                "expected_worker_id",
+                _required(self.expected_worker_id, "expected_worker_id"),
+            )
+
+    @classmethod
+    def create(
+        cls,
+        *,
+        tenant_id: str,
+        task_id: str,
+        agent_id: str,
+        principal_id: str,
+        runtime: str,
+        runtime_execution_id: str,
+        trace_id: str,
+        provenance_id: str,
+        run_id: str,
+        authorization_id: str,
+    ) -> "DispatchRecord":
+        return cls(
+            dispatch_id=f"dispatch_{uuid.uuid4().hex}",
+            tenant_id=tenant_id,
+            task_id=task_id,
+            agent_id=agent_id,
+            principal_id=principal_id,
+            runtime=runtime,
+            runtime_execution_id=runtime_execution_id,
+            trace_id=trace_id,
+            provenance_id=provenance_id,
+            run_id=run_id,
+            authorization_id=authorization_id,
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        value = asdict(self)
+        value["state"] = self.state.value
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "DispatchRecord":
+        return cls(**dict(value))
+
+
+class DispatchConflict(RuntimeError):
+    pass
+
+
+class DispatchNotFound(RuntimeError):
+    pass
+
+
+class DispatchRepository(Protocol):
+    def create(self, record: DispatchRecord) -> DispatchRecord: ...
+    def get(self, dispatch_id: str, *, tenant_id: str) -> DispatchRecord: ...
+    def get_by_task(self, task_id: str, *, tenant_id: str) -> DispatchRecord | None: ...
+    def get_by_runtime_execution(
+        self, runtime_execution_id: str, *, tenant_id: str
+    ) -> DispatchRecord | None: ...
+    def update(
+        self,
+        dispatch_id: str,
+        *,
+        tenant_id: str,
+        state: DispatchState | str | None = None,
+        expected_worker_id: str | None = None,
+        result_digest: str | None = None,
+    ) -> DispatchRecord: ...
+    def list(self, *, tenant_id: str) -> list[DispatchRecord]: ...
+
+
+class InMemoryDispatchRepository:
+    def __init__(self) -> None:
+        self._lock = threading.RLock()
+        self._records: dict[str, DispatchRecord] = {}
+        self._by_task: dict[tuple[str, str], str] = {}
+        self._by_runtime: dict[tuple[str, str], str] = {}
+
+    def create(self, record: DispatchRecord) -> DispatchRecord:
+        with self._lock:
+            task_ref = (record.tenant_id, record.task_id)
+            runtime_ref = (record.tenant_id, record.runtime_execution_id)
+            if task_ref in self._by_task or runtime_ref in self._by_runtime:
+                existing = self.get_by_task(record.task_id, tenant_id=record.tenant_id)
+                if existing == record:
+                    return record
+                raise DispatchConflict("task or runtime execution already has a dispatch")
+            self._records[record.dispatch_id] = record
+            self._by_task[task_ref] = record.dispatch_id
+            self._by_runtime[runtime_ref] = record.dispatch_id
+            return record
+
+    def get(self, dispatch_id: str, *, tenant_id: str) -> DispatchRecord:
+        with self._lock:
+            record = self._records.get(dispatch_id)
+            if record is None or record.tenant_id != tenant_id:
+                raise DispatchNotFound("dispatch not found")
+            return record
+
+    def get_by_task(self, task_id: str, *, tenant_id: str) -> DispatchRecord | None:
+        with self._lock:
+            dispatch_id = self._by_task.get((tenant_id, task_id))
+            return self._records.get(dispatch_id) if dispatch_id else None
+
+    def get_by_runtime_execution(
+        self, runtime_execution_id: str, *, tenant_id: str
+    ) -> DispatchRecord | None:
+        with self._lock:
+            dispatch_id = self._by_runtime.get((tenant_id, runtime_execution_id))
+            return self._records.get(dispatch_id) if dispatch_id else None
+
+    def update(
+        self,
+        dispatch_id: str,
+        *,
+        tenant_id: str,
+        state: DispatchState | str | None = None,
+        expected_worker_id: str | None = None,
+        result_digest: str | None = None,
+    ) -> DispatchRecord:
+        with self._lock:
+            current = self.get(dispatch_id, tenant_id=tenant_id)
+            target = DispatchState(state) if state is not None else current.state
+            if current.state in TERMINAL_DISPATCH_STATES and target != current.state:
+                raise DispatchConflict("terminal dispatch cannot transition")
+            updated = replace(
+                current,
+                state=target,
+                expected_worker_id=(
+                    expected_worker_id
+                    if expected_worker_id is not None
+                    else current.expected_worker_id
+                ),
+                result_digest=result_digest or current.result_digest,
+                updated_at=utc_now(),
+                completed_at=(utc_now() if target in TERMINAL_DISPATCH_STATES else None),
+            )
+            self._records[dispatch_id] = updated
+            return updated
+
+    def list(self, *, tenant_id: str) -> list[DispatchRecord]:
+        with self._lock:
+            return sorted(
+                [item for item in self._records.values() if item.tenant_id == tenant_id],
+                key=lambda item: (item.created_at, item.dispatch_id),
+            )
+
+
+class SQLiteDispatchRepository:
+    SCHEMA_VERSION = 1
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        with self._connect() as connection:
+            connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS dispatch_records (
+                    dispatch_id TEXT PRIMARY KEY,
+                    tenant_id TEXT NOT NULL,
+                    task_id TEXT NOT NULL,
+                    runtime_execution_id TEXT NOT NULL,
+                    payload_json TEXT NOT NULL,
+                    state TEXT NOT NULL,
+                    updated_at TEXT NOT NULL,
+                    UNIQUE(tenant_id, task_id),
+                    UNIQUE(tenant_id, runtime_execution_id)
+                );
+                CREATE INDEX IF NOT EXISTS idx_dispatch_tenant_state
+                    ON dispatch_records(tenant_id, state, updated_at);
+                """
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(str(self.path), timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        return connection
+
+    @staticmethod
+    def _encode(record: DispatchRecord) -> str:
+        return json.dumps(
+            record.as_dict(), ensure_ascii=False, sort_keys=True, separators=(",", ":")
+        )
+
+    @staticmethod
+    def _decode(row: sqlite3.Row) -> DispatchRecord:
+        value = json.loads(row["payload_json"])
+        if not isinstance(value, Mapping):
+            raise RuntimeError("invalid dispatch record")
+        return DispatchRecord.from_dict(value)
+
+    def create(self, record: DispatchRecord) -> DispatchRecord:
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            try:
+                connection.execute(
+                    "INSERT INTO dispatch_records VALUES (?, ?, ?, ?, ?, ?, ?)",
+                    (
+                        record.dispatch_id,
+                        record.tenant_id,
+                        record.task_id,
+                        record.runtime_execution_id,
+                        self._encode(record),
+                        record.state.value,
+                        record.updated_at,
+                    ),
+                )
+                connection.commit()
+                return record
+            except sqlite3.IntegrityError as exc:
+                connection.rollback()
+                existing = self.get_by_task(record.task_id, tenant_id=record.tenant_id)
+                if existing is not None and existing == record:
+                    return existing
+                raise DispatchConflict("task or runtime execution already has a dispatch") from exc
+
+    def get(self, dispatch_id: str, *, tenant_id: str) -> DispatchRecord:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT payload_json FROM dispatch_records WHERE dispatch_id = ? AND tenant_id = ?",
+                (_required(dispatch_id, "dispatch_id"), _required(tenant_id, "tenant_id")),
+            ).fetchone()
+        if row is None:
+            raise DispatchNotFound("dispatch not found")
+        return self._decode(row)
+
+    def get_by_task(self, task_id: str, *, tenant_id: str) -> DispatchRecord | None:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT payload_json FROM dispatch_records WHERE task_id = ? AND tenant_id = ?",
+                (_required(task_id, "task_id"), _required(tenant_id, "tenant_id")),
+            ).fetchone()
+        return self._decode(row) if row is not None else None
+
+    def get_by_runtime_execution(
+        self, runtime_execution_id: str, *, tenant_id: str
+    ) -> DispatchRecord | None:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT payload_json FROM dispatch_records WHERE runtime_execution_id = ? AND tenant_id = ?",
+                (
+                    _required(runtime_execution_id, "runtime_execution_id"),
+                    _required(tenant_id, "tenant_id"),
+                ),
+            ).fetchone()
+        return self._decode(row) if row is not None else None
+
+    def update(
+        self,
+        dispatch_id: str,
+        *,
+        tenant_id: str,
+        state: DispatchState | str | None = None,
+        expected_worker_id: str | None = None,
+        result_digest: str | None = None,
+    ) -> DispatchRecord:
+        current = self.get(dispatch_id, tenant_id=tenant_id)
+        target = DispatchState(state) if state is not None else current.state
+        if current.state in TERMINAL_DISPATCH_STATES and target != current.state:
+            raise DispatchConflict("terminal dispatch cannot transition")
+        updated = replace(
+            current,
+            state=target,
+            expected_worker_id=(
+                expected_worker_id if expected_worker_id is not None else current.expected_worker_id
+            ),
+            result_digest=result_digest or current.result_digest,
+            updated_at=utc_now(),
+            completed_at=(utc_now() if target in TERMINAL_DISPATCH_STATES else None),
+        )
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            connection.execute(
+                "UPDATE dispatch_records SET payload_json = ?, state = ?, updated_at = ? WHERE dispatch_id = ? AND tenant_id = ?",
+                (
+                    self._encode(updated),
+                    updated.state.value,
+                    updated.updated_at,
+                    updated.dispatch_id,
+                    updated.tenant_id,
+                ),
+            )
+            connection.commit()
+        return updated
+
+    def list(self, *, tenant_id: str) -> list[DispatchRecord]:
+        with self._lock, self._connect() as connection:
+            rows = connection.execute(
+                "SELECT payload_json FROM dispatch_records WHERE tenant_id = ? ORDER BY updated_at, dispatch_id",
+                (_required(tenant_id, "tenant_id"),),
+            ).fetchall()
+        return [self._decode(row) for row in rows]
@@ -0,0 +1,543 @@
+"""Portable multi-provider execution plans and aggregate release gates.
