evidence: close V2R1C4 v3 security validation

security: prove failure scenarios and non-root execution
security: derive evidence gates from required raw results
2026-07-29 20:32:26 +08:00 · 2026-07-29 20:27:20 +08:00 · 2026-07-29 20:21:05 +08:00 · 2026-07-29 20:08:59 +08:00 · 2026-07-29 19:58:42 +08:00 · 2026-07-29 19:50:05 +08:00
468 changed files with 15360 additions and 46870 deletions
@@ -1,486 +0,0 @@
 # Agent Production Deployment Requirements
 ## Status entering deployment
 ```yaml
 code_development: COMPLETED
 repository_commit: NOT_CREATED
 production_deployment: NOT_STARTED
 reason_repository_commit_missing:
  current ChatGPT GitOps runtime has AIOS_GITOPS_WRITES_ENABLED=false
 ```
 The code bundle is an input artifact. The Agent must place it on a non-main
 integration branch, review it, run acceptance tests, merge it through protected
 main and deploy the API adapter. The Agent must not regenerate or materially
 rewrite the supplied implementation without recording the new diff and tests.
 ## Frozen production state
 Before any change, verify:
 ```yaml
 main_oid: 875d41c3101093149414292067fd700dc214d4d3
 V2R1C5:
  tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
  peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
  baseline_version: V2R1C5
  baseline_status: PRODUCTION_DEPLOYED
  target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
  evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
 ```
 If authoritative `main` no longer equals the approved base OID, stop with
 `MANUAL_OWNER_REVIEW_REQUIRED / AUTHORIZED_BASE_OID_DRIFT`. Do not silently
 rebase the bundle onto a different base.
 ## Bootstrap sequence — no additional Owner interaction
 Use the following order so that the approved V2R1C6 base OID remains valid and
 the bridge does not create its own authorization deadlock:
 1. Verify the supplied archive/patch SHA-256.
 2. Install the bundle into a temporary root-owned staging directory outside the
   Git worktrees.
 3. Start a localhost-only temporary instance of
   `aios_authorized_task_writer_api.py` on a dedicated port or Unix socket.
 4. Bind it to the existing authenticated Owner registry and the exact
   `writer:provision` scope. Do not expose it through the public gateway.
 5. Execute the live V2R1C6 provisioning request while `main` still equals
   `875d41c3101093149414292067fd700dc214d4d3`.
 6. Verify `READY_FOR_CODE_AUTHORING`, the exact branch OID, writer scope and
   negative policy tests.
 7. Use the newly created scoped writer to commit this reviewed bundle onto:
   `agent/v2r1c6-mainline-reconciliation-20260805`.
 8. Stop and remove the temporary bootstrap service and revoke its temporary
   runtime credential. Preserve its signed grant receipt and audit logs.
 9. Open a protected PR from the V2R1C6 branch. Deploy the permanent bridge only
   from the reviewed merge commit.
 The temporary service is a control-plane bootstrap, not a production release.
 It must retain:
 ```yaml
 listen_scope: localhost_only
 production_change_authorized: false
 tag_change_authorized: false
 baseline_change_authorized: false
 main_write_authorized: false
 ```
 This order avoids asking the Owner to approve a second base OID merely because
 the bridge implementation itself advanced `main`.
 ### Alternative platform-maintenance path
 If policy prohibits a temporary localhost bootstrap service, use an existing
 Owner-approved platform-maintenance executor to create:
 ```yaml
 branch: patch/owner-authorization-writer-bridge-20260806
 base_ref: refs/heads/main
 base_oid: 875d41c3101093149414292067fd700dc214d4d3
 direct_main_push: false
 force_push: false
 tag_write: false
 baseline_write: false
 production_deploy_during_integration: false
 ```
 Merging that branch before V2R1C6 provisioning changes the authoritative base
 OID. In that alternative only, a new exact Owner base-OID amendment is required.
 The Agent must never substitute the newer `main` OID automatically.
 ## Files to install on the branch
 Copy with the same relative paths:
 ```text
 active-runtime/app/authorized_task_writer_provisioning.py
 active-runtime/app/aios_authorized_task_writer_api.py
 docs/gitops/authorized-task-writer-provisioning.md
 docs/gitops/openapi-authorized-task-writer-fragment.yaml
 deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
 scripts/smoke_authorized_task_writer_provisioning.py
 tests/test_authorized_task_writer_provisioning.py
 ```
 Merge the OpenAPI fragment into:
 ```text
 docs/gitops/openapi-chatgpt-actions.yaml
 ```
 The final schema must expose:
 ```yaml
 operationId: provisionAuthorizedTaskWriter
 path: POST /api/task-writer/provision-authorized
 x-openai-isConsequential: true
 ```
 Do not deploy the fragment as a second standalone OpenAPI document.
 ## Required review of existing API integration
 The adapter expects the existing API handler to provide:
 ```python
 handler.need(scope)
 handler.body()
 handler.sendj(value, status=200)
 api.H.do_POST
 api.main()
 ```
 Confirm these contracts against the branch before merge. If the live API has a
 different authentication object shape, make the smallest adapter-only change
 and rerun every test. The core provisioning policy must remain unchanged.
 The API authorization registry must grant `writer:provision` only to the
 authenticated Owner role. Agents and ordinary writer tokens must not receive
 this scope.
 ## Privilege boundary
 The API service must remain non-root.
 Install a root-owned sudoers rule that allows the API service identity to run
 only these exact commands with `sudo -n --`:
 ```text
 /usr/local/libexec/aios-grant-signer-adapter
 /usr/local/libexec/aios-grant-validator
 /usr/local/libexec/aios-task-writer-provisioner
 ```
 Do not allow:
 ```text
 /bin/sh
 /bin/bash
 /usr/bin/env
 /usr/bin/git
 wildcard executable paths
 SETENV
 arbitrary environment preservation
 ```
 The governed tools themselves must validate their `--grant-dir` and
 `--result-json` paths. Their binaries must be root-owned, non-symlink, regular,
 executable and not group/world writable.
 The signer must access its private signing material only through a runtime
 secret reference. No signing key or token may enter Git, API output, the
 provisioning receipt or systemd environment text.
 ## Runtime paths and permissions
 Create:
 ```text
 /var/lib/aios-gitops/authorized-writer-bridge
 /var/lib/aios-gitops/authorized-writer-bridge/receipts
 /var/lib/aios-gitops/authorized-writer-bridge/locks
 ```
 Required properties:
 ```yaml
 owner: API service identity
 mode: "0700"
 symlink: false
 persistent: true
 ```
 The directory contains redacted receipts only. Temporary signed grant
 directories are deleted after success or failure.
 ## Required staging environment
 Configure the API service:
 ```text
 AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
 AIOS_GITOPS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
 AIOS_GITOPS_AUTHORIZED_WRITER_STATE_ROOT=/var/lib/aios-gitops/authorized-writer-bridge
 AIOS_GITOPS_GRANT_SIGNER_ADAPTER=/usr/local/libexec/aios-grant-signer-adapter
 AIOS_GITOPS_GRANT_VALIDATOR=/usr/local/libexec/aios-grant-validator
 AIOS_GITOPS_TASK_WRITER_PROVISIONER=/usr/local/libexec/aios-task-writer-provisioner
 AIOS_GITOPS_OWNER_PROVISION_SCOPE=writer:provision
 AIOS_GITOPS_GOVERNED_USE_SUDO=true
 AIOS_GITOPS_SUDO_PATH=/usr/bin/sudo
 ```
 Use `aios_authorized_task_writer_api.py` as the API entrypoint. It delegates
 all pre-existing routes and adds only the new endpoint.
 ## Pre-merge tests
 Run from the repository root:
 ```bash
 python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py
 python3 scripts/smoke_authorized_task_writer_provisioning.py
 python3 -m py_compile \
  active-runtime/app/authorized_task_writer_provisioning.py \
  active-runtime/app/aios_authorized_task_writer_api.py
 ```
 Required result:
 ```yaml
 unit_tests:
  total: 9
  failures: 0
  errors: 0
 smoke: PASS
 py_compile: PASS
 ```
 Also run all existing GitOps API and isolated writer tests affected by:
 ```text
 aios_chatgpt_actions_api
 aios_isolated_writer_api
 isolated_writer_authz
 isolated_writer_token_registry
 single_owner_governance
 OpenAPI schema validation
 ```
 Any regression blocks merge.
 ## Staging API acceptance
 ### Negative authentication
 An Agent or non-Owner credential calling the endpoint must receive:
 ```yaml
 http_status: 403
 error: OWNER_AUTHORIZATION_REQUIRED
 ```
 ### Negative scope tests
 Requests enabling any of the following must be denied before signer execution:
 ```text
 production_change_authorized=true
 tag_change_authorized=true
 baseline_change_authorized=true
 main_write_authorized=true
 allowed_operations containing tag/main/baseline/admin operations
 missing required denied operation
 one_time_use=false
 expiry over 1800 seconds
 ```
 ### Drift and conflict tests
 Verify:
 ```yaml
 wrong_base_oid:
  http_status: 409
  error: AUTHORIZED_BASE_OID_DRIFT
 existing_unreceipted_target_branch:
  http_status: 409
  error: EXISTING_BRANCH_OID_CONFLICT
 ```
 ### Governed tool failures
 Independently inject and verify fail-closed behavior for:
 ```text
 signer unavailable
 signer signature absent
 validator signature_valid=false
 validator signer_trusted=false
 validator plan expired
 provisioner grant_consumed=false
 provisioner writer scope enables main/tag/baseline/force push
 any required negative policy test false
 ```
 None may create or modify a Git ref.
 ## Live V2R1C6 provisioning request
 After protected merge and API deployment, authenticate as the Owner and submit
 exactly:
 ```json
 {
  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
  "repository": "aios/aios",
  "base_ref": "refs/heads/main",
  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
  "owner_authorization_reference": "chat-owner-authorization:v2r1c6:20260806",
  "one_time_use": true,
  "expires_in_seconds": 900,
  "production_change_authorized": false,
  "tag_change_authorized": false,
  "baseline_change_authorized": false,
  "main_write_authorized": false,
  "allowed_operations": [
    "create_worktree",
    "create_target_branch_if_absent",
    "commit_to_target_branch",
    "push_target_branch"
  ],
  "denied_operations": [
    "direct_main_push",
    "force_push",
    "tag_create",
    "tag_update",
    "tag_delete",
    "branch_delete",
    "repository_admin",
    "baseline_write",
    "production_deploy",
    "production_marker_write",
    "history_rewrite"
  ]
 }
 ```
 This request must be executed by the localhost-only bootstrap instance before
 the bridge code advances `main`. The endpoint must never infer “current main”.
 If the Agent chooses the alternative merge-first path, it must stop after the
 merge and obtain an exact Owner amendment for the new merge OID. It must not
 silently replace the approved OID.
 ## Success response
 Require:
 ```yaml
 status: READY_FOR_CODE_AUTHORING
 grant_consumed: true
 branch: agent/v2r1c6-mainline-reconciliation-20260805
 branch_oid: <exact amended authorized base OID>
 base_oid: <same exact OID>
 main_unchanged: true
 writer_scope:
  workspace_role: task-scoped-isolated-writer
  writes_enabled: true
  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
  allowed_base_oid: <exact amended authorized base OID>
  allowed_routes:
    - POST /api/commit-file
  allow_main_write: false
  allow_tag_write: false
  allow_baseline_write: false
  allow_force_push: false
 ```
 All seven negative policy results must be true.
 Submit the identical request a second time. It must return the same grant and
 branch attestation with:
 ```yaml
 idempotent: true
 ```
 It must not run the provisioner again.
 ## Production postchecks
 After API deployment and writer provisioning, independently verify:
 ```yaml
 existing_routes_regression: PASS
 new_endpoint: PASS
 main_ref: expected reviewed merge commit
 V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
 V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
 V2R1C5_baseline_unchanged: true
 new_release_tag_created: false
 production_baseline_changed: false
 ```
 The deployment of this control-plane bridge does not authorize a V2R1C6
 production release. It only enables scoped code authoring.
 ## Rollback
 If the new API route fails:
 1. Stop accepting new provisioning calls.
 2. Restore the previous API entrypoint.
 3. Restart and verify all existing routes.
 4. Preserve receipts and logs.
 5. Revoke any task writer capability already minted.
 6. Do not delete a branch or rewrite a tag.
 7. Revert the protected-main bridge commit through an ordinary reviewed revert
   PR if source rollback is required.
 ## Required final Agent report
 ```yaml
 STATUS: COMPLETED | PARTIALLY_COMPLETED | BLOCKED | FAILED
 INTEGRATION:
  branch:
  commit:
  protected_pr:
  merge_commit:
  files_changed:
 TESTS:
  unit:
  smoke:
  py_compile:
  regression:
  fault_injection:
 DEPLOYMENT:
  service:
  entrypoint:
  runtime_status:
  endpoint_status:
  rollback_verified:
 PROVISIONING:
  owner_authorization_reference:
  approval_plan_id:
  grant_id:
  grant_digest_sha256:
  signing_key_identity:
  branch:
  branch_oid:
  workspace_path:
  grant_consumed:
  idempotent_replay:
 CONSISTENCY:
  main_oid:
  V2R1C5_tag_oid:
  V2R1C5_peeled_target_oid:
  baseline_version:
  baseline_changed:
  tags_changed:
 SECRETS:
  runtime_secret_reference_used:
  plaintext_secret_logged:
  plaintext_secret_committed:
 BLOCKERS:
 GOVERNANCE:
  force_push_used: false
  tag_rewritten: false
  direct_main_push: false
  secrets_committed: false
  owner_approval_respected: true
 ```
@@ -1,401 +0,0 @@
 # Agent Deployment Requirements: Owner Authorization Broker V2
 ## Objective
 Deploy the audited Owner Authorization Broker that closes the bootstrap gap
 without issuing a new general-purpose Owner credential and without modifying
 `/data/aios-gitops/runtime/secrets/gitops.tokens`.
 The broker reuses one existing, non-wildcard Owner credential only to
 authenticate the Owner identity through one pre-existing exact scope. It then
 records an immutable task authorization event and directly invokes the
 existing signed grant -> validator -> one-shot provisioner chain.
 Production deployment of V2R1C6 is **not** authorized by this task.
 ## Fixed bindings
 ```yaml
 task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
 repository: aios/aios
 base_ref: refs/heads/main
 base_oid: 875d41c3101093149414292067fd700dc214d4d3
 target_branch: agent/v2r1c6-mainline-reconciliation-20260805
 production_change_authorized: false
 tag_change_authorized: false
 baseline_change_authorized: false
 main_write_authorized: false
 ```
 The existing V2R1C5 objects are frozen:
 ```yaml
 tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
 peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
 baseline_version: V2R1C5
 baseline_status: PRODUCTION_DEPLOYED
 ```
 ## 1. Package verification
 Verify `MANIFEST.sha256` before installation. Reject any mismatch.
 Run:
 ```bash
 python3 -m unittest -v \
  tests/test_authorized_task_writer_provisioning.py \
  tests/test_owner_authorization_broker.py
 python3 scripts/smoke_authorized_task_writer_provisioning.py
 python3 scripts/smoke_owner_authorization_broker.py
 python3 -m py_compile \
  active-runtime/app/authorized_task_writer_provisioning.py \
  active-runtime/app/aios_authorized_task_writer_api.py \
  active-runtime/app/owner_authorization_broker.py \
  active-runtime/app/aios_owner_authorization_broker_api.py
 ```
 All checks must pass.
 ## 2. Existing Owner credential selection
 Read only the non-secret registry metadata. Select one existing credential
 that satisfies all of the following:
 ```yaml
 role: owner
 wildcard_scope: false
 account: exact known Owner identity
 contains_exact_intake_scope: true
 ```
 Use one existing exact scope such as `commit:create` or `file:write`. Prefer
 the narrowest scope already assigned to the intended Owner.
 Do not:
 - use the historical wildcard Owner credential;
 - add `writer:provision` to any bearer token;
 - create or modify a bearer credential;
 - print, copy or commit bearer-token material.
 Record only:
 ```yaml
 owner_account: <non-secret account>
 credential_id: <non-secret ID, when available>
 intake_scope: <one exact existing scope>
 scope_readback_available: true|false
 ```
 If `handler.need()` returns the exact scope set, configure the Owner account
 allowlist and leave the credential ID allowlist empty.
 If scope metadata is not returned, configure the exact non-secret credential
 ID allowlist. If neither exact scope metadata nor a stable non-secret
 credential ID can be proven, stop:
 ```yaml
 STATUS: BLOCKED
 REASON: OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE
 ```
 ## 3. Staging installation
 Install the four application modules in a root-owned staging directory:
 ```text
 authorized_task_writer_provisioning.py
 aios_authorized_task_writer_api.py
 owner_authorization_broker.py
 aios_owner_authorization_broker_api.py
 ```
 The directory and files must not be group/world writable.
 Prepare environment values:
 ```yaml
 AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED: "true"
 AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES: <one exact existing scope>
 AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES: <exact owner account>
 AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS: <exact ID or empty>
 AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS: "900"
 AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT:
  /var/lib/aios-gitops/owner-authorization-broker
 ```
 Use the existing signer, validator and provisioner paths. Do not change their
 root governance configuration or disable signature checks.
 Start a localhost-only staging instance on a temporary port. Do not replace
 the production service yet.
 ## 4. Authentication fail-closed tests
 The staging endpoint is:
 ```text
 POST /api/governance/owner-authorizations
 ```
 Required tests:
 ```yaml
 unauthenticated:
  expected: 401
 wrong_role:
  expected: 403
 wrong_scope:
  expected: 403
 wildcard_owner:
  expected: 403
  error: WILDCARD_OWNER_CREDENTIAL_REJECTED
 unallowlisted_owner:
  expected: 403
  error: OWNER_IDENTITY_NOT_ALLOWED
 production_capability_true:
  expected: 403
  error: PRODUCTION_CAPABILITY_REJECTED
 ```
 A connection failure, 404 or 500 is not an authorization-policy pass.
 ## 5. Formal provisioning request
 Use the selected existing non-wildcard Owner credential through its runtime
 secret reference. Never place the bearer token in the request body, command
 line, shell history, output report or Git.
 Request:
 ```json
 {
  "action": "AUTHORIZE_TASK_WRITER_PROVISIONING",
  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
  "repository": "aios/aios",
  "base_ref": "refs/heads/main",
  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
  "one_time_use": true,
  "expires_in_seconds": 900,
  "production_change_authorized": false,
  "tag_change_authorized": false,
  "baseline_change_authorized": false,
  "main_write_authorized": false,
  "allowed_operations": [
    "create_worktree",
    "create_target_branch_if_absent",
    "commit_to_target_branch",
    "push_target_branch"
  ],
  "denied_operations": [
    "direct_main_push",
    "force_push",
    "tag_create",
    "tag_update",
    "tag_delete",
    "branch_delete",
    "repository_admin",
    "baseline_write",
    "production_deploy",
    "production_marker_write",
    "history_rewrite"
  ]
 }
 ```
 The Owner authorization reference is generated by the broker. The caller must
 not submit or invent one.
 Expected result:
 ```yaml
 status: READY_FOR_CODE_AUTHORING
 owner_authorization_event_id: generated
 owner_authorization_reference: generated
 owner_authorization_digest_sha256: generated
 owner_authorization_consumed: true
 approval_plan_id: generated
 grant_digest_sha256: generated
 grant_consumed: true
 branch_oid: 875d41c3101093149414292067fd700dc214d4d3
 writer_scope:
  workspace_role: task-scoped-isolated-writer
  writes_enabled: true
  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
  allowed_base_oid: 875d41c3101093149414292067fd700dc214d4d3
  allow_main_write: false
  allow_tag_write: false
  allow_baseline_write: false
  allow_force_push: false
 ```
 ## 6. Independent post-provisioning verification
 Verify the Authority ref:
 ```bash
 git --git-dir=/data/aios-gitops/repo.git rev-parse \
  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
 ```
 It must equal:
 ```text
 875d41c3101093149414292067fd700dc214d4d3
 ```
 Verify `main` remains unchanged, V2R1C5 tag object and peeled target remain
 unchanged, and the Production Baseline remains V2R1C5.
 Verify the broker audit event under:
 ```text
 /var/lib/aios-gitops/owner-authorization-broker/events/
 ```
 Requirements:
 ```yaml
 status: CONSUMED
 wildcard_scope_used: false
 grant_consumed: true
 permissions:
  directory: "0700"
  json_files: "0600"
 ```
 Do not return bearer-token material in the report.
 ## 7. Commit the broker through the new writer
 After `READY_FOR_CODE_AUTHORING`, use only the writer's
 `POST /api/commit-file` route to put this code bundle on:
 ```text
 agent/v2r1c6-mainline-reconciliation-20260805
 ```
 Commit the bridge and broker as separate intentional commits when practical:
 1. Owner-authorized task-writer bridge.
 2. Audited Owner authorization broker and deployment docs.
 Do not merge to `main` directly. Create a protected PR after branch commits
 and tests are complete.
 ## 8. Permanent service deployment
 Only after protected review and merge:
 1. Install the reviewed files from the merge commit.
 2. Apply a reviewed systemd drop-in based on the provided example.
 3. Start the wrapper entrypoint:
   `aios_owner_authorization_broker_api.py`.
 4. Verify all existing API routes still work.
 5. Verify the broker remains localhost/reverse-proxy constrained as intended.
 6. Re-run authentication and policy tests.
 7. Remove the temporary staging instance.
 This permanent bridge deployment does not authorize a V2R1C6 production tag,
 Baseline update or application deployment.
 ## 9. Fail-closed conditions
 Stop with `BLOCKED` for any of the following:
 - Authority `main` no longer equals the fixed base OID.
 - Target branch exists at a different OID.
 - Only a wildcard Owner credential can authenticate.
 - Exact credential scope cannot be proven.
 - Owner identity is not explicitly allow-listed.
 - Signer, validator or provisioner self-test fails.
 - Grant is not marked one-time and consumed.
 - Writer allows main, tag, Baseline, force-push or branch-delete operations.
 - Audit event contains sensitive material.
 - V2R1C5 tag or Baseline changes.
 ## 10. Required Agent result
 ```yaml
 STATUS: READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
 PACKAGE:
  manifest_verified:
  unit_tests:
  smoke_tests:
  py_compile:
 OWNER_CREDENTIAL:
  account:
  credential_id:
  intake_scope:
  exact_scope_proven:
  wildcard_used: false
  token_logged: false
 BROKER:
  staging_listener:
  endpoint_status:
  event_id:
  authorization_reference:
  authorization_digest_sha256:
  event_consumed:
  audit_permissions_valid:
 GRANT:
  approval_plan_id:
  grant_digest_sha256:
  signer_identity:
  signature_valid:
  one_time_use:
  consumed:
 BRANCH:
  name:
  oid:
  base_oid:
  ref_exists:
  worktree_path:
  worktree_clean:
 WRITER:
  status:
  writes_enabled:
  allowed_branch:
  allowed_base_oid:
  allowed_routes:
  main_write_denied:
  tag_write_denied:
  baseline_write_denied:
  force_push_denied:
 POSTCHECK:
  main_unchanged:
  V2R1C5_tag_unchanged:
  baseline_unchanged:
 REPOSITORY_INTEGRATION:
  commit_oids:
  protected_pr:
  merged:
  permanent_bridge_deployed:
 BLOCKERS:
 GOVERNANCE:
  force_push_used: false
  tag_rewritten: false
  direct_main_push: false
  secrets_committed: false
  owner_approval_respected: true
 ```
@@ -1,562 +0,0 @@
 # Agent execution requirements: V2R1C6 task identity overlay
 ## Required result
 The Agent must return one of:
 - `READY_FOR_CODE_AUTHORING`
 - `BLOCKED`
 - `FAILED`
 The Agent may not report success until the task branch, isolated worktree and
 task writer are independently verified.
 This stage is **not** a production deployment. It must not modify `main`,
 V2R1C5, tags, Registry, Production Baseline or production services.
 ## Fixed authority
 ```yaml
 task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
 repository: aios/aios
 base_ref: refs/heads/main
 base_oid: 875d41c3101093149414292067fd700dc214d4d3
 target_branch: agent/v2r1c6-mainline-reconciliation-20260805
 owner_identity: aiman
 one_time_use: true
 maximum_ttl_seconds: 900
 production_change_authorized: false
 tag_change_authorized: false
 baseline_change_authorized: false
 main_write_authorized: false
 ```
 ## 1. Verify package
 Verify the externally supplied package against the published SHA-256 values and
 then verify every entry in `MANIFEST.sha256`.
 Do not synthesize a missing archive. Use either the verified ZIP or TAR.GZ.
 Required checks:
 ```yaml
 package_hash_match: true
 manifest_entries_match: true
 unit_tests_pass: true
 smoke_tests_pass: true
 py_compile_pass: true
 ```
 ## 2. Create root-owned staging
 Extract to a fresh directory such as:
 ```text
 /var/lib/aios-gitops/staging/v2r1c6-task-identity-overlay-<nonce>
 ```
 Requirements:
 ```yaml
 owner: root
 group: root
 directory_mode: "0700"
 files_not_world_writable: true
 symlinks_rejected: true
 ```
 Do not overwrite the active runtime tree.
 ## 3. Re-run target-host tests
 From the staging root:
 ```bash
 python3 -m unittest discover -s tests -v
 python3 scripts/smoke_authorized_task_writer_provisioning.py
 python3 scripts/smoke_owner_authorization_broker.py
 python3 scripts/smoke_task_identity_overlay.py
 python3 -m py_compile \
  active-runtime/app/authorized_task_writer_provisioning.py \
  active-runtime/app/owner_authorization_broker.py \
  active-runtime/app/task_identity_overlay.py \
  active-runtime/app/aios_authorized_task_writer_api.py \
  active-runtime/app/aios_owner_authorization_broker_api.py \
  active-runtime/app/aios_task_identity_overlay_api.py \
  active-runtime/app/aios_task_identity_overlay_cli.py \
  scripts/call_task_identity_overlay.py
 ```
 Any failure is `BLOCKED`; do not proceed.
 ## 4. Prestart Git and production freeze checks
 Read from the authority repository:
 ```bash
 git --git-dir=/data/aios-gitops/repo.git rev-parse refs/heads/main
 git --git-dir=/data/aios-gitops/repo.git \
  show-ref --verify --quiet \
  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
 git --git-dir=/data/aios-gitops/repo.git rev-parse refs/tags/V2R1C5
 git --git-dir=/data/aios-gitops/repo.git rev-parse 'refs/tags/V2R1C5^{}'
 ```
 Expected:
 ```yaml
 main_oid: 875d41c3101093149414292067fd700dc214d4d3
 target_branch_exists: false
 V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
 V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
 ```
 Read Baseline and require:
 ```yaml
 version: V2R1C5
 status: PRODUCTION_DEPLOYED
 target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
 evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
 ```
 If `main` has drifted, return:
 ```yaml
 STATUS: MANUAL_OWNER_REVIEW_REQUIRED
 REASON: AUTHORIZED_BASE_OID_DRIFT
 ```
 If the target branch already exists at another OID, return:
 ```yaml
 STATUS: MANUAL_OWNER_REVIEW_REQUIRED
 REASON: EXISTING_BRANCH_OID_CONFLICT
 ```
 Do not delete, reset or force-push the branch.
 ## 5. Discover active secret references
 The overlay does not read or modify `gitops.tokens`, but its issuer must compare
 the new random secret against all active bearer secret references.
 Discover references without printing secret contents. At minimum include the
 currently active ChatGPT/GitOps bearer secret reference and any other bearer
 files consumed by the active API.
 Pass them as a comma-separated list in:
 ```text
 AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS
 ```
 Evidence must contain only paths and SHA-256 match counts, not token values.
 If active secret references cannot be enumerated, return:
 ```yaml
 STATUS: BLOCKED
 REASON: ACTIVE_SECRET_REFERENCE_SET_UNRESOLVED
 ```
 ## 6. Install the transient systemd service
 Use the provided template:
 ```text
 deploy/systemd/aios-v2r1c6-task-identity-overlay.service.example
 ```
 Substitute only:
 - verified root-owned staging directory;
 - verified active secret-ref path list.
 Do not change task ID, repository, base OID, target branch or denied
 capabilities.
 The service must listen only on:
 ```text
 127.0.0.1:19864
 ```
 Before start, run:
 ```bash
 systemd-analyze verify \
  /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
 ```
 Then:
 ```bash
 sudo systemctl daemon-reload
 sudo systemctl start aios-v2r1c6-task-identity-overlay.service
 ```
 Confirm:
 ```bash
 curl --fail --silent http://127.0.0.1:19864/healthz
 ```
 Expected:
 ```yaml
 service: aios-task-identity-overlay
 status: active
 global_token_registry_used: false
 loopback_only: true
 ```
 Do not expose the port externally.
 ## 7. Issue the one-time overlay
 Use the root-only CLI. The authorization assertion is an audit label for this
 already approved Owner task; it must not be described as an external signed
 event.
 Example:
 ```bash
 sudo env \
  PYTHONPATH=<staging>/active-runtime/app \
  AIOS_GITOPS_IDENTITY_OVERLAY_STATE_ROOT=/var/lib/aios-gitops/task-identity-overlays \
  AIOS_GITOPS_IDENTITY_OVERLAY_SECRET_ROOT=/run/aios-gitops/task-identity-overlays \
  AIOS_GITOPS_IDENTITY_OVERLAY_TASK_ID=V2R1C6_TASK_SCOPED_WRITER_PROVISIONING \
  AIOS_GITOPS_IDENTITY_OVERLAY_OWNER_IDENTITY=aiman \
  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_REF=refs/heads/main \
  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_OID=875d41c3101093149414292067fd700dc214d4d3 \
  AIOS_GITOPS_IDENTITY_OVERLAY_TARGET_BRANCH=agent/v2r1c6-mainline-reconciliation-20260805 \
  AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS=<verified-secret-ref-list> \
  python3 <staging>/active-runtime/app/aios_task_identity_overlay_cli.py \
    issue \
    --ttl-seconds 900 \
    --authorization-assertion-ref owner-session:V2R1C6:approved-20260806 \
    --operator-identity <audited-agent-identity> \
    --result-json /run/aios-gitops/v2r1c6-overlay-issued.json
 ```
 The result must contain:
 ```yaml
 status: OVERLAY_ACTIVE
 idempotent: false
 overlay_id: present
 secret_ref: under /run/aios-gitops/task-identity-overlays
 expires_at: within 900 seconds
 ```
 It must not contain a token.
 Verify:
 ```yaml
 secret_file_mode: "0600"
 metadata_contains_raw_token: false
 token_hash_unique_across_configured_secret_refs: true
 ```
 ## 8. Negative tests
 Before the valid request:
 1. No Authorization header must return HTTP 401.
 2. A random wrong bearer must return HTTP 401.
 3. A request with `production_change_authorized=true` must be rejected.
 4. A request with another base OID or branch must be rejected.
 5. The valid overlay must remain `ACTIVE` after pre-auth request-validation
   failures.
 Do not use the global Owner or ChatGPT bearer credential for this endpoint.
 ## 9. Send the valid request
 Use:
 ```text
 deploy/v2r1c6-task-writer-authorization-request.json
 ```
 Use the provided client so the bearer is not placed in argv, shell history or
 logs:
 ```bash
 sudo python3 <staging>/scripts/call_task_identity_overlay.py \
  --secret-ref <secret_ref_from_issue_result> \
  --request-json <staging>/deploy/v2r1c6-task-writer-authorization-request.json \
  --url http://127.0.0.1:19864/api/governance/owner-authorizations \
  --result-json /var/lib/aios-gitops/v2r1c6-overlay-provision-result.json
 ```
 Required result:
 ```yaml
 http_status: 200
 status: READY_FOR_CODE_AUTHORING
 owner_authorization_consumed: true
 grant_consumed: true
 identity_overlay_consumed: true
 identity_overlay_secret_removed: true
 branch: agent/v2r1c6-mainline-reconciliation-20260805
 branch_oid: 875d41c3101093149414292067fd700dc214d4d3
 ```
 The result must not include:
 - bearer token;
 - private key;
 - signer secret;
 - raw signature;
 - credential value.
 ## 10. Independent acceptance
 Verify the branch:
 ```bash
 git --git-dir=/data/aios-gitops/repo.git \
  rev-parse refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
 ```
 It must equal:
 ```text
 875d41c3101093149414292067fd700dc214d4d3
 ```
 Verify worktree evidence returned by the provisioner:
 ```yaml
 branch: agent/v2r1c6-mainline-reconciliation-20260805
 head_oid: 875d41c3101093149414292067fd700dc214d4d3
 detached_head: false
 worktree_clean: true
 writer_status: active
 writes_enabled: true
 allowed_routes:
  - POST /api/commit-file
 allow_main_write: false
 allow_tag_write: false
 allow_baseline_write: false
 allow_force_push: false
 ```
 Run policy negative tests against the task writer and require explicit policy
 denials for:
 - main write;
 - another branch;
 - tag create/update;
 - Baseline write;
 - force push;
 - branch delete.
 Network errors, 404, 500 and stopped-service failures do not count as policy
 denials.
 ## 11. Stop and clean up the overlay
 After `READY_FOR_CODE_AUTHORING`:
 ```bash
 sudo systemctl stop aios-v2r1c6-task-identity-overlay.service
 sudo systemctl disable aios-v2r1c6-task-identity-overlay.service || true
 sudo rm -f /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
 sudo systemctl daemon-reload
 ```
 Verify:
 ```yaml
 overlay_listener_stopped: true
 overlay_secret_removed: true
 global_token_registry_unchanged: true
 disabled_owner_record_unchanged: true
 active_chatgpt_bot_record_unchanged: true
 audit_metadata_retained: true
 ```
 The root-owned staging directory may be retained until the code is committed,
 then removed after checksum-confirmed repository integration.
 ## 12. Commit the developed code through the task writer
 Only after writer acceptance, use `POST /api/commit-file` to commit the
 verified package contents to:
 ```text
 agent/v2r1c6-mainline-reconciliation-20260805
 ```
 Commit in reviewable groups:
 1. authorized task-writer bridge;
 2. Owner authorization broker;
 3. task identity overlay;
 4. tests, docs, OpenAPI and deployment templates.
 Do not include:
 - package archives;
 - runtime tokens;
 - `/run` or `/var/lib` state;
 - test result files containing host paths;
 - secret references containing values;
 - generated credentials.
 Run the complete 40-test suite from the branch after commits.
 ## 13. Protected PR
 Create a protected PR from:
 ```text
 agent/v2r1c6-mainline-reconciliation-20260805
 ```
 to:
 ```text
 main
 ```
 The PR must state:
 - this change closes Owner authorization bootstrap gaps;
 - the overlay is localhost-only and one-time;
 - the global token registry is not modified;
 - no production release is authorized;
 - V2R1C5 tag and Baseline remain unchanged.
 The Agent must not merge without the repository's normal protected review.
 ## 14. Required Agent report
 ```yaml
 STATUS:
  READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
 PACKAGE:
  zip_sha256:
  tar_gz_sha256:
  manifest_entries:
  manifest_matched:
 TESTS:
  unit_total:
  unit_passed:
  smoke_bridge:
  smoke_broker:
  smoke_overlay:
  py_compile:
 PRESTART:
  main_oid:
  target_branch_previously_absent:
  V2R1C5_tag_oid:
  V2R1C5_peeled_target:
  baseline_unchanged:
 OVERLAY:
  overlay_id:
  status:
  secret_ref:
  secret_file_mode:
  token_hash_unique:
  global_registry_used: false
  listener:
  expires_at:
  consumed:
  secret_removed:
 NEGATIVE_TESTS:
  unauthenticated_401:
  wrong_token_401:
  production_capability_denied:
  wrong_base_denied:
  wrong_branch_denied:
 OWNER_AUTHORIZATION:
  event_id:
  reference:
  consumed:
 GRANT:
  approval_plan_id:
  grant_id:
  grant_digest_sha256:
  signature_valid:
  consumed:
 BRANCH:
  name:
  oid:
  base_oid:
  ref_exists:
  worktree_path:
  worktree_clean:
 WRITER:
  status:
  writes_enabled:
  allowed_branch:
  allowed_base_oid:
  allowed_routes:
  main_write_denied:
  tag_write_denied:
  baseline_write_denied:
  force_push_denied:
 REPOSITORY_INTEGRATION:
  commits:
  tests_after_commit:
  protected_pr:
  merged: false
 POSTCHECK:
  main_unchanged:
  V2R1C5_tag_unchanged:
  baseline_unchanged:
  global_token_registry_unchanged:
  overlay_listener_stopped:
  overlay_secret_removed:
 SECRETS:
  plaintext_logged: false
  plaintext_committed: false
 BLOCKERS:
 GOVERNANCE:
  force_push_used: false
  tag_rewritten: false
  direct_main_push: false
  secrets_committed: false
  owner_approval_respected: true
 ```
 ## Fail-closed conditions
 Return `BLOCKED` and stop on any of:
 - authoritative main OID drift;
 - target branch conflict;
 - inability to enumerate active secret references;
 - secret hash collision;
 - overlay not bound to the exact task/base/branch;
 - non-loopback listener;
 - raw secret in result or logs;
 - Owner Authorization Broker event not created;
 - signer/validator/provisioner failure;
 - grant not consumed;
 - branch OID mismatch;
 - writer exposes main/tag/Baseline/force-push permissions;
 - V2R1C5 tag or Baseline changes.
 Never fall back to the shared `gitops-write-bot.token`, a wildcard credential,
 manual `gitops.tokens` edits or a direct Git ref write.
@@ -1,9 +0,0 @@
 {
  "schema": "aios.v2r1c7.engineering-build-receipt.v1",
  "version": "V2R1C7",
  "base_oid": "b356dec2ac5bd2a5f721aa73f8fd1902f9c65632",
  "production_deployed": false,
  "tag_created": false,
  "baseline_changed": false,
  "deployable": true
 }
@@ -1,7 +1,7 @@
 e4a1f86ef92ec1d3ff724eb75cf9c01758c1cc997e1afadc1c8b561bce5b813a  FULL_PACKAGE_MANIFEST.json
 c59c0288d4d999fbd79a2f275d4fb8c369029cb8bb721f95408308cc51eaa3a2  README.md
-1095953d5764d9c72f02e84b1d525e265d3a67a5bdb451ab9ef51a8e8b3032b8  VERSION
+b090062a92aeb14211bbfc1fcd43b5ee4f315d30054b437f3bcdac657210ee95  VERSION
-ee6e4fc6bc98a590fbc3585b62707e2562115e5a3f722e69a7c464d966bdc458  active-runtime/app/aios_gitops_model_api.py
+a664714bc1e13160cdd0dc32de460c65a83a3a95aa5cdad1833b1b650ab90e9d  active-runtime/app/aios_gitops_model_api.py
 0ffadf6ee1f297842bc44c6e753010fd2b7b02b1f5fb0d7e0676b7bec898db08  active-runtime/app/aios_v5_webops_app.py
 0ffadf6ee1f297842bc44c6e753010fd2b7b02b1f5fb0d7e0676b7bec898db08  active-runtime/app/aios_webops_app.py
 0eb12e0161371464605577707c84df413b555277933f9eb4488ab38032ff699b  active-runtime/migrations/001_webops_core_sqlite.sql
@@ -13,7 +13,7 @@ ee6e4fc6bc98a590fbc3585b62707e2562115e5a3f722e69a7c464d966bdc458  adapters/gitop
 013813b58d7844f3860d6f9bb484f84f92487652b573976c474bb35c91df8ae8  adapters/openclaw/openclaw_gitops_commands.py
 7a34ccdfdcdc132fe5daf01cd1acd9d9b7adbd0429d575b65e0771962ccedc62  adapters/webops/gitops_model_menu_fragment.html
 86b0cb6ee3192565b080672e5305dabba1283486442e630c71244ebac4910916  config/digital_life.yaml
-a3872f24e4cd64288758846ecd0b374db4aa41111feec3b17c41438136d6d5d0  config/domains.env
+5a27d48db343dcb723bcc1d9d8222aa3f72094c57cc43640aebe6558963bd20f  config/domains.env
 7a6f82cbddfc5c74bd37229e4f37fe4e73430ae585b4846abd1a80d852f2fed0  config/gitops_short_links.yaml
 4139d915bdd733171734d5d5d3411e6fc4f8f202c49af4321d706da176da690b  config/model_registry.yaml
 8d6202d3da60366c96a208f5e5eed1f09fd36d122f4cabdc038c21ce2e72ea16  config/npm_custom_locations.yaml
@@ -55,7 +55,7 @@ d8cea35eb6c1300d20804ef480312d26dbdc2ad3a2d26b9430c6ca4808155a95  fixes/patch_ru
 0eb12e0161371464605577707c84df413b555277933f9eb4488ab38032ff699b  migrations/001_webops_core_sqlite.sql
 6d61da88e7d6b208e7eee7195b521dc47cb68587f91987d7a0dd1c8801ef168d  migrations/002_seed_owner_admin_user.sql
 a2c0c7699e1eb46cfdeabfc905cb79b71ed14fb6bcf81ecc99ec47975cf05767  migrations/004_gitops_custom_llm_runtime.sql
-b77bce1ca78cede27de6594e25f6ce5bb0c4990c0953eeb79f7e2608d2515c32  package_verify_full.sh
+ca49f4165b50171968485ffa5535bc33d2158237ea55af10a3888a5fa0f7a535  package_verify_full.sh
 f65b7fba5d6bdac3070ff4309830e286cd6319a80ab2e55263e46022fed2bf7f  scripts/apply_migrations.py
 bc0452d261def2366cdefd845e62d7177b42806f93ba78294ece29a8a369157e  scripts/backup_before_fix.sh
 bdb439086c86b3b23f8240cb2bef0f757a6be242d21d13a79eb1e44434efbe2e  scripts/create_patch.sh
@@ -63,11 +63,11 @@ bdb439086c86b3b23f8240cb2bef0f757a6be242d21d13a79eb1e44434efbe2e  scripts/create
 1fdeecf0315f3ab4ec461c3376128054df9ac48e2fe5a3f64a138cd7d710d44d  scripts/generate_release_manifest.py
 80c6c10f259245681c42932f3f5f9b9a0fbd9cadce6a3f495d82cbdbc8618c73  scripts/healthcheck.sh
 3795cadfa6429a434c955913dbdcbf552181c88301a196b4b458f4f5dd206cd8  scripts/init_gitops_baseline.sh
-4d54a4ed6d35bbb6e9fe2924f3cfceeea9c3eed898017788f6c5ab8041394a47  scripts/install_v1r1c0_gitops_model_overlay.sh
+e76cd986d2387b76439e4a7fe503e48a2de8fc70fb52c45a13641c9d943f108f  scripts/install_v1r1c0_gitops_model_overlay.sh
 0064539ac1e1bd32dc8062ecc307ad2bc8520895009583a72d46868d1cf44e3c  scripts/install_webops_overlay.sh
 9fadafc4b4d098c006d159cb3b401eb19cf9ab9c5fa4b5cb109e946501c0b8e1  scripts/owner_wechat_notify_worker.py
-e0abd8ad44d4f088108f2046fd9d7bbd4465af50f79bd3b9fcbb72a8c61bee65  scripts/package_contract_check_v1r1c0.sh
+f537c58fc08685601f47fac5c0a3a2856e3ce9806c1918848c87a194a49c28a0  scripts/package_contract_check_v1r1c0.sh
-abef8df642c6d233af4a03c512876b02b326e19c924020b8dd8cc74236d18817  scripts/release_version.sh
+14ab40a7c342e21e8315def14d552dcff4b214d23f1f4be493e9d3fc2cee1a2f  scripts/release_version.sh
 bbdb3f9992b203ddc2a6a83241052663de4f021d0705724bd9df05acaa99b022  scripts/rollback_last_delta.sh
 0814c26ecf6732cf2c24f5f414ad0128a159768cfbbeb21d557274064feb1188  scripts/rollback_version.sh
 da84a5cc61c1d54a7d1e96e4b0a7186e192edf3ec12d694fc9d7608c3b1086ef  scripts/run_acceptance_with_autofix.sh
@@ -1,21 +0,0 @@
 bec7da1adb75bf5feaa63c60ec6d03adf15d7508742a486207033d000f72d4ff  AGENT_DEPLOYMENT_REQUIREMENTS.md
 251b46e51ce09aa2fd843bee48ef24a5608f31d24c599841f086ceb25c1a1715  README.md
 783f68ec4f00a11d43ceed536196bfedccaf6614f6db9805f7b36d24e5fa7bc2  TEST_RESULTS.json
 9208325e5b2e6f5ba6b64e000bc21d14d9f2f214e3ad33dd79857e85218fd6c2  VERSION
 c4b24b65195077716983acdc8611f705324413a74453858994ba51541957afd4  active-runtime/app/aios_authorized_task_writer_api.py
 8a1935fa098d47ac02ce51bbd9fd5fad7cf9ab9374ea3de5f630679b96681d84  active-runtime/app/authorized_task_writer_provisioning.py
 0997ab8332985c7124f334c4e49735d8833326578acc61a61a389bf792424de3  active-runtime/app/deployment_state.py
 dd3f8b1cab88e005a291f077807873c381e8ca92fe863dc05817925f0dff9613  active-runtime/app/v2r1c6_privacy_tools.py
 9e45025c41068cafdea2f360edfc4146a5459b0a6bcfbf1403206fc0161e7bac  active-runtime/app/v2r1c7_health_service.py
 c96ba560d69f6c2eb700b9f2b42a32e394dadd00dffb23bbefdb9fb3e1571c0d  deploy/aios-v2/systemd/aios-v2r1c7-production.service
 a05d4e8038fdb866ce17d4fb8a54798a268a1e8d44ff2cbc559069fa6ab2a667  deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
 a60dac51802bff67c2cfff61acdeb0a3a05d74a4f6cb47e3f78295ceb5c6acd9  docs/gitops/authorized-task-writer-provisioning.md
 2690f76452bceddda90c728278c600bcebd533db24776e2966423c5a8655e4b5  docs/gitops/openapi-authorized-task-writer-fragment.yaml
 560e5d9af8a8e2ec60ec31cf8659a7982b93ea09b7adb486b738ea2fba460d70  release-manifests/V2R1C7.json
 81a423c7814f81cb888b60a538c153e549b2be9099c881c968d55ae84efddc57  scripts/build_v2r1c7_release_artifact.py
 64c78dabffb05c8851f87b2a27c43bd1f21728dca586397d03a6bc22906a906c  scripts/probe_v2r1c7_health.py
 5419dc7de0f50908ad0ef1dac74172fce811bb7b45f314a6e1c1bb9ce618324d  scripts/rollback_v2r1c7_release.sh
 54e2845d2c3c026323ad45515e082d661e3b461feb3bfefedf5adc52db2d7b78  scripts/smoke_authorized_task_writer_provisioning.py
 32a860e28d5afc105f413d878a13fb8600fa74874dbd3bc4c031ef3efa17896a  scripts/verify_v2r1c7_release.py
 3cce2b744326fe12b89bcad3cd352c77738950964bf8519e72cb5e9c7a5dfbfc  tests/test_authorized_task_writer_provisioning.py
 8f3153c625241f60b65109eeac045e8aed7661d95f3a10f0b32ba3e0e9ac0a85  versions/V2R1C7.json
@@ -1,25 +0,0 @@
 {
  "git_branch_created": false,
  "git_commit_created": false,
  "production_mutation": false,
  "py_compile": {
    "files": [
      "active-runtime/app/authorized_task_writer_provisioning.py",
      "active-runtime/app/aios_authorized_task_writer_api.py"
    ],
    "status": "PASS"
  },
  "schema": "aios.authorized-task-writer-bridge-test-report.v1",
  "secrets_included": false,
  "smoke": {
    "command": "python3 scripts/smoke_authorized_task_writer_provisioning.py",
    "status": "PASS"
  },
  "status": "PASS",
  "unit_tests": {
    "command": "python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py",
    "errors": 0,
    "failures": 0,
    "total": 9
  }
 }
@@ -1 +1 @@
-V2R1C7
+V2R1C4
@@ -13,7 +13,6 @@ from hashlib import sha256
 from pathlib import Path
 import json
 from typing import Any
 from message_handoff import stable_event_id
 def utc_now() -> str:
@@ -56,19 +55,13 @@ class AgentEventBus:
        payload: dict[str, Any],
        correlation_id: str | None = None,
    ) -> dict[str, Any]:
-        event_id = stable_event_id(
+        event_id = "evt_" + sha256(
-            source=source, target=target, message_type=kind, payload=payload,
+            json.dumps(
-            tenant_id=(payload.get('tenant_id') if isinstance(payload, dict) else None),
+                {"kind": kind, "source": source, "summary": summary, "payload": payload},
-            user_id=(payload.get('user_id') if isinstance(payload, dict) else None),
+                sort_keys=True,
-            project_id=(payload.get('project_id') if isinstance(payload, dict) else None),
+                ensure_ascii=False,
-            conversation_id=(payload.get('conversation_id') if isinstance(payload, dict) else None),
+            ).encode("utf-8")
-            task_id=(payload.get('task_id') if isinstance(payload, dict) else None),
+        ).hexdigest()[:16]
            run_id=(payload.get('run_id') if isinstance(payload, dict) else None),
            correlation_id=(payload.get('correlation_id') if isinstance(payload, dict) else None),
            causation_id=(payload.get('causation_id') if isinstance(payload, dict) else None),
            sequence=(payload.get('sequence') if isinstance(payload, dict) else None),
            idempotency_key=(payload.get('idempotency_key') if isinstance(payload, dict) else None),
        )
        event = AgentEvent(event_id, kind, source, target, summary, payload, correlation_id=correlation_id)
        self._write("pending", event.to_dict())
        self._audit("created", event.to_dict())
@@ -7,7 +7,7 @@ class AgentEventObservabilityBridge:
    def __init__(self, hooks: AgentObservabilityHooks | None = None):
        self.hooks = hooks or AgentObservabilityHooks()
-    def consume(self, event: dict, *, actor=None, trace=None):
+    def consume(self, event: dict):
        kind = event.get("kind")
        payload = event.get("payload", {})
        if kind == "agent_started":
@@ -16,8 +16,6 @@ class AgentEventObservabilityBridge:
                visible_scope=payload.get("scope", "self"),
                entry_agent=payload.get("agent", "unknown"),
                execution_id=event.get("id"),
                actor=actor,
                trace=trace,
            )
        if kind == "agent_delegated":
            return self.hooks.delegate(event["execution_id"], payload.get("agent", "unknown"))
@@ -31,18 +31,6 @@ class AgentExecutionRecord:
    status: str = "completed"
    started_at: str = field(default_factory=utc_now)
    ended_at: str = field(default_factory=utc_now)
    trace_id: str | None = None
    span_id: str | None = None
    parent_span_id: str | None = None
    correlation_id: str | None = None
    causation_id: str | None = None
    tenant_id: str | None = None
    project_id: str | None = None
    conversation_id: str | None = None
    task_id: str | None = None
    claim_id: str | None = None
    run_id: str | None = None
    message_id: str | None = None
    def to_dict(self):
        return asdict(self)
@@ -9,49 +9,25 @@ try:
 except Exception:
    APIRouter = None
-from .agent_observability import AgentExecutionRecord, AgentObservability
+from .agent_observability import AgentExecutionRecord
 from .agent_observability_dashboard import AgentObservabilityDashboard
 from .agent_observability_store import AgentObservabilityStore
 from .trace_tool_credential_governance import GovernanceActor, TraceContext, authorize_scope
 store = AgentObservabilityStore()
 dashboard = AgentObservabilityDashboard(store.load())
-def record_agent_execution(payload: dict[str, Any], *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None):
+def record_agent_execution(payload: dict[str, Any]):
-    scoped = any(payload.get(name) is not None for name in (
+    record = AgentExecutionRecord(**payload)
        "trace_id", "span_id", "tenant_id", "project_id", "conversation_id", "task_id", "run_id"
    ))
    values = dict(payload)
    if scoped:
        if actor is None or trace is None:
            raise RuntimeError("TRACE_ACTOR_CONTEXT_REQUIRED")
        trusted = GovernanceActor.from_value(actor)
        authorize_scope(trusted, trace.scope)
        bound = {
            "trace_id": trace.trace_id, "span_id": trace.span_id,
            "parent_span_id": trace.parent_span_id, "correlation_id": trace.correlation_id,
            "causation_id": trace.causation_id, "tenant_id": trace.scope.tenant_id,
            "user_id": trace.scope.user_id, "project_id": trace.scope.project_id,
            "conversation_id": trace.scope.conversation_id, "task_id": trace.task_id,
            "claim_id": trace.claim_id, "run_id": trace.scope.run_id, "message_id": trace.message_id,
        }
        for name, authoritative in bound.items():
            if values.get(name) not in (None, authoritative):
                raise RuntimeError("TRACE_SCOPE_MISMATCH_DENY:" + name)
            values[name] = authoritative
    record = AgentExecutionRecord(**values)
    return {"status": "ok", "record": store.append(record)}
-def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user", *, actor: GovernanceActor | dict[str, Any] | None = None):
+def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user"):
-    records = store.query(user_id, group_id, role, actor=actor)
+    records = store.query(user_id, group_id, role)
    visible = AgentObservability()
    visible.records = [AgentExecutionRecord(**record) for record in records]
    return {
        "status": "ok",
        "records": records,
-        "summary": visible.summary(None),
+        "summary": store.load().summary(user_id if role != "owner" else None),
    }
@@ -14,11 +14,6 @@ from uuid import uuid4
 from .agent_observability import AgentExecutionRecord
 from .agent_observability_store import AgentObservabilityStore
 from .trace_tool_credential_governance import (
    GovernanceActor,
    TraceContext,
    authorize_scope,
 )
 def utc_now() -> str:
@@ -41,7 +36,6 @@ class AgentRunContext:
    input_tokens: int = 0
    output_tokens: int = 0
    status: str = "running"
    trace: TraceContext | None = None
    def delegate(self, agent_name: str) -> None:
        if agent_name not in self.path:
@@ -65,19 +59,7 @@ class AgentObservabilityHooks:
        visible_scope: str,
        entry_agent: str,
        execution_id: str | None = None,
        *,
        actor: GovernanceActor | dict[str, Any] | None = None,
        trace: TraceContext | None = None,
    ) -> dict[str, Any]:
        if execution_id is not None and execution_id in self.active:
            raise RuntimeError("OBSERVABILITY_EXECUTION_CONFLICT")
        if trace is not None:
            if actor is None:
                raise RuntimeError("TRACE_ACTOR_CONTEXT_REQUIRED")
            trusted_actor = GovernanceActor.from_value(actor)
            authorize_scope(trusted_actor, trace.scope)
            if trace.scope.user_id is not None and trace.scope.user_id != user_id:
                raise RuntimeError("TRACE_SCOPE_MISMATCH_DENY:user_id")
        run = AgentRunContext(
            execution_id=execution_id or f"exec_{uuid4().hex[:12]}",
            user_id=user_id,
@@ -85,7 +67,6 @@ class AgentObservabilityHooks:
            entry_agent=entry_agent,
            path=[entry_agent],
            used_hermes=entry_agent.lower() == "hermes",
            trace=trace,
        )
        self.active[run.execution_id] = run
        return {"status": "started", "execution_id": run.execution_id, "run": run.__dict__}
@@ -125,18 +106,6 @@ class AgentObservabilityHooks:
            status=status,
            started_at=run.started_at,
            ended_at=ended_at,
            trace_id=run.trace.trace_id if run.trace else None,
            span_id=run.trace.span_id if run.trace else None,
            parent_span_id=run.trace.parent_span_id if run.trace else None,
            correlation_id=run.trace.correlation_id if run.trace else None,
            causation_id=run.trace.causation_id if run.trace else None,
            tenant_id=run.trace.scope.tenant_id if run.trace else None,
            project_id=run.trace.scope.project_id if run.trace else None,
            conversation_id=run.trace.scope.conversation_id if run.trace else None,
            task_id=run.trace.task_id if run.trace else None,
            claim_id=run.trace.claim_id if run.trace else None,
            run_id=run.trace.scope.run_id if run.trace else None,
            message_id=run.trace.message_id if run.trace else None,
        )
        return {"status": "stored", "record": self.store.append(record)}
@@ -12,12 +12,6 @@ from pathlib import Path
 from typing import Any
 from .agent_observability import AgentExecutionRecord, AgentObservability
 from .trace_tool_credential_governance import (
    GovernanceActor,
    GovernanceError,
    GovernanceScope,
    authorize_scope,
 )
 class AgentObservabilityStore:
@@ -29,11 +23,6 @@ class AgentObservabilityStore:
    def append(self, record: AgentExecutionRecord) -> dict[str, Any]:
        path = self.records_dir / f"{record.execution_id}.json"
        data = record.to_dict()
        if path.exists():
            existing = json.loads(path.read_text(encoding="utf-8"))
            if existing == data:
                return existing
            raise RuntimeError("OBSERVABILITY_EXECUTION_CONFLICT")
        path.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
        return data
@@ -44,36 +33,8 @@ class AgentObservabilityStore:
            observability.records.append(AgentExecutionRecord(**raw))
        return observability
-    def query(self, user_id: str | None = None, group_id: str | None = None, role: str = "user", *, actor: GovernanceActor | dict[str, Any] | None = None) -> list[dict[str, Any]]:
+    def query(self, user_id: str | None = None, group_id: str | None = None, role: str = "user") -> list[dict[str, Any]]:
        records = [record.to_dict() for record in self.load().records]
        scoped = [record for record in records if record.get("tenant_id") is not None]
        legacy = [record for record in records if record.get("tenant_id") is None]
        if actor is not None:
            trusted = GovernanceActor.from_value(actor)
            visible: list[dict[str, Any]] = []
            for record in scoped:
                try:
                    authorize_scope(
                        trusted,
                        GovernanceScope(
                            "tenant",
                            tenant_id=record.get("tenant_id"),
                            user_id=record.get("user_id"),
                            project_id=record.get("project_id"),
                            conversation_id=record.get("conversation_id"),
                            run_id=record.get("run_id"),
                        ),
                    )
                except GovernanceError:
                    continue
                visible.append(record)
            if trusted.privileged:
                visible.extend(legacy)
            else:
                visible.extend(record for record in legacy if record.get("user_id") == trusted.scope.user_id)
            return visible
        # Caller-supplied role remains a legacy compatibility path only.
        records = legacy
        if role == "owner":
            return records
        if role == "group_admin" and group_id:
@@ -1,201 +0,0 @@
 """Fail-closed Agent Pull Runner primitives for AIOS autonomy v1.
 The runner owns task discovery and reporting only.  It never accepts shell
 strings: executors receive argv, an allowlisted cwd and an allowlisted env.
 Durable state is intentionally small so restart recovery and duplicate
 suppression can be verified without coupling the runner to one database.
 """
 from __future__ import annotations
 import json
 import os
 import random
 import shutil
 import subprocess
 import tempfile
 import time
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Callable, Mapping, Protocol, Sequence
 class RunnerError(RuntimeError):
    """Raised when a runner contract would be violated."""
@dataclass(frozen=True)
 class RunnerConfig:
    worker_id: str
    capabilities: tuple[str, ...] = ()
    long_poll_seconds: int = 30
    fallback_seconds: int = 60
    jitter_seconds: int = 5
    max_backoff_seconds: int = 300
    executable_allowlist: tuple[str, ...] = ()
    working_directory_allowlist: tuple[str, ...] = ()
    environment_allowlist: tuple[str, ...] = ()
@dataclass
 class RunnerState:
    inflight: dict[str, dict[str, Any]] = field(default_factory=dict)
    terminal: dict[str, dict[str, Any]] = field(default_factory=dict)
 class RunnerTransport(Protocol):
    def register_worker(self, worker_id: str, capabilities: Sequence[str]) -> Mapping[str, Any]: ...
    def heartbeat(self, worker_id: str) -> Mapping[str, Any]: ...
    def long_poll(self, worker_id: str, timeout_seconds: int) -> Mapping[str, Any] | None: ...
    def poll(self, worker_id: str) -> Mapping[str, Any] | None: ...
    def claim(self, worker_id: str, task: Mapping[str, Any]) -> Mapping[str, Any]: ...
    def renew(self, worker_id: str, task_id: str) -> Mapping[str, Any]: ...
    def report_progress(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
    def report_result(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
    def report_evidence(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
 class JsonStateStore:
    """Atomic JSON state store for restart recovery."""
    def __init__(self, path: str | os.PathLike[str]) -> None:
        self.path = Path(path)
    def load(self) -> RunnerState:
        if not self.path.exists():
            return RunnerState()
        value = json.loads(self.path.read_text(encoding="utf-8"))
        if not isinstance(value, dict):
            raise RunnerError("runner state must be an object")
        return RunnerState(
            inflight=dict(value.get("inflight", {})),
            terminal=dict(value.get("terminal", {})),
        )
    def save(self, state: RunnerState) -> None:
        self.path.parent.mkdir(parents=True, exist_ok=True)
        fd, name = tempfile.mkstemp(prefix=self.path.name + ".", dir=self.path.parent)
        try:
            with os.fdopen(fd, "w", encoding="utf-8") as handle:
                json.dump({"inflight": state.inflight, "terminal": state.terminal}, handle, sort_keys=True)
                handle.write("\n")
            os.chmod(name, 0o600)
            os.replace(name, self.path)
        finally:
            if os.path.exists(name):
                os.unlink(name)
 class AgentPullRunner:
    """Pull, claim, execute and report one task at a time."""
    def __init__(
        self,
        config: RunnerConfig,
        transport: RunnerTransport,
        state_store: JsonStateStore | None = None,
        *,
        random_fn: Callable[[], float] = random.random,
    ) -> None:
        if not config.worker_id.strip():
            raise RunnerError("worker_id is required")
        self.config = config
        self.transport = transport
        self.state_store = state_store
        self.random_fn = random_fn
        self.state = state_store.load() if state_store else RunnerState()
    def _save(self) -> None:
        if self.state_store:
            self.state_store.save(self.state)
    def register(self) -> Mapping[str, Any]:
        return self.transport.register_worker(self.config.worker_id, self.config.capabilities)
    def heartbeat(self) -> Mapping[str, Any]:
        return self.transport.heartbeat(self.config.worker_id)
    def discovery_delay(self, failures: int) -> float:
        failures = max(0, int(failures))
        base = min(self.config.max_backoff_seconds, self.config.fallback_seconds * (2**failures))
        jitter = self.random_fn() * max(0, self.config.jitter_seconds)
        return min(self.config.max_backoff_seconds, base + jitter)
    def discover_once(self) -> Mapping[str, Any] | None:
        try:
            task = self.transport.long_poll(self.config.worker_id, self.config.long_poll_seconds)
        except Exception:
            task = None
        if task is None:
            task = self.transport.poll(self.config.worker_id)
        if not task:
            return None
        task_id = str(task.get("task_id", ""))
        if not task_id:
            raise RunnerError("task_id is required")
        if task_id in self.state.terminal:
            return {"status": "duplicate_suppressed", "task_id": task_id}
        claimed = dict(self.transport.claim(self.config.worker_id, task))
        self.state.inflight[task_id] = claimed
        self._save()
        return claimed
    def renew(self, task_id: str) -> Mapping[str, Any]:
        if task_id not in self.state.inflight:
            raise RunnerError("task is not inflight")
        return self.transport.renew(self.config.worker_id, task_id)
    def report_progress(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
        if task_id not in self.state.inflight:
            raise RunnerError("task is not inflight")
        return self.transport.report_progress(self.config.worker_id, task_id, payload)
    def report_evidence(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
        if task_id not in self.state.inflight:
            raise RunnerError("task is not inflight")
        return self.transport.report_evidence(self.config.worker_id, task_id, payload)
    def report_result(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
        if task_id in self.state.terminal:
            return {"status": "duplicate_terminal_suppressed", "task_id": task_id}
        if task_id not in self.state.inflight:
            raise RunnerError("task is not inflight")
        result = dict(self.transport.report_result(self.config.worker_id, task_id, payload))
        self.state.terminal[task_id] = {"result": result, "reported_at": time.time()}
        self.state.inflight.pop(task_id, None)
        self._save()
        return result
    def recover_after_restart(self) -> list[Mapping[str, Any]]:
        recovered: list[Mapping[str, Any]] = []
        for task_id in tuple(self.state.inflight):
            recovered.append(self.renew(task_id))
        return recovered
    def validate_execution(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> None:
        if not argv or any(not isinstance(item, str) or not item for item in argv):
            raise RunnerError("argv_only_execution_required")
        if any(ch in argv[0] for ch in (";", "|", "&", "`", "\n")):
            raise RunnerError("shell_syntax_denied")
        executable = shutil.which(argv[0])
        if not executable:
            raise RunnerError("executable_not_found")
        if self.config.executable_allowlist and not any(
            os.path.realpath(executable).startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
            or os.path.realpath(executable) == os.path.realpath(prefix)
            for prefix in self.config.executable_allowlist
        ):
            raise RunnerError("executable_not_allowlisted")
        real_cwd = os.path.realpath(os.fspath(cwd))
        if self.config.working_directory_allowlist and not any(
            real_cwd == os.path.realpath(prefix)
            or real_cwd.startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
            for prefix in self.config.working_directory_allowlist
        ):
            raise RunnerError("working_directory_not_allowlisted")
        if self.config.environment_allowlist and any(key not in self.config.environment_allowlist for key in env):
            raise RunnerError("environment_key_not_allowlisted")
    def execute_argv(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> Mapping[str, Any]:
        self.validate_execution(argv, cwd, env)
        completed = subprocess.run(list(argv), cwd=os.fspath(cwd), env=dict(env), shell=False, text=True, capture_output=True, check=False)
        return {"returncode": completed.returncode, "stdout": completed.stdout, "stderr": completed.stderr}
@@ -1,36 +0,0 @@
 """Small operational CLI for the Agent Pull Runner contract."""
 from __future__ import annotations
 import argparse
 import json
 from agent_pull_runner import AgentPullRunner, RunnerConfig
 class _NoopTransport:
    def register_worker(self, worker_id, capabilities): return {"status": "registered", "worker_id": worker_id, "capabilities": list(capabilities)}
    def heartbeat(self, worker_id): return {"status": "alive", "worker_id": worker_id}
    def long_poll(self, worker_id, timeout_seconds): return None
    def poll(self, worker_id): return None
    def claim(self, worker_id, task): return task
    def renew(self, worker_id, task_id): return {"status": "renewed", "task_id": task_id}
    def report_progress(self, worker_id, task_id, payload): return {"status": "progress_recorded", "task_id": task_id}
    def report_result(self, worker_id, task_id, payload): return {"status": "result_recorded", "task_id": task_id}
    def report_evidence(self, worker_id, task_id, payload): return {"status": "evidence_recorded", "task_id": task_id}
 def main() -> int:
    parser = argparse.ArgumentParser(description="AIOS Agent Pull Runner")
    parser.add_argument("--worker-id", default="self-test-worker")
    parser.add_argument("--self-test", action="store_true")
    args = parser.parse_args()
    runner = AgentPullRunner(RunnerConfig(worker_id=args.worker_id, fallback_seconds=60), _NoopTransport())
    if args.self_test:
        print(json.dumps({"status": "PASS", "registration": runner.register(), "fallback_seconds": runner.config.fallback_seconds}, sort_keys=True))
        return 0
    print(json.dumps({"status": "READY", "worker_id": args.worker_id}, sort_keys=True))
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,722 +0,0 @@
 """Owner-controlled CAS-bound execution-envelope rebind for Online Agent Tasks.
 This service exists for a narrow recovery case: a Task was projected/claimed with a read-only
 source_capture envelope before its already-registered deterministic plan became authoritative.
 It never creates Tasks/Jobs/branches and never accepts arbitrary metadata patches. It only replaces
 metadata.execution + the derived execution_projection for the same governed binding, after an
 official NEEDS_REWORK transition has returned the Task to QUEUED with no active lease.