+
+A plan is a DAG of executor-neutral stages. Only root stages are declared at
+plan creation. A dependent stage is declared atomically after every dependency
+passes its Truth + notification gate, so its start deadline cannot expire while
+it is legitimately waiting for upstream work.
+"""
+from __future__ import annotations
+
+import json
+import sqlite3
+import threading
+from dataclasses import asdict, dataclass, field
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .executor_protocol import ExecutorProviderRegistry, normalize_executor
+from .external_task_control import ExternalTaskCoordinator
+from .external_task_query import list_records
+from .task_execution_registry import (
+    ExecutionTaskManifest,
+    ExecutionTruthRecord,
+    ExecutionTruthState,
+    required,
+    utc_now,
+)
+
+PLAN_SCHEMA_VERSION = "aios.execution-plan.v2"
+WAITING_DEPENDENCY = "WAITING_DEPENDENCY"
+
+
+@dataclass(frozen=True)
+class ExecutionStageManifest:
+    stage_id: str
+    task_id: str
+    executor_type: str
+    role: str
+    steps: Sequence[str]
+    depends_on: Sequence[str] = ()
+    required_evidence: Sequence[str] = ()
+    notification_events: Sequence[str] = ("STARTED", "SUCCEEDED", "FAILED")
+    owner_notification_ref: str = "AIOS_OWNER_WECHAT_TARGET_REF"
+    start_deadline_seconds: int = 300
+    heartbeat_timeout_seconds: int = 180
+    required: bool = True
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        for name in ("stage_id", "task_id", "role", "owner_notification_ref"):
+            object.__setattr__(self, name, required(getattr(self, name), name))
+        object.__setattr__(self, "executor_type", normalize_executor(self.executor_type))
+        steps = tuple(required(item, "step") for item in self.steps)
+        if not steps:
+            raise ValueError("execution stage requires at least one step")
+        object.__setattr__(self, "steps", steps)
+        object.__setattr__(
+            self,
+            "depends_on",
+            tuple(sorted({required(item, "depends_on") for item in self.depends_on})),
+        )
+        object.__setattr__(
+            self,
+            "required_evidence",
+            tuple(sorted({required(item, "required_evidence") for item in self.required_evidence})),
+        )
+        object.__setattr__(
+            self,
+            "notification_events",
+            tuple(sorted({required(item, "notification_event") for item in self.notification_events})),
+        )
+        if self.start_deadline_seconds < 1 or self.heartbeat_timeout_seconds < 1:
+            raise ValueError("stage deadlines must be positive")
+        object.__setattr__(
+            self,
+            "metadata",
+            json.loads(json.dumps(dict(self.metadata), ensure_ascii=False, default=str)),
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        value = asdict(self)
+        value["steps"] = list(self.steps)
+        value["depends_on"] = list(self.depends_on)
+        value["required_evidence"] = list(self.required_evidence)
+        value["notification_events"] = list(self.notification_events)
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ExecutionStageManifest":
+        return cls(**dict(value))
+
+
+@dataclass(frozen=True)
+class ExecutionPlanManifest:
+    plan_id: str
+    source_branch: str
+    source_oid: str
+    target_version: str
+    stages: Sequence[ExecutionStageManifest]
+    release_gate_policy: str = "all_required_stages"
+    schema_version: str = PLAN_SCHEMA_VERSION
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        for name in ("plan_id", "source_branch", "source_oid", "target_version"):
+            object.__setattr__(self, name, required(getattr(self, name), name))
+        if self.schema_version != PLAN_SCHEMA_VERSION:
+            raise ValueError("unsupported execution plan schema")
+        if self.release_gate_policy != "all_required_stages":
+            raise ValueError("unsupported release gate policy")
+        stages = tuple(self.stages)
+        if not stages:
+            raise ValueError("execution plan requires stages")
+        stage_ids = [item.stage_id for item in stages]
+        task_ids = [item.task_id for item in stages]
+        if len(stage_ids) != len(set(stage_ids)):
+            raise ValueError("execution plan stage_id values must be unique")
+        if len(task_ids) != len(set(task_ids)):
+            raise ValueError("execution plan task_id values must be unique")
+        known = set(stage_ids)
+        for stage in stages:
+            unknown = sorted(set(stage.depends_on) - known)
+            if unknown:
+                raise ValueError(f"stage {stage.stage_id} has unknown dependencies: {unknown}")
+            if stage.stage_id in stage.depends_on:
+                raise ValueError("stage cannot depend on itself")
+        self._assert_acyclic(stages)
+        object.__setattr__(self, "stages", stages)
+        object.__setattr__(
+            self,
+            "metadata",
+            json.loads(json.dumps(dict(self.metadata), ensure_ascii=False, default=str)),
+        )
+
+    @staticmethod
+    def _assert_acyclic(stages: Sequence[ExecutionStageManifest]) -> None:
+        dependencies = {item.stage_id: set(item.depends_on) for item in stages}
+        resolved: set[str] = set()
+        while len(resolved) < len(stages):
+            ready = {
+                stage_id
+                for stage_id, deps in dependencies.items()
+                if stage_id not in resolved and deps.issubset(resolved)
+            }
+            if not ready:
+                raise ValueError("execution plan contains a dependency cycle")
+            resolved.update(ready)
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "schema_version": self.schema_version,
+            "plan_id": self.plan_id,
+            "source_branch": self.source_branch,
+            "source_oid": self.source_oid,
+            "target_version": self.target_version,
+            "release_gate_policy": self.release_gate_policy,
+            "stages": [item.as_dict() for item in self.stages],
+            "metadata": dict(self.metadata),
+        }
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ExecutionPlanManifest":
+        raw = dict(value)
+        raw["stages"] = tuple(
+            ExecutionStageManifest.from_dict(item) for item in raw.get("stages") or ()
+        )
+        return cls(**raw)
+
+    def stage(self, stage_id: str) -> ExecutionStageManifest:
+        normalized = required(stage_id, "stage_id")
+        for stage in self.stages:
+            if stage.stage_id == normalized:
+                return stage
+        raise KeyError(f"execution stage not found: {normalized}")
+
+
+class SQLiteExecutionPlanStore:
+    """Durable plan declarations; stage state remains in Truth Registry."""
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+        with self._connect() as connection:
+            connection.executescript(
+                """
+                CREATE TABLE IF NOT EXISTS execution_plans (
+                    plan_id TEXT PRIMARY KEY,
+                    manifest_json TEXT NOT NULL,
+                    created_at TEXT NOT NULL,
+                    updated_at TEXT NOT NULL
+                );
+                """
+            )
+
+    def _connect(self) -> sqlite3.Connection:
+        connection = sqlite3.connect(str(self.path), timeout=30.0)
+        connection.row_factory = sqlite3.Row
+        connection.execute("PRAGMA journal_mode=WAL")
+        connection.execute("PRAGMA synchronous=FULL")
+        return connection
+
+    @staticmethod
+    def _encode(plan: ExecutionPlanManifest) -> str:
+        return json.dumps(
+            plan.as_dict(),
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+        )
+
+    def save(
+        self,
+        plan: ExecutionPlanManifest,
+        *,
+        allow_source_oid_supersession: bool = False,
+    ) -> None:
+        payload = self._encode(plan)
+        now = utc_now()
+        with self._lock, self._connect() as connection:
+            connection.execute("BEGIN IMMEDIATE")
+            existing = connection.execute(
+                "SELECT manifest_json FROM execution_plans WHERE plan_id = ?",
+                (plan.plan_id,),
+            ).fetchone()
+            if existing is not None:
+                if existing["manifest_json"] != payload:
+                    previous = json.loads(existing["manifest_json"])
+                    replacement = plan.as_dict()
+                    previous_oid = previous.pop("source_oid", None)
+                    replacement_oid = replacement.pop("source_oid", None)
+                    if (
+                        not allow_source_oid_supersession
+                        or previous != replacement
+                        or previous_oid == replacement_oid
+                    ):
+                        connection.rollback()
+                        raise RuntimeError(
+                            "plan_id already exists with another manifest"
+                        )
+                    connection.execute(
+                        "UPDATE execution_plans SET manifest_json = ?, updated_at = ? WHERE plan_id = ?",
+                        (payload, now, plan.plan_id),
+                    )
+                    connection.commit()
+                    return
+                connection.rollback()
+                return
+            connection.execute(
+                "INSERT INTO execution_plans VALUES (?, ?, ?, ?)",
+                (plan.plan_id, payload, now, now),
+            )
+            connection.commit()
+
+    def get(self, plan_id: str) -> ExecutionPlanManifest:
+        with self._lock, self._connect() as connection:
+            row = connection.execute(
+                "SELECT manifest_json FROM execution_plans WHERE plan_id = ?",
+                (required(plan_id, "plan_id"),),
+            ).fetchone()
+        if row is None:
+            raise KeyError("execution plan not found")
+        value = json.loads(row["manifest_json"])
+        if not isinstance(value, Mapping):
+            raise ValueError("stored execution plan is invalid")
+        return ExecutionPlanManifest.from_dict(value)
+
+    def list(self) -> list[ExecutionPlanManifest]:
+        with self._lock, self._connect() as connection:
+            rows = connection.execute(
+                "SELECT manifest_json FROM execution_plans ORDER BY created_at, plan_id"
+            ).fetchall()
+        return [
+            ExecutionPlanManifest.from_dict(json.loads(row["manifest_json"]))
+            for row in rows
+        ]
+
+
+class ExecutionPlanCoordinator:
+    """Declares dependency-ready stages and evaluates aggregate release gates."""