 """
 from __future__ import annotations
 from dataclasses import dataclass
 from datetime import datetime, timezone
 import hashlib
 import hmac
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 import json
 import os
 from pathlib import Path
 import re
 import sqlite3
 from typing import Any, Callable, Mapping, Sequence
 import urllib.error
 import urllib.request
 from aios_online_agent_execution import (
    GovernedExecutionBinding,
    validate_execution_envelope,
 )
 TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
 KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
 SHA_RE = re.compile(r"^[0-9a-f]{64}$")
 MAX_BODY = 64 * 1024
 AUTHORIZATION_ID_ENV = "AIOS_AGENT_TASK_EXECUTION_REBIND_AUTHORIZATION_ID"
 class ExecutionRebindError(RuntimeError):
    def __init__(self, code: str, status: int = 409) -> None:
        super().__init__(code)
        self.code = code
        self.status = status
 def _canonical(value: object) -> bytes:
    return json.dumps(
        value, sort_keys=True, separators=(",", ":"), ensure_ascii=False
    ).encode("utf-8")
 def _sha(value: object) -> str:
    return hashlib.sha256(_canonical(value)).hexdigest()
 def _now() -> str:
    return datetime.now(timezone.utc).isoformat()
 def _require_string(
    value: object,
    code: str,
    pattern: re.Pattern[str] | None = None,
 ) -> str:
    if not isinstance(value, str) or not value.strip():
        raise ExecutionRebindError(code, 400)
    value = value.strip()
    if pattern is not None and pattern.fullmatch(value) is None:
        raise ExecutionRebindError(code, 400)
    return value
 def _required_authorization_id() -> str:
    value = os.environ.get(AUTHORIZATION_ID_ENV, "").strip()
    if not value:
        raise RuntimeError("TASK_EXECUTION_REBIND_AUTHORIZATION_ID_MISSING")
    if KEY_RE.fullmatch(value) is None:
        raise RuntimeError("TASK_EXECUTION_REBIND_AUTHORIZATION_ID_INVALID")
    return value
@dataclass(frozen=True)
 class ExecutionRebindRequest:
    expected_status: str
    expected_revision: int
    expected_attempt: int
    previous_verification_sha256: str
    expected_old_execution_digest: str
    expected_new_execution_digest: str
    authorization_id: str
    idempotency_key: str
    reason: str
    @classmethod
    def from_mapping(cls, value: Mapping[str, Any]) -> "ExecutionRebindRequest":
        allowed = {
            "expected_status",
            "expected_revision",
            "expected_attempt",
            "previous_verification_sha256",
            "expected_old_execution_digest",
            "expected_new_execution_digest",
            "authorization_id",
            "idempotency_key",
            "reason",
        }
        if set(value) != allowed:
            raise ExecutionRebindError("EXECUTION_REBIND_FIELDS_INVALID", 400)
        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
        if status != "QUEUED":
            raise ExecutionRebindError("EXPECTED_STATUS_INVALID", 400)
        revision = value["expected_revision"]
        attempt = value["expected_attempt"]
        if (
            not isinstance(revision, int)
            or isinstance(revision, bool)
            or revision < 0
            or not isinstance(attempt, int)
            or isinstance(attempt, bool)
            or attempt < 1
        ):
            raise ExecutionRebindError("EXECUTION_REBIND_INTEGER_INVALID", 400)
        verification = _require_string(
            value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID"
        )
        old_digest = _require_string(
            value["expected_old_execution_digest"], "OLD_EXECUTION_DIGEST_INVALID"
        )
        new_digest = _require_string(
            value["expected_new_execution_digest"], "NEW_EXECUTION_DIGEST_INVALID"
        )
        for digest, code in (
            (verification, "VERIFICATION_SHA256_INVALID"),
            (old_digest, "OLD_EXECUTION_DIGEST_INVALID"),
            (new_digest, "NEW_EXECUTION_DIGEST_INVALID"),
        ):
            if SHA_RE.fullmatch(digest) is None:
                raise ExecutionRebindError(code, 400)
        if old_digest == new_digest:
            raise ExecutionRebindError("EXECUTION_REBIND_DIGEST_UNCHANGED", 400)
        authorization = _require_string(
            value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE
        )
        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
        reason = _require_string(value["reason"], "EXECUTION_REBIND_REASON_INVALID")
        if len(reason) > 512:
            raise ExecutionRebindError("EXECUTION_REBIND_REASON_INVALID", 400)
        return cls(
            status,
            revision,
            attempt,
            verification,
            old_digest,
            new_digest,
            authorization,
            key,
            reason,
        )
    def public(self) -> dict[str, Any]:
        return {
            "expected_status": self.expected_status,
            "expected_revision": self.expected_revision,
            "expected_attempt": self.expected_attempt,
            "previous_verification_sha256": self.previous_verification_sha256,
            "expected_old_execution_digest": self.expected_old_execution_digest,
            "expected_new_execution_digest": self.expected_new_execution_digest,
            "authorization_id": self.authorization_id,
            "idempotency_key": self.idempotency_key,
            "reason": self.reason,
        }
 class CanonicalBridgeExecutionResolver:
    """Resolve the already-registered plan from the canonical governed Bridge."""
    def __init__(self, base_url: str, control_token: str) -> None:
        self.base_url = base_url.rstrip("/")
        self.control_token = control_token
    def __call__(
        self,
        task_id: str,
        required_capabilities: Sequence[str],
    ) -> dict[str, Any]:
        body = json.dumps(
            {
                "task_id": task_id,
                "required_capabilities": list(required_capabilities),
            },
            sort_keys=True,
            separators=(",", ":"),
        ).encode("utf-8")
        request = urllib.request.Request(
            self.base_url + "/v2/execution-envelope",
            method="POST",
            data=body,
            headers={
                "Authorization": "Bearer " + self.control_token,
                "Content-Type": "application/json",
                "Accept": "application/json",
            },
        )
        try:
            with urllib.request.urlopen(request, timeout=15) as response:
                raw = response.read()
                status = response.status
        except urllib.error.HTTPError as exc:
            raw = exc.read()
            status = exc.code
        try:
            value = json.loads(raw.decode("utf-8"))
        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
            raise ExecutionRebindError("CANONICAL_EXECUTION_RESPONSE_INVALID", 502) from exc
        if not isinstance(value, Mapping):
            raise ExecutionRebindError("CANONICAL_EXECUTION_RESPONSE_INVALID", 502)
        if status != 200:
            raise ExecutionRebindError(
                str(value.get("error") or "CANONICAL_EXECUTION_RESOLUTION_FAILED"),
                502 if status >= 500 else 409,
            )
        return dict(value)
 class ExecutionRebindStore:
    """Official owner-controlled mutation with CAS, plan resolution and durable audit."""
    def __init__(
        self,
        db_path: Path,
        resolver: Callable[[str, Sequence[str]], Mapping[str, Any]],
    ) -> None:
        self.db_path = Path(db_path)
        self.resolver = resolver
    def _connect(self) -> sqlite3.Connection:
        connection = sqlite3.connect(self.db_path, timeout=30.0)
        connection.row_factory = sqlite3.Row
        connection.execute("PRAGMA foreign_keys=ON")
        connection.execute("PRAGMA busy_timeout=30000")
        return connection
    @staticmethod
    def _columns(
        connection: sqlite3.Connection,
        table: str,
    ) -> dict[str, sqlite3.Row]:
        return {
            str(row["name"]): row
            for row in connection.execute(f'PRAGMA table_info("{table}")')
        }
    @staticmethod
    def _json_value(raw: object, code: str) -> dict[str, Any]:
        if isinstance(raw, Mapping):
            return dict(raw)
        if not isinstance(raw, str):
            raise ExecutionRebindError(code, 409)
        try:
            value = json.loads(raw)
        except json.JSONDecodeError as exc:
            raise ExecutionRebindError(code, 409) from exc
        if not isinstance(value, Mapping):
            raise ExecutionRebindError(code, 409)
        return dict(value)
    @staticmethod
    def _verification_hash(raw: object) -> str:
        if raw in (None, ""):
            value: object = {}
        elif isinstance(raw, str):
            try:
                value = json.loads(raw)
            except json.JSONDecodeError as exc:
                raise ExecutionRebindError("TASK_VERIFICATION_INVALID", 409) from exc
        else:
            value = raw
        return _sha(value)
    @staticmethod
    def _metadata_column(columns: Mapping[str, sqlite3.Row]) -> str:
        for name in ("metadata_json", "metadata"):
            if name in columns:
                return name
        raise ExecutionRebindError("TASK_METADATA_SCHEMA_UNSUPPORTED", 503)
    @staticmethod
    def _required_capabilities(
        task: sqlite3.Row,
        columns: Mapping[str, sqlite3.Row],
        old_execution: Mapping[str, Any],
    ) -> list[str]:
        for field in ("required_capabilities_json", "required_capabilities"):
            if field not in columns:
                continue
            raw = task[field]
            if raw in (None, ""):
                continue
            if isinstance(raw, str):
                try:
                    value = json.loads(raw)
                except json.JSONDecodeError:
                    value = [item for item in raw.split(",") if item.strip()]
            else:
                value = raw
            if isinstance(value, list) and all(isinstance(item, str) for item in value):
                return [item.strip() for item in value if item.strip()]
        value = old_execution.get("capability_scope")
        if isinstance(value, list) and all(isinstance(item, str) for item in value):
            return [item for item in value if item]
        raise ExecutionRebindError("TASK_CAPABILITIES_UNAVAILABLE", 503)
    @staticmethod
    def _event_table(
        connection: sqlite3.Connection,
    ) -> tuple[str, dict[str, sqlite3.Row]]:
        tables = {
            row["name"]
            for row in connection.execute(
                "SELECT name FROM sqlite_master WHERE type='table'"
            )
        }
        for name in ("task_events", "events"):
            if name not in tables:
                continue
            columns = ExecutionRebindStore._columns(connection, name)
            if "task_id" in columns and ("event_type" in columns or "type" in columns):
                return name, columns
        raise ExecutionRebindError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
    @staticmethod
    def _insert_event(
        connection: sqlite3.Connection,
        task_id: str,
        payload: Mapping[str, Any],
    ) -> None:
        table, columns = ExecutionRebindStore._event_table(connection)
        values: dict[str, Any] = {"task_id": task_id}
        if "event_type" in columns:
            values["event_type"] = "TASK_EXECUTION_REBIND_AUTHORIZED"
        else:
            values["type"] = "TASK_EXECUTION_REBIND_AUTHORIZED"
        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
        if "payload_json" in columns:
            values["payload_json"] = payload_text
        elif "payload" in columns:
            values["payload"] = payload_text
        else:
            raise ExecutionRebindError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
        if "created_at" in columns:
            values["created_at"] = _now()
        if "agent_id" in columns:
            values["agent_id"] = "owner-control"
        if "actor_id" in columns:
            values["actor_id"] = "owner-control"
        names = list(values)
        quoted = ",".join('"' + name + '"' for name in names)
        placeholders = ",".join("?" for _ in names)
        connection.execute(
            f'INSERT INTO "{table}" ({quoted}) VALUES ({placeholders})',
            tuple(values[name] for name in names),
        )
    @staticmethod
    def _ensure_rebind_table(connection: sqlite3.Connection) -> None:
        connection.execute(
            """
            CREATE TABLE IF NOT EXISTS task_execution_rebinds (
              task_id TEXT NOT NULL,
              idempotency_key TEXT NOT NULL,
              request_sha256 TEXT NOT NULL,
              authorization_id TEXT NOT NULL,
              previous_verification_sha256 TEXT NOT NULL,
              old_execution_digest TEXT NOT NULL,
              new_execution_digest TEXT NOT NULL,
              expected_revision INTEGER NOT NULL,
              applied_revision INTEGER NOT NULL,
              attempt INTEGER NOT NULL,
              reason TEXT NOT NULL,
              created_at TEXT NOT NULL,
              PRIMARY KEY(task_id,idempotency_key)
            )
            """
        )
    def _load_and_validate(
        self,
        connection: sqlite3.Connection,
        task_id: str,
        request: ExecutionRebindRequest,
    ) -> tuple[sqlite3.Row, dict[str, sqlite3.Row], str, dict[str, Any], dict[str, Any]]:
        columns = self._columns(connection, "tasks")
        required = {
            "task_id",
            "status",
            "attempt",
            "revision",
            "claimed_by",
            "lease_token_hash",
            "lease_expires_at",
            "verification_json",
        }
        if not required.issubset(columns):
            raise ExecutionRebindError("TASK_SCHEMA_EXECUTION_REBIND_UNSUPPORTED", 503)
        metadata_column = self._metadata_column(columns)
        task = connection.execute(
            "SELECT * FROM tasks WHERE task_id=?",
            (task_id,),
        ).fetchone()
        if task is None:
            raise ExecutionRebindError("TASK_NOT_FOUND", 404)
        if (
            str(task["status"]) != request.expected_status
            or int(task["revision"]) != request.expected_revision
            or int(task["attempt"]) != request.expected_attempt
        ):
            raise ExecutionRebindError("EXECUTION_REBIND_CAS_MISMATCH", 409)
        if task["lease_token_hash"] not in (None, "") or task["lease_expires_at"] not in (None, ""):
            raise ExecutionRebindError("EXECUTION_REBIND_ACTIVE_LEASE_DENY", 409)
        verification_sha = self._verification_hash(task["verification_json"])
        if verification_sha != request.previous_verification_sha256:
            raise ExecutionRebindError("EXECUTION_REBIND_VERIFICATION_DRIFT", 409)
        metadata = self._json_value(
            task[metadata_column],
            "TASK_METADATA_INVALID",
        )
        execution = metadata.get("execution")
        if not isinstance(execution, Mapping):
            raise ExecutionRebindError("TASK_EXECUTION_METADATA_MISSING", 409)
        old_execution = validate_execution_envelope(dict(execution))
        if old_execution["execution_digest"] != request.expected_old_execution_digest:
            raise ExecutionRebindError("EXECUTION_REBIND_OLD_DIGEST_DRIFT", 409)
        if old_execution.get("action") != "source_capture":
            raise ExecutionRebindError("EXECUTION_REBIND_SOURCE_CAPTURE_REQUIRED", 409)
        projection = metadata.get("execution_projection")
        if isinstance(projection, Mapping):
            projected_digest = str(projection.get("execution_digest") or "")
            if projected_digest and projected_digest != request.expected_old_execution_digest:
                raise ExecutionRebindError("EXECUTION_REBIND_PROJECTION_DRIFT", 409)
        return task, columns, metadata_column, metadata, old_execution
    def rebind(
        self,
        task_id: str,
        request: ExecutionRebindRequest,
    ) -> dict[str, Any]:
        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
        required_authorization = _required_authorization_id()
        if request.authorization_id != required_authorization:
            raise ExecutionRebindError("EXECUTION_REBIND_AUTHORIZATION_ID_MISMATCH", 403)
        request_sha = _sha(request.public())
        # Idempotent replay must win before CAS validation because a successful
        # rebind necessarily increments the Task revision and changes the persisted envelope.
        with self._connect() as connection:
            self._ensure_rebind_table(connection)
            replay = connection.execute(
                "SELECT * FROM task_execution_rebinds WHERE task_id=? AND idempotency_key=?",
                (task_id, request.idempotency_key),
            ).fetchone()
            if replay is not None:
                if replay["request_sha256"] != request_sha:
                    raise ExecutionRebindError("EXECUTION_REBIND_IDEMPOTENCY_CONFLICT", 409)
                connection.commit()
                return {
                    "task_id": task_id,
                    "status": "QUEUED",
                    "attempt": int(replay["attempt"]),
                    "revision": int(replay["applied_revision"]),
                    "old_execution_digest": replay["old_execution_digest"],
                    "new_execution_digest": replay["new_execution_digest"],
                    "authorization_id": replay["authorization_id"],
                    "idempotent": True,
                }
        # Read/CAS snapshot first. Canonical Bridge resolution happens outside the DB write lock.
        with self._connect() as connection:
            task, columns, _, _, old_execution = self._load_and_validate(
                connection, task_id, request
            )
            capabilities = self._required_capabilities(task, columns, old_execution)
        binding = GovernedExecutionBinding.from_mapping(old_execution)
        resolved = dict(self.resolver(task_id, capabilities))
        new_execution = validate_execution_envelope(resolved, binding=binding)
        if new_execution.get("action") != "deterministic":
            raise ExecutionRebindError("EXECUTION_REBIND_DETERMINISTIC_PLAN_REQUIRED", 409)
        if new_execution["execution_digest"] != request.expected_new_execution_digest:
            raise ExecutionRebindError("EXECUTION_REBIND_NEW_DIGEST_DRIFT", 409)
        if new_execution["execution_digest"] == old_execution["execution_digest"]:
            raise ExecutionRebindError("EXECUTION_REBIND_DIGEST_UNCHANGED", 409)
        # Re-read under BEGIN IMMEDIATE and apply only if the exact snapshot is unchanged.
        with self._connect() as connection:
            connection.execute("BEGIN IMMEDIATE")
            self._ensure_rebind_table(connection)
            replay = connection.execute(
                "SELECT * FROM task_execution_rebinds WHERE task_id=? AND idempotency_key=?",
                (task_id, request.idempotency_key),
            ).fetchone()
            if replay is not None:
                if replay["request_sha256"] != request_sha:
                    raise ExecutionRebindError("EXECUTION_REBIND_IDEMPOTENCY_CONFLICT", 409)
                connection.commit()
                return {
                    "task_id": task_id,
                    "status": "QUEUED",
                    "attempt": int(replay["attempt"]),
                    "revision": int(replay["applied_revision"]),
                    "old_execution_digest": replay["old_execution_digest"],
                    "new_execution_digest": replay["new_execution_digest"],
                    "authorization_id": replay["authorization_id"],
                    "idempotent": True,
                }
            task, columns, metadata_column, metadata, current_old = self._load_and_validate(
                connection, task_id, request
            )
            if current_old["execution_digest"] != old_execution["execution_digest"]:
                raise ExecutionRebindError("EXECUTION_REBIND_OLD_DIGEST_DRIFT", 409)
            new_metadata = dict(metadata)
            new_metadata["execution"] = new_execution
            new_metadata["execution_projection"] = {
                "schema": "aios.online-agent.task-projection.v1",
                "task_id": binding.task_id,
                "job_id": binding.job_id,
                "execution_digest": new_execution["execution_digest"],
            }
            applied_revision = request.expected_revision + 1
            previous_claimed_by = task["claimed_by"]
            cursor = connection.execute(
                f"""
                UPDATE tasks
                   SET "{metadata_column}"=?, revision=?, claimed_by=NULL,
                       lease_token_hash=NULL, lease_expires_at=NULL
                 WHERE task_id=? AND status=? AND revision=? AND attempt=?
                   AND claimed_by IS ? AND lease_token_hash IS NULL AND lease_expires_at IS NULL
                """,
                (
                    json.dumps(new_metadata, sort_keys=True, separators=(",", ":")),
                    applied_revision,
                    task_id,
                    request.expected_status,
                    request.expected_revision,
                    request.expected_attempt,
                    previous_claimed_by,
                ),
            )
            if cursor.rowcount != 1:
                raise ExecutionRebindError("EXECUTION_REBIND_CAS_MISMATCH", 409)
            event_payload = {
                "schema": "aios.task-execution-rebind.event.v1",
                "task_id": task_id,
                "job_id": binding.job_id,
                "authorization_id": request.authorization_id,
                "idempotency_key": request.idempotency_key,
                "reason": request.reason,
                "previous_verification_sha256": request.previous_verification_sha256,
                "old_execution_digest": old_execution["execution_digest"],
                "new_execution_digest": new_execution["execution_digest"],
                "old_action": old_execution.get("action"),
                "new_action": new_execution.get("action"),
                "previous_revision": request.expected_revision,
                "applied_revision": applied_revision,
                "attempt": request.expected_attempt,
                "request_sha256": request_sha,
                "previous_claimed_by": previous_claimed_by,
                "stale_claim_normalized": previous_claimed_by not in (None, ""),
            }
            self._insert_event(connection, task_id, event_payload)
            connection.execute(
                """
                INSERT INTO task_execution_rebinds(
                  task_id,idempotency_key,request_sha256,authorization_id,
                  previous_verification_sha256,old_execution_digest,new_execution_digest,
                  expected_revision,applied_revision,attempt,reason,created_at
                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
                """,
                (
                    task_id,
                    request.idempotency_key,
                    request_sha,
                    request.authorization_id,
                    request.previous_verification_sha256,
                    old_execution["execution_digest"],
                    new_execution["execution_digest"],
                    request.expected_revision,
                    applied_revision,
                    request.expected_attempt,
                    request.reason,
                    _now(),
                ),
            )
            connection.commit()
            return {
                "task_id": task_id,
                "status": "QUEUED",
                "attempt": request.expected_attempt,
                "revision": applied_revision,
                "old_execution_digest": old_execution["execution_digest"],
                "new_execution_digest": new_execution["execution_digest"],
                "authorization_id": request.authorization_id,
                "idempotent": False,
            }
 class ExecutionRebindHandler(BaseHTTPRequestHandler):
    store: ExecutionRebindStore | None = None
    control_token: str = ""
    def log_message(self, *_args: Any) -> None:
        return
    def _json(self, value: Mapping[str, Any], status: int) -> None:
        data = json.dumps(
            dict(value), sort_keys=True, separators=(",", ":")
        ).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(data)))
        self.end_headers()
        self.wfile.write(data)
    def _authorized(self) -> bool:
        header = self.headers.get("Authorization", "")
        return (
            header.startswith("Bearer ")
            and bool(self.control_token)
            and hmac.compare_digest(header[7:], self.control_token)
        )
    def do_GET(self) -> None:
        if self.path == "/health":
            self._json(
                {"status": "ok", "service": "aios-agent-task-execution-rebind"},
                200,
            )
        else:
            self._json({"error": "NOT_FOUND"}, 404)
    def do_POST(self) -> None:
        match = re.fullmatch(r"/v1/tasks/([^/]+)/execution-rebind", self.path)
        if match is None:
            self._json({"error": "NOT_FOUND"}, 404)
            return
        if not self._authorized():
            self._json({"error": "UNAUTHORIZED"}, 401)
            return
        try:
            length = int(self.headers.get("Content-Length", "0"))
        except ValueError:
            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
            return
        if length < 1 or length > MAX_BODY:
            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
            return
        try:
            value = json.loads(self.rfile.read(length).decode("utf-8"))
            if not isinstance(value, Mapping):
                raise ValueError
            request = ExecutionRebindRequest.from_mapping(value)
            if self.store is None:
                raise ExecutionRebindError("RUNTIME_UNAVAILABLE", 503)
            result = self.store.rebind(match.group(1), request)
            self._json(result, 200 if result["idempotent"] else 201)
        except ExecutionRebindError as exc:
            self._json({"error": exc.code}, exc.status)
        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
            self._json({"error": "REQUEST_INVALID"}, 400)
 def load_control_token(path: Path) -> str:
    if path.is_symlink() or not path.is_file():
        raise RuntimeError("TASK_EXECUTION_REBIND_CONTROL_CREDENTIAL_UNAVAILABLE")
    value = path.read_text(encoding="utf-8").strip()
    if len(value) < 32:
        raise RuntimeError("TASK_EXECUTION_REBIND_CONTROL_CREDENTIAL_INVALID")
    return value
 def serve() -> None:
    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
    _required_authorization_id()
    token_path = Path(
        os.environ.get(
            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
            str(
                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
                / "agent_task_control_token"
            ),
        )
    )
    token = load_control_token(token_path)
    bridge = os.environ.get(
        "AIOS_GOVERNED_WRITE_API_URL",
        "http://127.0.0.1:18892",
    )
    host = os.environ.get("AIOS_TASK_EXECUTION_REBIND_HOST", "127.0.0.1")
    port = int(os.environ.get("AIOS_TASK_EXECUTION_REBIND_PORT", "18942"))
    ExecutionRebindHandler.store = ExecutionRebindStore(
        db,
        CanonicalBridgeExecutionResolver(bridge, token),
    )
    ExecutionRebindHandler.control_token = token
    ThreadingHTTPServer((host, port), ExecutionRebindHandler).serve_forever()
 if __name__ == "__main__":
    serve()
@@ -1,427 +0,0 @@
 """Owner-controlled, CAS-bound retry extension for exhausted Online Agent Tasks."""
 from __future__ import annotations
 from dataclasses import dataclass
 from datetime import datetime, timezone
 import hashlib
 import hmac
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 import json
 import os
 from pathlib import Path
 import re
 import sqlite3
 from typing import Any, Mapping
 TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
 KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
 MAX_BODY = 64 * 1024
 AUTHORIZE_EXTENSION_ID_ENV = "AIOS_AGENT_TASK_AUTHORIZATION_ID"
 class RetryExtensionError(RuntimeError):
    def __init__(self, code: str, status: int = 409) -> None:
        super().__init__(code)
        self.code = code
        self.status = status
 def _canonical(value: object) -> bytes:
    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
 def _sha(value: object) -> str:
    return hashlib.sha256(_canonical(value)).hexdigest()
 def _required_authorization_id() -> str:
    value = os.environ.get(AUTHORIZE_EXTENSION_ID_ENV, "").strip()
    if not value:
        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_MISSING")
    if KEY_RE.fullmatch(value) is None:
        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_INVALID")
    return value
 def _now() -> str:
    return datetime.now(timezone.utc).isoformat()
 def _require_string(value: object, code: str, pattern: re.Pattern[str] | None = None) -> str:
    if not isinstance(value, str) or not value.strip():
        raise RetryExtensionError(code, 400)
    value = value.strip()
    if pattern is not None and pattern.fullmatch(value) is None:
        raise RetryExtensionError(code, 400)
    return value
@dataclass(frozen=True)
 class RetryExtensionRequest:
    expected_status: str
    expected_revision: int
    expected_attempt: int
    expected_max_attempts: int
    next_max_attempts: int
    previous_verification_sha256: str
    authorization_id: str
    idempotency_key: str
    @classmethod
    def from_mapping(cls, value: Mapping[str, Any]) -> "RetryExtensionRequest":
        allowed = {
            "expected_status", "expected_revision", "expected_attempt", "expected_max_attempts",
            "next_max_attempts", "previous_verification_sha256", "authorization_id", "idempotency_key",
        }
        if set(value) != allowed:
            raise RetryExtensionError("RETRY_EXTENSION_FIELDS_INVALID", 400)
        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
        if status != "FAILED":
            raise RetryExtensionError("EXPECTED_STATUS_INVALID", 400)
        ints: dict[str, int] = {}
        for field in ("expected_revision", "expected_attempt", "expected_max_attempts", "next_max_attempts"):
            item = value[field]
            if not isinstance(item, int) or isinstance(item, bool) or item < 0:
                raise RetryExtensionError("RETRY_EXTENSION_INTEGER_INVALID", 400)
            ints[field] = item
        if ints["expected_attempt"] != ints["expected_max_attempts"]:
            raise RetryExtensionError("RETRY_EXTENSION_NOT_EXHAUSTED", 409)
        if ints["next_max_attempts"] != ints["expected_max_attempts"] + 1:
            raise RetryExtensionError("RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP", 400)
        if ints["next_max_attempts"] > 50:
            raise RetryExtensionError("RETRY_EXTENSION_LIMIT_EXCEEDED", 400)
        verification = _require_string(value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID")
        if re.fullmatch(r"[0-9a-f]{64}", verification) is None:
            raise RetryExtensionError("VERIFICATION_SHA256_INVALID", 400)
        authorization = _require_string(value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE)
        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
        return cls(
            status,
            ints["expected_revision"],
            ints["expected_attempt"],
            ints["expected_max_attempts"],
            ints["next_max_attempts"],
            verification,
            authorization,
            key,
        )
    def public(self) -> dict[str, Any]:
        return {
            "expected_status": self.expected_status,
            "expected_revision": self.expected_revision,
            "expected_attempt": self.expected_attempt,
            "expected_max_attempts": self.expected_max_attempts,
            "next_max_attempts": self.next_max_attempts,
            "previous_verification_sha256": self.previous_verification_sha256,
            "authorization_id": self.authorization_id,
            "idempotency_key": self.idempotency_key,
        }
 class RetryExtensionStore:
    """Owns the official mutation. Direct/manual DB edits remain forbidden."""
    def __init__(self, db_path: Path) -> None:
        self.db_path = Path(db_path)
    def _connect(self) -> sqlite3.Connection:
        connection = sqlite3.connect(self.db_path, timeout=30.0)
        connection.row_factory = sqlite3.Row
        connection.execute("PRAGMA foreign_keys=ON")
        connection.execute("PRAGMA busy_timeout=30000")
        return connection
    @staticmethod
    def _columns(connection: sqlite3.Connection, table: str) -> dict[str, sqlite3.Row]:
        return {str(row["name"]): row for row in connection.execute(f'PRAGMA table_info("{table}")')}
    @staticmethod
    def _event_table(connection: sqlite3.Connection) -> tuple[str, dict[str, sqlite3.Row]]:
        tables = {
            row["name"]
            for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")
        }
        for name in ("task_events", "events"):
            if name not in tables:
                continue
            columns = RetryExtensionStore._columns(connection, name)
            if "task_id" in columns and ("event_type" in columns or "type" in columns):
                return name, columns
        raise RetryExtensionError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
    @staticmethod
    def _verification_hash(raw: object) -> str:
        if raw in (None, ""):
            value: object = {}
        elif isinstance(raw, str):
            try:
                value = json.loads(raw)
            except json.JSONDecodeError as exc:
                raise RetryExtensionError("TASK_VERIFICATION_INVALID", 409) from exc
        else:
            value = raw
        return _sha(value)
    @staticmethod
    def _ensure_extension_table(connection: sqlite3.Connection) -> None:
        connection.execute(
            """
            CREATE TABLE IF NOT EXISTS task_retry_extensions (
              task_id TEXT NOT NULL,
              idempotency_key TEXT NOT NULL,
              request_sha256 TEXT NOT NULL,
              authorization_id TEXT NOT NULL,
              previous_verification_sha256 TEXT NOT NULL,
              previous_max_attempts INTEGER NOT NULL,
              next_max_attempts INTEGER NOT NULL,
              expected_revision INTEGER NOT NULL,
              applied_revision INTEGER NOT NULL,
              created_at TEXT NOT NULL,
              PRIMARY KEY(task_id, idempotency_key)
            )
            """
        )
    @staticmethod
    def _insert_event(
        connection: sqlite3.Connection,
        task_id: str,
        payload: Mapping[str, Any],
    ) -> None:
        table, columns = RetryExtensionStore._event_table(connection)
        values: dict[str, Any] = {"task_id": task_id}
        if "event_type" in columns:
            values["event_type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
        else:
            values["type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
        if "payload_json" in columns:
            values["payload_json"] = payload_text
        elif "payload" in columns:
            values["payload"] = payload_text
        else:
            raise RetryExtensionError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
        if "created_at" in columns:
            values["created_at"] = _now()
        if "agent_id" in columns:
            values["agent_id"] = "owner-control"
        if "actor_id" in columns:
            values["actor_id"] = "owner-control"
        names = list(values)
        sql = f'INSERT INTO "{table}" ({",".join(f"""\"{name}\"""" for name in names)}) VALUES ({",".join("?" for _ in names)})'
        connection.execute(sql, tuple(values[name] for name in names))
    def extend(self, task_id: str, request: RetryExtensionRequest) -> dict[str, Any]:
        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
        required_authorization_id = _required_authorization_id()
        if request.authorization_id != required_authorization_id:
            raise RetryExtensionError("RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH", 403)
        request_payload = request.public()
        request_sha = _sha(request_payload)
        with self._connect() as connection:
            connection.execute("BEGIN IMMEDIATE")
            self._ensure_extension_table(connection)
            replay = connection.execute(
                "SELECT * FROM task_retry_extensions WHERE task_id=? AND idempotency_key=?",
                (task_id, request.idempotency_key),
            ).fetchone()
            if replay is not None:
                if replay["request_sha256"] != request_sha:
                    raise RetryExtensionError("RETRY_EXTENSION_IDEMPOTENCY_CONFLICT", 409)
                connection.commit()
                return {
                    "task_id": task_id,
                    "status": "QUEUED",
                    "attempt": request.expected_attempt,
                    "max_attempts": int(replay["next_max_attempts"]),
                    "revision": int(replay["applied_revision"]),
                    "idempotent": True,
                    "authorization_id": replay["authorization_id"],
                    "previous_verification_sha256": replay["previous_verification_sha256"],
                }
            columns = self._columns(connection, "tasks")
            required = {
                "task_id", "status", "attempt", "max_attempts", "revision", "claimed_by",
                "lease_token_hash", "lease_expires_at", "verification_json",
            }
            if not required.issubset(columns):
                raise RetryExtensionError("TASK_SCHEMA_RETRY_EXTENSION_UNSUPPORTED", 503)
            task = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
            if task is None:
                raise RetryExtensionError("TASK_NOT_FOUND", 404)
            actual_verification_sha = self._verification_hash(task["verification_json"])
            if actual_verification_sha != request.previous_verification_sha256:
                raise RetryExtensionError("RETRY_EXTENSION_VERIFICATION_DRIFT", 409)
            if (
                task["status"] != request.expected_status
                or int(task["revision"]) != request.expected_revision
                or int(task["attempt"]) != request.expected_attempt
                or int(task["max_attempts"]) != request.expected_max_attempts
            ):
                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
            for lease_field in ("lease_token_hash", "lease_expires_at"):
                if lease_field in columns and task[lease_field] not in (None, ""):
                    raise RetryExtensionError("RETRY_EXTENSION_ACTIVE_LEASE_DENY", 409)
            previous_claimed_by = task["claimed_by"]
            applied_revision = request.expected_revision + 1
            cursor = connection.execute(
                """
                UPDATE tasks
                   SET status='QUEUED', max_attempts=?, revision=?, claimed_by=NULL,
                       lease_token_hash=NULL, lease_expires_at=NULL
                 WHERE task_id=? AND status=? AND revision=? AND attempt=? AND max_attempts=?
                   AND claimed_by IS ?
                   AND lease_token_hash IS NULL AND lease_expires_at IS NULL
                """,
                (
                    request.next_max_attempts,
                    applied_revision,
                    task_id,
                    request.expected_status,
                    request.expected_revision,
                    request.expected_attempt,
                    request.expected_max_attempts,
                    previous_claimed_by,
                ),
            )
            if cursor.rowcount != 1:
                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
            event_payload = {
                "schema": "aios.task-retry-extension.event.v1",
                "task_id": task_id,
                "authorization_id": request.authorization_id,
                "idempotency_key": request.idempotency_key,
                "previous_verification_sha256": request.previous_verification_sha256,
                "previous_max_attempts": request.expected_max_attempts,
                "next_max_attempts": request.next_max_attempts,
                "previous_revision": request.expected_revision,
                "applied_revision": applied_revision,
                "request_sha256": request_sha,
                "previous_claimed_by": previous_claimed_by,
                "stale_terminal_claim_normalized": previous_claimed_by not in (None, ""),
            }
            self._insert_event(connection, task_id, event_payload)
            connection.execute(
                """
                INSERT INTO task_retry_extensions(
                  task_id,idempotency_key,request_sha256,authorization_id,previous_verification_sha256,
                  previous_max_attempts,next_max_attempts,expected_revision,applied_revision,created_at
                ) VALUES (?,?,?,?,?,?,?,?,?,?)
                """,
                (
                    task_id,
                    request.idempotency_key,
                    request_sha,
                    request.authorization_id,
                    request.previous_verification_sha256,
                    request.expected_max_attempts,
                    request.next_max_attempts,
                    request.expected_revision,
                    applied_revision,
                    _now(),
                ),
            )
            connection.commit()
            return {
                "task_id": task_id,
                "status": "QUEUED",
                "attempt": request.expected_attempt,
                "max_attempts": request.next_max_attempts,
                "revision": applied_revision,
                "idempotent": False,
                "authorization_id": request.authorization_id,
                "previous_verification_sha256": request.previous_verification_sha256,
            }
 class RetryExtensionHandler(BaseHTTPRequestHandler):
    store: RetryExtensionStore | None = None
    control_token: str = ""
    def log_message(self, *_args: Any) -> None:
        return
    def _json(self, value: Mapping[str, Any], status: int) -> None:
        data = json.dumps(dict(value), sort_keys=True, separators=(",", ":")).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(data)))
        self.end_headers()
        self.wfile.write(data)
    def _authorized(self) -> bool:
        header = self.headers.get("Authorization", "")
        return (
            header.startswith("Bearer ")
            and bool(self.control_token)
            and hmac.compare_digest(header[7:], self.control_token)
        )
    def do_GET(self) -> None:
        if self.path == "/health":
            self._json({"status": "ok", "service": "aios-agent-task-retry-extension"}, 200)
        else:
            self._json({"error": "NOT_FOUND"}, 404)
    def do_POST(self) -> None:
        match = re.fullmatch(r"/v1/tasks/([^/]+)/retry-extension", self.path)
        if match is None:
            self._json({"error": "NOT_FOUND"}, 404)
            return
        if not self._authorized():
            self._json({"error": "UNAUTHORIZED"}, 401)
            return
        try:
            length = int(self.headers.get("Content-Length", "0"))
        except ValueError:
            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
            return
        if length < 1 or length > MAX_BODY:
            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
            return
        try:
            value = json.loads(self.rfile.read(length).decode("utf-8"))
            if not isinstance(value, Mapping):
                raise ValueError
            request = RetryExtensionRequest.from_mapping(value)
            if self.store is None:
                raise RetryExtensionError("RUNTIME_UNAVAILABLE", 503)
            result = self.store.extend(match.group(1), request)
            self._json(result, 200 if result["idempotent"] else 201)
        except RetryExtensionError as exc:
            self._json({"error": exc.code}, exc.status)
        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
            self._json({"error": "REQUEST_INVALID"}, 400)
 def load_control_token(path: Path) -> str:
    if path.is_symlink() or not path.is_file():
        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_UNAVAILABLE")
    value = path.read_text(encoding="utf-8").strip()
    if len(value) < 32:
        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_INVALID")
    return value
 def serve() -> None:
    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
    _required_authorization_id()
    token_path = Path(
        os.environ.get(
            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
            str(Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials")) / "agent_task_control_token"),
        )
    )
    host = os.environ.get("AIOS_TASK_RETRY_HOST", "127.0.0.1")
    port = int(os.environ.get("AIOS_TASK_RETRY_PORT", "18941"))
    RetryExtensionHandler.store = RetryExtensionStore(db)
    RetryExtensionHandler.control_token = load_control_token(token_path)
    ThreadingHTTPServer((host, port), RetryExtensionHandler).serve_forever()
 if __name__ == "__main__":
    serve()
@@ -1,258 +0,0 @@
 """Fail-closed Authority Git side-effect boundary.
 Only this module may issue the narrowly scoped ref CAS primitives used by the
 durable executor. It never accepts force updates, arbitrary refs, tags, or
 direct production mutations.
 """
 from __future__ import annotations
 from dataclasses import dataclass
 import os
 from pathlib import Path
 import re
 import subprocess
 import tempfile
 from typing import Mapping, Sequence
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 TASK_BRANCH_RE = re.compile(r"^refs/heads/agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
 class AuthorityGitError(RuntimeError):
    pass
 def _oid(value: str, field: str) -> str:
    if not isinstance(value, str) or not OID_RE.fullmatch(value):
        raise AuthorityGitError(f"{field}_INVALID")
    return value
@dataclass(frozen=True, slots=True)
 class AuthorityGitExecutor:
    git_dir: Path
    worktree_root: Path = Path("/var/lib/aios-gitops/worktrees")
    def __post_init__(self) -> None:
        if not self.git_dir.is_absolute() or self.git_dir.is_symlink():
            raise AuthorityGitError("AUTHORITY_GIT_DIR_INVALID")
        if not self.worktree_root.is_absolute() or self.worktree_root.is_symlink():
            raise AuthorityGitError("WORKTREE_ROOT_INVALID")
    def _git(self, args: Sequence[str], *, check: bool = True) -> str:
        result = subprocess.run(
            ["git", f"--git-dir={self.git_dir}", *args],
            text=True,
            capture_output=True,
            check=False,
        )
        if check and result.returncode != 0:
            raise AuthorityGitError("AUTHORITY_GIT_COMMAND_FAILED")
        return result.stdout.strip()
    def read_ref(self, ref: str) -> str | None:
        if not ref.startswith("refs/") or ref.startswith(("refs/tags/", "refs/remotes/")):
            raise AuthorityGitError("REF_READ_SCOPE_DENIED")
        value = self._git(["rev-parse", "--verify", ref], check=False)
        return value if value and OID_RE.fullmatch(value) else None
    def commit_exists(self, oid: str) -> bool:
        _oid(oid, "commit_oid")
        result = subprocess.run(["git", f"--git-dir={self.git_dir}", "cat-file", "-e", oid + "^{commit}"], capture_output=True, check=False)
        return result.returncode == 0
    def ancestry_check(self, older_oid: str, newer_oid: str) -> bool:
        _oid(older_oid, "older_oid")
        _oid(newer_oid, "newer_oid")
        result = subprocess.run(
            ["git", f"--git-dir={self.git_dir}", "merge-base", "--is-ancestor", older_oid, newer_oid],
            capture_output=True,
            check=False,
        )
        if result.returncode not in (0, 1):
            raise AuthorityGitError("ANCESTRY_CHECK_FAILED")
        return result.returncode == 0
    def create_detached_worktree(
        self,
        base_oid: str,
        worktree_name: str,
        root: Path | None = None,
    ) -> Path:
        _oid(base_oid, "base_oid")
        if not worktree_name or "/" in worktree_name or "\\" in worktree_name or worktree_name in {".", ".."}:
            raise AuthorityGitError("WORKTREE_NAME_INVALID")
        parent = root or self.worktree_root
        if not parent.is_absolute() or parent.is_symlink():
            raise AuthorityGitError("WORKTREE_ROOT_INVALID")
        path = parent / worktree_name
        if path.exists() or path.is_symlink():
            raise AuthorityGitError("WORKTREE_ALREADY_EXISTS")
        parent.mkdir(parents=True, exist_ok=True)
        self._git(["worktree", "add", "--detach", str(path), base_oid])
        return path
    def recover_failed_detached_worktree_exact(
        self,
        *,
        path: Path,
        expected_oid: str,
        stale_oid: str,
        target_ref: str,
    ) -> str:
        """Recreate one exact clean, detached, single-attempt worktree at its durable head."""
        _oid(expected_oid, "expected_oid")
        _oid(stale_oid, "stale_oid")
        if not TASK_BRANCH_RE.fullmatch(target_ref):
            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
        if self.read_ref(target_ref) is not None:
            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
        if (
            not path.is_absolute()
            or path.parent != self.worktree_root
            or path.name in {"", ".", ".."}
            or path.is_symlink()
            or not path.is_dir()
        ):
            raise AuthorityGitError("WORKTREE_RECOVERY_PATH_INVALID")
        head = subprocess.run(
            ["git", "-C", str(path), "rev-parse", "HEAD"],
            text=True, capture_output=True, check=False,
        )
        if head.returncode != 0 or head.stdout.strip() != stale_oid or stale_oid == expected_oid:
            raise AuthorityGitError("WORKTREE_RECOVERY_HEAD_INVALID")
        symbolic = subprocess.run(
            ["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"],
            text=True, capture_output=True, check=False,
        )
        if symbolic.returncode != 1:
            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_DETACHED")
        status = subprocess.run(
            ["git", "-C", str(path), "status", "--porcelain=v1", "--untracked-files=all"],
            text=True, capture_output=True, check=False,
        )
        if status.returncode != 0 or status.stdout:
            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_CLEAN")
        parents = self._git(["rev-list", "--parents", "-n", "1", stale_oid]).split()
        if parents != [stale_oid, expected_oid]:
            raise AuthorityGitError("WORKTREE_RECOVERY_LINEAGE_INVALID")
        registered = [
            line.removeprefix("worktree ")
            for line in self._git(["worktree", "list", "--porcelain"]).splitlines()
            if line.startswith("worktree ")
        ]
        if registered.count(str(path)) != 1:
            raise AuthorityGitError("WORKTREE_RECOVERY_REGISTRATION_INVALID")
        self._git(["worktree", "remove", "--force", str(path)])
        if path.exists() or path.is_symlink():
            raise AuthorityGitError("WORKTREE_RECOVERY_REMOVE_FAILED")
        recreated = self.create_detached_worktree(expected_oid, path.name, path.parent)
        readback = subprocess.run(
            ["git", "-C", str(recreated), "rev-parse", "HEAD"],
            text=True, capture_output=True, check=False,
        )
        detached = subprocess.run(
            ["git", "-C", str(recreated), "symbolic-ref", "-q", "HEAD"],
            text=True, capture_output=True, check=False,
        )
        if readback.returncode != 0 or readback.stdout.strip() != expected_oid or detached.returncode != 1:
            raise AuthorityGitError("WORKTREE_RECOVERY_READBACK_MISMATCH")
        return stale_oid
    def create_task_branch_CAS(self, branch: str, expected_base_oid: str, new_oid: str) -> str:
        if not TASK_BRANCH_RE.fullmatch(branch):
            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
        _oid(expected_base_oid, "expected_base_oid")
        _oid(new_oid, "new_oid")
        current = self.read_ref(branch)
        if current is not None:
            if current == new_oid:
                return new_oid
            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
        if not self.ancestry_check(expected_base_oid, new_oid):
            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
        self._git(["update-ref", branch, new_oid, "0" * 40])
        readback = self.read_ref(branch)
        if readback != new_oid:
            raise AuthorityGitError("AUTHORITY_CREATE_READBACK_MISMATCH")
        return readback
    def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
        if not TASK_BRANCH_RE.fullmatch(branch):
            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
        _oid(expected_oid, "expected_oid")
        _oid(new_oid, "new_oid")
        current = self.read_ref(branch)
        if current != expected_oid:
            if current == new_oid:
                return new_oid
            raise AuthorityGitError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
        if not self.ancestry_check(expected_oid, new_oid):
            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
        self._git(["update-ref", branch, new_oid, expected_oid])
        readback = self.read_ref(branch)
        if readback != new_oid:
            raise AuthorityGitError("AUTHORITY_CAS_READBACK_MISMATCH")
        return readback
    def ff_CAS_main_after_verified_protected_merge(self, expected_oid: str, new_oid: str) -> str:
        _oid(expected_oid, "expected_oid")
        _oid(new_oid, "new_oid")
        if not self.ancestry_check(expected_oid, new_oid):
            raise AuthorityGitError("MAIN_FF_REQUIRED")
        current = self.read_ref("refs/heads/main")
        if current != expected_oid:
            if current == new_oid:
                return new_oid
            raise AuthorityGitError("AUTHORITY_MAIN_EXPECTATION_MISMATCH")
        self._git(["update-ref", "refs/heads/main", new_oid, expected_oid])
        readback = self.read_ref("refs/heads/main")
        if readback != new_oid:
            raise AuthorityGitError("AUTHORITY_MAIN_CAS_READBACK_MISMATCH")
        return readback
    def commit_file_in_isolated_worktree(
        self,
        *,
        base_oid: str,
        files: Mapping[str, bytes],
        message: str,
        worktree_name: str,
    ) -> str:
        _oid(base_oid, "base_oid")
        if not worktree_name or "/" in worktree_name or "\\" in worktree_name or worktree_name in {".", ".."}:
            raise AuthorityGitError("WORKTREE_NAME_INVALID")
        root = self.worktree_root / worktree_name
        if root.exists() or root.is_symlink():
            raise AuthorityGitError("WORKTREE_ALREADY_EXISTS")
        self.worktree_root.mkdir(parents=True, exist_ok=True)
        self._git(["worktree", "add", "--detach", str(root), base_oid])
        try:
            for relative, content in files.items():
                path = Path(relative)
                if path.is_absolute() or ".." in path.parts or not path.parts or path.parts[0] == ".git":
                    raise AuthorityGitError("FILE_PATH_INVALID")
                target = root / path
                target.parent.mkdir(parents=True, exist_ok=True)
                target.write_bytes(content)
            result = subprocess.run(
                ["git", "-C", str(root), "add", "--", *files.keys()],
                text=True,
                capture_output=True,
                check=False,
            )
            if result.returncode != 0:
                raise AuthorityGitError("WORKTREE_ADD_FAILED")
            result = subprocess.run(
                ["git", "-C", str(root), "-c", "user.name=aios-durable-job", "-c", "user.email=aios-durable-job@localhost", "commit", "--no-verify", "-m", message],
                text=True,
                capture_output=True,
                check=False,
            )
            if result.returncode != 0:
                raise AuthorityGitError("WORKTREE_COMMIT_FAILED")
            return subprocess.check_output(["git", "-C", str(root), "rev-parse", "HEAD"], text=True).strip()
        finally:
            subprocess.run(["git", f"--git-dir={self.git_dir}", "worktree", "remove", "--force", str(root)], capture_output=True, check=False)
@@ -1,73 +0,0 @@
 """HTTP adapter for Owner-authorized task writer provisioning.
 Run this module instead of aios_chatgpt_actions_api.py. All existing routes are
 delegated unchanged; only POST /api/task-writer/provision-authorized is added.
 """
 from __future__ import annotations
 import os
 import urllib.parse
 import aios_chatgpt_actions_api as api
 from authorized_task_writer_provisioning import (
    AuthorizedTaskWriterProvisioner,
    OwnerContext,
    ProvisioningError,
 )
 _original_do_post = api.H.do_POST
 _ENDPOINT = "/api/task-writer/provision-authorized"
 def _owner_authorization(handler):
    scope = os.getenv(
        "AIOS_GITOPS_OWNER_PROVISION_SCOPE", "writer:provision"
    )
    auth = handler.need(scope)
    if not auth:
        return None
    if auth.get("role") != "owner":
        handler.sendj({"error": "OWNER_AUTHORIZATION_REQUIRED"}, 403)
        return None
    identity = str(auth.get("account") or "").strip()
    if not identity:
        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
        return None
    return auth
 def _authorized_do_post(self):
    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
    if path != _ENDPOINT:
        return _original_do_post(self)
    auth = _owner_authorization(self)
    if not auth:
        return
    data = self.body()
    owner_reference = str(data.get("owner_authorization_reference") or "")
    try:
        result = AuthorizedTaskWriterProvisioner().provision(
            data,
            OwnerContext(
                identity=str(auth["account"]),
                role=str(auth["role"]),
                authorization_reference=owner_reference,
            ),
        )
        return self.sendj(result)
    except ProvisioningError as exc:
        body = {"error": exc.code}
        if exc.details:
            body["details"] = exc.details
        return self.sendj(body, exc.status)
    except Exception:
        # Do not expose tool output, paths containing credentials, or traceback data.
        return self.sendj({"error": "AUTHORIZED_WRITER_BRIDGE_INTERNAL_ERROR"}, 500)
 api.H.do_POST = _authorized_do_post
 if __name__ == "__main__":
    api.main()
@@ -0,0 +1,379 @@
 #!/usr/bin/env python3
 """Task-scoped continuous authorization controller for the AIOS Candidate writer."""
 from __future__ import annotations
 import base64, fcntl, hashlib, json, os, pwd, grp, re, socket, sqlite3, stat, subprocess, sys, tempfile, time, urllib.error, urllib.parse, urllib.request
 from datetime import datetime, timedelta, timezone
 from pathlib import Path, PurePosixPath, PureWindowsPath
 from typing import Any
 TASK='AIOS-AUTONOMOUS-RELEASE-FULL-IMPLEMENTATION-20260726'
 AUTH_ID='authz-aios-autonomous-release-20260726'
 BRANCH='patch/chatgpt-autonomous-completion-contract-20260726'
 BASE='875d41c3101093149414292067fd700dc214d4d3'
 REPO='aios/aios'
 WRITER_AUDIENCE='chatgpt-autonomous-release-writer'
 ACTOR='chatgpt-gitops-bot'
 WRITER_INSTANCE='writer-6e32f321-1240-46f8-9693-0b0631d9c77b'
 CHILD_OPERATION_MAX_USES=20
 ROOT=Path('/data/aios-gitops')
 WORKTREE=ROOT/'worktrees/chatgpt-autonomous-completion-contract-20260726'
 BARE=ROOT/'repo.git'
 TASK_ROOT=ROOT/'runtime/tasks'/TASK
 AUTH_DIR=Path('/etc/aios-gitops/task-authorizations')
 PARENT=AUTH_DIR/'authz-aios-autonomous-release-20260726.json'
 STATE_DIR=Path('/var/lib/aios-autonomous-release-authorization')
 STATE=STATE_DIR/'state.json'
 LOCK=STATE_DIR/'controller.lock'
 AUDIT=TASK_ROOT/'continuous-authorization.audit.jsonl'
 SOCKET_DIR=Path('/run/aios-autonomous-release-authorization')
 SOCKET_PATH=SOCKET_DIR/'controller.sock'
 PROJECTION=Path('/etc/aios-gitops/credentials/chatgpt-autonomous-release-writer')
 REGISTRY=Path('/var/lib/aios-chatgpt-autonomous-release-writer/token-registry.sqlite3')
 WRITER_LEDGER=Path('/var/lib/aios-chatgpt-autonomous-release-writer/operation-ledger.sqlite3')
 ASKPASS=Path('/usr/libexec/aios-autonomous-release-authorization/gitea_askpass.py')
 PATH_POLICY=Path('/etc/aios-gitops/policies-chatgpt-autonomous-release/autonomous-release-path-policy.json')
 ROUTE_BINDING=Path('/etc/aios-gitops/action-route-bindings/chatgpt-autonomous-release-20260726.json')
 OID_RE=re.compile(r'^[0-9a-f]{40}$')
 OP_RE=re.compile(r'^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$')
 TERMINAL={'COMPLETED','CANCELLED','FAILED_FINAL','REVOKED','REVOKED_IDLE_TIMEOUT','REVOKED_WALL_CLOCK','RECONCILIATION_REQUIRED'}
 sys.path.insert(0,'/usr/libexec/aios-chatgpt-autonomous-release-writer-fullprofile-8ac2f90f')
 from isolated_writer_token_registry import TokenRegistry
 def now() -> datetime: return datetime.now(timezone.utc)
 def stamp() -> str: return now().replace(microsecond=0).isoformat()
 def canonical(value: Any) -> bytes: return json.dumps(value,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode('utf-8')
 def fail(code: str, status: int=503, **details: Any) -> None: raise ControlError(code,status,details)
 class ControlError(RuntimeError):
 def __init__(self,code:str,status:int=503,details:dict[str,Any]|None=None): self.code,self.status,self.details=code,status,details or {}; super().__init__(code)
 def owned_regular(path:Path, mode:int) -> os.stat_result:
 try: info=os.lstat(path)
 except FileNotFoundError: fail('authorization_config_missing')
 if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)&~mode: fail('authorization_config_permissions_rejected')
 return info
 def load_json(path:Path,mode:int=0o600) -> dict[str,Any]:
 owned_regular(path,mode)
 try: value=json.loads(path.read_text(encoding='utf-8'))
 except Exception: fail('authorization_config_json_rejected')
 if not isinstance(value,dict): fail('authorization_config_schema_rejected')
 return value
 def atomic_json(path:Path,value:dict[str,Any],mode:int=0o600) -> None:
 path.parent.mkdir(parents=True,exist_ok=True)
 raw=canonical(value)+b'\n'
 fd,tmp=tempfile.mkstemp(prefix='.new-',dir=path.parent)
 try:
  os.fchmod(fd,mode); os.write(fd,raw); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,path)
  os.chmod(path,mode)
 finally:
  try: os.close(fd)
  except OSError: pass
  if os.path.exists(tmp): os.unlink(tmp)
 def append_audit(event:dict[str,Any]) -> None:
 TASK_ROOT.mkdir(parents=True,exist_ok=True)
 flags=os.O_WRONLY|os.O_CREAT|os.O_APPEND|getattr(os,'O_NOFOLLOW',0)
 fd=os.open(AUDIT,flags,0o600)
 try: os.write(fd,canonical({'at':stamp(),'task_id':TASK,'secrets_included':False,**event})+b'\n'); os.fsync(fd)
 finally: os.close(fd)
 def parent() -> dict[str,Any]:
 p=load_json(PARENT)
 required={'schema_version','development_authorization_id','authorization_type','task_id','actor_identity','audience','repository','exact_branch','approved_base_oid','allowed_path_roots','allowed_exact_paths','allowed_operations','created_at','valid_until','maximum_wall_clock_seconds','idle_timeout_seconds','manual_reapproval_per_commit','maximum_concurrent_writes','path_policy_sha256','writer_instance_id'}
 if set(p)!=required or p.get('schema_version')!=1: fail('parent_authorization_schema_rejected')
 fixed={'development_authorization_id':AUTH_ID,'authorization_type':'TASK_SCOPED_CONTINUOUS_DEVELOPMENT','task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'exact_branch':BRANCH,'approved_base_oid':BASE,'manual_reapproval_per_commit':False,'maximum_concurrent_writes':1,'writer_instance_id':WRITER_INSTANCE}
 if any(p.get(k)!=v for k,v in fixed.items()): fail('parent_authorization_binding_rejected')
 if p.get('maximum_wall_clock_seconds')!=86400 or p.get('idle_timeout_seconds')!=2700: fail('parent_authorization_lifetime_rejected')
 if not isinstance(p.get('allowed_path_roots'),list) or not isinstance(p.get('allowed_exact_paths'),list) or not isinstance(p.get('allowed_operations'),list): fail('parent_authorization_scope_rejected')
 raw=PATH_POLICY.read_bytes()
 if hashlib.sha256(raw).hexdigest()!=p.get('path_policy_sha256'): fail('parent_authorization_path_policy_changed')
 return p
 def parse_time(v:Any) -> datetime:
 try:
  d=datetime.fromisoformat(str(v).replace('Z','+00:00'))
  return d.astimezone(timezone.utc)
 except Exception: fail('authorization_time_rejected')
 def components(path:str)->tuple[str,...]:
 if not isinstance(path,str) or not path or path!=path.strip() or '\\' in path or '\x00' in path: fail('authorization_path_rejected',403)
 pp=PurePosixPath(path); wp=PureWindowsPath(path)
 parts=tuple(path.split('/'))
 if pp.is_absolute() or wp.is_absolute() or bool(wp.drive) or any(x in {'','.','..'} for x in parts): fail('authorization_path_rejected',403)
 return parts
 def path_allowed(p:dict[str,Any],path:str)->bool:
 item=components(path)
 for root in p['allowed_path_roots']:
  r=components(str(root).rstrip('/'))
  if item[:len(r)]==r: return True
 return any(item==components(x) for x in p['allowed_exact_paths'])
 def git(*args:str,cwd:Path|None=None,env:dict[str,str]|None=None)->str:
 e=os.environ.copy(); e.update(env or {}); e['GIT_CONFIG_COUNT']='1'; e['GIT_CONFIG_KEY_0']='safe.directory'; e['GIT_CONFIG_VALUE_0']=str(WORKTREE)
 r=subprocess.run(['git',*args],cwd=cwd,text=True,capture_output=True,env=e)
 if r.returncode: fail('authorization_git_probe_failed',503)
 return r.stdout.strip()
 def credential_lines()->list[str]:
 cp=Path(os.environ.get('CREDENTIALS_DIRECTORY',''))/'gitea_git_http'
 try:
  info=os.lstat(cp); lines=cp.read_text(encoding='utf-8').splitlines()
 except OSError: fail('authorization_gitea_credential_unavailable')
 if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or len(lines)!=2 or lines[0]!='gitops-bot' or not lines[1]: fail('authorization_gitea_credential_rejected')
 return lines
 def remote_oid()->str:
 credential_lines()
 e={'GIT_ASKPASS':str(ASKPASS),'GIT_TERMINAL_PROMPT':'0'}
 out=git('ls-remote','--heads','http://127.0.0.1:3000/aios/aios.git',f'refs/heads/{BRANCH}',cwd=WORKTREE,env=e)
 fields=out.split()
 if len(fields)!=2 or not OID_RE.fullmatch(fields[0]): fail('authorization_git_ls_remote_rejected')
 return fields[0]
 def api_oid()->str:
 user,password=credential_lines(); branch=urllib.parse.quote(BRANCH,safe='')
 encoded=base64.b64encode((user+':'+password).encode()).decode()
 request=urllib.request.Request('http://127.0.0.1:3000/api/v1/repos/aios/aios/branches/'+branch,headers={'Authorization':'Basic '+encoded,'Host':'g.cnnetmkt.top'})
 try:
  with urllib.request.urlopen(request,timeout=10) as response: value=json.loads(response.read())
 except Exception: fail('authorization_gitea_api_unavailable')
 oid=str(value.get('commit',{}).get('id',''))
 if not OID_RE.fullmatch(oid): fail('authorization_gitea_api_oid_rejected')
 return oid
 def four_way(expected:str)->None:
 local=git('rev-parse','HEAD',cwd=WORKTREE)
 bare=git('--git-dir',str(BARE),'rev-parse',f'refs/heads/{BRANCH}')
 remote=remote_oid(); api=api_oid()
 if any(x!=expected for x in (local,bare,remote,api)): fail('RECONCILIATION_REQUIRED',409,current_head_oid=local)
 if git('status','--porcelain',cwd=WORKTREE)!='': fail('authorization_worktree_dirty',409)
 def state()->dict[str,Any]:
 s=load_json(STATE)
 required={'schema_version','development_authorization_id','task_id','status','current_head_oid','last_activity_at','writer_child','test_child','inflight','updated_at'}
 if set(s)!=required or s.get('schema_version')!=1 or s.get('development_authorization_id')!=AUTH_ID or s.get('task_id')!=TASK or not OID_RE.fullmatch(str(s.get('current_head_oid',''))): fail('authorization_state_schema_rejected')
 return s
 def save_state(s:dict[str,Any])->None: s['updated_at']=stamp(); atomic_json(STATE,s)
 def lock():
 STATE_DIR.mkdir(parents=True,exist_ok=True); os.chmod(STATE_DIR,0o700)
 f=open(LOCK,'a+b'); os.chmod(LOCK,0o600); fcntl.flock(f.fileno(),fcntl.LOCK_EX); return f
 def route_binding_valid(p:dict[str,Any])->None:
 b=load_json(ROUTE_BINDING,0o640)
 identities=b.get('action_identities')
 if b.get('task_id')!=TASK or b.get('writer_instance_id')!=WRITER_INSTANCE or b.get('repository')!=REPO or b.get('branch')!=BRANCH or b.get('approved_base_oid')!=BASE or b.get('path_policy_sha256')!=p.get('path_policy_sha256') or not isinstance(identities,list) or len(identities)!=1 or identities[0].get('account')!=ACTOR:
  fail('authorization_route_binding_changed',409)
 def task_live(p:dict[str,Any],s:dict[str,Any],*,touch:bool)->None:
 route_binding_valid(p)
 if s['status'] in TERMINAL: fail('authorization_task_terminal',409)
 if now()>=parse_time(p['valid_until']):
  s['status']='REVOKED_WALL_CLOCK'; save_state(s); cleanup(s,'wall_clock'); fail('authorization_task_terminal',409)
 if (now()-parse_time(s['last_activity_at'])).total_seconds()>p['idle_timeout_seconds']:
  s['status']='REVOKED_IDLE_TIMEOUT'; save_state(s); cleanup(s,'idle_timeout'); fail('authorization_task_terminal',409)
 if touch: s['last_activity_at']=stamp(); save_state(s)
 def projection_token()->str|None:
 if not PROJECTION.exists(): return None
 try:
  info=os.lstat(PROJECTION)
  if not stat.S_ISREG(info.st_mode) or stat.S_ISLNK(info.st_mode) or info.st_uid!=0 or stat.S_IMODE(info.st_mode)!=0o600: fail('authorization_projection_rejected')
  token=PROJECTION.read_text(encoding='utf-8').strip()
  return token if len(token.encode())>=32 else None
 except OSError: fail('authorization_projection_rejected')
 def write_projection(token:str)->None:
 PROJECTION.parent.mkdir(parents=True,exist_ok=True)
 fd,tmp=tempfile.mkstemp(prefix='.writer-',dir=PROJECTION.parent)
 try:
  os.fchmod(fd,0o600); os.write(fd,(token+'\n').encode()); os.fsync(fd); os.close(fd); os.chown(tmp,0,0); os.replace(tmp,PROJECTION); os.chmod(PROJECTION,0o600)
 finally:
  try: os.close(fd)
  except OSError: pass
  if os.path.exists(tmp): os.unlink(tmp)
 def post_revoke_401(token:str)->None:
 req=urllib.request.Request('http://127.0.0.1:19893/api/runtime-status',headers={'Authorization':'Bearer '+token})
 try: urllib.request.urlopen(req,timeout=5)
 except urllib.error.HTTPError as e:
  if e.code==401:return
 except Exception: pass
 fail('authorization_old_credential_revocation_unverified')
 def rotate_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
 old=projection_token(); registry=TokenRegistry(REGISTRY)
 old_record=registry.find(old) if old else None
 if old_record and (old_record.get('task_id')!=TASK or old_record.get('development_authorization_id')!=AUTH_ID):
  if parse_time(old_record.get('expires_at'))>=now(): fail('authorization_existing_projection_binding_rejected')
  if not registry.revoke(str(old_record['token_id'])): fail('authorization_historical_child_revoke_failed')
  post_revoke_401(old)
  append_audit({'event':'historical_expired_child_revoked','old_credential_http_status':401})
  old_record=None
 issued=now().replace(microsecond=0); expires=issued+timedelta(minutes=20)
 prefixes=[str(x).rstrip('/')+'/' for x in p['allowed_path_roots']]
 grant={'token_id':'continuous-child-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'credential_id':'credential-'+issued.strftime('%Y%m%dT%H%M%SZ')+'-'+os.urandom(3).hex(),'development_authorization_id':AUTH_ID,'audience':WRITER_AUDIENCE,'task_id':TASK,'actor_identity':ACTOR,'writer_instance_id':WRITER_INSTANCE,'repository_identity':REPO,'source_cidrs':['127.0.0.1/32'],'allowed_branch':BRANCH,'current_expected_head_oid':s['current_head_oid'],'approved_base_oid':BASE,'allowed_operations':p['allowed_operations'],'allowed_paths':p['allowed_exact_paths'],'allowed_path_prefixes':prefixes,'not_before':issued.isoformat(),'expires_at':expires.isoformat(),'renewable':False,'max_uses':{operation:CHILD_OPERATION_MAX_USES for operation in p['allowed_operations']},'issued_by':'task_authorization_controller'}
 token,record=registry.issue(grant)
 try:
  write_projection(token)
  if old_record:
   if not registry.revoke(str(old_record['token_id'])): fail('authorization_old_child_revoke_failed')
   post_revoke_401(old)
 except Exception:
  registry.revoke(str(record['token_id']))
  try: PROJECTION.unlink()
  except FileNotFoundError: pass
  raise
 s['writer_child']={'credential_id':record['credential_id'],'issued_at':record['not_before'],'expires_at':record['expires_at'],'current_expected_head_oid':s['current_head_oid'],'rotation_reason':reason}
 save_state(s); append_audit({'event':'child_grant_rotated','reason':reason,'current_head_oid':s['current_head_oid'],'old_grant_revoked':bool(old_record),'old_credential_http_status':401 if old_record else None})
 return token
 def child_operation_quota_exhausted(rec:dict[str,Any],registry:TokenRegistry)->bool:
 token_id=str(rec.get('token_id',''))
 allowed=rec.get('allowed_operations')
 limits=rec.get('max_uses')
 if not token_id or not isinstance(allowed,list) or not isinstance(limits,dict): fail('authorization_child_quota_schema_rejected')
 for operation in allowed:
  maximum=limits.get(operation)
  if not isinstance(operation,str) or not isinstance(maximum,int) or maximum<1: fail('authorization_child_quota_schema_rejected')
  if registry.usage(token_id,operation)>=maximum: return True
 return False
 def ensure_child(p:dict[str,Any],s:dict[str,Any],reason:str)->str:
 token=projection_token(); meta=s.get('writer_child') or {}
 expired=True
 try: expired=(parse_time(meta.get('expires_at'))-now()).total_seconds()<=300
 except Exception: pass
 if not token or expired or meta.get('current_expected_head_oid')!=s['current_head_oid']:
  return rotate_child(p,s,reason)
 registry=TokenRegistry(REGISTRY)
 rec=registry.find(token)
 if not rec or rec.get('revoked') or rec.get('development_authorization_id')!=AUTH_ID or rec.get('current_expected_head_oid')!=s['current_head_oid']:
  return rotate_child(p,s,reason)
 if child_operation_quota_exhausted(rec,registry):
  return rotate_child(p,s,'operation_quota_exhausted')
 return token
 def ledger_verified(operation_id:str,commit_oid:str)->None:
 with sqlite3.connect(WRITER_LEDGER) as db:
  row=db.execute('select operation_id,branch,commit_oid,state,verification_status from writer_operations where operation_id=?',(operation_id,)).fetchone()
 if not row or row[1]!=BRANCH or row[2]!=commit_oid or row[3]!='COMPLETED' or row[4]!='bare+gitea': fail('authorization_writer_ledger_rejected',409)
 def reconcile(p:dict[str,Any],s:dict[str,Any],previous:str,new:str,operation_id:str)->dict[str,Any]:
 inflight=s.get('inflight')
 if not isinstance(inflight,dict) or inflight.get('previous_head_oid')!=previous or inflight.get('operation_id')!=operation_id: fail('authorization_inflight_rejected',409)
 if previous!=s['current_head_oid'] or not OID_RE.fullmatch(new): fail('authorization_head_transition_rejected',409)
 ledger_verified(operation_id,new); four_way(new)
 s['current_head_oid']=new; s['inflight']=None; s['last_activity_at']=stamp(); save_state(s)
 ensure_child(p,s,'head_advance')
 append_audit({'event':'authorization_head_advanced','previous_head_oid':previous,'new_commit_oid':new,'four_way_ref_status':True,'worktree_clean':True})
 return {'authorization_current_head_oid':new,'automatic_head_advance':True,'four_way_ref_status':True}
 def prepare(p:dict[str,Any],s:dict[str,Any],data:dict[str,Any])->dict[str,Any]:
 required={'expected_current_head_oid','operation_id','idempotency_key','exact_path','content_digest','commit_message_digest','branch','path','message'}
 if set(data)!=required: fail('authorization_request_schema_rejected',403)
 if data['branch']!=BRANCH or data['path']!=data['exact_path'] or not path_allowed(p,str(data['path'])): fail('authorization_path_rejected',403)
 if data['expected_current_head_oid']!=s['current_head_oid'] or not OID_RE.fullmatch(str(data['expected_current_head_oid'])): fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
 if not OP_RE.fullmatch(str(data['operation_id'])) or not OP_RE.fullmatch(str(data['idempotency_key'])): fail('authorization_operation_id_rejected',403)
 if not all(isinstance(data[k],str) and re.fullmatch(r'[0-9a-f]{64}',data[k]) for k in ('content_digest','commit_message_digest')): fail('authorization_digest_rejected',403)
 if hashlib.sha256(data['message'].encode()).hexdigest()!=data['commit_message_digest']: fail('authorization_commit_message_digest_rejected',403)
 inflight=s.get('inflight')
 if inflight:
  if inflight.get('operation_id')==data['operation_id'] and inflight.get('idempotency_key')==data['idempotency_key']: return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
  fail('BRANCH_HEAD_CHANGED',409,current_head_oid=s['current_head_oid'])
 four_way(s['current_head_oid'])
 s['inflight']={'operation_id':data['operation_id'],'idempotency_key':data['idempotency_key'],'previous_head_oid':s['current_head_oid'],'path':data['path'],'created_at':stamp()}; s['last_activity_at']=stamp(); save_state(s)
 append_audit({'event':'write_prepared','operation_id':data['operation_id'],'path':data['path'],'expected_head_oid':s['current_head_oid']})
 return {'expected_head_oid':s['current_head_oid'],'idempotency_key':data['idempotency_key']}
 def test_authorize(p:dict[str,Any],s:dict[str,Any],operation:str)->dict[str,Any]:
 allowed={'pytest_dormant','pytest_autonomous_release','compileall_autonomous_release','git_diff_check'}
 if operation not in allowed: fail('candidate_test_executor_operation_rejected',403)
 four_way(s['current_head_oid'])
 child=s.get('test_child') or {}; refresh=True
 try: refresh=(parse_time(child.get('expires_at'))-now()).total_seconds()<=300
 except Exception: pass
 if refresh:
  issued=now().replace(microsecond=0); child={'test_authorization_id':'test-authz-aios-autonomous-release-20260726','grant_id':'test-child-'+issued.strftime('%Y%m%dT%H%M%SZ'),'issued_at':issued.isoformat(),'expires_at':(issued+timedelta(minutes=20)).isoformat()}; s['test_child']=child
 s['last_activity_at']=stamp(); save_state(s); append_audit({'event':'test_authorized','operation':operation})
 return {'test_authorization_id':child['test_authorization_id'],'operation':operation,'expires_at':child['expires_at']}
 def cleanup(s:dict[str,Any],reason:str)->None:
 old=projection_token()
 if old:
  reg=TokenRegistry(REGISTRY); rec=reg.find(old)
  if rec: reg.revoke(str(rec['token_id']))
  try: PROJECTION.unlink()
  except FileNotFoundError: pass
  try: post_revoke_401(old)
  except ControlError: pass
 for unit in ('aios-chatgpt-autonomous-release-route.service','aios-chatgpt-autonomous-release-writer.service'):
  subprocess.run(['/usr/bin/systemctl','stop',unit],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
 subprocess.run(['/usr/bin/systemctl','stop','aios-autonomous-release-dormant-test-executor@*.service'],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL,timeout=20)
 try: ROUTE_BINDING.unlink()
 except FileNotFoundError: pass
 try: SOCKET_PATH.unlink()
 except FileNotFoundError: pass
 append_audit({'event':'authorization_cleanup','reason':reason,'projection_removed':not PROJECTION.exists(),'route_overlay_removed':not ROUTE_BINDING.exists(),'task_services_stop_requested':True})
 def request(data:dict[str,Any])->dict[str,Any]:
 op=data.get('op'); f=lock()
 try:
  p=parent(); s=state(); task_live(p,s,touch=False)
  if op=='describe_authorization':
   four_way(s['current_head_oid'])
   return {'development_authorization_id':AUTH_ID,'task_id':TASK,'actor_identity':ACTOR,'audience':WRITER_AUDIENCE,'repository':REPO,'branch':BRANCH,'approved_base_oid':BASE,'authorization_status':s['status'],'current_head_oid':s['current_head_oid']}
  if op=='get_writer_token':
   four_way(s['current_head_oid']); token=ensure_child(p,s,'scheduled_or_requested_rotation'); return {'token':token,'current_head_oid':s['current_head_oid']}
  if op=='prepare_write':
   ensure_child(p,s,'pre_write_quota_check')
   return prepare(p,s,data.get('request') if isinstance(data.get('request'),dict) else {})
  if op=='reconcile_commit':
   r=data.get('result') if isinstance(data.get('result'),dict) else {}; return reconcile(p,s,str(r.get('previous_head_oid','')),str(r.get('new_commit_oid','')),str(r.get('operation_id','')))
  if op=='fail_write':
   r=data.get('result') if isinstance(data.get('result'),dict) else {}; inflight=s.get('inflight')
   if isinstance(inflight,dict) and inflight.get('operation_id')==r.get('operation_id'): s['inflight']=None; save_state(s)
   return {'cleared':True}
  if op=='authorize_test': return test_authorize(p,s,str(data.get('operation','')))
  fail('authorization_operation_rejected',403)
 finally:
  fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
 def peer_allowed(conn:socket.socket)->bool:
 try:
  import struct
  _pid,uid,gid=struct.unpack('3i',conn.getsockopt(socket.SOL_SOCKET,socket.SO_PEERCRED,12))
  return uid==pwd.getpwnam('aiman').pw_uid and gid==grp.getgrnam('gitops').gr_gid
 except Exception: return False
 def serve()->None:
 SOCKET_DIR.mkdir(parents=True,exist_ok=True); os.chown(SOCKET_DIR,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_DIR,0o750)
 try: SOCKET_PATH.unlink()
 except FileNotFoundError: pass
 with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as server:
  server.bind(str(SOCKET_PATH)); os.chown(SOCKET_PATH,0,grp.getgrnam('gitops').gr_gid); os.chmod(SOCKET_PATH,0o660); server.listen(32); server.settimeout(1.0)
  last=0.0
  while True:
   if time.monotonic()-last>30:
    last=time.monotonic()
    try:
     f=lock(); p=parent(); s=state(); task_live(p,s,touch=False); four_way(s['current_head_oid']); ensure_child(p,s,'scheduled_rotation'); fcntl.flock(f.fileno(),fcntl.LOCK_UN); f.close()
    except ControlError as e:
     append_audit({'event':'scheduled_check_blocked','error':e.code})
     if e.code=='authorization_task_terminal': return
    except Exception: append_audit({'event':'scheduled_check_blocked','error':'authorization_controller_internal_error'})
   try: conn,_=server.accept()
   except socket.timeout: continue
   with conn:
    if not peer_allowed(conn): conn.sendall(canonical({'ok':False,'status':403,'error':'authorization_peer_rejected'})+b'\n'); continue
    try:
     raw=conn.recv(131072); data=json.loads(raw.decode()); result=request(data); conn.sendall(canonical({'ok':True,'result':result})+b'\n')
    except ControlError as e: conn.sendall(canonical({'ok':False,'status':e.status,'error':e.code,**e.details})+b'\n')
    except Exception as exc:
     append_audit({'event':'controller_internal_error','error_type':type(exc).__name__})
     conn.sendall(canonical({'ok':False,'status':503,'error':'authorization_controller_internal_error'})+b'\n')
 if __name__=='__main__': serve()
@@ -1,89 +0,0 @@
 """Governed API facade for branch-bound repair leases.