+
+    def __init__(
+        self,
+        *,
+        task_coordinator: ExternalTaskCoordinator,
+        plan_store: SQLiteExecutionPlanStore,
+        providers: ExecutorProviderRegistry,
+    ) -> None:
+        self.task_coordinator = task_coordinator
+        self.plan_store = plan_store
+        self.providers = providers
+
+    @classmethod
+    def from_file(
+        cls,
+        path: str | Path,
+        *,
+        providers: ExecutorProviderRegistry,
+    ) -> "ExecutionPlanCoordinator":
+        return cls(
+            task_coordinator=ExternalTaskCoordinator.from_file(path),
+            plan_store=SQLiteExecutionPlanStore(path),
+            providers=providers,
+        )
+
+    @staticmethod
+    def _task_manifest(
+        plan: ExecutionPlanManifest,
+        stage: ExecutionStageManifest,
+    ) -> ExecutionTaskManifest:
+        return ExecutionTaskManifest(
+            task_id=stage.task_id,
+            executor=stage.executor_type,
+            source_branch=plan.source_branch,
+            source_oid=plan.source_oid,
+            target_version=plan.target_version,
+            steps=stage.steps,
+            start_deadline_seconds=stage.start_deadline_seconds,
+            heartbeat_timeout_seconds=stage.heartbeat_timeout_seconds,
+            required_evidence=stage.required_evidence,
+            notification_events=stage.notification_events,
+            owner_notification_ref=stage.owner_notification_ref,
+            manifest_version="aios.external-task.v2",
+        )
+
+    def _record(self, task_id: str) -> ExecutionTruthRecord | None:
+        try:
+            return self.task_coordinator.registry.get(task_id)
+        except KeyError:
+            return None
+
+    def _declare_stage(
+        self,
+        plan: ExecutionPlanManifest,
+        stage: ExecutionStageManifest,
+    ) -> ExecutionTruthRecord:
+        self.providers.validate_manifest(self._task_manifest(plan, stage))
+        return self.task_coordinator.declare(self._task_manifest(plan, stage))
+
+    def declare(self, plan: ExecutionPlanManifest) -> Mapping[str, Any]:
+        for stage in plan.stages:
+            self.providers.get(stage.executor_type)
+        allow_source_oid_supersession = False
+        try:
+            previous = self.plan_store.get(plan.plan_id)
+        except KeyError:
+            previous = None
+        if previous is not None and previous.source_oid != plan.source_oid:
+            previous_value = previous.as_dict()
+            replacement_value = plan.as_dict()
+            previous_value.pop("source_oid")
+            replacement_value.pop("source_oid")
+            root_records = [
+                self._record(stage.task_id)
+                for stage in previous.stages
+                if not stage.depends_on
+            ]
+            allow_source_oid_supersession = bool(
+                previous_value == replacement_value
+                and root_records
+                and all(
+                    record is not None
+                    and record.state == ExecutionTruthState.NOT_STARTED
+                    for record in root_records
+                )
+            )
+        self.plan_store.save(
+            plan,
+            allow_source_oid_supersession=allow_source_oid_supersession,
+        )
+        for stage in plan.stages:
+            if not stage.depends_on:
+                self._declare_stage(plan, stage)
+        return self.snapshot(plan.plan_id)
+
+    def declare_file(self, path: str | Path) -> Mapping[str, Any]:
+        value = json.loads(Path(path).read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping):
+            raise ValueError("execution plan file must contain a JSON object")
+        return self.declare(ExecutionPlanManifest.from_dict(value))
+
+    def dependency_gate(self, plan_id: str, stage_id: str) -> Mapping[str, Any]:
+        plan = self.plan_store.get(plan_id)
+        stage = plan.stage(stage_id)
+        dependencies: list[Mapping[str, Any]] = []
+        passed = True
+        for dependency_id in stage.depends_on:
+            dependency = plan.stage(dependency_id)
+            record = self._record(dependency.task_id)
+            if record is None:
+                gate: Mapping[str, Any] = {
+                    "task_id": dependency.task_id,
+                    "state": WAITING_DEPENDENCY,
+                    "passed": False,
+                    "release_blocking": True,
+                }
+            else:
+                gate = self.task_coordinator.gate(dependency.task_id)
+            dependencies.append(
+                {
+                    "stage_id": dependency.stage_id,
+                    "task_id": dependency.task_id,
+                    "gate": gate,
+                }
+            )
+            if not gate["passed"]:
+                passed = False
+        return {
+            "plan_id": plan.plan_id,
+            "stage_id": stage.stage_id,
+            "passed": passed,
+            "release_blocking": not passed,
+            "dependencies": dependencies,
+        }
+
+    def activate_ready(self, plan_id: str) -> list[Mapping[str, Any]]:
+        plan = self.plan_store.get(plan_id)
+        activated: list[Mapping[str, Any]] = []
+        for stage in plan.stages:
+            if self._record(stage.task_id) is not None:
+                continue
+            dependency = self.dependency_gate(plan.plan_id, stage.stage_id)
+            if not dependency["passed"]:
+                continue
+            record = self._declare_stage(plan, stage)
+            activated.append(
+                {
+                    "stage_id": stage.stage_id,
+                    "task_id": record.task_id,
+                    "executor_type": stage.executor_type,
+                    "state": record.state.value,
+                }
+            )
+        return activated
+
+    def discover_ready(
+        self,
+        *,
+        plan_id: str,
+        executor_type: str,
+    ) -> list[Mapping[str, Any]]:
+        plan = self.plan_store.get(plan_id)
+        self.activate_ready(plan.plan_id)
+        normalized = normalize_executor(executor_type)
+        records = {
+            item.task_id: item
+            for item in list_records(
+                self.task_coordinator.registry.path,
+                executor=normalized,
+                states=(
+                    ExecutionTruthState.DECLARED.value,
+                    ExecutionTruthState.REGISTERED.value,
+                ),
+            )
+        }
+        ready: list[Mapping[str, Any]] = []
+        for stage in plan.stages:
+            if stage.executor_type != normalized or stage.task_id not in records:
+                continue
+            dependency = self.dependency_gate(plan.plan_id, stage.stage_id)
+            if dependency["passed"]:
+                ready.append(
+                    {
+                        "plan_id": plan.plan_id,
+                        "stage": stage.as_dict(),
+                        "record": records[stage.task_id].as_dict(),
+                    }
+                )
+        return ready
+
+    def snapshot(self, plan_id: str) -> Mapping[str, Any]:
+        plan = self.plan_store.get(plan_id)
+        stages: list[Mapping[str, Any]] = []
+        for stage in plan.stages:
+            record = self._record(stage.task_id)
+            dependency = self.dependency_gate(plan.plan_id, stage.stage_id)
+            if record is None:
+                truth: Mapping[str, Any] = {
+                    "task_id": stage.task_id,
+                    "state": WAITING_DEPENDENCY,
+                    "passed": False,
+                    "release_blocking": True,
+                    "executor_run_id": None,
+                    "executor_id": None,
+                    "current_step": 0,
+                    "total_steps": len(stage.steps),
+                    "evidence": {},
+                    "error": {},
+                    "notifications": [],
+                }
+            else:
+                truth = self.task_coordinator.status(stage.task_id)
+            stages.append(
+                {
+                    "stage": stage.as_dict(),
+                    "dependency_gate": dependency,
+                    "truth": truth,
+                }
+            )
+        return {
+            "manifest": plan.as_dict(),
+            "stages": stages,
+        }
+
+    def gate(self, plan_id: str) -> Mapping[str, Any]:
+        plan = self.plan_store.get(plan_id)
+        self.activate_ready(plan.plan_id)
+        stages: list[Mapping[str, Any]] = []
+        required_passed = True
+        for stage in plan.stages:
+            dependency = self.dependency_gate(plan.plan_id, stage.stage_id)
+            record = self._record(stage.task_id)
+            if record is None:
+                truth_gate: Mapping[str, Any] = {
+                    "task_id": stage.task_id,
+                    "state": WAITING_DEPENDENCY,
+                    "passed": False,
+                    "release_blocking": True,
+                }
+            else:
+                truth_gate = self.task_coordinator.gate(stage.task_id)
+            stage_passed = bool(truth_gate["passed"] and dependency["passed"])
+            if stage.required and not stage_passed:
+                required_passed = False
+            stages.append(
+                {
+                    "stage_id": stage.stage_id,
+                    "task_id": stage.task_id,
+                    "executor_type": stage.executor_type,
+                    "role": stage.role,
+                    "required": stage.required,
+                    "passed": stage_passed,
+                    "truth_gate": truth_gate,
+                    "dependency_gate": dependency,
+                }
+            )
+        return {
+            "plan_id": plan.plan_id,
+            "target_version": plan.target_version,
+            "policy": plan.release_gate_policy,
+            "passed": required_passed,
+            "release_blocking": not required_passed,
+            "stages": stages,
+        }
@@ -0,0 +1,323 @@
+"""AIOS V2 Agent 执行证据。
+
+Evidence 按租户隔离并使用原子 JSON 写入。生产模式下，claim、heartbeat
+和 complete 在落盘前必须通过最小权限 Evidence Grant 授权。
+"""
+from __future__ import annotations
+
+import json
+import os
+import threading
+from dataclasses import asdict, dataclass, field, replace
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Mapping, Protocol
+
+from .provenance import ProvenanceDenied, digest_payload
+
+
+class EvidenceAuthorizationWriter(Protocol):
+    def authorize_evidence_write(self, **values: Any) -> Any: ...