 The facade is transport-neutral so the permanent control plane can expose it
 through its existing authenticated loopback/API seam without creating a second
 Git writer or a global credential registry.
 """
 from __future__ import annotations
 from typing import Any, Mapping
 from branch_repair_lease import LeaseError, RepairLease, RepairLeaseManager, sanitized_lease_view
 class BranchRepairLeaseAPI:
    """Validate operation envelopes and return sanitized lease metadata."""
    def __init__(self, manager: RepairLeaseManager) -> None:
        self.manager = manager
    @staticmethod
    def _required(request: Mapping[str, Any], name: str) -> Any:
        value = request.get(name)
        if value is None or value == "":
            raise LeaseError(f"missing required field: {name}")
        return value
    @staticmethod
    def _view(lease: RepairLease) -> dict[str, Any]:
        return {"status": "ok", "lease": sanitized_lease_view(lease)}
    def handle(self, request: Mapping[str, Any]) -> dict[str, Any]:
        try:
            operation = self._required(request, "operation")
            owner = str(self._required(request, "owner_identity"))
            if operation == "issue":
                lease = self.manager.issue(
                    task_id=str(self._required(request, "task_id")),
                    owner_identity=owner,
                    branch=str(self._required(request, "branch")),
                    description=str(self._required(request, "description")),
                    allowed_paths=tuple(self._required(request, "allowed_paths")),
                    ttl_seconds=int(request.get("ttl_seconds", 3600)),
                )
            elif operation == "attach_existing_branch":
                lease = self.manager.attach_existing_branch(
                    str(self._required(request, "lease_id")),
                    owner_identity=owner,
                    expected_head_oid=str(self._required(request, "expected_head_oid")),
                )
            elif operation == "authorize_commit":
                lease = self.manager.authorize_commit(
                    str(self._required(request, "lease_id")),
                    owner_identity=owner,
                    expected_head_oid=str(self._required(request, "expected_head_oid")),
                    paths=tuple(self._required(request, "paths")),
                    content=request.get("content"),
                )
            elif operation == "record_commit":
                lease = self.manager.record_commit(
                    str(self._required(request, "lease_id")),
                    owner_identity=owner,
                    expected_head_oid=str(self._required(request, "expected_head_oid")),
                    new_head_oid=str(self._required(request, "new_head_oid")),
                    paths=tuple(self._required(request, "paths")),
                )
            elif operation == "recover":
                lease = self.manager.recover(
                    str(self._required(request, "lease_id")), owner_identity=owner
                )
            elif operation == "renew":
                lease = self.manager.renew(
                    str(self._required(request, "lease_id")),
                    owner_identity=owner,
                    ttl_seconds=int(self._required(request, "ttl_seconds")),
                )
            elif operation == "complete":
                lease = self.manager.complete(
                    str(self._required(request, "lease_id")), owner_identity=owner
                )
            elif operation == "revoke":
                lease = self.manager.revoke(
                    str(self._required(request, "lease_id")), owner_identity=owner
                )
            else:
                raise LeaseError("unsupported lease operation")
            return self._view(lease)
        except (LeaseError, TypeError, ValueError):
            return {"status": "blocked", "error": "lease_request_rejected"}
@@ -1,48 +0,0 @@
 """Root-only CLI for the branch-bound repair lease API."""
 from __future__ import annotations
 import argparse
 import json
 import os
 import sys
 from pathlib import Path
 from aios_branch_repair_lease_api import BranchRepairLeaseAPI
 from branch_repair_lease import GitProbe, LeaseStore
 from branch_repair_lease import RepairLeaseManager
 def main() -> int:
    parser = argparse.ArgumentParser(description="AIOS branch repair lease CLI")
    parser.add_argument("--store", required=True)
    parser.add_argument("--bare-repo", required=True)
    parser.add_argument("--request-file")
    parser.add_argument("--request-json")
    args = parser.parse_args()
    if hasattr(os, "geteuid") and os.geteuid() != 0:
        print(json.dumps({"status": "blocked", "error": "root_required"}))
        return 2
    if bool(args.request_file) == bool(args.request_json):
        print(json.dumps({"status": "blocked", "error": "one_request_source_required"}))
        return 2
    try:
        raw = (
            Path(args.request_file).read_text(encoding="utf-8")
            if args.request_file
            else str(args.request_json)
        )
        request = json.loads(raw)
        if not isinstance(request, dict):
            raise ValueError("request must be an object")
        api = BranchRepairLeaseAPI(RepairLeaseManager(LeaseStore(args.store), GitProbe(args.bare_repo)))
        response = api.handle(request)
        print(json.dumps(response, ensure_ascii=True, sort_keys=True, separators=(",", ":")))
        return 0 if response.get("status") == "ok" else 1
    except Exception:
        print(json.dumps({"status": "blocked", "error": "lease_cli_failed"}))
        return 1
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,104 +0,0 @@
 """Read-only validation of recovered campaign authorization evidence."""
 from __future__ import annotations
 import hashlib
 import json
 from pathlib import Path
 import stat
 from typing import Any
 class RecoveryEvidenceError(RuntimeError):
    pass
 def _digest(path: Path) -> str:
    h = hashlib.sha256()
    with path.open("rb") as stream:
        for block in iter(lambda: stream.read(1024 * 1024), b""):
            h.update(block)
    return h.hexdigest()
 def _secure_json(path: Path) -> dict[str, Any]:
    if path.is_symlink() or not path.is_file():
        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_MISSING")
    info = path.stat(follow_symlinks=False)
    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & 0o022:
        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_PERMISSIONS")
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_INVALID") from exc
    if not isinstance(value, dict):
        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_OBJECT_REQUIRED")
    return value
 def load_recovered_authorization(path: str | Path) -> dict[str, Any]:
    """Verify the recovery receipt, sidecar, and all referenced immutable files."""
    receipt_path = Path(path)
    receipt = _secure_json(receipt_path)
    sidecar = receipt_path.with_suffix(receipt_path.suffix + ".sha256")
    if sidecar.is_symlink() or not sidecar.is_file():
        raise RecoveryEvidenceError("RECOVERY_DIGEST_SIDECAR_MISSING")
    expected = sidecar.read_text(encoding="ascii").split()[0]
    actual = _digest(receipt_path)
    if expected != actual:
        raise RecoveryEvidenceError("RECOVERY_DIGEST_MISMATCH")
    required = {
        "schema",
        "campaign_id",
        "original_event_id",
        "original_authorization_digest",
        "signed_grant_id",
        "signed_grant_digest",
        "task_id",
        "repository",
        "original_base_oid",
        "branch",
        "expected_branch_oid",
        "recovered_from_existing_evidence",
        "new_owner_interaction",
        "recovery_state",
        "production_side_effect_executed",
        "global_writes_enabled",
        "grant_consumed",
        "owner_authorization_consumed",
        "original_receipts_immutable",
        "recovered_at",
        "evidence_files",
    }
    if set(receipt) != required or receipt["schema"] != "aios.owner-authorization-recovery.v1":
        raise RecoveryEvidenceError("RECOVERY_SCHEMA_INVALID")
    if receipt["recovered_from_existing_evidence"] is not True or receipt["new_owner_interaction"] is not False:
        raise RecoveryEvidenceError("RECOVERY_NOT_APPEND_ONLY")
    if receipt["production_side_effect_executed"] is not False or receipt["global_writes_enabled"] is not False:
        raise RecoveryEvidenceError("RECOVERY_SCOPE_INVALID")
    if receipt["recovery_state"] != "RECOVERED_PENDING_CONTINUATION_LEASE":
        raise RecoveryEvidenceError("RECOVERY_STATE_INVALID")
    evidence = receipt["evidence_files"]
    if not isinstance(evidence, list) or not evidence:
        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_LIST_INVALID")
    for item in evidence:
        if not isinstance(item, dict) or set(item) != {"path", "sha256"}:
            raise RecoveryEvidenceError("RECOVERY_EVIDENCE_ENTRY_INVALID")
        target = Path(item["path"])
        if _digest(target) != item["sha256"]:
            raise RecoveryEvidenceError("RECOVERY_EVIDENCE_DIGEST_MISMATCH")
    return {
        "schema": receipt["schema"],
        "state": receipt["recovery_state"],
        "campaign_id": receipt["campaign_id"],
        "original_event_id": receipt["original_event_id"],
        "original_authorization_digest": receipt["original_authorization_digest"],
        "signed_grant_id": receipt["signed_grant_id"],
        "task_id": receipt["task_id"],
        "repository": receipt["repository"],
        "original_base_oid": receipt["original_base_oid"],
        "branch": receipt["branch"],
        "expected_branch_oid": receipt["expected_branch_oid"],
        "digest": actual,
        "new_owner_interaction": False,
    }
@@ -1,163 +0,0 @@
 """Canonical fail-closed capability semantics for task eligibility."""
 from __future__ import annotations
 from collections.abc import Iterable
 _TASK_ALIASES: dict[str, frozenset[str]] = {
    "repository_read": frozenset({"repo.read"}),
    "git.read": frozenset({"repo.read"}),
    "repo.read": frozenset({"repo.read"}),
    "test_execution": frozenset({"test.execute"}),
    "git.test": frozenset({"test.execute"}),
    "test.execute": frozenset({"test.execute"}),
    "governed_git_write": frozenset({"governed.git.write.branch", "governed.git.write.file"}),
    "governed.git.write": frozenset({"governed.git.write.branch", "governed.git.write.file"}),
    "governed.write.branch": frozenset({"governed.git.write.branch"}),
    "governed.write.file": frozenset({"governed.git.write.file"}),
    "shell": frozenset({"runtime.shell"}),
    "git": frozenset({"runtime.git"}),
    "python": frozenset({"runtime.python"}),
    "code.read": frozenset({"legacy.code.read"}),
    "code.review": frozenset({"legacy.code.review"}),
    "code.write": frozenset({"legacy.code.write"}),
    "code.write.patch": frozenset({"legacy.code.write.patch"}),
    "test.python": frozenset({"legacy.test.python"}),
    "test.shell.allowlisted": frozenset({"legacy.test.shell.allowlisted"}),
    "git.commit": frozenset({"legacy.git.commit"}),
    "git.diff.read": frozenset({"legacy.git.diff.read"}),
    "git.force_push": frozenset({"legacy.git.force_push"}),
    "deploy.production": frozenset({"legacy.deploy.production"}),
    "secret.transform": frozenset({"legacy.secret.transform"}),
    "secure_file_transformer": frozenset({"legacy.secure_file_transformer"}),
    "runtime.shadow": frozenset({"legacy.runtime.shadow"}),
    "review.security": frozenset({"legacy.review.security"}),
    "review.api-contract": frozenset({"legacy.review.api-contract"}),
    "gpu.train": frozenset({"legacy.gpu.train"}),
    "agent.runtime.hermes": frozenset({"agent.runtime.hermes"}),
    "agent.runtime.openclaw": frozenset({"agent.runtime.openclaw"}),
 }
 _WORKER_ALIASES: dict[str, frozenset[str]] = {
    "git.read": frozenset({"repo.read"}),
    "repo.read": frozenset({"repo.read"}),
    "repository_read": frozenset({"repo.read"}),
    "git.test": frozenset({"test.execute"}),
    "test.execute": frozenset({"test.execute"}),
    "test_execution": frozenset({"test.execute"}),
    "governed.write.branch": frozenset({"governed.git.write.branch"}),
    "governed.git.write.branch": frozenset({"governed.git.write.branch"}),
    "governed.write.file": frozenset({"governed.git.write.file"}),
    "governed.git.write.file": frozenset({"governed.git.write.file"}),
    "shell": frozenset({"runtime.shell"}),
    "git": frozenset({"runtime.git"}),
    "python": frozenset({"runtime.python"}),
    "code.read": frozenset({"legacy.code.read"}),
    "code.review": frozenset({"legacy.code.review"}),
    "code.write": frozenset({"legacy.code.write"}),
    "code.write.patch": frozenset({"legacy.code.write.patch"}),
    "test.python": frozenset({"legacy.test.python"}),
    "test.shell.allowlisted": frozenset({"legacy.test.shell.allowlisted"}),
    "git.commit": frozenset({"legacy.git.commit"}),
    "git.diff.read": frozenset({"legacy.git.diff.read"}),
    "git.force_push": frozenset({"legacy.git.force_push"}),
    "deploy.production": frozenset({"legacy.deploy.production"}),
    "secret.transform": frozenset({"legacy.secret.transform"}),
    "secure_file_transformer": frozenset({"legacy.secure_file_transformer"}),
    "runtime.shadow": frozenset({"legacy.runtime.shadow"}),
    "review.security": frozenset({"legacy.review.security"}),
    "review.api-contract": frozenset({"legacy.review.api-contract"}),
    "gpu.train": frozenset({"legacy.gpu.train"}),
    "agent.runtime.hermes": frozenset({"agent.runtime.hermes"}),
    "agent.runtime.openclaw": frozenset({"agent.runtime.openclaw"}),
 }
 _UNKNOWN_PREFIX = "exact:"
 def _clean(value: object) -> str:
    if not isinstance(value, str):
        raise ValueError("capability must be a string")
    text = value.strip().lower()
    if not text:
        raise ValueError("capability must not be empty")
    return text
 def normalize_required_capabilities(values: Iterable[object]) -> frozenset[str]:
    """Map task-facing names to one semantic vocabulary.
    Unknown names remain explicit exact requirements. They are never treated
    as wildcards or granted by a failed normalization.
    """
    result: set[str] = set()
    for value in values:
        text = _clean(value)
        if "*" in text:
            result.add(_UNKNOWN_PREFIX + text)
        else:
            result.update(_TASK_ALIASES.get(text, frozenset({_UNKNOWN_PREFIX + text})))
    return frozenset(result)
 def normalize_worker_capabilities(values: Iterable[object]) -> frozenset[str]:
    """Map registered worker names to effective semantic capabilities."""
    result: set[str] = set()
    for value in values:
        text = _clean(value)
        if "*" in text:
            continue
        mapped = _WORKER_ALIASES.get(text)
        if mapped is not None:
            result.update(mapped)
    if {
        "governed.git.write.branch",
        "governed.git.write.file",
    }.issubset(result):
        result.add("governed.git.write")
    return frozenset(result)
 def has_capabilities(
    worker_capabilities: Iterable[object],
    required_capabilities: Iterable[object],
 ) -> bool:
    """Return the single eligibility decision used by poll and claim."""
    required = normalize_required_capabilities(required_capabilities)
    effective = normalize_worker_capabilities(worker_capabilities)
    if any(value.startswith(_UNKNOWN_PREFIX) for value in required):
        return False
    return required.issubset(effective)
 def required_capabilities_subset(
    granted_requirements: Iterable[object],
    required_requirements: Iterable[object],
 ) -> bool:
    """Check semantic capability containment for delegation constraints."""
    granted = normalize_required_capabilities(granted_requirements)
    required = normalize_required_capabilities(required_requirements)
    if any(value.startswith(_UNKNOWN_PREFIX) for value in granted | required):
        return False
    return required.issubset(granted)
 def normalized_capability_matrix(
    worker_capabilities: Iterable[object],
    required_capabilities: Iterable[object],
 ) -> dict[str, object]:
    """Expose non-secret decision evidence for tests and diagnostics."""
    worker_values = tuple(worker_capabilities)
    required_values = tuple(required_capabilities)
    worker = normalize_worker_capabilities(worker_values)
    required = normalize_required_capabilities(required_values)
    return {
        "worker_effective": sorted(worker),
        "task_required": sorted(required),
        "eligible": has_capabilities(worker_values, required_values),
    }
@@ -0,0 +1,567 @@
 #!/usr/bin/env python3
 """Task-bound bridge from the legacy ChatGPT Action to an isolated Writer V2."""
 from __future__ import annotations
 import hashlib
 import hmac
 import json
 import os
 import re
 import sqlite3
 import socket
 import stat
 import urllib.error
 import urllib.parse
 import urllib.request
 from datetime import datetime, timezone
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path, PurePosixPath, PureWindowsPath
 from typing import Any
 CONFIG_PATH = Path(os.environ["AIOS_ACTION_ROUTE_BINDING"])
 POLICY_PATH = Path(os.environ["AIOS_ACTION_ROUTE_PATH_POLICY"])
 KNOWN_IDENTITIES_PATH = Path(os.environ["AIOS_ACTION_ROUTE_KNOWN_IDENTITIES"])
 STATE_PATH = Path(os.environ["AIOS_ACTION_ROUTE_STATE"])
 AUDIT_PATH = Path(os.environ["AIOS_ACTION_ROUTE_AUDIT"])
 HOST = os.environ.get("AIOS_ACTION_ROUTE_HOST", "127.0.0.1")
 PORT = int(os.environ.get("AIOS_ACTION_ROUTE_PORT", "19894"))
 EXPECTED_TASK_ID = os.environ["AIOS_ACTION_ROUTE_TASK_ID"]
 EXPECTED_ROUTE_HEADER = os.environ["AIOS_ACTION_ROUTE_HEADER"]
 AUTHORIZATION_SOCKET = Path(os.environ["AIOS_CONTINUOUS_AUTHORIZATION_SOCKET"])
 OID_RE = re.compile(r"[0-9a-f]{40}")
 SECRET_RE = re.compile(
    r"(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)"
    r"\s*[:=]\s*[\"']?([A-Za-z0-9_./+=:-]{16,})"
 )
 SECRET_VALUE_RE = re.compile(
    r"(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,}|"
    r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----)"
 )
 ALLOWED_REQUEST_FIELDS = frozenset({"base","branch","content","create_branch","message","path","task_id","development_authorization_id","actor_identity","audience","approved_base_oid","expected_current_head_oid","operation_id","idempotency_key","exact_path","content_digest","commit_message_digest"})
 class RouteError(RuntimeError):
    def __init__(self, code: str, status: int = 400, **details: Any):
        super().__init__(code)
        self.code = code
        self.status = status
        self.details = details
 def utc_now() -> str:
    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 def canonical_json(value: Any) -> bytes:
    return json.dumps(
        value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
    ).encode("utf-8")
 def load_root_managed_json(
    path: Path, *, expected_mode: int = 0o640
 ) -> tuple[dict[str, Any], bytes]:
    info = os.lstat(path)
    if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode):
        raise RouteError("writer_route_config_type_rejected", 503)
    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & ~expected_mode:
        raise RouteError("writer_route_config_permissions_rejected", 503)
    raw = path.read_bytes()
    try:
        value = json.loads(raw)
    except (UnicodeDecodeError, json.JSONDecodeError):
        raise RouteError("writer_route_config_json_rejected", 503) from None
    if not isinstance(value, dict):
        raise RouteError("writer_route_config_object_required", 503)
    return value, raw
 def load_binding() -> dict[str, Any]:
    binding, _ = load_root_managed_json(CONFIG_PATH)
    required = {
        "schema_version",
        "task_id",
        "writer_instance_id",
        "repository",
        "branch",
        "approved_base_oid",
        "writer_url",
        "path_policy_sha256",
        "action_identities",
    }
    if set(binding) != required or binding.get("schema_version") != 1:
        raise RouteError("writer_route_binding_schema_rejected", 503)
    if binding["task_id"] != EXPECTED_TASK_ID:
        raise RouteError("writer_route_task_binding_rejected", 503)
    if binding["repository"] != "aios/aios":
        raise RouteError("writer_route_repository_rejected", 503)
    if not OID_RE.fullmatch(str(binding["approved_base_oid"])):
        raise RouteError("writer_route_base_oid_rejected", 503)
    if binding["writer_url"] != "http://127.0.0.1:19893":
        raise RouteError("writer_route_upstream_rejected", 503)
    identities = binding.get("action_identities")
    if not isinstance(identities, list) or len(identities) != 1:
        raise RouteError("writer_route_action_identity_rejected", 503)
    identity = identities[0]
    if (
        not isinstance(identity, dict)
        or set(identity) != {"account", "token_sha256"}
        or identity.get("account") != "chatgpt-gitops-bot"
        or not re.fullmatch(
            r"[0-9a-f]{64}", str(identity.get("token_sha256", ""))
        )
    ):
        raise RouteError("writer_route_action_identity_rejected", 503)
    return binding
 def allowed_path_scope(binding: dict[str, Any]) -> tuple[set[str], tuple[str, ...]]:
    policy, raw = load_root_managed_json(POLICY_PATH)
    actual = hashlib.sha256(raw).hexdigest()
    if actual != binding["path_policy_sha256"]:
        raise RouteError("writer_route_path_policy_digest_mismatch", 503)
    if policy.get("allowed_branch") != binding["branch"]:
        raise RouteError("writer_route_path_policy_branch_mismatch", 503)
    operation = (policy.get("allowed_operations") or {}).get("commit_file.atomic")
    paths = operation.get("exact_paths") if isinstance(operation, dict) else None
    prefixes = operation.get("prefix_paths") if isinstance(operation, dict) else None
    if not isinstance(paths, list) or not paths or not all(
        isinstance(x, str) for x in paths
    ):
        raise RouteError("writer_route_path_policy_rejected", 503)
    if not isinstance(prefixes, list) or not prefixes or not all(
        isinstance(x, str) and x.endswith("/") for x in prefixes
    ):
        raise RouteError("writer_route_path_policy_rejected", 503)
    if any(not valid_relative_path(x[:-1]) for x in prefixes):
        raise RouteError("writer_route_path_policy_rejected", 503)
    if any(not valid_relative_path(x) for x in paths):
        raise RouteError("writer_route_path_policy_rejected", 503)
    return set(paths), tuple(prefixes)
 def valid_relative_path(path: str) -> bool:
    if not isinstance(path, str) or not path or path != path.strip():
        return False
    if "\x00" in path or "\\" in path:
        return False
    try:
        decoded = urllib.parse.unquote(path, errors="strict")
    except (UnicodeDecodeError, ValueError):
        return False
    if decoded != path:
        return False
    posix = PurePosixPath(path)
    windows = PureWindowsPath(path)
    return not (
        posix.is_absolute()
        or windows.is_absolute()
        or bool(windows.drive)
        or any(part in {"", ".", ".."} for part in path.split("/"))
    )
 def path_allowed(binding: dict[str, Any], path: str) -> bool:
    if not valid_relative_path(path):
        return False
    exact_paths, prefixes = allowed_path_scope(binding)
    return path in exact_paths or any(path.startswith(prefix) for prefix in prefixes)
 def bearer(headers: Any) -> str:
    value = headers.get("Authorization", "")
    if not value.startswith("Bearer "):
        raise RouteError("unauthorized", 401)
    token = value[7:].strip()
    if not token:
        raise RouteError("unauthorized", 401)
    return token
 def authorize_action(headers: Any, binding: dict[str, Any]) -> str:
    digest = hashlib.sha256(bearer(headers).encode("utf-8")).hexdigest()
    identity = binding["action_identities"][0]
    if not hmac.compare_digest(identity["token_sha256"], digest):
        known, _ = load_root_managed_json(KNOWN_IDENTITIES_PATH)
        identities = known.get("identities")
        if known.get("schema_version") != 1 or not isinstance(identities, list):
            raise RouteError("writer_route_identity_catalog_rejected", 503)
        observed = "unregistered"
        allowed_accounts = {
            "chatgpt-gitops-bot",
            "gitops-write-bot",
            "codex-gitops-bot",
        }
        for candidate in identities:
            if not isinstance(candidate, dict) or set(candidate) != {
                "account",
                "token_sha256",
            }:
                raise RouteError("writer_route_identity_catalog_rejected", 503)
            account = str(candidate.get("account", ""))
            token_sha256 = str(candidate.get("token_sha256", ""))
            if account not in allowed_accounts or not re.fullmatch(
                r"[0-9a-f]{64}", token_sha256
            ):
                raise RouteError("writer_route_identity_catalog_rejected", 503)
            if hmac.compare_digest(token_sha256, digest):
                observed = account
        raise RouteError(
            "writer_route_action_identity_rejected",
            403,
            accepted_action_identity=str(identity["account"]),
            observed_action_identity=observed,
            identity_alias_accepted=False,
        )
    return str(identity["account"])
 def authorization_call(operation: str, **payload: Any) -> dict[str, Any]:
    request = {"op": operation, **payload}
    try:
        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
            client.settimeout(15)
            client.connect(str(AUTHORIZATION_SOCKET))
            client.sendall(canonical_json(request))
            raw = client.recv(131072)
        response = json.loads(raw.decode("utf-8"))
    except (OSError, TimeoutError, UnicodeDecodeError, json.JSONDecodeError):
        raise RouteError("authorization_controller_unavailable", 503) from None
    if not isinstance(response, dict) or not response.get("ok"):
        if not isinstance(response, dict):
            raise RouteError("authorization_controller_response_rejected", 503)
        details = {k: v for k, v in response.items() if k not in {"ok", "status", "error"}}
        raise RouteError(str(response.get("error") or "authorization_controller_rejected"), int(response.get("status") or 503), **details)
    result = response.get("result")
    if not isinstance(result, dict):
        raise RouteError("authorization_controller_response_rejected", 503)
    return result
 def writer_token() -> str:
    value = authorization_call("get_writer_token").get("token")
    if not isinstance(value, str) or len(value.encode("utf-8")) < 32:
        raise RouteError("writer_route_credential_rejected", 503)
    return value
 def writer_call(
    binding: dict[str, Any],
    method: str,
    path: str,
    payload: dict[str, Any] | None = None,
 ) -> tuple[int, dict[str, Any]]:
    data = canonical_json(payload) if payload is not None else None
    headers = {"Authorization": "Bearer " + writer_token()}
    if data is not None:
        headers["Content-Type"] = "application/json"
    request = urllib.request.Request(
        binding["writer_url"] + path, data=data, method=method, headers=headers
    )
    try:
        with urllib.request.urlopen(request, timeout=90) as response:
            body = json.loads(response.read())
            return response.status, body
    except urllib.error.HTTPError as exc:
        try:
            body = json.loads(exc.read())
        except Exception:
            body = {"error": "writer_route_upstream_non_json_error"}
        return exc.code, body
    except (OSError, TimeoutError):
        raise RouteError("writer_route_upstream_unavailable", 503) from None
 def validate_request(data: Any, binding: dict[str, Any]) -> dict[str, Any]:
    if not isinstance(data, dict):
        raise RouteError("writer_route_request_object_required")
    if not {"branch", "path", "content"}.issubset(data):
        raise RouteError("writer_route_request_incomplete")
    if not set(data).issubset(ALLOWED_REQUEST_FIELDS):
        raise RouteError("writer_route_request_fields_rejected")
    if data["branch"] != binding["branch"]:
        raise RouteError("writer_route_request_binding_failed", 403)
    if data.get("create_branch") not in (None, False):
        raise RouteError("writer_route_request_binding_failed", 403)
    if data.get("base", "main") not in {"main", binding["approved_base_oid"]}:
        raise RouteError("writer_route_request_binding_failed", 403)
    path = data["path"]
    if not isinstance(path, str) or not path_allowed(binding, path):
        raise RouteError("writer_route_request_binding_failed", 403)
    content = data["content"]
    if not isinstance(content, str) or "\x00" in content or "\r" in content:
        raise RouteError("writer_route_content_rejected")
    if len(content.encode("utf-8")) > 1_048_576:
        raise RouteError("writer_route_content_too_large", 413)
    if SECRET_RE.search(content) or SECRET_VALUE_RE.search(content):
        raise RouteError("writer_route_secret_content_rejected", 403)
    message = data.get("message") or f"chore(chatgpt): update {path}"
    if not isinstance(message, str) or not 1 <= len(message) <= 200 or "\x00" in message or "\n" in message or "\r" in message:
        raise RouteError("writer_route_message_rejected")
    return {"branch": binding["branch"], "path": path, "content": content, "message": message}
 def complete_request(data: dict[str, Any], normalized: dict[str, Any], binding: dict[str, Any], account: str) -> dict[str, Any]:
    authorization = authorization_call("describe_authorization")
    expected = {
        "task_id": binding["task_id"],
        "development_authorization_id": authorization.get("development_authorization_id"),
        "actor_identity": account,
        "audience": authorization.get("audience"),
        "branch": binding["branch"],
        "approved_base_oid": binding["approved_base_oid"],
    }
    required = {
        "task_id": EXPECTED_TASK_ID,
        "development_authorization_id": "authz-aios-autonomous-release-20260726",
        "actor_identity": "chatgpt-gitops-bot",
        "audience": "chatgpt-autonomous-release-writer",
        "branch": binding["branch"],
        "approved_base_oid": binding["approved_base_oid"],
    }
    if expected != required or authorization.get("authorization_status") != "ACTIVE" or authorization.get("current_head_oid") is None:
        raise RouteError("writer_route_request_binding_failed", 403)
    for key, value in required.items():
        if key in data and data[key] != value:
            raise RouteError("writer_route_request_binding_failed", 403)
    if "exact_path" in data and data["exact_path"] != normalized["path"]:
        raise RouteError("writer_route_request_binding_failed", 403)
    current_head = str(authorization["current_head_oid"])
    if not OID_RE.fullmatch(current_head):
        raise RouteError("authorization_current_head_rejected", 503)
    if "expected_current_head_oid" in data and data["expected_current_head_oid"] != current_head:
        raise RouteError("BRANCH_HEAD_CHANGED", 409, current_head_oid=current_head)
    content_digest = hashlib.sha256(normalized["content"].encode("utf-8")).hexdigest()
    message_digest = hashlib.sha256(normalized["message"].encode("utf-8")).hexdigest()
    if "content_digest" in data and data["content_digest"] != content_digest:
        raise RouteError("writer_route_request_binding_failed", 403)
    if "commit_message_digest" in data and data["commit_message_digest"] != message_digest:
        raise RouteError("writer_route_request_binding_failed", 403)
    seed = {**required, "expected_current_head_oid": current_head, "path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest}
    request_digest = hashlib.sha256(canonical_json(seed)).hexdigest()
    idempotency_key = "action-" + request_digest
    operation_id = hashlib.sha256((EXPECTED_TASK_ID + "\0" + idempotency_key).encode("utf-8")).hexdigest()
    if "idempotency_key" in data and data["idempotency_key"] != idempotency_key:
        raise RouteError("writer_route_request_binding_failed", 403)
    if "operation_id" in data and data["operation_id"] != operation_id:
        raise RouteError("writer_route_request_binding_failed", 403)
    return {**normalized, **required, "expected_current_head_oid": current_head, "operation_id": operation_id, "idempotency_key": idempotency_key, "exact_path": normalized["path"], "content_digest": content_digest, "commit_message_digest": message_digest, "request_digest": request_digest}
 def current_writer_head(binding: dict[str, Any]) -> str:
    status, body = writer_call(binding, "GET", "/api/runtime-status")
    if status != 200:
        raise RouteError(
            "writer_route_runtime_status_failed", 503, upstream_status=status
        )
    required = {
        "service": "chatgpt-autonomous-release-writer",
        "writes_enabled": True,
        "allowed_branch": binding["branch"],
        "approved_base_oid": binding["approved_base_oid"],
        "path_policy_sha256": binding["path_policy_sha256"],
    }
    if any(body.get(key) != value for key, value in required.items()):
        raise RouteError("writer_route_runtime_binding_mismatch", 503)
    head = str(body.get("workspace_head_oid", ""))
    if not OID_RE.fullmatch(head):
        raise RouteError("writer_route_runtime_head_rejected", 503)
    return head
 def operation_binding(
    request_digest: str, binding: dict[str, Any]
 ) -> tuple[str, str]:
    STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
        db.execute("PRAGMA journal_mode=WAL")
        db.execute("PRAGMA synchronous=FULL")
        db.execute(
            """
            CREATE TABLE IF NOT EXISTS action_operations (
                request_digest TEXT PRIMARY KEY,
                expected_head_oid TEXT NOT NULL,
                idempotency_key TEXT NOT NULL UNIQUE,
                created_at TEXT NOT NULL
            )
            """
        )
        row = db.execute(
            "SELECT expected_head_oid,idempotency_key FROM action_operations "
            "WHERE request_digest=?",
            (request_digest,),
        ).fetchone()
        if row:
            return str(row[0]), str(row[1])
    head = current_writer_head(binding)
    key = "action-" + request_digest
    with sqlite3.connect(STATE_PATH, timeout=30, isolation_level=None) as db:
        db.execute("PRAGMA journal_mode=WAL")
        db.execute("PRAGMA synchronous=FULL")
        db.execute("BEGIN IMMEDIATE")
        db.execute(
            "INSERT OR IGNORE INTO action_operations"
            "(request_digest,expected_head_oid,idempotency_key,created_at) "
            "VALUES(?,?,?,?)",
            (request_digest, head, key, utc_now()),
        )
        row = db.execute(
            "SELECT expected_head_oid,idempotency_key FROM action_operations "
            "WHERE request_digest=?",
            (request_digest,),
        ).fetchone()
        db.execute("COMMIT")
    return str(row[0]), str(row[1])
 def append_audit(event: dict[str, Any]) -> None:
    AUDIT_PATH.parent.mkdir(parents=True, exist_ok=True)
    flags = os.O_WRONLY | os.O_CREAT | os.O_APPEND | getattr(os, "O_NOFOLLOW", 0)
    fd = os.open(AUDIT_PATH, flags, 0o600)
    try:
        os.write(fd, canonical_json(event) + b"\n")
        os.fsync(fd)
    finally:
        os.close(fd)
 class Handler(BaseHTTPRequestHandler):
    server_version = "AIOSActionTaskRouter/1"
    def log_message(self, _format: str, *_args: Any) -> None:
        return
    def send_json(self, status: int, value: dict[str, Any]) -> None:
        body = json.dumps(value, ensure_ascii=False, sort_keys=True).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json; charset=utf-8")
        self.send_header("Content-Length", str(len(body)))
        self.send_header("Cache-Control", "no-store")
        self.end_headers()
        self.wfile.write(body)
    def do_GET(self) -> None:
        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
        if path != "/health":
            return self.send_json(404, {"error": "not_found"})
        try:
            binding = load_binding()
            self.send_json(
                200,
                {
                    "status": "ok",
                    "service": "aios-action-task-router",
                    "task_id": binding["task_id"],
                    "writer_instance_id": binding["writer_instance_id"],
                    "branch": binding["branch"],
                },
            )
        except RouteError as exc:
            self.send_json(exc.status, {"error": exc.code, **exc.details})
    def do_POST(self) -> None:
        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
        if path != "/api/file":
            return self.send_json(404, {"error": "not_found"})
        if self.client_address[0] not in {"127.0.0.1", "::1"}:
            return self.send_json(403, {"error": "writer_route_source_rejected"})
        if self.headers.get("X-AIOS-Route-Task") != EXPECTED_ROUTE_HEADER:
            return self.send_json(403, {"error": "writer_route_header_rejected"})
        try:
            length = int(self.headers.get("Content-Length", "0"))
            if not 0 < length <= 1_100_000:
                raise RouteError("writer_route_content_length_rejected", 413)
            try:
                data = json.loads(self.rfile.read(length).decode("utf-8"))
            except (UnicodeDecodeError, json.JSONDecodeError):
                raise RouteError("writer_route_request_json_rejected") from None
            binding = load_binding()
            account = authorize_action(self.headers, binding)
            normalized = validate_request(data, binding)
            normalized = complete_request(data, normalized, binding, account)
            prepared = authorization_call("prepare_write", request={key: normalized[key] for key in ("expected_current_head_oid", "operation_id", "idempotency_key", "exact_path", "content_digest", "commit_message_digest", "branch", "path", "message")})
            expected_head = str(prepared["expected_head_oid"])
            writer_payload = {"branch": normalized["branch"], "path": normalized["path"], "content": normalized["content"], "message": normalized["message"], "expected_head_oid": expected_head, "idempotency_key": str(prepared["idempotency_key"])}
            request_digest = hashlib.sha256(canonical_json({"task_id": binding["task_id"], "operation_id": normalized["operation_id"], "idempotency_key": normalized["idempotency_key"], "content_digest": normalized["content_digest"], "commit_message_digest": normalized["commit_message_digest"]})).hexdigest()
            status, result = writer_call(
                binding, "POST", "/api/commit-file", writer_payload
            )
            audit = {
                "at": utc_now(),
                "task_id": binding["task_id"],
                "writer_instance_id": binding["writer_instance_id"],
                "account": account,
                "branch": normalized["branch"],
                "path": normalized["path"],
                "request_digest": request_digest,
                "expected_head_oid": expected_head,
                "status": status,
                "operation_id": result.get("operation_id"),
                "commit_oid": result.get("commit_oid"),
                "error": result.get("error"),
                "secrets_included": False,
            }
            append_audit(audit)
            if status != 200:
                try:
                    authorization_call("fail_write", result={"operation_id": normalized["operation_id"]})
                except RouteError:
                    pass
                return self.send_json(status, result)
            advanced = authorization_call("reconcile_commit", result={"previous_head_oid": expected_head, "new_commit_oid": result.get("commit_oid"), "operation_id": result.get("operation_id")})
            return self.send_json(
                200,
                {
                    "status": "committed",
                    "branch": normalized["branch"],
                    "path": normalized["path"],
                    "commit": {
                        "status": "committed",
                        "branch": normalized["branch"],
                        "rev": result.get("commit_oid"),
                        "previous_head_oid": expected_head,
                        "new_tree_oid": result.get("new_tree_oid"),
                        "push_status": result.get("push_status"),
                        "four_way_ref_status": advanced.get("four_way_ref_status") is True,
                        "sync": {"status": "verified", "target": "bare+git-ls-remote+gitea-api"},
                    },
                    "writer_instance_id": binding["writer_instance_id"],
                    "operation_id": result.get("operation_id"),
                    "idempotent": result.get("idempotent"),
                    "secrets_included": False,
                },
            )
        except RouteError as exc:
            if exc.code == "writer_route_action_identity_rejected":
                try:
                    append_audit(
                        {
                            "at": utc_now(),
                            "task_id": EXPECTED_TASK_ID,
                            "event": "action_identity_rejected",
                            "accepted_action_identity": exc.details.get(
                                "accepted_action_identity"
                            ),
                            "observed_action_identity": exc.details.get(
                                "observed_action_identity"
                            ),
                            "identity_alias_accepted": False,
                            "secrets_included": False,
                        }
                    )
                except Exception:
                    pass
            self.send_json(exc.status, {"error": exc.code, **exc.details})
        except Exception:
            self.send_json(500, {"error": "writer_route_internal_error"})
 def main() -> None:
    load_binding()
    server = ThreadingHTTPServer((HOST, PORT), Handler)
    server.serve_forever()
 if __name__ == "__main__":
    main()
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 from __future__ import annotations
-import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, urllib.request, uuid
+import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, uuid
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any
@@ -33,11 +33,6 @@ from silent_release_hardening import (
    SignedReleasePlanApproval,
    SilentReleaseActionService,
 )
 try:
    from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
 except ModuleNotFoundError:
    sys.path.insert(0, str(Path(__file__).resolve().parent))
    from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
 try:
    from authoritative_git import (
        AuthoritativeGitError,
@@ -125,12 +120,6 @@ def reject_non_read_http(handler, method: str, path: str) -> bool:
        return False
    if path in SILENT_RELEASE_POST_PATHS:
        return False
    if (
        method == 'POST'
        and path in ('/api/file', '/api/commit-file')
        and os.getenv('AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED', os.getenv('AIOS_GITOPS_JOB_CONTROLLER_ENABLED', 'false')).lower() in {'1', 'true', 'yes', 'on'}
    ):
        return False
    decision = evaluate_git_write(WS)
    if decision.allowed:
        return False
@@ -404,51 +393,6 @@ class H(BaseHTTPRequestHandler):
        if not a['ok']: self.sendj({'error':'unauthorized','hint':'Bearer token required'},401); return None
        if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
        return a
    def bridge_release(self, path, data):
        route = {
            '/createTagApprovalRequest': '/v2/tag/approval-request',
            '/requestOrCreateTag': '/v2/tag/publish',
            '/getTagPublicationStatus': '/v2/tag/status',
            '/buildProductionArtifact': '/v2/release/artifact',
            '/executeApprovedProductionRelease': '/v2/release/execute',
            '/getReleaseConsistency': '/v2/release/consistency',
            '/runReleaseAcceptance': '/v2/release/acceptance',
        }.get(path)
        if route is None:
            raise ValueError('governed_release_route_invalid')
        base = os.getenv('AIOS_BRIDGE_V2_URL', 'http://127.0.0.1:18892').rstrip('/')
        request = urllib.request.Request(
            base + route,
            data=json.dumps(data, sort_keys=True, separators=(',', ':')).encode('utf-8'),
            headers={'Content-Type': 'application/json'},
            method='POST',
        )
        try:
            with urllib.request.urlopen(request, timeout=30) as response:
                result = json.loads(response.read().decode('utf-8'))
                return self.sendj(result, response.status)
        except urllib.error.HTTPError as exc:
            try:
                body = json.loads(exc.read().decode('utf-8'))
            except Exception:
                body = {'error': 'bridge_http_error'}
            return self.sendj(body, exc.code)
        except (urllib.error.URLError, TimeoutError) as exc:
            return self.sendj({'error': 'GOVERNED_BRIDGE_UNAVAILABLE', 'detail': type(exc).__name__}, 503)
    def do_POST(self):
        path = urllib.parse.urlparse(self.path).path
        if path in {
            '/createTagApprovalRequest', '/requestOrCreateTag', '/getTagPublicationStatus',
            '/buildProductionArtifact', '/executeApprovedProductionRelease',
            '/getReleaseConsistency', '/runReleaseAcceptance',
        }:
            actor = self.need('tag:create')
            if not actor:
                return
            return self.bridge_release(path, self.body())
        if reject_non_read_http(self, 'POST', path):
            return
        return self.sendj({'error': 'not_found', 'path': path}, 404)
    def do_GET(self):
        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
        if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
@@ -722,44 +666,7 @@ class H(BaseHTTPRequestHandler):
    def file(self,data):
        a=self.need('file:write');
        if not a: return
-        if os.getenv('AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED', os.getenv('AIOS_GITOPS_JOB_CONTROLLER_ENABLED', 'false')).lower() not in {'1','true','yes','on'}:
+        b=checkout(data.get('branch'), data.get('base','main'), bool(data.get('create_branch'))); r=write_file(data.get('path'), data.get('content','')); c=commit([r], data.get('message') or f'chore(chatgpt): update {r}'); audit(a['account'],'file',r,{'branch':b,'commit':c}); self.sendj({'status':'committed','branch':b,'path':r,'commit':c})
            return self.sendj({'error':'DURABLE_JOB_CONTROLLER_UNAVAILABLE','retryable':True},503)
        try:
            path = relpath(str(data.get('path') or ''))
            branch = str(data.get('branch') or '')
            expected = str(data.get('expected_branch_oid') or '')
            campaign_id = str(data.get('campaign_id') or os.getenv('AIOS_GITOPS_CAMPAIGN_ID') or '')
            supplied_digest = str(data.get('payload_digest') or '')
            content = data.get('content')
            payload_bytes = None
            if content is not None:
                payload_bytes = content.encode('utf-8') if isinstance(content, str) else json.dumps(content, sort_keys=True, ensure_ascii=False).encode('utf-8')
            payload_digest = supplied_digest or hashlib.sha256(payload_bytes or b'').hexdigest()
            if not campaign_id or not branch or not expected:
                return self.sendj({'error':'JOB_BINDING_REQUIRED','retryable':False},409)
            request = {
                'campaign_id': campaign_id,
                'repository': REPOSITORY_IDENTITY or 'aios/aios',
                'operation': 'commit-file',
                'branch': branch,
                'expected_branch_oid': expected,
                'payload_digest': payload_digest,
                # The controller persists only the binding and digest. Raw
                # content is never copied into durable state or logs.
            }
            receipt = GitOpsJobController(
                JobStore(Path(os.getenv('AIOS_GITOPS_JOB_ROOT', '/var/lib/aios-gitops/jobs')))
            ).submit(request, payload=payload_bytes)
            return self.sendj({
                'job_id': receipt.job_id,
                'state': receipt.state.value,
                'side_effect_state': receipt.side_effect_state,
                'retryable': receipt.http_status == 503,
            }, receipt.http_status)
        except ServiceUnavailable as exc:
            return self.sendj({'error':str(exc),'layer':'durable_job','retryable':True,'side_effect_state':'UNKNOWN'},503)
        except JobError as exc:
            return self.sendj({'error':str(exc),'retryable':False},409)
    def commit(self,data):
        a=self.need('commit:create');
        if not a: return
@@ -950,4 +857,3 @@ def main():
    print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
    ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()
@@ -1,224 +0,0 @@
 """ChatGPT GitOps Bridge v2 contract and governed release operations."""
 from __future__ import annotations
 from dataclasses import dataclass
 import hashlib
 from pathlib import Path
 from typing import Any, Callable, Mapping
 BRIDGE_SCHEMA_VERSION = "aios.chatgpt-gitops-bridge.v2"
 BRIDGE_OPERATIONS = (
    "getRuntimeStatus",
    "getGovernedWriteCapabilities",
    "createGovernedTask",
    "acquireWriterLease",
    "bootstrapWriterLease",
    "renewWriterLease",
    "commitFileGoverned",
    "commitFilesGoverned",
    "getGitOpsJob",
    "resumeGitOpsJob",
    "reconcileGitOpsJob",
    "createTagApprovalRequest",
    "requestOrCreateTag",
    "getTagPublicationStatus",
    "buildProductionArtifact",
    "executeApprovedProductionRelease",
    "getReleaseConsistency",
    "runReleaseAcceptance",
    "getControlPlaneSnapshot",
 )
 OPERATION_REQUIRED_FIELDS = {
    "createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
    "acquireWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
    "bootstrapWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
    "renewWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
    "commitFileGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "path", "content_base64", "message"),
    "commitFilesGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "files", "message"),
    "getGitOpsJob": ("job_id",),
    "resumeGitOpsJob": ("job_id", "expected_revision"),
    "reconcileGitOpsJob": ("job_id", "expected_revision"),
    "createTagApprovalRequest": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "owner_approval", "execute"),
    "requestOrCreateTag": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
    "getTagPublicationStatus": ("version",),
    "buildProductionArtifact": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
    "executeApprovedProductionRelease": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
    "getReleaseConsistency": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
    "runReleaseAcceptance": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
    "getControlPlaneSnapshot": (),
 }
 BRIDGE_OPERATION_CONTRACTS = {
    "acquireWriterLease": {
        "method": "POST",
        "path": "/v2/writer-lease",
        "required_fields": OPERATION_REQUIRED_FIELDS["acquireWriterLease"],
        "response_fields": (
            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
            "create_target_branch", "worktree_mode", "cas_ref_update_required",
        ),
    },
    "bootstrapWriterLease": {
        "method": "POST",
        "path": "/v2/writer-lease/bootstrap",
        "required_fields": OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"],
        "response_fields": (
            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
            "create_target_branch", "worktree_mode", "cas_ref_update_required",
            "recovered", "bootstrapped", "runtime_rehydrated",
            "durable_branch_lease_present", "idempotent",
        ),
    },
    "renewWriterLease": {
        "method": "POST",
        "path": "/v2/writer-lease/renew",
        "required_fields": OPERATION_REQUIRED_FIELDS["renewWriterLease"],
        "response_fields": (
            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
            "recovered", "bootstrapped", "runtime_rehydrated",
            "durable_branch_lease_present", "idempotent",
        ),
    },
    "commitFileGoverned": {
        "method": "POST", "path": "/v2/commit-file",
        "required_fields": OPERATION_REQUIRED_FIELDS["commitFileGoverned"],
        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
    },
    "commitFilesGoverned": {
        "method": "POST", "path": "/v2/commit-files",
        "required_fields": OPERATION_REQUIRED_FIELDS["commitFilesGoverned"],
        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
    },
 }
 class RuntimeDriftError(RuntimeError):
    pass
 class BridgeV2Error(RuntimeError):
    pass
@dataclass(frozen=True, slots=True)
 class ControlPlaneReleaseManifest:
    control_plane_release_version: str
    control_plane_target_oid: str
    artifact_sha256: str
    runtime_path: Path
    bridge_schema_version: str
    repository_identity: str
    authoritative_git_dir: Path
    deployment_state: str
    def as_dict(self) -> dict[str, object]:
        return {
            "control_plane_release_version": self.control_plane_release_version,
            "control_plane_target_oid": self.control_plane_target_oid,
            "artifact_sha256": self.artifact_sha256,
            "runtime_path": str(self.runtime_path),
            "bridge_schema_version": self.bridge_schema_version,
            "repository_identity": self.repository_identity,
            "authoritative_git_dir": str(self.authoritative_git_dir),
            "deployment_state": self.deployment_state,
        }
    def validate(self, artifact: Path, *, observed_oid: str, approved_root: Path = Path("/opt/aios/gitops-control-plane")) -> dict[str, object]:
        try:
            runtime = self.runtime_path.resolve(strict=True)
            root = approved_root.resolve(strict=True)
            artifact_path = artifact.resolve(strict=True)
            runtime.relative_to(root)
            artifact_path.relative_to(runtime)
        except (OSError, ValueError):
            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT") from None
        mutable_markers = {"workspace", "workspaces", "worktree", "worktrees"}
        if mutable_markers.intersection(part.lower() for part in runtime.parts):
            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
        valid = (
            len(self.control_plane_target_oid) == 40
            and observed_oid == self.control_plane_target_oid
            and len(self.artifact_sha256) == 64
            and hashlib.sha256(artifact_path.read_bytes()).hexdigest() == self.artifact_sha256
            and self.bridge_schema_version == BRIDGE_SCHEMA_VERSION
            and self.repository_identity == "aios/aios"
            and self.authoritative_git_dir == Path("/data/aios-gitops/repo.git")
            and self.authoritative_git_dir.is_absolute()
            and self.deployment_state == "STAGING"
        )
        if not valid:
            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
        return {**self.as_dict(), "drift_status": "PASS"}
 class BridgeV2Adapter:
    """Thin operation adapter; all mutating handlers are injected seams."""
    def __init__(self, *, runtime_status: Mapping[str, Any], handlers: Mapping[str, Callable[[Mapping[str, Any]], Any]] | None = None) -> None:
        self.runtime_status = dict(runtime_status)
        self.handlers = dict(handlers or {})
    def getRuntimeStatus(self) -> dict[str, Any]:
        return {"bridge_schema_version": BRIDGE_SCHEMA_VERSION, **self.runtime_status}
    def getGovernedWriteCapabilities(self) -> dict[str, Any]:
        return {
            "bridge_schema_version": BRIDGE_SCHEMA_VERSION,
            "legacy_writes_enabled": False,
            "governed_writes_enabled": True,
            "operations": list(BRIDGE_OPERATIONS),
            "operation_contracts": {
                operation: {
                    **contract,
                    "required_fields": list(contract["required_fields"]),
                    "response_fields": list(contract["response_fields"]),
                }
                for operation, contract in BRIDGE_OPERATION_CONTRACTS.items()
            },
            "force_push": False,
            "main_write": False,
            "tag_write": False,
            "baseline_write": False,
            "production_write": False,
            "approved_release_operations": True,
            "approved_release_scope": {
                "version": "V2R2C1",
                "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
                "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
                "approval_plan_id": "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e",
            },
        }
    @staticmethod
    def legacy_write_disabled() -> dict[str, object]:
        return {"error": "LEGACY_WRITE_DISABLED", "replacement": "createGovernedTask", "governed_writes_available": True}
    def _call(self, operation: str, request: Mapping[str, Any]) -> Any:
        required = OPERATION_REQUIRED_FIELDS[operation]
        if any(key not in request for key in required):
            raise BridgeV2Error("BRIDGE_REQUEST_FIELDS_MISSING")
        handler = self.handlers.get(operation)
        if handler is None:
            raise BridgeV2Error("GOVERNED_HANDLER_UNAVAILABLE")
        return handler(dict(request))
    def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
    def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
    def bootstrapWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("bootstrapWriterLease", request)
    def renewWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("renewWriterLease", request)
    def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
    def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
    def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)
    def resumeGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("resumeGitOpsJob", request)
    def reconcileGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("reconcileGitOpsJob", request)
    def createTagApprovalRequest(self, request: Mapping[str, Any]) -> Any: return self._call("createTagApprovalRequest", request)
    def requestOrCreateTag(self, request: Mapping[str, Any]) -> Any: return self._call("requestOrCreateTag", request)
    def getTagPublicationStatus(self, request: Mapping[str, Any]) -> Any: return self._call("getTagPublicationStatus", request)
    def buildProductionArtifact(self, request: Mapping[str, Any]) -> Any: return self._call("buildProductionArtifact", request)
    def executeApprovedProductionRelease(self, request: Mapping[str, Any]) -> Any: return self._call("executeApprovedProductionRelease", request)
    def getReleaseConsistency(self, request: Mapping[str, Any]) -> Any: return self._call("getReleaseConsistency", request)
    def runReleaseAcceptance(self, request: Mapping[str, Any]) -> Any: return self._call("runReleaseAcceptance", request)
    def getControlPlaneSnapshot(self, request: Mapping[str, Any] | None = None) -> Any: return self._call("getControlPlaneSnapshot", request or {})
@@ -1,692 +0,0 @@
 """Governed continuation executor for exact existing task branches.
 The executor composes the existing continuation lease and durable Job store.
 All Git and Gitea side effects live behind injected narrow interfaces so the
 state machine can prove Authority, Git-network, API-branch, and commit-object
 agreement before it reports completion.
 """
 from __future__ import annotations
 import base64
 from dataclasses import asdict, dataclass
 from datetime import datetime, timezone
 import hashlib
 import json
 import os
 from pathlib import Path, PurePosixPath
 import re
 import subprocess
 from typing import Callable, Mapping, Protocol
 from urllib.error import HTTPError, URLError
 from urllib.parse import quote, urlsplit
 from urllib.request import Request, urlopen
 from aios_authority_git_executor import AuthorityGitExecutor
 from aios_continuation_lease import WriterLeaseRequestV2
 from aios_gitops_job_controller import GitOpsJobController, JobState
 from aios_gitops_reconciliation_core import ReconciliationAction, RemoteObservation, decide_reconciliation
 from authorized_task_writer_provisioning import validate_writer_lease_request_v2
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SECRET_PATTERNS = (
    re.compile(rb"gh[pousr]_[A-Za-z0-9]{20,}"),
    re.compile(rb"(?i)(?:token|password|secret|api[_-]?key)\s*[:=]\s*[\"'][^\"'\s]{12,}[\"']"),
    re.compile(rb"-----BEGIN " + rb"(?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
 )
 class ContinuationExecutionError(RuntimeError):
    """Stable fail-closed continuation execution error."""
 class DetachedWorkspace(Protocol):
    def is_detached(self) -> bool: ...
    def head_oid(self) -> str: ...
    def commit_files(self, files: Mapping[str, bytes], message: str) -> str: ...
 class AuthorityPort(Protocol):
    def branch_exists(self, branch: str) -> bool: ...
    def branch_head(self, branch: str) -> str: ...
    def is_ancestor(self, older: str, newer: str) -> bool: ...
    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str: ...