+
+
+def utc_now() -> str:
+    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
+
+
+def _required(value: str, label: str) -> str:
+    normalized = str(value or "").strip()
+    if not normalized:
+        raise ValueError(f"{label} is required")
+    return normalized
+
+
+def _safe(value: Mapping[str, Any] | None) -> dict[str, Any]:
+    return json.loads(json.dumps(dict(value or {}), ensure_ascii=False, default=str))
+
+
+@dataclass(frozen=True)
+class ExecutionEvidence:
+    execution_id: str
+    tenant_id: str
+    task_id: str
+    agent_id: str
+    executor: str
+    branch: str
+    status: str = "claimed"
+    progress_completed: int = 0
+    progress_total: int = 1
+    current_step: str = "claim"
+    last_commit: str | None = None
+    test_status: str = "not_run"
+    test_summary: Mapping[str, Any] = field(default_factory=dict)
+    result_summary: Mapping[str, Any] = field(default_factory=dict)
+    claimed_at: str = field(default_factory=utc_now)
+    heartbeat_at: str = field(default_factory=utc_now)
+    completed_at: str | None = None
+    provenance_id: str | None = None
+    run_id: str | None = None
+    last_authorization_id: str | None = None
+
+    def __post_init__(self) -> None:
+        for name in (
+            "execution_id",
+            "tenant_id",
+            "task_id",
+            "agent_id",
+            "executor",
+            "branch",
+            "status",
+            "current_step",
+            "claimed_at",
+            "heartbeat_at",
+        ):
+            object.__setattr__(self, name, _required(getattr(self, name), name))
+        if self.progress_completed < 0 or self.progress_total < 1:
+            raise ValueError("invalid progress values")
+        if self.progress_completed > self.progress_total:
+            raise ValueError("progress_completed cannot exceed progress_total")
+        object.__setattr__(self, "test_summary", _safe(self.test_summary))
+        object.__setattr__(self, "result_summary", _safe(self.result_summary))
+        for optional in ("provenance_id", "run_id", "last_authorization_id"):
+            value = getattr(self, optional)
+            object.__setattr__(self, optional, str(value).strip() if value else None)
+
+
+class ExecutionTracker:
+    """每个租户、每次执行持久保存一份证据记录。"""
+
+    def __init__(
+        self,
+        root: str | Path,
+        *,
+        provenance_writer: EvidenceAuthorizationWriter | None = None,
+        require_provenance: bool = False,
+    ) -> None:
+        self.root = Path(root).resolve()
+        self.root.mkdir(parents=True, exist_ok=True)
+        self.provenance_writer = provenance_writer
+        self.require_provenance = bool(require_provenance)
+        if self.require_provenance and self.provenance_writer is None:
+            raise ValueError("production evidence tracking requires a provenance writer")
+        self._lock = threading.RLock()
+
+    @staticmethod
+    def _component(value: str) -> str:
+        normalized = _required(value, "path component")
+        if normalized in {".", ".."} or "/" in normalized or "\\" in normalized:
+            raise ValueError("invalid evidence path component")
+        return normalized
+
+    def _path(self, tenant_id: str, execution_id: str) -> Path:
+        tenant = self._component(tenant_id)
+        execution = self._component(execution_id)
+        return self.root / tenant / f"{execution}.json"
+
+    def _authorize(
+        self,
+        evidence: ExecutionEvidence,
+        *,
+        operation: str,
+        principal_id: str | None,
+        provenance_id: str | None,
+        run_id: str | None,
+        changes: Mapping[str, Any],
+    ) -> str | None:
+        if not self.require_provenance:
+            return None
+        if self.provenance_writer is None:
+            raise RuntimeError("Run Provenance writer is not configured")
+        effective_provenance = provenance_id or evidence.provenance_id
+        effective_run = run_id or evidence.run_id
+        if not effective_provenance or not effective_run or not principal_id:
+            raise RuntimeError(
+                "production evidence write requires provenance_id, run_id and principal_id"
+            )
+        request_digest = digest_payload(
+            {
+                "operation": operation,
+                "execution_id": evidence.execution_id,
+                "tenant_id": evidence.tenant_id,
+                "task_id": evidence.task_id,
+                "agent_id": evidence.agent_id,
+                "executor": evidence.executor,
+                "branch": evidence.branch,
+                "changes": dict(changes),
+            }
+        )
+        try:
+            authorization = self.provenance_writer.authorize_evidence_write(
+                provenance_id=effective_provenance,
+                run_id=effective_run,
+                tenant_id=evidence.tenant_id,
+                task_id=evidence.task_id,
+                agent_id=evidence.agent_id,
+                principal_id=principal_id,
+                request_digest=request_digest,
+            )
+        except ProvenanceDenied as exc:
+            raise RuntimeError(f"Run Provenance denied evidence write: {exc}") from exc
+        return authorization.authorization_id
+
+    def claim(
+        self,
+        evidence: ExecutionEvidence,
+        *,
+        principal_id: str | None = None,
+        provenance_id: str | None = None,
+        run_id: str | None = None,
+    ) -> ExecutionEvidence:
+        path = self._path(evidence.tenant_id, evidence.execution_id)
+        with self._lock:
+            if path.exists():
+                current = self._read(path)
+                if current.task_id != evidence.task_id or current.agent_id != evidence.agent_id:
+                    raise RuntimeError("execution_id already belongs to another task")
+                if self.require_provenance and (
+                    current.provenance_id != (provenance_id or evidence.provenance_id)
+                    or current.run_id != (run_id or evidence.run_id)
+                ):
+                    raise RuntimeError(
+                        "execution_id already belongs to another provenance context"
+                    )
+                return current
+            effective_provenance = provenance_id or evidence.provenance_id
+            effective_run = run_id or evidence.run_id
+            authorization_id = self._authorize(
+                evidence,
+                operation="claim",
+                principal_id=principal_id,
+                provenance_id=effective_provenance,
+                run_id=effective_run,
+                changes={"status": evidence.status, "current_step": evidence.current_step},
+            )
+            persisted = replace(
+                evidence,
+                provenance_id=effective_provenance,
+                run_id=effective_run,
+                last_authorization_id=authorization_id,
+            )
+            self._write(path, persisted)
+            return persisted
+
+    def heartbeat(
+        self,
+        *,
+        tenant_id: str,
+        execution_id: str,
+        status: str | None = None,
+        current_step: str | None = None,
+        progress_completed: int | None = None,
+        progress_total: int | None = None,
+        last_commit: str | None = None,
+        principal_id: str | None = None,
+        provenance_id: str | None = None,
+        run_id: str | None = None,
+    ) -> ExecutionEvidence:
+        path = self._path(tenant_id, execution_id)
+        with self._lock:
+            current = self._read(path)
+            changes = {
+                "status": status or current.status,
+                "current_step": current_step or current.current_step,
+                "progress_completed": (
+                    progress_completed
+                    if progress_completed is not None
+                    else current.progress_completed
+                ),
+                "progress_total": (
+                    progress_total if progress_total is not None else current.progress_total
+                ),
+                "last_commit": last_commit or current.last_commit,
+            }
+            authorization_id = self._authorize(
+                current,
+                operation="heartbeat",
+                principal_id=principal_id,
+                provenance_id=provenance_id,
+                run_id=run_id,
+                changes=changes,
+            )
+            updated = replace(
+                current,
+                **changes,
+                last_authorization_id=authorization_id or current.last_authorization_id,
+                heartbeat_at=utc_now(),
+            )
+            self._write(path, updated)
+            return updated
+
+    def complete(
+        self,
+        *,
+        tenant_id: str,
+        execution_id: str,
+        status: str,
+        test_status: str,
+        test_summary: Mapping[str, Any] | None = None,
+        result_summary: Mapping[str, Any] | None = None,
+        last_commit: str | None = None,
+        principal_id: str | None = None,
+        provenance_id: str | None = None,
+        run_id: str | None = None,
+    ) -> ExecutionEvidence:
+        path = self._path(tenant_id, execution_id)
+        with self._lock:
+            current = self._read(path)
+            changes = {
+                "status": _required(status, "status"),
+                "current_step": "complete",
+                "progress_completed": current.progress_total,
+                "last_commit": last_commit or current.last_commit,
+                "test_status": _required(test_status, "test_status"),
+                "test_summary": _safe(test_summary),
+                "result_summary": _safe(result_summary),
+            }
+            authorization_id = self._authorize(
+                current,
+                operation="complete",
+                principal_id=principal_id,
+                provenance_id=provenance_id,
+                run_id=run_id,
+                changes=changes,
+            )
+            updated = replace(
+                current,
+                **changes,
+                last_authorization_id=authorization_id or current.last_authorization_id,
+                heartbeat_at=utc_now(),
+                completed_at=utc_now(),
+            )
+            self._write(path, updated)
+            return updated
+
+    def get(self, *, tenant_id: str, execution_id: str) -> ExecutionEvidence:
+        return self._read(self._path(tenant_id, execution_id))
+
+    def list(self, *, tenant_id: str) -> list[ExecutionEvidence]:
+        tenant_dir = self.root / self._component(tenant_id)
+        if not tenant_dir.exists():
+            return []
+        records = [self._read(path) for path in tenant_dir.glob("*.json")]
+        return sorted(records, key=lambda item: (item.heartbeat_at, item.execution_id), reverse=True)
+
+    @staticmethod
+    def _read(path: Path) -> ExecutionEvidence:
+        try:
+            value = json.loads(path.read_text(encoding="utf-8"))
+        except FileNotFoundError as exc:
+            raise KeyError("execution evidence not found") from exc
+        if not isinstance(value, Mapping):
+            raise RuntimeError("invalid execution evidence file")
+        return ExecutionEvidence(**dict(value))
+
+    @staticmethod
+    def _write(path: Path, evidence: ExecutionEvidence) -> None:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        temporary = path.with_suffix(f".tmp-{os.getpid()}")
+        temporary.write_text(
+            json.dumps(asdict(evidence), ensure_ascii=False, sort_keys=True, indent=2) + "\n",
+            encoding="utf-8",
+        )
+        os.chmod(temporary, 0o640)
+        os.replace(temporary, path)
@@ -0,0 +1,204 @@
+"""Persistent and portable AIOS executor provider catalog.
+
+The catalog contains descriptors only: provider names, protocol/adapter versions,
+trust roles, capabilities and configuration schema identifiers. Credentials,
+endpoints and runtime secrets are intentionally excluded and must be resolved in
+the destination environment.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import threading
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .executor_protocol import (
+    EXECUTOR_PROTOCOL_VERSION,
+    DescriptorOnlyProvider,
+    ExecutorProvider,
+    ExecutorProviderDescriptor,
+    ExecutorProviderRegistry,
+    default_provider_registry,
+)
+
+CATALOG_SCHEMA_VERSION = "aios.executor.catalog.v1"
+MIGRATION_SCHEMA_VERSION = "aios.executor.migration.v1"
+
+
+def canonical_json_bytes(value: Mapping[str, Any]) -> bytes:
+    return json.dumps(
+        dict(value),
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+        default=str,
+    ).encode("utf-8")
+
+
+def sha256_payload(value: Mapping[str, Any]) -> str:
+    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
+
+
+@dataclass(frozen=True)
+class ExecutorCatalogSnapshot:
+    catalog: Mapping[str, Any]
+    catalog_sha256: str
+    path: str
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "catalog": dict(self.catalog),
+            "catalog_sha256": self.catalog_sha256,
+            "path": self.path,
+        }
+
+
+class FileExecutorCatalogStore:
+    """Atomic file store for provider descriptors and migration packages."""
+
+    def __init__(self, path: str | Path) -> None:
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = threading.RLock()
+
+    @staticmethod
+    def _validate_catalog(value: Mapping[str, Any]) -> ExecutorProviderRegistry:
+        if value.get("schema_version") != CATALOG_SCHEMA_VERSION:
+            raise ValueError("unsupported executor catalog schema")
+        if value.get("protocol_version") != EXECUTOR_PROTOCOL_VERSION:
+            raise ValueError("executor catalog protocol mismatch")
+        providers = value.get("providers")
+        if not isinstance(providers, Sequence) or isinstance(providers, (str, bytes)):
+            raise ValueError("executor catalog providers must be an array")
+        return ExecutorProviderRegistry.import_catalog(value)
+
+    def initialize_defaults(self) -> ExecutorCatalogSnapshot:
+        with self._lock:
+            if self.path.exists():
+                return self.load()
+            return self.save(default_provider_registry())
+
+    def load(self) -> ExecutorCatalogSnapshot:
+        with self._lock:
+            value = json.loads(self.path.read_text(encoding="utf-8"))
+        if not isinstance(value, Mapping):
+            raise ValueError("executor catalog must contain a JSON object")
+        registry = self._validate_catalog(value)
+        normalized = registry.export_catalog()
+        return ExecutorCatalogSnapshot(
+            catalog=normalized,
+            catalog_sha256=sha256_payload(normalized),
+            path=str(self.path),
+        )
+
+    def registry(
+        self,
+        *,
+        provider_factories: Mapping[str, ExecutorProvider] | None = None,
+    ) -> ExecutorProviderRegistry:
+        snapshot = self.load()
+        return ExecutorProviderRegistry.import_catalog(
+            snapshot.catalog,
+            provider_factories=provider_factories,
+        )
+
+    def save(self, registry: ExecutorProviderRegistry) -> ExecutorCatalogSnapshot:
+        catalog = registry.export_catalog()
+        self._validate_catalog(catalog)
+        encoded = json.dumps(
+            catalog,
+            ensure_ascii=False,
+            sort_keys=True,
+            indent=2,
+        ) + "\n"
+        with self._lock:
+            temporary = self.path.with_suffix(f".tmp-{os.getpid()}")
+            temporary.write_text(encoded, encoding="utf-8")
+            os.chmod(temporary, 0o640)
+            os.replace(temporary, self.path)
+        return ExecutorCatalogSnapshot(
+            catalog=catalog,
+            catalog_sha256=sha256_payload(catalog),
+            path=str(self.path),
+        )
+
+    def upsert_descriptor(
+        self,
+        descriptor: ExecutorProviderDescriptor,
+    ) -> ExecutorCatalogSnapshot:
+        with self._lock:
+            if self.path.exists():
+                registry = self.registry()
+            else:
+                registry = default_provider_registry()
+            try:
+                registry.register(DescriptorOnlyProvider(descriptor), replace=True)
+            except KeyError:
+                registry.register(DescriptorOnlyProvider(descriptor))
+            return self.save(registry)
+
+    def export_migration_package(
+        self,
+        *,
+        source_environment: str,
+        required_executor_types: Sequence[str] = (),
+    ) -> Mapping[str, Any]:
+        snapshot = self.load()
+        registry = ExecutorProviderRegistry.import_catalog(snapshot.catalog)
+        required = tuple(sorted({str(item).strip().lower() for item in required_executor_types if str(item).strip()}))
+        if required:
+            available = {item.executor_type for item in registry.list_descriptors()}
+            missing = sorted(set(required) - available)
+            if missing:
+                raise ValueError(f"migration package is missing providers: {missing}")
+        package = {
+            "schema_version": MIGRATION_SCHEMA_VERSION,
+            "source_environment": str(source_environment or "").strip(),
+            "catalog": snapshot.catalog,
+            "catalog_sha256": snapshot.catalog_sha256,
+            "required_executor_types": list(required),
+            "secret_values_included": False,
+        }
+        if not package["source_environment"]:
+            raise ValueError("source_environment is required")
+        return {
+            **package,
+            "package_sha256": sha256_payload(package),
+        }
+
+    @classmethod
+    def import_migration_package(
+        cls,
+        value: Mapping[str, Any],
+        *,
+        destination_path: str | Path,
+        destination_environment: str,
+        provider_factories: Mapping[str, ExecutorProvider] | None = None,
+    ) -> ExecutorCatalogSnapshot:
+        if value.get("schema_version") != MIGRATION_SCHEMA_VERSION:
+            raise ValueError("unsupported executor migration schema")
+        if value.get("secret_values_included") is not False:
+            raise ValueError("executor migration package must not contain secrets")
+        package_without_hash = {key: item for key, item in value.items() if key != "package_sha256"}
+        if sha256_payload(package_without_hash) != value.get("package_sha256"):
+            raise ValueError("executor migration package hash mismatch")
+        catalog = value.get("catalog")
+        if not isinstance(catalog, Mapping):
+            raise ValueError("executor migration package has no catalog")
+        if sha256_payload(catalog) != value.get("catalog_sha256"):
+            raise ValueError("executor catalog hash mismatch")
+        registry = ExecutorProviderRegistry.import_catalog(
+            catalog,
+            provider_factories=provider_factories,
+        )
+        required = tuple(value.get("required_executor_types") or ())
+        available = {item.executor_type for item in registry.list_descriptors()}
+        missing = sorted(set(required) - available)
+        if missing:
+            raise ValueError(f"destination provider factories are missing: {missing}")
+        if not str(destination_environment or "").strip():
+            raise ValueError("destination_environment is required")
+        return cls(destination_path).save(registry)
@@ -0,0 +1,441 @@
+"""Versioned, extensible executor protocol for AIOS external tasks.
+
+The core lifecycle is executor-neutral. OpenClaw, Hermes, Codex and the scoped
+ChatGPT supervisor are built-in
+providers, not hard-coded protocol branches. Future providers register a
+versioned descriptor and use the same Truth Registry, evidence, notification
+and release-gate mechanisms without modifying the lifecycle state machine.
+"""
+from __future__ import annotations
+
+import json
+import re
+import threading
+from dataclasses import asdict, dataclass, field
+from typing import Any, Mapping, Protocol, Sequence
+
+from .external_task_control import ExternalTaskCoordinator
+from .task_execution_registry import ExecutionTaskManifest, ExecutionTruthRecord
+
+EXECUTOR_PROTOCOL_VERSION = "aios.executor.v1"
+_PROVIDER_NAME = re.compile(r"^[a-z][a-z0-9._-]{1,63}$")
+_VERSION = re.compile(r"^[0-9]+(?:\.[0-9]+){0,2}(?:[-+][A-Za-z0-9._-]+)?$")
+DISCOVERABLE_STATES: Sequence[str] = ("DECLARED", "REGISTERED")
+
+
+def normalize_executor(value: str) -> str:
+    normalized = str(value or "").strip().lower()
+    if not _PROVIDER_NAME.fullmatch(normalized):
+        raise ValueError("executor type must be a lowercase provider identifier")
+    return normalized
+
+
+def _major(version: str) -> int:
+    normalized = str(version or "").strip()
+    if not _VERSION.fullmatch(normalized):
+        raise ValueError(f"invalid version: {version}")
+    return int(normalized.split(".", 1)[0])
+
+
+@dataclass(frozen=True)
+class ExecutorProviderDescriptor:
+    """Portable provider metadata stored without credentials or runtime secrets."""
+
+    executor_type: str
+    adapter_version: str
+    protocol_version: str = EXECUTOR_PROTOCOL_VERSION
+    trust_roles: Sequence[str] = ()
+    capabilities: Sequence[str] = ()
+    configuration_schema: str = "aios.executor.config.v1"
+    portable: bool = True
+    metadata: Mapping[str, Any] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "executor_type", normalize_executor(self.executor_type))
+        adapter_version = str(self.adapter_version or "").strip()
+        if not _VERSION.fullmatch(adapter_version):
+            raise ValueError("adapter_version must be version-like")
+        object.__setattr__(self, "adapter_version", adapter_version)
+        protocol_version = str(self.protocol_version or "").strip()
+        if not protocol_version.startswith("aios.executor.v"):
+            raise ValueError("unsupported executor protocol namespace")
+        int(protocol_version.rsplit("v", 1)[1])
+        object.__setattr__(self, "protocol_version", protocol_version)
+        roles = tuple(sorted({str(item).strip() for item in self.trust_roles if str(item).strip()}))
+        if not roles:
+            raise ValueError("provider must declare at least one trust role")
+        capabilities = tuple(
+            sorted({str(item).strip() for item in self.capabilities if str(item).strip()})
+        )
+        object.__setattr__(self, "trust_roles", roles)
+        object.__setattr__(self, "capabilities", capabilities)
+        object.__setattr__(
+            self,
+            "configuration_schema",
+            str(self.configuration_schema or "").strip(),
+        )
+        object.__setattr__(
+            self,
+            "metadata",
+            json.loads(json.dumps(dict(self.metadata), ensure_ascii=False, default=str)),
+        )
+
+    def as_dict(self) -> dict[str, Any]:
+        value = asdict(self)
+        value["trust_roles"] = list(self.trust_roles)
+        value["capabilities"] = list(self.capabilities)
+        return value
+
+    @classmethod
+    def from_dict(cls, value: Mapping[str, Any]) -> "ExecutorProviderDescriptor":
+        return cls(**dict(value))
+
+    def protocol_compatible_with(self, other: "ExecutorProviderDescriptor") -> bool:
+        return (
+            self.executor_type == other.executor_type
+            and self.protocol_version == other.protocol_version
+            and _major(self.adapter_version) == _major(other.adapter_version)
+        )
+
+
+class ExternalExecutorAdapter(Protocol):
+    """Runtime-specific implementation behind the common lifecycle."""