    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
 class RemotePort(Protocol):
    def repository_identity(self) -> str: ...
    def push_new_exact(self, branch: str, new: str) -> None: ...
    def push_exact(self, branch: str, expected: str, new: str) -> None: ...
    def read_git_ref(self, branch: str) -> str | None: ...
    def read_api_branch(self, branch: str) -> str | None: ...
    def commit_visible(self, oid: str) -> bool: ...
 class CredentialProjection(Protocol):
    def project(self) -> None: ...
    def revoke(self) -> None: ...
 def _run(argv: list[str], *, cwd: Path | None = None, environment: Mapping[str, str] | None = None) -> str:
    result = subprocess.run(
        argv,
        cwd=cwd,
        env=None if environment is None else dict(environment),
        text=True,
        capture_output=True,
        check=False,
    )
    if result.returncode != 0:
        raise ContinuationExecutionError("SUBPROCESS_FAILED")
    return result.stdout.strip()
@dataclass(slots=True)
 class AuthorityGitAdapter:
    """Branch-name adapter over the existing narrow AuthorityGitExecutor."""
    executor: AuthorityGitExecutor
    @staticmethod
    def _ref(branch: str) -> str:
        return f"refs/heads/{branch}"
    def branch_exists(self, branch: str) -> bool:
        return self.executor.read_ref(self._ref(branch)) is not None
    def branch_head(self, branch: str) -> str:
        value = self.executor.read_ref(self._ref(branch))
        if value is None:
            raise ContinuationExecutionError("EXISTING_BRANCH_MISSING")
        return value
    def is_ancestor(self, older: str, newer: str) -> bool:
        return self.executor.ancestry_check(older, newer)
    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str:
        return self.executor.create_task_branch_CAS(self._ref(branch), expected_base, new)
    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
        return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
@dataclass(slots=True)
 class DetachedGitWorkspace:
    path: Path
    def __post_init__(self) -> None:
        if not self.path.is_absolute() or self.path.is_symlink() or not self.path.is_dir():
            raise ContinuationExecutionError("WORKTREE_PATH_INVALID")
        top = Path(_run(["git", "rev-parse", "--show-toplevel"], cwd=self.path)).resolve()
        if top != self.path.resolve():
            raise ContinuationExecutionError("WORKTREE_PATH_INVALID")
    def is_detached(self) -> bool:
        result = subprocess.run(
            ["git", "symbolic-ref", "-q", "HEAD"],
            cwd=self.path,
            capture_output=True,
            check=False,
        )
        return result.returncode == 1
    def head_oid(self) -> str:
        return _run(["git", "rev-parse", "HEAD"], cwd=self.path)
    def _dirty_paths(self) -> set[str]:
        command = subprocess.run(
            ["git", "status", "--porcelain=v1", "--untracked-files=all"],
            cwd=self.path,
            text=True,
            capture_output=True,
            check=False,
        )
        if command.returncode != 0:
            raise ContinuationExecutionError("SUBPROCESS_FAILED")
        output = command.stdout
        result: set[str] = set()
        for line in output.splitlines():
            path = line[3:]
            if " -> " in path:
                path = path.split(" -> ", 1)[1]
            result.add(path)
        return result
    def materialize_files(self, files: Mapping[str, bytes]) -> None:
        dirty = self._dirty_paths()
        expected_paths = set(files)
        if dirty and dirty != expected_paths:
            raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
        for relative, content in files.items():
            target = (self.path / relative).resolve()
            try:
                target.relative_to(self.path.resolve())
            except ValueError as exc:
                raise ContinuationExecutionError("COMMIT_PATH_REJECTED") from exc
            if target.is_symlink():
                raise ContinuationExecutionError("COMMIT_PATH_REJECTED")
            target.parent.mkdir(parents=True, exist_ok=True)
            target.write_bytes(content)
    def commit_files(self, files: Mapping[str, bytes], message: str) -> str:
        expected_paths = set(files)
        if self._dirty_paths() != expected_paths:
            raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
        for relative, content in files.items():
            target = (self.path / relative).resolve()
            try:
                target.relative_to(self.path.resolve())
            except ValueError as exc:
                raise ContinuationExecutionError("COMMIT_PATH_REJECTED") from exc
            if not target.is_file() or target.is_symlink() or target.read_bytes() != content:
                raise ContinuationExecutionError("AUTHORING_PAYLOAD_MISMATCH")
        _run(["git", "add", "--", *sorted(expected_paths)], cwd=self.path)
        staged = set(_run(["git", "diff", "--cached", "--name-only"], cwd=self.path).splitlines())
        if staged != expected_paths:
            raise ContinuationExecutionError("STAGED_SCOPE_MISMATCH")
        environment = os.environ.copy()
        environment.update(
            {
                "GIT_AUTHOR_NAME": "AIOS Governed Continuation",
                "GIT_AUTHOR_EMAIL": "aios-governed-continuation@localhost",
                "GIT_COMMITTER_NAME": "AIOS Governed Continuation",
                "GIT_COMMITTER_EMAIL": "aios-governed-continuation@localhost",
            }
        )
        _run(["git", "commit", "--no-gpg-sign", "-m", message, "--", *sorted(expected_paths)], cwd=self.path, environment=environment)
        if not self.is_detached():
            raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
        return self.head_oid()
@dataclass(slots=True)
 class ServerSideCredentialProjection:
    ssh_key_path: Path
    api_token_path: Path
    active: bool = False
    def project(self) -> None:
        for path in (self.ssh_key_path, self.api_token_path):
            if path.is_symlink() or not path.is_file() or path.stat().st_size < 32:
                raise ContinuationExecutionError("CREDENTIAL_PROJECTION_MISSING")
        self.active = True
    def revoke(self) -> None:
        self.active = False
@dataclass(slots=True)
 class GiteaContinuationRemote:
    workspace: Path
    credential: ServerSideCredentialProjection
    remote_name: str = "gitea"
    repository: str = "aios/aios"
    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
    expected_host: str = "g.cnnetmkt.top"
    @staticmethod
    def validate_remote_url(value: str, expected_host: str = "g.cnnetmkt.top") -> None:
        if value.startswith(("/", "file:")) or value.endswith("/data/aios-gitops/repo.git"):
            raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
        if "://" in value:
            parsed = urlsplit(value)
            host, path = parsed.hostname, parsed.path
        else:
            location = value.split("@", 1)[-1]
            host, separator, path = location.partition(":")
            if not separator:
                raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
            path = "/" + path
        if host != expected_host or path.rstrip("/") not in {"/aios/aios.git", "/git/aios/aios.git"}:
            raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
    def repository_identity(self) -> str:
        url = _run(["git", "remote", "get-url", self.remote_name], cwd=self.workspace)
        self.validate_remote_url(url, self.expected_host)
        if self.repository != "aios/aios":
            raise ContinuationExecutionError("REMOTE_REPOSITORY_IDENTITY_MISMATCH")
        return self.repository
    def _require_projected(self) -> None:
        if not self.credential.active:
            raise ContinuationExecutionError("CREDENTIAL_PROJECTION_MISSING")
    def read_git_ref(self, branch: str) -> str | None:
        self._require_projected()
        output = _run(["git", "ls-remote", self.remote_name, f"refs/heads/{branch}"], cwd=self.workspace)
        if not output:
            return None
        oid, ref = output.split(maxsplit=1)
        if ref != f"refs/heads/{branch}" or not OID_RE.fullmatch(oid):
            raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
        return oid
    def push_new_exact(self, branch: str, new: str) -> None:
        self._require_projected()
        self.repository_identity()
        if self.read_git_ref(branch) is not None:
            raise ContinuationExecutionError("GITEA_TARGET_BRANCH_ALREADY_EXISTS")
        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
        if self.read_git_ref(branch) != new:
            raise ContinuationExecutionError("GITEA_CREATE_READBACK_MISMATCH")
    def push_exact(self, branch: str, expected: str, new: str) -> None:
        self._require_projected()
        self.repository_identity()
        if self.read_git_ref(branch) != expected:
            raise ContinuationExecutionError("GITEA_BRANCH_EXPECTATION_MISMATCH")
        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
    def _api(self, path: str) -> object:
        self._require_projected()
        token = self.credential.api_token_path.read_text(encoding="utf-8").strip()
        request = Request(
            self.api_base.rstrip("/") + path,
            headers={"Accept": "application/json", "Authorization": f"token {token}"},
        )
        try:
            with urlopen(request, timeout=20) as response:
                return json.loads(response.read().decode("utf-8"))
        except HTTPError as exc:
            if exc.code == 404:
                return None
            raise ContinuationExecutionError(f"GITEA_API_HTTP_{exc.code}") from exc
        except (URLError, TimeoutError, OSError, json.JSONDecodeError) as exc:
            raise ContinuationExecutionError("GITEA_API_UNAVAILABLE") from exc
    def read_api_branch(self, branch: str) -> str | None:
        owner, name = self.repository.split("/", 1)
        page = 1
        while page <= 100:
            value = self._api(f"/repos/{quote(owner)}/{quote(name)}/branches?page={page}&limit=50")
            if value is None:
                return None
            if not isinstance(value, list):
                raise ContinuationExecutionError("GITEA_API_BRANCH_COLLECTION_INVALID")
            for item in value:
                if not isinstance(item, dict) or item.get("name") != branch:
                    continue
                oid = item.get("commit", {}).get("id")
                if not isinstance(oid, str) or not OID_RE.fullmatch(oid):
                    raise ContinuationExecutionError("GITEA_API_BRANCH_INVALID")
                return oid
            if len(value) < 50:
                return None
            page += 1
        raise ContinuationExecutionError("GITEA_API_BRANCH_PAGINATION_LIMIT")
    def commit_visible(self, oid: str) -> bool:
        owner, name = self.repository.split("/", 1)
        value = self._api(f"/repos/{quote(owner)}/{quote(name)}/git/commits/{oid}")
        if not isinstance(value, dict):
            return False
        observed = value.get("sha") or value.get("id")
        return observed == oid
@dataclass(frozen=True, slots=True)
 class ContinuationPermissions:
    create_target_branch: bool = False
    force_push: bool = False
    tag_write: bool = False
    baseline_write: bool = False
    production_write: bool = False
    main_write: bool = False
    def validate(self) -> None:
        if any(asdict(self).values()):
            raise ContinuationExecutionError("MUTATION_PERMISSION_DENIED")
@dataclass(frozen=True, slots=True)
 class ContinuationRuntimeBinding:
    request: WriterLeaseRequestV2
    job_id: str
    workspace_path: Path
    lease_not_before: datetime
    lease_expires_at: datetime
    original_receipt_valid: bool
    original_grant_consumed: bool
    permissions: ContinuationPermissions
@dataclass(frozen=True, slots=True)
 class ContinuationCommit:
    idempotency_key: str
    files: Mapping[str, bytes]
    message: str
    def payload(self) -> bytes:
        if not self.idempotency_key or not self.message.strip() or not self.files:
            raise ContinuationExecutionError("COMMIT_REQUEST_INVALID")
        normalized: dict[str, str] = {}
        for path, content in self.files.items():
            pure = PurePosixPath(path)
            if (
                not isinstance(path, str)
                or pure.is_absolute()
                or ".." in pure.parts
                or path.startswith((".git/", "baseline/", "production/"))
                or not isinstance(content, bytes)
            ):
                raise ContinuationExecutionError("COMMIT_PATH_REJECTED")
            if any(pattern.search(content) for pattern in SECRET_PATTERNS):
                raise ContinuationExecutionError("SECRET_LIKE_PAYLOAD_REJECTED")
            normalized[path] = base64.b64encode(content).decode("ascii")
        return json.dumps(
            {"files_base64": normalized, "message": self.message},
            sort_keys=True,
            separators=(",", ":"),
        ).encode("utf-8")
 class ContinuationExecutor:
    def __init__(
        self,
        controller: GitOpsJobController,
        authority: AuthorityPort,
        workspace: DetachedWorkspace,
        remote: RemotePort,
        credential: CredentialProjection,
        *,
        now: Callable[[], datetime] = lambda: datetime.now(timezone.utc),
    ) -> None:
        self.controller = controller
        self.authority = authority
        self.workspace = workspace
        self.remote = remote
        self.credential = credential
        self.now = now
        self._observed_generations: dict[str, int] = {}
    def observe_generation(self, branch: str, generation: int) -> None:
        self._observed_generations[branch] = max(generation, self._observed_generations.get(branch, 0))
    def _max_generation(self, branch: str, *, exclude_job_id: str | None = None) -> int:
        observed = self._observed_generations.get(branch, 0)
        with self.controller.store._connect() as connection:
            if exclude_job_id is None:
                row = connection.execute(
                    "SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
                    (branch,),
                ).fetchone()
            else:
                row = connection.execute(
                    "SELECT MAX(generation) AS generation FROM branch_leases "
                    "WHERE branch=? AND job_id!=?",
                    (branch, exclude_job_id),
                ).fetchone()
        durable = int(row["generation"] or 0)
        return max(observed, durable)
    @staticmethod
    def _request_mapping(request: WriterLeaseRequestV2) -> dict[str, object]:
        return {
            "schema": WriterLeaseRequestV2.schema,
            "task_id": request.task_id,
            "job_id": request.job_id,
            "repository": request.repository,
            "branch_mode": request.branch_mode,
            "base_oid": request.base_oid,
            "expected_branch_oid": request.expected_branch_oid,
            "target_branch": request.target_branch,
            "generation": request.generation,
            "lease_seconds": request.lease_seconds,
        }
    def _validate_preflight(self, binding: ContinuationRuntimeBinding, *, job_id: str | None = None) -> None:
        request = binding.request
        request_mapping = self._request_mapping(request)
        normalized = validate_writer_lease_request_v2(request_mapping, self.authority)
        expected_normalized = {
            **request_mapping,
            "create_target_branch": request.branch_mode == "CREATE_NEW",
            "worktree_mode": (
                "detached_at_base_oid"
                if request.branch_mode == "CREATE_NEW"
                else "detached_at_expected_head"
            ),
            "cas_ref_update_required": True,
        }
        if normalized != expected_normalized:
            raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
        if not binding.original_receipt_valid or not binding.original_grant_consumed:
            raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
        binding.permissions.validate()
        now = self.now()
        if now < binding.lease_not_before:
            raise ContinuationExecutionError("LEASE_NOT_ACTIVE")
        if now >= binding.lease_expires_at:
            raise ContinuationExecutionError("LEASE_EXPIRED")
        if request.generation <= self._max_generation(request.target_branch, exclude_job_id=job_id):
            raise ContinuationExecutionError("GENERATION_NOT_MONOTONIC")
        if not self.workspace.is_detached():
            raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
        if self.workspace.head_oid() != request.expected_branch_oid:
            raise ContinuationExecutionError("WORKTREE_HEAD_MISMATCH")
        if self.remote.repository_identity() != request.repository:
            raise ContinuationExecutionError("REMOTE_REPOSITORY_IDENTITY_MISMATCH")
    def _job_request(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit, payload: bytes) -> dict[str, object]:
        request = binding.request
        return {
            "idempotency_key": commit.idempotency_key,
            "campaign_id": request.task_id,
            "task_id": request.task_id,
            "repository": request.repository,
            "operation": "CONTINUATION_COMMIT_FILES",
            "branch": request.target_branch,
            "expected_branch_oid": request.expected_branch_oid,
            "base_oid": request.base_oid,
            "branch_mode": request.branch_mode,
            "payload_digest": hashlib.sha256(payload).hexdigest(),
            "lineage_anchor_oid": request.base_oid,
            "generation": request.generation,
        }
    def execute(
        self,
        binding: ContinuationRuntimeBinding,
        commit: ContinuationCommit,
        *,
        before_complete: Callable[[str], None] | None = None,
    ) -> dict[str, object]:
        commit.payload()
        if not binding.job_id or binding.request.job_id != binding.job_id:
            raise ContinuationExecutionError("RUNTIME_LINEAGE_MISSING_JOB_ID")
        current = self.controller.store.read(binding.job_id)
        current_state = JobState(current["state"])
        if current_state == JobState.COMPLETED:
            return self.controller.store._receipt(current, duplicate=True).as_dict()
        if current_state == JobState.REMOTE_VERIFIED:
            receipt = json.loads(str(current["receipt_json"] or "{}"))
            commit_oid = str(receipt.get("authority_oid") or "")
            if not OID_RE.fullmatch(commit_oid):
                raise ContinuationExecutionError("GOVERNED_COMMIT_OID_INVALID")
            if before_complete is not None:
                before_complete(commit_oid)
            return self.controller.advance(
                binding.job_id,
                JobState.COMPLETED,
                side_effect_state="REMOTE_VERIFIED",
                receipt=receipt,
            ).as_dict()
        self._validate_preflight(binding, job_id=binding.job_id)
        request = binding.request
        projected = False
        try:
            self.credential.project()
            projected = True
            row = self.controller.store.read(binding.job_id)
            state = JobState(row["state"])
            if state == JobState.REQUESTED:
                self.controller.advance(
                    binding.job_id,
                    JobState.AUTHORIZED,
                    side_effect_state="AUTHORIZED",
                    receipt={"task_id": request.task_id, "original_grant_consumed": True},
                    expected_revision=int(row["revision"]),
                )
                row = self.controller.store.read(binding.job_id)
                state = JobState(row["state"])
            if state == JobState.AUTHORIZED:
                self.controller.lease_job(
                    binding.job_id,
                    lease_id=f"lease-{binding.job_id}",
                    lineage_anchor_oid=request.base_oid,
                    current_head_oid=request.expected_branch_oid,
                    generation=request.generation,
                    lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
                    expected_revision=int(row["revision"]),
                )
                row = self.controller.store.read(binding.job_id)
                state = JobState(row["state"])
            if state == JobState.LEASED:
                self.controller.advance(binding.job_id, JobState.WORKTREE_READY,
                                        side_effect_state="WORKTREE_READY", expected_revision=int(row["revision"]))
                row = self.controller.store.read(binding.job_id)
                state = JobState(row["state"])
            if state == JobState.WORKTREE_READY:
                self.controller.advance(binding.job_id, JobState.EXECUTING,
                                        side_effect_state="IN_PROGRESS", expected_revision=int(row["revision"]))
            elif state != JobState.EXECUTING:
                raise ContinuationExecutionError("JOB_EXECUTION_STATE_INVALID")
            new_oid = self.workspace.commit_files(commit.files, commit.message)
            if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
                raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
            if request.branch_mode == "CREATE_NEW":
                authority_oid = self.authority.create_task_branch_cas(request.target_branch, request.base_oid, new_oid)
            else:
                authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
            if authority_oid != new_oid:
                raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
            self.controller.advance(
                binding.job_id,
                JobState.LOCAL_VERIFIED,
                side_effect_state="LOCAL_VERIFIED",
                receipt={"authority_oid": authority_oid, "force_push": False},
            )
            try:
                self.controller.advance(binding.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
                if request.branch_mode == "CREATE_NEW":
                    self.remote.push_new_exact(request.target_branch, new_oid)
                else:
                    self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
            except Exception:
                return self._remote_pending(binding.job_id, authority_oid, new_oid)
            return self._finish_remote_verification(
                binding.job_id,
                authority_oid,
                new_oid,
                before_complete=before_complete,
            )
        finally:
            if projected:
                self.credential.revoke()
    def _observe_remote(self, branch: str, oid: str) -> tuple[str | None, str | None, bool]:
        return self.remote.read_git_ref(branch), self.remote.read_api_branch(branch), self.remote.commit_visible(oid)
    def _remote_pending(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
        receipt = {
            "authority_oid": authority_oid,
            "desired_remote_oid": new_oid,
            "remote_verified": False,
            "force_push": False,
        }
        result = self.controller.advance(
            job_id,
            JobState.RECONCILIATION_REQUIRED,
            side_effect_state="REMOTE_PUSH_PENDING",
            receipt=receipt,
        )
        return result.as_dict()
    def _finish_remote_verification(
        self,
        job_id: str,
        authority_oid: str,
        new_oid: str,
        *,
        before_complete: Callable[[str], None] | None = None,
    ) -> dict[str, object]:
        row = self.controller.store.read(job_id)
        branch = row["branch"]
        request = json.loads(row["request_json"])["binding"]
        git_oid, api_oid, visible = self._observe_remote(branch, new_oid)
        decision = decide_reconciliation(RemoteObservation("aios/aios", branch, new_oid, authority_oid, git_oid, api_oid, visible, datetime.now(timezone.utc).isoformat(), request.get("expected_branch_oid")))
        if decision.action is not ReconciliationAction.MARK_REMOTE_VERIFIED:
            return self._remote_pending(job_id, authority_oid, new_oid)
        receipt = {
            "authority_oid": authority_oid,
            "git_remote_oid": git_oid,
            "api_branch_oid": api_oid,
            "commit_visible": True,
            "remote_verified": True,
            "reconciliation_decision": decision.action.value,
            "force_push": False,
        }
        self.controller.advance(
            job_id,
            JobState.REMOTE_VERIFIED,
            side_effect_state="REMOTE_VERIFIED",
            receipt=receipt,
        )
        if before_complete is not None:
            before_complete(new_oid)
        return self.controller.advance(
            job_id,
            JobState.COMPLETED,
            side_effect_state="REMOTE_VERIFIED",
            receipt=receipt,
        ).as_dict()
    def reconcile(self, job_id: str) -> dict[str, object]:
        row = self.controller.store.read(job_id)
        state = JobState(row["state"])
        if state == JobState.COMPLETED:
            return self.controller.store._receipt(row, duplicate=True).as_dict()
        if state != JobState.RECONCILIATION_REQUIRED:
            raise ContinuationExecutionError("JOB_NOT_RECONCILABLE")
        request = json.loads(row["request_json"])["binding"]
        receipt = json.loads(row["receipt_json"])
        new_oid = receipt["desired_remote_oid"]
        authority_oid = self.authority.branch_head(row["branch"])
        try:
            generation = int(request.get("generation") or 0)
        except (TypeError, ValueError) as exc:
            raise ContinuationExecutionError("DURABLE_BINDING_GENERATION_INVALID") from exc
        if generation > 0:
            with self.controller.store._connect() as connection:
                earlier = connection.execute(
                    "SELECT 1 FROM jobs WHERE branch=? AND state=? "
                    "AND CAST(json_extract(request_json, '$.binding.generation') AS INTEGER) < ? LIMIT 1",
                    (row["branch"], JobState.RECONCILIATION_REQUIRED.value, generation),
                ).fetchone()
            if earlier is not None:
                raise ContinuationExecutionError("EARLIER_RECONCILIATION_REQUIRED")
        self.credential.project()
        try:
            git_oid, api_oid, visible = self._observe_remote(row["branch"], new_oid)
            if authority_oid == git_oid == api_oid == new_oid and visible:
                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST")
                return self._finish_remote_verification(job_id, new_oid, new_oid)
            expected_oid = request["expected_branch_oid"]
            if (
                self.authority.is_ancestor(new_oid, authority_oid)
                and git_oid is not None
                and git_oid == api_oid
                and self.authority.is_ancestor(git_oid, new_oid)
            ):
                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_CHAIN")
                self.remote.push_exact(row["branch"], git_oid, new_oid)
                return self._finish_remote_verification(job_id, new_oid, new_oid)
            if authority_oid == new_oid and git_oid == api_oid == expected_oid:
                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_RETRY")
                self.remote.push_exact(row["branch"], expected_oid, new_oid)
                return self._finish_remote_verification(job_id, new_oid, new_oid)
            return self.controller.store._receipt(row, duplicate=True).as_dict()
        finally:
            self.credential.revoke()
@@ -1,157 +0,0 @@
 """Campaign-aware continuation leases for an existing Git branch.
 This module is deliberately transport-neutral. It validates branch lineage
 and hands ref mutation to an injected compare-and-swap broker; it does not run
 Git, inspect credentials, or create a branch itself.
 """
 from __future__ import annotations
 from dataclasses import dataclass, replace
 from datetime import datetime, timedelta, timezone
 import re
 from typing import Protocol
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 TARGET_BRANCH = "agent/autonomous-release-campaign-v1-20260807"
 LINEAGE_ANCHOR = "69b45e81dcd2c3707c367003b08c55fd361faae8"
 CAMPAIGN_HEAD = "bba675fab3b7e0c5fba7066720252b3c91b9f20d"
 class ContinuationError(RuntimeError):
    """Stable fail-closed error for lease or branch binding violations."""
 class BranchProbe(Protocol):
    def branch_exists(self, branch: str) -> bool: ...
    def branch_head(self, branch: str) -> str: ...
    def is_ancestor(self, older: str, newer: str) -> bool: ...
 class RefCAS(Protocol):
    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
 def _oid(value: str, field: str) -> str:
    if not isinstance(value, str) or not OID_RE.fullmatch(value):
        raise ContinuationError(f"{field}_invalid")
    return value
@dataclass(frozen=True, slots=True)
 class WriterLeaseRequestV2:
    task_id: str
    repository: str
    branch_mode: str
    base_oid: str
    expected_branch_oid: str
    target_branch: str
    generation: int
    lease_seconds: int = 900
    job_id: str = ""
    schema = "aios.task-writer-lease.v2"
    accepted_schemas = frozenset({"aios.task-writer-lease.v2", "aios.task-writer-lease-request.v2"})
    def validate(self, probe: BranchProbe) -> None:
        if not self.task_id or self.repository != "aios/aios":
            raise ContinuationError("request_identity_invalid")
        if not self.job_id or not self.job_id.startswith("job-"):
            raise ContinuationError("job_id_invalid")
        if self.branch_mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
            raise ContinuationError("branch_mode_invalid")
        _oid(self.base_oid, "base_oid")
        _oid(self.expected_branch_oid, "expected_branch_oid")
        if self.target_branch in {"main", "master"} or self.target_branch.startswith(("refs/", "tags/")):
            raise ContinuationError("protected_branch_rejected")
        if not isinstance(self.generation, int) or isinstance(self.generation, bool) or self.generation < 1:
            raise ContinuationError("generation_invalid")
        if not isinstance(self.lease_seconds, int) or not 1 <= self.lease_seconds <= 86_400:
            raise ContinuationError("lease_duration_invalid")
        if self.branch_mode == "CONTINUE_EXISTING":
            if not probe.branch_exists(self.target_branch):
                raise ContinuationError("EXISTING_BRANCH_MISSING")
            actual = _oid(probe.branch_head(self.target_branch), "actual_branch_oid")
            if actual != self.expected_branch_oid:
                raise ContinuationError("EXISTING_BRANCH_OID_CONFLICT")
            if not probe.is_ancestor(self.base_oid, actual):
                raise ContinuationError("BASE_NOT_ANCESTOR_OF_BRANCH")
        elif hasattr(probe, "commit_exists") and not probe.commit_exists(self.base_oid):
            raise ContinuationError("BASE_COMMIT_NOT_FOUND")
        elif self.branch_mode == "CREATE_NEW" and probe.branch_exists(self.target_branch):
            raise ContinuationError("TARGET_BRANCH_ALREADY_EXISTS")
        elif self.branch_mode == "CREATE_NEW" and self.base_oid != self.expected_branch_oid:
            raise ContinuationError("CREATE_NEW_BASE_EXPECTATION_MISMATCH")
@dataclass(frozen=True, slots=True)
 class CampaignWriterLease:
    task_id: str
    repository: str
    branch: str
    lineage_anchor_oid: str
    current_head_oid: str
    generation: int
    lease_expires_at: datetime
    append_only: bool = True
    renewable: bool = True
    multi_commit: bool = True
    recoverable: bool = True
    state: str = "ACTIVE"
    branch_bound: bool = True
    def __post_init__(self) -> None:
        _oid(self.lineage_anchor_oid, "lineage_anchor_oid")
        _oid(self.current_head_oid, "current_head_oid")
        if not all((self.append_only, self.renewable, self.multi_commit, self.recoverable, self.branch_bound)):
            raise ContinuationError("lease_capability_downgrade")
 class ContinuationLeaseManager:
    """State machine for a multi-commit lease with CAS-only ref updates."""
    def __init__(self, probe: BranchProbe, refs: RefCAS, *, now=datetime.now) -> None:
        self.probe = probe
        self.refs = refs
        self.now = now
    def open(self, request: WriterLeaseRequestV2) -> CampaignWriterLease:
        request.validate(self.probe)
        if request.branch_mode != "CONTINUE_EXISTING":
            raise ContinuationError("CREATE_NEW_REQUIRES_SEPARATE_PROVISIONER")
        return CampaignWriterLease(
            task_id=request.task_id,
            repository=request.repository,
            branch=request.target_branch,
            lineage_anchor_oid=request.base_oid,
            current_head_oid=request.expected_branch_oid,
            generation=request.generation,
            lease_expires_at=self.now(timezone.utc) + timedelta(seconds=request.lease_seconds),
        )
    def renew(self, lease: CampaignWriterLease, seconds: int) -> CampaignWriterLease:
        if lease.state != "ACTIVE" or not lease.renewable or seconds < 1:
            raise ContinuationError("lease_not_renewable")
        return replace(lease, lease_expires_at=self.now(timezone.utc) + timedelta(seconds=seconds))
    def append_commit(self, lease: CampaignWriterLease, new_head_oid: str) -> CampaignWriterLease:
        if lease.state != "ACTIVE":
            raise ContinuationError("lease_not_active")
        _oid(new_head_oid, "new_head_oid")
        if not self.probe.is_ancestor(lease.current_head_oid, new_head_oid):
            raise ContinuationError("NON_FAST_FORWARD_COMMIT")
        try:
            actual = self.refs.compare_and_swap_branch(
                lease.branch, lease.current_head_oid, new_head_oid
            )
        except Exception as exc:
            raise ContinuationError("BRANCH_LEASE_STALE") from exc
        if actual != new_head_oid:
            raise ContinuationError("BRANCH_LEASE_STALE")
        return replace(lease, current_head_oid=new_head_oid)
    def supersede(self, lease: CampaignWriterLease) -> CampaignWriterLease:
        if lease.state not in {"ACTIVE", "RECOVERABLE_FAILURE", "RECONCILIATION_REQUIRED"}:
            raise ContinuationError("lease_not_supersedable")
        return replace(lease, generation=lease.generation + 1, state="SUPERSEDED")
@@ -1,25 +0,0 @@
 """Separate read, write, and release plane readiness evaluation."""
 from __future__ import annotations
 from dataclasses import dataclass
 from typing import Mapping
@dataclass(frozen=True, slots=True)
 class RuntimeStatus:
    read_plane: Mapping[str, bool]
    write_plane: Mapping[str, bool]
    release_plane: Mapping[str, bool]
    @property
    def release_control_plane_ready(self) -> bool:
        return all(self.read_plane.values()) and all(self.write_plane.values()) and all(self.release_plane.values())
    def as_dict(self) -> dict[str, object]:
        return {
            "READ_PLANE": dict(self.read_plane),
            "WRITE_PLANE": dict(self.write_plane),
            "RELEASE_PLANE": dict(self.release_plane),
            "release_control_plane_ready": self.release_control_plane_ready,
        }
@@ -1,58 +0,0 @@
 """Workspace-independent authority/network/Gitea ref sentinel."""
 from __future__ import annotations
 from dataclasses import dataclass
 from pathlib import Path
 import subprocess
 from typing import Callable, Mapping
 class SentinelError(RuntimeError):
    pass
@dataclass(frozen=True, slots=True)
 class SentinelInputs:
    authority_git_dir: Path
    gitea_remote: str
    gitea_api: str
    ref: str
    expected_oid: str
@dataclass(frozen=True, slots=True)
 class SentinelResult:
    authority_oid: str | None
    network_oid: str | None
    gitea_oid: str | None
    equal: bool
    error: str | None = None
 def authority_oid(inputs: SentinelInputs) -> str:
    result = subprocess.run(
        ["git", "--git-dir", str(inputs.authority_git_dir), "rev-parse", inputs.ref],
        text=True,
        capture_output=True,
        check=False,
    )
    if result.returncode != 0:
        raise SentinelError("AUTHORITY_REF_UNAVAILABLE")
    return result.stdout.strip()
 def evaluate(
    inputs: SentinelInputs,
    *,
    network_reader: Callable[[str, str], str | None],
    gitea_reader: Callable[[str, str], str | None],
 ) -> SentinelResult:
    try:
        local = authority_oid(inputs)
        network = network_reader(inputs.gitea_remote, inputs.ref)
        gitea = gitea_reader(inputs.gitea_api, inputs.ref)
        equal = local == network == gitea == inputs.expected_oid
        return SentinelResult(local, network, gitea, equal, None if equal else "OID_MISMATCH")
    except SentinelError as exc:
        return SentinelResult(None, None, None, False, str(exc))
@@ -1,26 +0,0 @@
 """Non-sensitive control-plane snapshot assembly."""
 from __future__ import annotations
 from typing import Any, Mapping
 def _copy(value: Mapping[str, Any] | None, keys: tuple[str, ...]) -> dict[str, Any]:
    value = value or {}
    return {key: value.get(key) for key in keys}
 def build_control_plane_snapshot(*, target_version: str, runtime: Mapping[str, Any] | None = None, repository: Mapping[str, Any] | None = None, production: Mapping[str, Any] | None = None, task: Mapping[str, Any] | None = None, capabilities: Mapping[str, Any] | None = None, credential_broker: Mapping[str, Any] | None = None) -> dict[str, Any]:
    return {
        "version": {"target_release": target_version},
        "runtime": _copy(runtime, ("bridge_schema_version", "control_plane_release_version", "runtime_release_commit", "runtime_path", "artifact_sha256", "drift_status")),
        "repository": _copy(repository, ("identity", "authority_git_dir", "authority_main_oid")),
        "production": _copy(production, ("baseline_version", "target_oid", "deployment_state")),
        "task": _copy(task, ("task_id", "branch", "authority_branch_oid", "gitea_git_oid", "gitea_api_oid", "commit_visible", "generation", "reconciliation_state")),
        "capabilities": _copy(capabilities, ("legacy_writes_enabled", "governed_writes_enabled", "force_push", "main_write", "tag_write", "baseline_write", "production_write")),
        "credential_broker": _copy(credential_broker, ("status", "provider")),
        "secret_material_exposed": False,
    }
 def getControlPlaneSnapshot(**kwargs: Any) -> dict[str, Any]:
    return build_control_plane_snapshot(**kwargs)
@@ -1,124 +0,0 @@
 """Metadata-only, server-side credential lease broker."""
 from __future__ import annotations
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 import os
 from pathlib import Path
 import secrets
 import re
 from typing import Any, Callable, Mapping
@dataclass(frozen=True, slots=True)
 class CredentialLease:
    lease_id: str
    task_id: str
    repository: str
    target_branch: str
    generation: int
    issued_at: str
    expires_at: str
    scopes: tuple[str, ...]
    provider: str
    state: str = "ACTIVE"
    scope_type: str = "system"
    tenant_id: str | None = None
    user_id: str | None = None
    project_id: str | None = None
    run_id: str | None = None
    def as_dict(self) -> dict[str, Any]:
        return {"lease_id": self.lease_id, "task_id": self.task_id, "repository": self.repository, "target_branch": self.target_branch, "generation": self.generation, "issued_at": self.issued_at, "expires_at": self.expires_at, "scopes": list(self.scopes), "provider": self.provider, "state": self.state, "scope_type": self.scope_type, "tenant_id": self.tenant_id, "user_id": self.user_id, "project_id": self.project_id, "run_id": self.run_id}
 class FileCredentialProvider:
    def __init__(self, token_path: str | os.PathLike[str], *, actor: str = "aios-autonomy-agent") -> None:
        self.token_path = Path(token_path)
        self.actor = actor
    def environment(self, lease: CredentialLease) -> dict[str, str]:
        if not self.token_path.is_file():
            raise RuntimeError("CREDENTIAL_PROVIDER_UNAVAILABLE")
        return {"CREDENTIAL_FILE": str(self.token_path), "GITEA_MACHINE_ACTOR": self.actor}
 class CredentialBroker:
    def __init__(self, provider: Any, *, now: Callable[[], datetime] | None = None) -> None:
        self.provider = provider
        self.now = now or (lambda: datetime.now(timezone.utc))
        self._leases: dict[str, CredentialLease] = {}
    def issue(self, *, task_id: str, repository: str, target_branch: str, generation: int, scopes: tuple[str, ...] = ("git:push", "gitea:read"), lease_seconds: int = 900, scope_type: str = "system", tenant_id: str | None = None, user_id: str | None = None, project_id: str | None = None, run_id: str | None = None) -> dict[str, Any]:
        if repository != "aios/aios" or not target_branch.startswith("agent/") or generation < 1 or not 1 <= lease_seconds <= 86400:
            raise ValueError("CREDENTIAL_LEASE_BINDING_INVALID")
        if scope_type == "tenant":
            if not tenant_id:
                raise ValueError("CREDENTIAL_SCOPE_DENY")
        elif scope_type in {"system", "global"}:
            if any((tenant_id, user_id, project_id, run_id)):
                raise ValueError("CREDENTIAL_SCOPE_DENY")
        else:
            raise ValueError("CREDENTIAL_SCOPE_DENY")
        now = self.now().astimezone(timezone.utc)
        lease = CredentialLease("lease-" + secrets.token_hex(16), task_id, repository, target_branch, generation, now.isoformat(), (now + timedelta(seconds=lease_seconds)).isoformat(), tuple(scopes), type(self.provider).__name__, "ACTIVE", scope_type, tenant_id, user_id, project_id, run_id)
        self._leases[lease.lease_id] = lease
        return lease.as_dict()
    def _get(self, lease_id: str) -> CredentialLease:
        lease = self._leases.get(lease_id)
        if lease is None:
            raise KeyError("CREDENTIAL_LEASE_NOT_FOUND")
        if lease.state == "ACTIVE" and self.now().astimezone(timezone.utc) >= datetime.fromisoformat(lease.expires_at):
            lease = CredentialLease(**{**lease.as_dict(), "scopes": tuple(lease.scopes), "state": "EXPIRED"})
            self._leases[lease_id] = lease
        return lease
    def environment(self, lease_id: str) -> Mapping[str, str]:
        lease = self._get(lease_id)
        if lease.state != "ACTIVE":
            raise RuntimeError("CREDENTIAL_LEASE_NOT_ACTIVE")
        environment = self.provider.environment(lease)
        for key, value in environment.items():
            upper = str(key).upper()
            if not isinstance(value, str):
                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
            sensitive = any(marker in upper for marker in ("CREDENTIAL", "TOKEN", "SECRET", "PASSWORD", "PRIVATE_KEY", "API_KEY"))
            if re.search(r"(?i)bearer\s+\S+|(?:token|secret|password|api[_-]?key)\s*[:=]", value):
                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
            if sensitive and upper.endswith("_FILE"):
                candidate = Path(value)
                credential_root = Path("/run/credentials")
                try:
                    resolved = candidate.resolve(strict=False)
                except OSError as exc:
                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY") from exc
                if not candidate.is_absolute() or not (resolved == credential_root or credential_root in resolved.parents):
                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
            elif sensitive and upper.endswith("_REFERENCE"):
                if re.fullmatch(r"(?:systemd-credential|vault|secret-manager):[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}", value) is None:
                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
            elif sensitive:
                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
        return environment
    def authorize(self, lease_id: str, *, task_id: str, operation: str, scope_type: str = "system", tenant_id: str | None = None, user_id: str | None = None, project_id: str | None = None, run_id: str | None = None) -> Mapping[str, str]:
        lease = self._get(lease_id)
        if lease.state != "ACTIVE" or lease.task_id != task_id or operation not in lease.scopes:
            raise RuntimeError("CREDENTIAL_SCOPE_DENY")
        requested = (scope_type, tenant_id, user_id, project_id, run_id)
        actual = (lease.scope_type, lease.tenant_id, lease.user_id, lease.project_id, lease.run_id)
        if requested != actual:
            raise RuntimeError("CREDENTIAL_SCOPE_DENY")
        return self.environment(lease_id)
    def status(self, lease_id: str) -> dict[str, Any]:
        return self._get(lease_id).as_dict()
    def revoke(self, lease_id: str) -> dict[str, Any]:
        lease = self._get(lease_id)
        if lease.state == "REVOKED":
            return lease.as_dict()
        updated = CredentialLease(**{**lease.as_dict(), "scopes": tuple(lease.scopes), "state": "REVOKED"})
        self._leases[lease_id] = updated
        return updated.as_dict()
@@ -1,125 +0,0 @@
 """Non-Owner Gitea machine capability and branch reconciliation boundary."""
 from __future__ import annotations
 from dataclasses import dataclass
 from typing import Any, Mapping, Protocol
 class MachineBrokerError(RuntimeError):
    pass
 class GiteaTransport(Protocol):
    def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str: ...
    def create_or_update_pr(self, branch: str, target: str, title: str, body: str) -> Mapping[str, Any]: ...
    def publish_status(self, branch: str, state: str, description: str) -> Mapping[str, Any]: ...
    def protected_merge(self, pr_number: int) -> Mapping[str, Any]: ...
    def read_branch(self, branch: str) -> str | None: ...
    def whoami(self) -> Mapping[str, Any]: ...
    def repository(self, owner: str, name: str) -> Mapping[str, Any]: ...