+
+    descriptor: ExecutorProviderDescriptor
+
+    def discover(self) -> Sequence[ExecutionTruthRecord]: ...
+    def execute(self, manifest: ExecutionTaskManifest) -> Mapping[str, Any]: ...
+    def notify_owner(self, payload: Mapping[str, Any]) -> str: ...
+
+
+class ExecutorProvider(Protocol):
+    descriptor: ExecutorProviderDescriptor
+
+    def validate_manifest(self, manifest: ExecutionTaskManifest) -> None: ...
+    def build_adapter(self, configuration: Mapping[str, Any]) -> ExternalExecutorAdapter: ...
+
+
+class DescriptorOnlyProvider:
+    """Default provider used when lifecycle integration is supplied externally."""
+
+    def __init__(self, descriptor: ExecutorProviderDescriptor) -> None:
+        self.descriptor = descriptor
+
+    def validate_manifest(self, manifest: ExecutionTaskManifest) -> None:
+        if normalize_executor(manifest.executor) != self.descriptor.executor_type:
+            raise ValueError("manifest executor does not match provider")
+
+    def build_adapter(self, configuration: Mapping[str, Any]) -> ExternalExecutorAdapter:
+        raise RuntimeError(
+            f"provider {self.descriptor.executor_type} requires an external adapter factory"
+        )
+
+
+class ExecutorProviderRegistry:
+    """Thread-safe registry supporting runtime registration and catalog migration."""
+
+    def __init__(self, providers: Sequence[ExecutorProvider] = ()) -> None:
+        self._lock = threading.RLock()
+        self._providers: dict[str, ExecutorProvider] = {}
+        for provider in providers:
+            self.register(provider)
+
+    def register(self, provider: ExecutorProvider, *, replace: bool = False) -> None:
+        descriptor = provider.descriptor
+        key = normalize_executor(descriptor.executor_type)
+        with self._lock:
+            current = self._providers.get(key)
+            if current is not None and not replace:
+                raise ValueError(f"executor provider already registered: {key}")
+            if current is not None and not descriptor.protocol_compatible_with(
+                current.descriptor
+            ):
+                raise ValueError(
+                    f"replacement provider is incompatible with registered provider: {key}"
+                )
+            self._providers[key] = provider
+
+    def unregister(self, executor_type: str) -> ExecutorProvider:
+        key = normalize_executor(executor_type)
+        with self._lock:
+            try:
+                return self._providers.pop(key)
+            except KeyError as exc:
+                raise KeyError(f"executor provider is not registered: {key}") from exc
+
+    def get(self, executor_type: str) -> ExecutorProvider:
+        key = normalize_executor(executor_type)
+        with self._lock:
+            provider = self._providers.get(key)
+        if provider is None:
+            raise KeyError(f"executor provider is not registered: {key}")
+        return provider
+
+    def descriptor(self, executor_type: str) -> ExecutorProviderDescriptor:
+        return self.get(executor_type).descriptor
+
+    def validate_manifest(self, manifest: ExecutionTaskManifest) -> None:
+        self.get(manifest.executor).validate_manifest(manifest)
+
+    def trusted(
+        self,
+        *,
+        executor_type: str,
+        roles: Sequence[str],
+        platform_admin: bool = False,
+    ) -> bool:
+        if platform_admin or "platform_admin" in set(roles):
+            return True
+        descriptor = self.descriptor(executor_type)
+        return bool(set(descriptor.trust_roles).intersection(set(roles)))
+
+    def list_descriptors(self) -> tuple[ExecutorProviderDescriptor, ...]:
+        with self._lock:
+            return tuple(
+                self._providers[key].descriptor for key in sorted(self._providers)
+            )
+
+    def export_catalog(self) -> Mapping[str, Any]:
+        return {
+            "schema_version": "aios.executor.catalog.v1",
+            "protocol_version": EXECUTOR_PROTOCOL_VERSION,
+            "providers": [item.as_dict() for item in self.list_descriptors()],
+        }
+
+    @classmethod
+    def import_catalog(
+        cls,
+        value: Mapping[str, Any],
+        *,
+        provider_factories: Mapping[str, ExecutorProvider] | None = None,
+    ) -> "ExecutorProviderRegistry":
+        if value.get("schema_version") != "aios.executor.catalog.v1":
+            raise ValueError("unsupported executor catalog schema")
+        if value.get("protocol_version") != EXECUTOR_PROTOCOL_VERSION:
+            raise ValueError("executor catalog protocol mismatch")
+        factories = dict(provider_factories or {})
+        providers: list[ExecutorProvider] = []
+        for raw in value.get("providers") or ():
+            descriptor = ExecutorProviderDescriptor.from_dict(raw)
+            provider = factories.get(descriptor.executor_type)
+            if provider is not None:
+                if not provider.descriptor.protocol_compatible_with(descriptor):
+                    raise ValueError(
+                        f"provider factory does not match imported descriptor: {descriptor.executor_type}"
+                    )
+                providers.append(provider)
+            else:
+                providers.append(DescriptorOnlyProvider(descriptor))
+        return cls(providers)
+
+
+BUILTIN_PROVIDER_DESCRIPTORS: Sequence[ExecutorProviderDescriptor] = (
+    ExecutorProviderDescriptor(
+        executor_type="openclaw",
+        adapter_version="2.1.0",
+        trust_roles=("runtime", "openclaw_executor"),
+        capabilities=(
+            "deploy",
+            "http_runtime",
+            "owner_notification",
+            "healthcheck",
+            "rollback",
+        ),
+        configuration_schema="aios.executor.openclaw.config.v1",
+        metadata={"official": True},
+    ),
+    ExecutorProviderDescriptor(
+        executor_type="hermes",
+        adapter_version="2.1.0",
+        trust_roles=("runtime", "hermes_executor"),
+        capabilities=(
+            "queue",
+            "lease",
+            "worker",
+            "runtime_validation",
+            "restart_recovery",
+        ),
+        configuration_schema="aios.executor.hermes.config.v1",
+        metadata={"official": True},
+    ),
+    ExecutorProviderDescriptor(
+        executor_type="codex",
+        adapter_version="2.1.0",
+        trust_roles=("codex", "codex_executor"),
+        capabilities=("code", "test", "docs", "gitops_patch", "security_review"),
+        configuration_schema="aios.executor.codex.config.v1",
+        metadata={"official": True},
+    ),
+    ExecutorProviderDescriptor(
+        executor_type="chatgpt-supervisor",
+        adapter_version="2.1.0",
+        trust_roles=("chatgpt_supervisor",),
+        capabilities=(
+            "acceptance",
+            "deploy",
+            "evidence",
+            "healthcheck",
+            "rollback",
+            "wechat_simulation",
+        ),
+        configuration_schema="aios.executor.chatgpt-supervisor.config.v1",
+        metadata={"official": True, "production_mutation_allowed": False},
+    ),
+)
+
+
+def default_provider_registry() -> ExecutorProviderRegistry:
+    return ExecutorProviderRegistry(
+        [DescriptorOnlyProvider(item) for item in BUILTIN_PROVIDER_DESCRIPTORS]
+    )
+
+
+def trusted_for_executor(
+    *,
+    executor: str,
+    roles: Sequence[str],
+    platform_admin: bool = False,
+    registry: ExecutorProviderRegistry | None = None,
+) -> bool:
+    return (registry or default_provider_registry()).trusted(
+        executor_type=executor,
+        roles=roles,
+        platform_admin=platform_admin,
+    )
+
+
+@dataclass(frozen=True)
+class ExecutorIdentity:
+    executor_type: str
+    executor_id: str
+    executor_run_id: str
+    protocol_version: str = EXECUTOR_PROTOCOL_VERSION
+
+    def __post_init__(self) -> None:
+        object.__setattr__(self, "executor_type", normalize_executor(self.executor_type))
+        for name in ("executor_id", "executor_run_id"):
+            value = str(getattr(self, name) or "").strip()
+            if not value:
+                raise ValueError(f"{name} is required")
+            object.__setattr__(self, name, value)
+        if self.protocol_version != EXECUTOR_PROTOCOL_VERSION:
+            raise ValueError("executor identity protocol mismatch")
+
+
+class ExecutorLifecycleSession:
+    """Executor-neutral lifecycle facade used by every registered provider."""
+
+    def __init__(
+        self,
+        coordinator: ExternalTaskCoordinator,
+        identity: ExecutorIdentity,
+        *,
+        registry: ExecutorProviderRegistry | None = None,
+    ) -> None:
+        self.coordinator = coordinator
+        self.identity = identity
+        self.registry = registry or default_provider_registry()
+        self.registry.get(identity.executor_type)
+
+    def _assert_manifest(self, task_id: str) -> ExecutionTaskManifest:
+        record = self.coordinator.registry.get(task_id)
+        manifest = record.manifest
+        self.registry.validate_manifest(manifest)
+        if normalize_executor(manifest.executor) != self.identity.executor_type:
+            raise PermissionError(
+                f"task executor is {manifest.executor}, not {self.identity.executor_type}"
+            )
+        return manifest
+
+    def register(self, task_id: str) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.register(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+        )
+
+    def retry_not_started(self, task_id: str) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.retry_not_started(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+        )
+
+    def claim(self, task_id: str) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.claim(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+        )
+
+    def start(self, task_id: str) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.start(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+        )
+
+    def heartbeat(self, task_id: str, *, current_step: int) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.heartbeat(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+            current_step=current_step,
+        )
+
+    def succeed(
+        self,
+        task_id: str,
+        *,
+        evidence: Mapping[str, str],
+    ) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.succeed(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+            evidence=evidence,
+        )
+
+    def fail(
+        self,
+        task_id: str,
+        *,
+        error: Mapping[str, Any],
+        evidence: Mapping[str, str] | None = None,
+    ) -> ExecutionTruthRecord:
+        self._assert_manifest(task_id)
+        return self.coordinator.fail(
+            task_id,
+            executor_run_id=self.identity.executor_run_id,
+            executor_id=self.identity.executor_id,
+            error=error,
+            evidence=evidence,
+        )
+
+
+class OpenClawExecutorSession(ExecutorLifecycleSession):
+    def __init__(self, coordinator: ExternalTaskCoordinator, *, executor_id: str, executor_run_id: str) -> None:
+        super().__init__(
+            coordinator,
+            ExecutorIdentity("openclaw", executor_id, executor_run_id),
+        )
+
+
+class HermesExecutorSession(ExecutorLifecycleSession):
+    def __init__(self, coordinator: ExternalTaskCoordinator, *, executor_id: str, executor_run_id: str) -> None:
+        super().__init__(
+            coordinator,
+            ExecutorIdentity("hermes", executor_id, executor_run_id),
+        )
+
+
+class CodexExecutorSession(ExecutorLifecycleSession):
+    def __init__(self, coordinator: ExternalTaskCoordinator, *, executor_id: str, executor_run_id: str) -> None:
+        super().__init__(
+            coordinator,
+            ExecutorIdentity("codex", executor_id, executor_run_id),
+        )
@@ -0,0 +1,313 @@
+"""Provider-neutral worker runtime for AIOS external executors.
+
+Providers implement only step execution and notification delivery. Discovery,
+dependency gates, lifecycle truth, heartbeat, evidence validation and durable
+notification acknowledgement are identical for every current and future
+executor Provider.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import uuid
+from dataclasses import dataclass, field
+from typing import Any, Mapping, Protocol, Sequence
+
+from .execution_plan import ExecutionPlanCoordinator, ExecutionStageManifest
+from .executor_protocol import (
+    ExecutorIdentity,
+    ExecutorLifecycleSession,
+    ExecutorProviderRegistry,
+    normalize_executor,
+)
+from .external_task_control import ExternalTaskCoordinator, NotificationRecord
+from .task_execution_registry import ExecutionTruthState
+
+
+class StepRunner(Protocol):
+    def run_step(
+        self,
+        *,
+        plan_id: str,
+        stage: ExecutionStageManifest,
+        step: str,
+        step_number: int,
+        executor_id: str,
+        executor_run_id: str,
+    ) -> Mapping[str, str]: ...
+
+
+class NotificationSender(Protocol):
+    def send(self, notification: NotificationRecord) -> str: ...
+
+
+@dataclass(frozen=True)
+class StageRunResult:
+    plan_id: str
+    stage_id: str
+    task_id: str
+    executor_type: str
+    executor_id: str
+    executor_run_id: str
+    state: str
+    evidence: Mapping[str, str] = field(default_factory=dict)
+    error: Mapping[str, Any] = field(default_factory=dict)
+    delivered_notifications: Sequence[str] = ()
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "plan_id": self.plan_id,
+            "stage_id": self.stage_id,
+            "task_id": self.task_id,
+            "executor_type": self.executor_type,
+            "executor_id": self.executor_id,
+            "executor_run_id": self.executor_run_id,
+            "state": self.state,
+            "evidence": dict(self.evidence),
+            "error": dict(self.error),
+            "delivered_notifications": list(self.delivered_notifications),
+        }
+
+
+class UnifiedExecutorWorker:
+    """Dependency-aware worker shared by every registered Provider."""
+
+    def __init__(
+        self,
+        *,
+        plan_coordinator: ExecutionPlanCoordinator,
+        task_coordinator: ExternalTaskCoordinator,
+        providers: ExecutorProviderRegistry,
+        executor_type: str,
+        executor_id: str,
+        step_runner: StepRunner,
+        notification_sender: NotificationSender,
+    ) -> None:
+        self.plan_coordinator = plan_coordinator
+        self.task_coordinator = task_coordinator
+        self.providers = providers
+        self.executor_type = normalize_executor(executor_type)
+        self.executor_id = str(executor_id or "").strip()
+        if not self.executor_id:
+            raise ValueError("executor_id is required")
+        self.providers.get(self.executor_type)
+        self.step_runner = step_runner
+        self.notification_sender = notification_sender
+
+    def _session(self, executor_run_id: str) -> ExecutorLifecycleSession:
+        return ExecutorLifecycleSession(
+            self.task_coordinator,
+            ExecutorIdentity(
+                executor_type=self.executor_type,
+                executor_id=self.executor_id,
+                executor_run_id=executor_run_id,
+            ),
+            registry=self.providers,
+        )
+
+    def _notification_candidates(self, task_id: str) -> tuple[NotificationRecord, ...]:
+        """Return idempotent delivery candidates, including prior failures.
+
+        The outbox has a unique ``(task_id, event_type)`` key. Retrying therefore
+        reuses the same notification ID and cannot create duplicate STARTED or
+        SUCCEEDED events. A later successful acknowledgement replaces FAILED
+        with DELIVERED and records the receipt hash.
+        """
+        candidates: dict[str, NotificationRecord] = {}
+        for status in ("PENDING", "FAILED"):
+            for item in self.task_coordinator.notifications.list(
+                task_id=task_id,
+                status=status,
+            ):
+                candidates[item.notification_id] = item
+        return tuple(
+            candidates[key]
+            for key in sorted(
+                candidates,
+                key=lambda item: (
+                    candidates[item].created_at,
+                    candidates[item].notification_id,
+                ),
+            )
+        )
+
+    def _deliver_notifications(self, task_id: str) -> tuple[str, ...]:
+        delivered: list[str] = []
+        for item in self._notification_candidates(task_id):
+            try:
+                receipt = self.notification_sender.send(item)
+                acknowledged = self.task_coordinator.notifications.acknowledge(
+                    item.notification_id,
+                    receipt_sha256=receipt,
+                )
+                delivered.append(acknowledged.event_type)
+            except Exception as exc:
+                self.task_coordinator.notifications.fail(
+                    item.notification_id,
+                    error=f"{type(exc).__name__}: {exc}",
+                )
+        return tuple(sorted(set(delivered)))
+
+    def retry_failed_notifications(self, *, task_id: str) -> tuple[str, ...]:
+        """Retry failed owner notifications without changing task truth."""
+        return self._deliver_notifications(task_id)
+
+    def run_ready(
+        self,
+        *,
+        plan_id: str,
+        max_stages: int = 1,
+    ) -> list[StageRunResult]:
+        if max_stages < 1:
+            raise ValueError("max_stages must be positive")
+        ready = self.plan_coordinator.discover_ready(
+            plan_id=plan_id,
+            executor_type=self.executor_type,
+        )[:max_stages]
+        return [
+            self.run_stage(
+                plan_id=plan_id,
+                stage_id=item["stage"]["stage_id"],
+            )
+            for item in ready
+        ]
+
+    def run_stage(
+        self,
+        *,
+        plan_id: str,
+        stage_id: str,
+        executor_run_id: str | None = None,
+    ) -> StageRunResult:
+        plan = self.plan_coordinator.plan_store.get(plan_id)
+        stage = plan.stage(stage_id)
+        if stage.executor_type != self.executor_type:
+            raise PermissionError(
+                f"stage executor is {stage.executor_type}, not {self.executor_type}"
+            )
+        dependency = self.plan_coordinator.dependency_gate(plan_id, stage_id)
+        if not dependency["passed"]:
+            raise RuntimeError("stage dependencies are not satisfied")
+
+        run_id = executor_run_id or f"{self.executor_type}_run_{uuid.uuid4().hex}"
+        session = self._session(run_id)
+        record = self.task_coordinator.registry.get(stage.task_id)
+        evidence: dict[str, str] = dict(record.evidence)
+        delivered: list[str] = []
+        try:
+            if record.state == ExecutionTruthState.DECLARED:
+                record = session.register(stage.task_id)
+            if record.state == ExecutionTruthState.REGISTERED:
+                record = session.claim(stage.task_id)
+            if record.state == ExecutionTruthState.CLAIMED:
+                record = session.start(stage.task_id)
+                delivered.extend(self._deliver_notifications(stage.task_id))
+            if record.state != ExecutionTruthState.RUNNING:
+                raise RuntimeError(
+                    f"stage cannot execute from state {record.state.value}"
+                )
+
+            # Re-running the current step is intentional: Provider steps must be
+            # idempotent and a crash between side effect and heartbeat cannot be
+            # safely interpreted as completed work.
+            start_step = max(1, record.current_step)
+            for number, step in enumerate(stage.steps, start=1):
+                if number < start_step:
+                    continue
+                produced = self.step_runner.run_step(
+                    plan_id=plan_id,
+                    stage=stage,
+                    step=step,
+                    step_number=number,
+                    executor_id=self.executor_id,
+                    executor_run_id=run_id,
+                )
+                if not isinstance(produced, Mapping):
+                    raise TypeError("step runner must return an evidence mapping")
+                evidence.update(
+                    {
+                        str(key).strip(): str(value).strip().lower()
+                        for key, value in produced.items()
+                    }
+                )
+                record = session.heartbeat(stage.task_id, current_step=number)
+
+            record = session.succeed(stage.task_id, evidence=evidence)
+            delivered.extend(self._deliver_notifications(stage.task_id))
+            return StageRunResult(
+                plan_id=plan_id,
+                stage_id=stage.stage_id,
+                task_id=stage.task_id,
+                executor_type=self.executor_type,
+                executor_id=self.executor_id,
+                executor_run_id=run_id,
+                state=record.state.value,
+                evidence=dict(record.evidence),
+                delivered_notifications=tuple(sorted(set(delivered))),
+            )
+        except Exception as exc:
+            current = self.task_coordinator.registry.get(stage.task_id)
+            if current.state in {
+                ExecutionTruthState.REGISTERED,
+                ExecutionTruthState.CLAIMED,
+                ExecutionTruthState.RUNNING,
+            }:
+                current = session.fail(
+                    stage.task_id,
+                    error={
+                        "code": "executor_stage_failed",
+                        "error_type": type(exc).__name__,
+                        "message": str(exc),
+                    },
+                    evidence=evidence or None,
+                )
+            delivered.extend(self._deliver_notifications(stage.task_id))
+            return StageRunResult(
+                plan_id=plan_id,
+                stage_id=stage.stage_id,
+                task_id=stage.task_id,
+                executor_type=self.executor_type,
+                executor_id=self.executor_id,
+                executor_run_id=run_id,
+                state=current.state.value,
+                evidence=dict(current.evidence),
+                error=dict(current.error),
+                delivered_notifications=tuple(sorted(set(delivered))),
+            )
+
+
+class JsonEvidenceStepRunner:
+    """Adapter for handlers returning evidence-name to SHA256 mappings."""
+
+    def __init__(self, handler) -> None:
+        self.handler = handler
+
+    def run_step(self, **values: Any) -> Mapping[str, str]:
+        result = self.handler(**values)
+        if not isinstance(result, Mapping):
+            raise TypeError("step handler must return a mapping")
+        return {str(key): str(value) for key, value in result.items()}
+
+
+class JsonReceiptNotificationSender:
+    """Adapter for senders returning a SHA256 or receipt JSON object."""
+
+    def __init__(self, sender) -> None:
+        self.sender = sender
+
+    def send(self, notification: NotificationRecord) -> str:
+        result = self.sender(notification.as_dict())
+        if isinstance(result, str):
+            return result
+        if not isinstance(result, Mapping):
+            raise TypeError(
+                "notification sender must return SHA256 or a receipt object"
+            )
+        encoded = json.dumps(
+            dict(result),
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+            default=str,
+        ).encode("utf-8")
+        return hashlib.sha256(encoded).hexdigest()
@@ -0,0 +1,266 @@
+#!/usr/bin/env python3
+"""CLI for durable external-task truth and notification receipts.
+
+The CLI is suitable for OpenClaw workers, systemd jobs and release gates. It
+never infers execution from the presence of a manifest: each lifecycle action
+must be recorded explicitly in the shared SQLite registry.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+from typing import Any, Mapping, Sequence
+
+from .external_task_control import ExternalTaskCoordinator
+from .external_task_query import list_records
+
+
+def _json_mapping(value: str | None, path: str | None) -> Mapping[str, Any]:
+    if value and path:
+        raise ValueError("inline JSON and JSON file are mutually exclusive")
+    if path:
+        parsed = json.loads(Path(path).read_text(encoding="utf-8"))
+    else:
+        parsed = json.loads(value or "{}")
+    if not isinstance(parsed, Mapping):
+        raise ValueError("JSON value must be an object")
+    return dict(parsed)
+
+
+def _coordinator(args: argparse.Namespace) -> ExternalTaskCoordinator:
+    return ExternalTaskCoordinator.from_file(args.store_file)
+
+
+def _print(value: Any) -> None:
+    print(json.dumps(value, ensure_ascii=False, sort_keys=True, indent=2, default=str))
+
+
+def cmd_declare(args: argparse.Namespace) -> int:
+    record = _coordinator(args).declare_file(args.manifest)
+    _print(record.as_dict())
+    return 0
+
+
+def cmd_discover(args: argparse.Namespace) -> int:
+    records = list_records(
+        args.store_file,
+        executor=args.executor,
+        states=tuple(args.state or ()),
+    )
+    _print({"count": len(records), "items": [item.as_dict() for item in records]})
+    return 0
+
+
+def cmd_register(args: argparse.Namespace) -> int:
+    _print(_coordinator(args).register(args.task_id, executor_run_id=args.executor_run_id).as_dict())
+    return 0
+
+
+def cmd_claim(args: argparse.Namespace) -> int:
+    _print(
+        _coordinator(args).claim(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_start(args: argparse.Namespace) -> int:
+    _print(
+        _coordinator(args).start(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_heartbeat(args: argparse.Namespace) -> int:
+    _print(
+        _coordinator(args).heartbeat(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+            current_step=args.current_step,
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_succeed(args: argparse.Namespace) -> int:
+    evidence = _json_mapping(args.evidence_json, args.evidence_file)
+    _print(
+        _coordinator(args).succeed(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+            evidence={str(key): str(value) for key, value in evidence.items()},
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_fail(args: argparse.Namespace) -> int:
+    error = _json_mapping(args.error_json, args.error_file)
+    evidence = None
+    if args.evidence_json or args.evidence_file:
+        evidence_value = _json_mapping(args.evidence_json, args.evidence_file)
+        evidence = {str(key): str(value) for key, value in evidence_value.items()}
+    _print(
+        _coordinator(args).fail(
+            args.task_id,
+            executor_run_id=args.executor_run_id,
+            executor_id=args.executor_id,
+            error=error,
+            evidence=evidence,
+        ).as_dict()
+    )
+    return 0
+
+
+def cmd_status(args: argparse.Namespace) -> int:
+    _print(_coordinator(args).status(args.task_id))
+    return 0
+
+
+def cmd_gate(args: argparse.Namespace) -> int:
+    value = _coordinator(args).gate(args.task_id)
+    _print(value)
+    return 0 if value["passed"] else 3
+
+
+def cmd_notifications(args: argparse.Namespace) -> int:
+    items = _coordinator(args).notifications.list(task_id=args.task_id, status=args.status)
+    _print({"count": len(items), "items": [item.as_dict() for item in items]})
+    return 0
+
+
+def cmd_ack(args: argparse.Namespace) -> int:
+    _print(
+        _coordinator(args).notifications.acknowledge(
+            args.notification_id,
+            receipt_sha256=args.receipt_sha256,
+        ).as_dict()
+    )
+    return 0
+
+
+def common(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument(
+        "--store-file",
+        default=os.getenv(
+            "AIOS_EXTERNAL_TASK_STORE_FILE",
+            "/var/lib/aios-v2/external-task-truth.sqlite3",
+        ),
+    )
+
+
+def lifecycle(parser: argparse.ArgumentParser) -> None:
+    parser.add_argument("--task-id", required=True)
+    parser.add_argument("--executor-run-id", required=True)
+    parser.add_argument("--executor-id", required=True)
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(description="AIOS external task truth CLI")
+    commands = parser.add_subparsers(dest="command", required=True)
+
+    declare = commands.add_parser("declare")
+    common(declare)
+    declare.add_argument("--manifest", required=True)
+    declare.set_defaults(handler=cmd_declare)
+
+    discover = commands.add_parser("discover")
+    common(discover)
+    discover.add_argument("--executor", default="openclaw")
+    discover.add_argument("--state", action="append")
+    discover.set_defaults(handler=cmd_discover)
+
+    register = commands.add_parser("register")
+    common(register)
+    register.add_argument("--task-id", required=True)
+    register.add_argument("--executor-run-id", required=True)
+    register.set_defaults(handler=cmd_register)
+
+    claim = commands.add_parser("claim")
+    common(claim)
+    lifecycle(claim)
+    claim.set_defaults(handler=cmd_claim)
+
+    start = commands.add_parser("start")
+    common(start)
+    lifecycle(start)
+    start.set_defaults(handler=cmd_start)
+
+    heartbeat = commands.add_parser("heartbeat")
+    common(heartbeat)
+    lifecycle(heartbeat)
+    heartbeat.add_argument("--current-step", type=int, required=True)
+    heartbeat.set_defaults(handler=cmd_heartbeat)
+
+    succeed = commands.add_parser("succeed")
+    common(succeed)
+    lifecycle(succeed)
+    evidence = succeed.add_mutually_exclusive_group(required=True)
+    evidence.add_argument("--evidence-json")
+    evidence.add_argument("--evidence-file")
+    succeed.set_defaults(handler=cmd_succeed)
+
+    fail = commands.add_parser("fail")
+    common(fail)
+    lifecycle(fail)
+    error = fail.add_mutually_exclusive_group(required=True)
+    error.add_argument("--error-json")
+    error.add_argument("--error-file")
+    fail_evidence = fail.add_mutually_exclusive_group()
+    fail_evidence.add_argument("--evidence-json")
+    fail_evidence.add_argument("--evidence-file")
+    fail.set_defaults(handler=cmd_fail)
+
+    status = commands.add_parser("status")
+    common(status)
+    status.add_argument("--task-id", required=True)
+    status.set_defaults(handler=cmd_status)
+
+    gate = commands.add_parser("gate")
+    common(gate)
+    gate.add_argument("--task-id", required=True)
+    gate.set_defaults(handler=cmd_gate)
+
+    notifications = commands.add_parser("notifications")
+    common(notifications)
+    notifications.add_argument("--task-id")
+    notifications.add_argument("--status")
+    notifications.set_defaults(handler=cmd_notifications)
+
+    ack = commands.add_parser("ack-notification")
+    common(ack)
+    ack.add_argument("--notification-id", required=True)
+    ack.add_argument("--receipt-sha256", required=True)
+    ack.set_defaults(handler=cmd_ack)
+    return parser
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    try:
+        return int(args.handler(args))
+    except Exception as exc:
+        print(
+            json.dumps(
+                {"status": "error", "error": type(exc).__name__, "message": str(exc)},
+                ensure_ascii=False,
+            ),
+            file=sys.stderr,
+        )
+        return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
--- a/Show More
+++ b/Show More