@dataclass(frozen=True, slots=True)
 class MachineCredentialProjection:
    """Opaque systemd credential reference; the credential value is never accepted."""
    reference: str
    account: str
    owner_account: str = "aiman"
    @classmethod
    def from_mapping(cls, value: Mapping[str, Any]) -> "MachineCredentialProjection":
        if set(value) != {"scheme", "name", "account"}:
            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
        if value["scheme"] != "systemd-credential" or value["name"] != "gitea-machine-token":
            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
        return cls(f"{value['scheme']}:{value['name']}", str(value["account"]))
    def __post_init__(self) -> None:
        if self.reference != "systemd-credential:gitea-machine-token":
            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
        if not self.account or self.account == self.owner_account:
            raise MachineBrokerError("OWNER_MACHINE_IDENTITY_REJECTED")
@dataclass(frozen=True, slots=True)
 class CampaignCapabilityReceipt:
    campaign_id: str
    task_id: str
    repository: str
    branch: str
    expected_oid: str
    capabilities: frozenset[str]
    denied: frozenset[str]
    def require(self, capability: str) -> None:
        if capability in self.denied or capability not in self.capabilities:
            raise MachineBrokerError("CAPABILITY_DENIED")
        if self.branch in {"main", "master"}:
            raise MachineBrokerError("PROTECTED_BRANCH_DENIED")
 class GiteaMachineBroker:
    def __init__(self, transport: GiteaTransport, credential: MachineCredentialProjection, receipt: CampaignCapabilityReceipt) -> None:
        self.transport = transport
        self.credential = credential
        self.receipt = receipt
    def verify_identity(self) -> Mapping[str, Any]:
        identity = dict(self.transport.whoami())
        login = identity.get("login") or identity.get("username")
        if not isinstance(login, str) or not login or login == self.credential.owner_account or login != self.credential.account:
            raise MachineBrokerError("GITEA_MACHINE_IDENTITY_INVALID")
        owner, name = self.receipt.repository.split("/", 1)
        repo = dict(self.transport.repository(owner, name))
        if repo.get("full_name") != self.receipt.repository:
            raise MachineBrokerError("GITEA_REPOSITORY_MISMATCH")
        return {"login": login, "repository": self.receipt.repository, "owner_account": self.credential.owner_account}
    def push_branch(self, new_oid: str) -> str:
        self.receipt.require("exact_task_branch_push")
        return self.transport.compare_and_swap_branch(self.receipt.branch, self.receipt.expected_oid, new_oid)
    def create_pr(self, title: str, body: str) -> Mapping[str, Any]:
        self.receipt.require("pr_create_update")
        return self.transport.create_or_update_pr(self.receipt.branch, "main", title, body)
    def status(self, state: str, description: str, context: str = "aios/durable-release") -> Mapping[str, Any]:
        self.receipt.require("status_publish")
        return self.transport.publish_status(self.receipt.branch, state, description, context)
    def merge(self, pr_number: int) -> Mapping[str, Any]:
        self.receipt.require("protected_merge")
        return self.transport.protected_merge(pr_number)
    def readback(self) -> str | None:
        self.receipt.require("remote_readback")
        return self.transport.read_branch(self.receipt.branch)
 def reconcile_exact_branch(authority_oid: str, gitea_oid: str | None, expected_oid: str) -> str:
    if authority_oid != expected_oid:
        return "AUTHORITY_EXPECTATION_MISMATCH"
    if gitea_oid is None:
        return "CREATE_REQUIRED"
    if gitea_oid == expected_oid:
        return "ALREADY_IN_SYNC"
    return "MANUAL_OWNER_REVIEW_REQUIRED"
 def reconcile_fast_forward(
    remote_oid: str | None,
    expected_old_oid: str,
    new_oid: str,
    *,
    old_is_ancestor_of_new: bool,
 ) -> str:
    """Return a bounded action for an active Job/lease branch scope."""
    if remote_oid is None:
        return "CREATE_REQUIRED"
    if remote_oid == new_oid:
        return "ALREADY_IN_SYNC"
    if remote_oid == expected_old_oid and old_is_ancestor_of_new:
        return "FAST_FORWARD_REQUIRED"
    return "MANUAL_OWNER_REVIEW_REQUIRED"
@@ -1,208 +0,0 @@
 """Gitea HTTP/Git transport using only a projected systemd credential."""
 from __future__ import annotations
 from dataclasses import dataclass
 import json
 import os
 from pathlib import Path
 import subprocess
 import tempfile
 from typing import Any, Mapping
 from urllib.error import HTTPError, URLError
 from urllib.parse import quote, urlencode
 from urllib.request import Request, urlopen
 class GiteaTransportError(RuntimeError):
    pass
 def _safe_oid(value: str, field: str) -> str:
    if not isinstance(value, str) or len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
        raise GiteaTransportError(f"{field}_INVALID")
    return value
@dataclass(slots=True)
 class GiteaMachineTransport:
    api_base: str
    repository_id: str
    remote_url: str
    authority_git_dir: Path
    credential_name: str = "gitea-machine-token"
    actor: str = "aios-autonomy-agent"
    timeout: int = 20
    expected_merge_head: str | None = None
    expected_merge_base: str | None = None
    def __post_init__(self) -> None:
        if self.credential_name != "gitea-machine-token":
            raise GiteaTransportError("CREDENTIAL_NAME_INVALID")
        if "/" not in self.repository_id or self.repository_id.startswith("/"):
            raise GiteaTransportError("REPOSITORY_INVALID")
        if not self.api_base.startswith("https://") and not self.api_base.startswith("http://127.0.0.1"):
            raise GiteaTransportError("GITEA_API_SCOPE_INVALID")
        if not self.remote_url.startswith("https://"):
            raise GiteaTransportError("GITEA_REMOTE_SCOPE_INVALID")
    @property
    def _credential_path(self) -> Path:
        directory = os.environ.get("CREDENTIALS_DIRECTORY", "")
        if not directory:
            raise GiteaTransportError("CREDENTIAL_PROJECTION_MISSING")
        path = Path(directory) / self.credential_name
        if path.is_symlink() or not path.is_file():
            raise GiteaTransportError("CREDENTIAL_PROJECTION_MISSING")
        return path
    def _token(self) -> str:
        value = self._credential_path.read_text(encoding="utf-8").strip()
        if not value:
            raise GiteaTransportError("CREDENTIAL_EMPTY")
        return value
    def _request(self, method: str, path: str, body: Mapping[str, Any] | None = None) -> tuple[int, Any]:
        data = None if body is None else json.dumps(dict(body), separators=(",", ":")).encode()
        headers = {"Accept": "application/json", "Authorization": f"token {self._token()}"}
        if data is not None:
            headers["Content-Type"] = "application/json"
        request = Request(self.api_base.rstrip("/") + path, data=data, headers=headers, method=method)
        try:
            with urlopen(request, timeout=self.timeout) as response:
                raw = response.read()
                return response.status, json.loads(raw.decode()) if raw else {}
        except HTTPError as exc:
            # Never include response bodies: Gitea may echo sensitive request context.
            raise GiteaTransportError(f"GITEA_HTTP_{exc.code}") from exc
        except (URLError, TimeoutError, OSError) as exc:
            raise GiteaTransportError("GITEA_NETWORK_ERROR") from exc
    def whoami(self) -> Mapping[str, Any]:
        return self._request("GET", "/user")[1]
    def repository_info(self) -> Mapping[str, Any]:
        owner, name = self.repository_id.split("/", 1)
        return self._request("GET", f"/repos/{quote(owner)}/{quote(name)}")[1]
    def repository(self, owner: str, name: str) -> Mapping[str, Any]:
        if f"{owner}/{name}" != self.repository_id:
            raise GiteaTransportError("REPOSITORY_SCOPE_DENIED")
        return self.repository_info()
    def read_branch(self, branch: str) -> str | None:
        owner, name = self.repository_id.split("/", 1)
        try:
            value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/branches/{quote(branch, safe='/')}")[1]
        except GiteaTransportError as exc:
            if str(exc) == "GITEA_HTTP_404":
                return None
            raise
        sha = value.get("commit", {}).get("id") if isinstance(value, dict) else None
        return _safe_oid(sha, "remote_branch_oid")
    def _askpass(self) -> tuple[Path, dict[str, str]]:
        credential = self._credential_path
        fd, name = tempfile.mkstemp(prefix="aios-gitea-askpass-", dir="/tmp")
        path = Path(name)
        os.fchmod(fd, 0o700)
        script = "#!/bin/sh\ncase \"$1\" in *Username*) printf '%s\\n' \"$GITEA_MACHINE_ACTOR\" ;; *) cat \"$CREDENTIAL_FILE\" ;; esac\n"
        with os.fdopen(fd, "w", encoding="utf-8") as stream:
            stream.write(script)
            stream.flush()
            os.fsync(stream.fileno())
        return path, {
            "GIT_ASKPASS": str(path),
            "GIT_TERMINAL_PROMPT": "0",
            "GITEA_MACHINE_ACTOR": self.actor,
            "CREDENTIAL_FILE": str(credential),
        }
    def _push_branch_fast_forward(self, branch: str, new_oid: str) -> None:
        askpass, additions = self._askpass()
        environment = os.environ.copy()
        environment.update(additions)
        try:
            result = subprocess.run(
                ["git", f"--git-dir={self.authority_git_dir}", "push", self.remote_url, f"{new_oid}:refs/heads/{branch}"],
                text=True,
                capture_output=True,
                check=False,
                env=environment,
                timeout=self.timeout,
            )
            if result.returncode != 0:
                raise GiteaTransportError("GITEA_BRANCH_CREATE_FAILED")
        finally:
            askpass.unlink(missing_ok=True)
    def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str:
        _safe_oid(expected_oid, "expected_oid")
        _safe_oid(new_oid, "new_oid")
        current = self.read_branch(branch)
        if current == new_oid:
            return new_oid
        if current is None:
            self._push_branch_fast_forward(branch, new_oid)
            readback = self.read_branch(branch)
            if readback != new_oid:
                raise GiteaTransportError("GITEA_BRANCH_CREATE_READBACK_MISMATCH")
            return readback
        if current != expected_oid:
            raise GiteaTransportError("GITEA_BRANCH_EXPECTATION_MISMATCH")
        # The preflight read binds the expected old tip. The Git receive-pack
        # then enforces the actual fast-forward CAS while transferring the new
        # objects; no force/lease override or arbitrary ref is permitted.
        self._push_branch_fast_forward(branch, new_oid)
        readback = self.read_branch(branch)
        if readback != new_oid:
            raise GiteaTransportError("GITEA_BRANCH_CAS_READBACK_MISMATCH")
        return readback
    def _pulls(self) -> list[Mapping[str, Any]]:
        owner, name = self.repository_id.split("/", 1)
        query = urlencode({"state": "all", "base_branch": "main", "limit": 100})
        value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/pulls?{query}")[1]
        return value if isinstance(value, list) else []
    def create_or_update_pr(self, branch: str, target: str, title: str, body: str) -> Mapping[str, Any]:
        if target != "main":
            raise GiteaTransportError("PR_BASE_SCOPE_DENIED")
        head = self.read_branch(branch)
        if head is None:
            raise GiteaTransportError("PR_HEAD_MISSING")
        matches = [p for p in self._pulls() if (p.get("head") or {}).get("ref") == branch and (p.get("base") or {}).get("ref") == target]
        open_matches = [p for p in matches if p.get("state") == "open"]
        if len(open_matches) > 1:
            raise GiteaTransportError("MULTIPLE_MATCHING_PRS")
        if open_matches:
            if (open_matches[0].get("head") or {}).get("sha") != head:
                raise GiteaTransportError("PR_HEAD_CONFLICT")
            return open_matches[0]
        owner, name = self.repository_id.split("/", 1)
        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/pulls", {"head": branch, "base": target, "title": title, "body": body, "allow_maintainer_edit": False})[1]
    def publish_status(self, branch: str, state: str, description: str, context: str = "aios/durable-release") -> Mapping[str, Any]:
        oid = self.read_branch(branch)
        if oid is None:
            raise GiteaTransportError("STATUS_BRANCH_MISSING")
        owner, name = self.repository_id.split("/", 1)
        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/statuses/{oid}", {"state": state, "context": context, "description": description})[1]
    def protected_merge(self, pr_number: int) -> Mapping[str, Any]:
        if not isinstance(pr_number, int) or pr_number < 1:
            raise GiteaTransportError("PR_NUMBER_INVALID")
        owner, name = self.repository_id.split("/", 1)
        pr = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/pulls/{pr_number}")[1]
        if pr.get("state") != "open" or (pr.get("base") or {}).get("ref") != "main":
            raise GiteaTransportError("PR_MERGE_BINDING_INVALID")
        if pr.get("mergeable") is False:
            raise GiteaTransportError("PR_NOT_MERGEABLE")
        head_oid = (pr.get("head") or {}).get("sha")
        base_oid = (pr.get("base") or {}).get("sha")
        if self.expected_merge_head is not None and head_oid != self.expected_merge_head:
            raise GiteaTransportError("PR_HEAD_EXPECTATION_MISMATCH")
        if self.expected_merge_base is not None and base_oid != self.expected_merge_base:
            raise GiteaTransportError("PR_BASE_EXPECTATION_MISMATCH")
        body = {"do": "fast-forward-only", "force_merge": False, "merge_when_checks_succeed": False, "head_commit_id": head_oid}
        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/pulls/{pr_number}/merge", body)[1]
@@ -1,93 +0,0 @@
 """Canonical Gitea transport and slash-branch verification."""
 from __future__ import annotations
 from dataclasses import dataclass
 import json
 import os
 from pathlib import Path
 import subprocess
 from typing import Any, Callable, Mapping, Optional
 from urllib.parse import quote
 from urllib.request import Request, urlopen
 from aios_gitops_reconciliation_core import RemoteObservation
@dataclass(frozen=True, slots=True)
 class GiteaPublisherConfig:
    repository: str = "aios/aios"
    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
    remote_name: str = "gitea-http"
 class GiteaPublisher:
    def __init__(self, workspace: Path, *, config: GiteaPublisherConfig = GiteaPublisherConfig(), credential: Any = None, api_get: Callable[[str], Any] | None = None, git_ref: Callable[[str], Optional[str]] | None = None) -> None:
        self.workspace = Path(workspace)
        self.config = config
        self.credential = credential
        self._api_get = api_get
        self._git_ref = git_ref
    @staticmethod
    def validate_repository(repository: str) -> None:
        if repository != "aios/aios":
            raise ValueError("REPOSITORY_IDENTITY_MISMATCH")
    @staticmethod
    def validate_branch(branch: str) -> None:
        if not isinstance(branch, str) or not branch.startswith("agent/") or branch in {"main", "master"}:
            raise ValueError("BRANCH_SCOPE_DENIED")
    def repository_identity(self) -> str:
        self.validate_repository(self.config.repository)
        return self.config.repository
    def _environment(self) -> dict[str, str]:
        if self.credential is not None and hasattr(self.credential, "environment"):
            return dict(self.credential.environment())
        return {}
    def read_git_ref(self, branch: str) -> Optional[str]:
        self.validate_branch(branch)
        if self._git_ref is not None:
            return self._git_ref(branch)
        result = subprocess.run(["git", "-C", str(self.workspace), "ls-remote", self.config.remote_name, f"refs/heads/{branch}"], text=True, capture_output=True, check=False, env={**os.environ, **self._environment(), "GIT_TERMINAL_PROMPT": "0"})
        if result.returncode != 0 or not result.stdout.strip():
            return None
        return result.stdout.split()[0]
    def _api(self, path: str) -> Any:
        if self._api_get is not None:
            return self._api_get(path)
        headers = {"Accept": "application/json"}
        env = self._environment()
        if env.get("AIOS_GITEA_TOKEN"):
            headers["Authorization"] = "token " + env["AIOS_GITEA_TOKEN"]
        with urlopen(Request(self.config.api_base.rstrip("/") + path, headers=headers), timeout=20) as response:
            return json.loads(response.read() or b"{}")
    def read_api_branch(self, branch: str) -> Optional[str]:
        self.validate_branch(branch)
        for page in range(1, 101):
            value = self._api(f"/repos/aios/aios/branches?page={page}&limit=50")
            if not isinstance(value, list):
                return None
            for item in value:
                if isinstance(item, Mapping) and item.get("name") == branch:
                    commit = item.get("commit")
                    return commit.get("id") if isinstance(commit, Mapping) else None
            if len(value) < 50:
                return None
        raise RuntimeError("GITEA_BRANCH_PAGINATION_LIMIT")
    def commit_visible(self, oid: str) -> bool:
        if not isinstance(oid, str) or len(oid) != 40:
            return False
        try:
            value = self._api(f"/repos/aios/aios/git/commits/{quote(oid, safe='')}")
            return isinstance(value, Mapping) and value.get("sha", oid) == oid
        except Exception:
            return False
    def observe(self, branch: str, desired_oid: str, authority_oid: Optional[str], *, expected_oid: Optional[str] = None, observed_at: str = "") -> RemoteObservation:
        return RemoteObservation(self.repository_identity(), branch, desired_oid, authority_oid, self.read_git_ref(branch), self.read_api_branch(branch), self.commit_visible(desired_oid), observed_at, expected_oid)
@@ -1,707 +0,0 @@
 """SQLite-backed durable GitOps Job Controller.
 The controller owns durable intent, idempotency, lease metadata, state
 transitions, receipts, and payload references. A worker owns Git side effects
 behind the campaign capability and branch-CAS boundaries.
 """
 from __future__ import annotations
 from dataclasses import dataclass
 from enum import Enum
 import hashlib
 import json
 import os
 from pathlib import Path
 import sqlite3
 import tempfile
 from datetime import datetime, timezone
 from typing import Any, Callable, Mapping
 class JobError(RuntimeError):
    pass
 class ServiceUnavailable(JobError):
    pass
@dataclass(frozen=True, slots=True)
 class LeaseRenewalResult:
    """Durable outcome of one writer-lease recovery attempt."""
    renewed: bool
    idempotent: bool
    durable: bool
    lease_expires_at: str | None
    def __bool__(self) -> bool:
        return self.renewed or self.idempotent
 class BindingConflict(JobError):
    pass
 class JobState(str, Enum):
    REQUESTED = "REQUESTED"
    AUTHORIZED = "AUTHORIZED"
    LEASED = "LEASED"
    WORKTREE_READY = "WORKTREE_READY"
    EXECUTING = "EXECUTING"
    LOCAL_VERIFIED = "LOCAL_VERIFIED"
    REMOTE_SYNCING = "REMOTE_SYNCING"
    REMOTE_VERIFIED = "REMOTE_VERIFIED"
    COMPLETED = "COMPLETED"
    RECOVERABLE_FAILURE = "RECOVERABLE_FAILURE"
    RECONCILING = "RECONCILING"
    RECONCILIATION_REQUIRED = "RECONCILIATION_REQUIRED"
    MANUAL_OWNER_REVIEW_REQUIRED = "MANUAL_OWNER_REVIEW_REQUIRED"
 _ORDER = {
    JobState.REQUESTED: 0,
    JobState.AUTHORIZED: 1,
    JobState.LEASED: 2,
    JobState.WORKTREE_READY: 3,
    JobState.EXECUTING: 4,
    JobState.LOCAL_VERIFIED: 5,
    JobState.REMOTE_SYNCING: 6,
    JobState.REMOTE_VERIFIED: 7,
    JobState.COMPLETED: 8,
 }
 _RECOVERABLE = {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}
 _TERMINAL = {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED}
 def utc_now() -> str:
    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
 def parse_utc(value: str) -> datetime:
    normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
    parsed = datetime.fromisoformat(normalized)
    if parsed.tzinfo is None:
        raise ValueError("LEASE_EXPIRY_INVALID")
    return parsed.astimezone(timezone.utc)
 def canonical_json(value: Any) -> bytes:
    return (
        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n"
    ).encode("utf-8")
 def sha256_json(value: Any) -> str:
    return hashlib.sha256(canonical_json(value)).hexdigest()
 class PayloadStore:
    """Content-addressed filesystem payloads; raw content never enters SQLite."""
    def __init__(self, root: str | os.PathLike[str]) -> None:
        self.root = Path(root)
        if not self.root.is_absolute() or self.root.is_symlink():
            raise JobError("PAYLOAD_ROOT_INVALID")
        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
        os.chmod(self.root, 0o700)
    def put(self, content: bytes, expected_digest: str) -> tuple[str, int]:
        digest = hashlib.sha256(content).hexdigest()
        if digest != expected_digest:
            raise JobError("PAYLOAD_DIGEST_MISMATCH")
        if len(expected_digest) != 64 or any(ch not in "0123456789abcdef" for ch in expected_digest):
            raise JobError("PAYLOAD_DIGEST_INVALID")
        target = self.root / expected_digest
        if target.is_symlink():
            raise JobError("PAYLOAD_PATH_SYMLINK")
        if target.is_file():
            if target.stat().st_size != len(content) or hashlib.sha256(target.read_bytes()).hexdigest() != digest:
                raise JobError("PAYLOAD_EXISTING_MISMATCH")
            return f"sha256/{digest}", len(content)
        fd, temporary = tempfile.mkstemp(prefix=".payload-", dir=self.root)
        try:
            os.fchmod(fd, 0o600)
            with os.fdopen(fd, "wb") as stream:
                stream.write(content)
                stream.flush()
                os.fsync(stream.fileno())
            os.replace(temporary, target)
            os.chmod(target, 0o600)
        finally:
            if os.path.exists(temporary):
                os.unlink(temporary)
        return f"sha256/{digest}", len(content)
    def read_verified(self, reference: str, expected_digest: str, expected_size: int) -> bytes:
        if reference != f"sha256/{expected_digest}":
            raise JobError("PAYLOAD_REFERENCE_MISMATCH")
        path = self.root / expected_digest
        if path.is_symlink() or not path.is_file():
            raise JobError("PAYLOAD_MISSING")
        content = path.read_bytes()
        if len(content) != expected_size or hashlib.sha256(content).hexdigest() != expected_digest:
            raise JobError("PAYLOAD_VERIFY_FAILED")
        return content
@dataclass(frozen=True, slots=True)
 class JobReceipt:
    job_id: str
    idempotency_key: str
    state: JobState
    side_effect_state: str
    http_status: int
    revision: int
    receipt: Mapping[str, Any] | None = None
    def as_dict(self) -> dict[str, Any]:
        return {
            "job_id": self.job_id,
            "idempotency_key": self.idempotency_key,
            "state": self.state.value,
            "side_effect_state": self.side_effect_state,
            "http_status": self.http_status,
            "revision": self.revision,
            "receipt": dict(self.receipt) if self.receipt else None,
        }
 class JobStore:
    SCHEMA_VERSION = 1
    def __init__(self, root: str | os.PathLike[str], *, payload_root: str | os.PathLike[str] | None = None) -> None:
        self.root = Path(root)
        if not self.root.is_absolute() or self.root.is_symlink():
            raise JobError("JOB_ROOT_INVALID")
        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
        os.chmod(self.root, 0o700)
        self.db_path = self.root / "state.sqlite3"
        self.payloads = PayloadStore(payload_root or self.root.parent / "payloads" / "sha256")
        self._initialize()
    def _connect(self) -> sqlite3.Connection:
        if self.db_path.is_symlink():
            raise ServiceUnavailable("JOB_DB_SYMLINK")
        connection = sqlite3.connect(self.db_path, timeout=30.0)
        connection.row_factory = sqlite3.Row
        connection.execute("PRAGMA journal_mode=WAL")
        connection.execute("PRAGMA synchronous=FULL")
        connection.execute("PRAGMA foreign_keys=ON")
        connection.execute("PRAGMA busy_timeout=30000")
        return connection
    def _initialize(self) -> None:
        try:
            with self._connect() as connection:
                connection.executescript(
                    """
                    CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);
                    CREATE TABLE IF NOT EXISTS jobs (
                      job_id TEXT PRIMARY KEY, idempotency_key TEXT NOT NULL UNIQUE,
                      campaign_id TEXT NOT NULL, repository TEXT NOT NULL, operation TEXT NOT NULL,
                      branch TEXT NOT NULL, expected_branch_oid TEXT NOT NULL,
                      payload_digest TEXT NOT NULL, payload_ref TEXT, payload_size INTEGER,
                      state TEXT NOT NULL, side_effect_state TEXT NOT NULL,
                      revision INTEGER NOT NULL, request_json TEXT NOT NULL,
                      receipt_json TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
                    );
                    CREATE TABLE IF NOT EXISTS idempotency_keys (
                      key TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE,
                      binding_json TEXT NOT NULL, created_at TEXT NOT NULL,
                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
                    );
                    CREATE TABLE IF NOT EXISTS branch_leases (
                      lease_id TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE,
                      branch TEXT NOT NULL, lineage_anchor_oid TEXT NOT NULL,
                      current_head_oid TEXT NOT NULL, generation INTEGER NOT NULL,
                      lease_expires_at TEXT NOT NULL, state TEXT NOT NULL,
                      revision INTEGER NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
                    );
                    CREATE TABLE IF NOT EXISTS state_transitions (
                      sequence INTEGER PRIMARY KEY AUTOINCREMENT, job_id TEXT NOT NULL,
                      from_state TEXT, to_state TEXT NOT NULL, revision INTEGER NOT NULL,
                      side_effect_state TEXT NOT NULL, created_at TEXT NOT NULL,
                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
                    );
                    CREATE TABLE IF NOT EXISTS receipts (
                      receipt_id TEXT PRIMARY KEY, job_id TEXT NOT NULL,
                      kind TEXT NOT NULL, digest TEXT NOT NULL, payload_json TEXT NOT NULL,
                      created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
                    );
                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '1');
                    """
                )
        except sqlite3.Error as exc:
            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
    def _mirror(self, job: Mapping[str, Any]) -> None:
        directory = self.root / str(job["job_id"])
        directory.mkdir(mode=0o700, exist_ok=True)
        (directory / "receipts").mkdir(mode=0o700, exist_ok=True)
        (directory / "logs-digest").mkdir(mode=0o700, exist_ok=True)
        for name, value in (("request.json", job["request"]), ("state.json", job)):
            target = directory / name
            fd, temporary = tempfile.mkstemp(prefix=".mirror-", dir=directory)
            try:
                os.fchmod(fd, 0o600)
                with os.fdopen(fd, "wb") as stream:
                    stream.write(canonical_json(value))
                    stream.flush()
                    os.fsync(stream.fileno())
                os.replace(temporary, target)
            finally:
                if os.path.exists(temporary):
                    os.unlink(temporary)
    def read(self, job_id: str) -> dict[str, Any]:
        try:
            with self._connect() as connection:
                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
        except sqlite3.Error as exc:
            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
        if row is None:
            raise JobError("JOB_NOT_FOUND")
        return dict(row)
    def _receipt(self, row: Mapping[str, Any], *, duplicate: bool) -> JobReceipt:
        state = JobState(row["state"])
        if state == JobState.COMPLETED:
            status, side = 200, "COMPLETED"
        elif state in _RECOVERABLE:
            status = 202
            side = row["side_effect_state"] if row["side_effect_state"] == "REMOTE_PUSH_PENDING" else "RESUME_SAME_JOB"
        elif row["side_effect_state"] == "UNKNOWN":
            status, side = 503, "UNKNOWN"
        else:
            status, side = 202, "SAME_JOB" if duplicate else "QUEUED"
        receipt = json.loads(row["receipt_json"]) if row["receipt_json"] else None
        return JobReceipt(row["job_id"], row["idempotency_key"], state, side, status, int(row["revision"]), receipt)
 class GitOpsJobController:
    def __init__(self, store: JobStore) -> None:
        self.store = store
    @staticmethod
    def _binding(request: Mapping[str, Any]) -> dict[str, str]:
        fields = ("campaign_id", "repository", "operation", "branch", "expected_branch_oid", "payload_digest")
        if any(not isinstance(request.get(field), str) or not request[field].strip() for field in fields):
            raise JobError("JOB_BINDING_INVALID")
        oid = request["expected_branch_oid"]
        digest = request["payload_digest"]
        if len(oid) != 40 or any(ch not in "0123456789abcdef" for ch in oid):
            raise JobError("EXPECTED_BRANCH_OID_INVALID")
        if len(digest) != 64 or any(ch not in "0123456789abcdef" for ch in digest):
            raise JobError("PAYLOAD_DIGEST_INVALID")
        if request["branch"] in {"main", "master"} or request["branch"].startswith(("refs/", "tags/")):
            raise JobError("PROTECTED_BRANCH_REJECTED")
        binding = {field: str(request[field]) for field in fields}
        # Operation-specific, non-secret binding inputs must survive the
        # durable round trip and participate in idempotency. Arbitrary request
        # fields are intentionally discarded rather than persisted.
        optional = (
            "idempotency_key",
            "task_id",
            "new_branch_oid",
            "authorization_recovery_digest",
            "lineage_anchor_oid",
            "base_oid",
            "branch_mode",
            "generation",
            "expected_main_oid",
            "pr_number",
            "target_branch",
            "check_context",
            "check_state",
            "check_description",
        )
        for field in optional:
            value = request.get(field)
            if value is None:
                continue
            if isinstance(value, bool) or not isinstance(value, (str, int)):
                raise JobError("JOB_BINDING_OPTION_INVALID")
            text = str(value).strip()
            if not text or len(text) > 512:
                raise JobError("JOB_BINDING_OPTION_INVALID")
            binding[field] = text
        return binding
    def submit(self, request: Mapping[str, Any], *, payload: bytes | None = None) -> JobReceipt:
        binding = self._binding(request)
        payload_ref = request.get("payload_ref")
        payload_size = request.get("payload_size")
        if payload is not None:
            payload_ref, payload_size = self.store.payloads.put(payload, binding["payload_digest"])
        if payload_ref is not None and payload_ref != f"sha256/{binding['payload_digest']}":
            raise JobError("PAYLOAD_REFERENCE_MISMATCH")
        if payload_ref is not None and (not isinstance(payload_size, int) or payload_size < 0):
            raise JobError("PAYLOAD_SIZE_INVALID")
        client_idempotency_key = binding.get("idempotency_key")
        if client_idempotency_key is not None:
            if len(client_idempotency_key) > 128 or not all(
                character.isalnum() or character in "._:-" for character in client_idempotency_key
            ):
                raise JobError("IDEMPOTENCY_KEY_INVALID")
            key = sha256_json({"client_idempotency_key": client_idempotency_key})
        else:
            key = sha256_json(binding)
        job_id = "job-" + key[:32]
        durable_request = dict(binding)
        if payload_ref is not None:
            durable_request.update({"payload_ref": str(payload_ref), "payload_size": int(payload_size)})
        now = utc_now()
        try:
            with self.store._connect() as connection:
                connection.execute("BEGIN IMMEDIATE")
                existing = connection.execute("SELECT * FROM jobs WHERE idempotency_key=?", (key,)).fetchone()
                if existing is not None:
                    if json.loads(existing["request_json"]).get("binding") != binding:
                        raise BindingConflict("BINDING_CONFLICT")
                    row = dict(existing)
                    connection.commit()
                    return self.store._receipt(row, duplicate=True)
                connection.execute(
                    "INSERT INTO jobs(job_id,idempotency_key,campaign_id,repository,operation,branch,expected_branch_oid,payload_digest,payload_ref,payload_size,state,side_effect_state,revision,request_json,receipt_json,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
                    (job_id, key, binding["campaign_id"], binding["repository"], binding["operation"], binding["branch"], binding["expected_branch_oid"], binding["payload_digest"], payload_ref, payload_size, JobState.REQUESTED.value, "NONE", 0, json.dumps({"binding": binding, **durable_request}, sort_keys=True), None, now, now),
                )
                connection.execute("INSERT INTO idempotency_keys(key,job_id,binding_json,created_at) VALUES(?,?,?,?)", (key, job_id, json.dumps(binding, sort_keys=True), now))
                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, None, JobState.REQUESTED.value, 0, "NONE", now))
                row = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
                connection.commit()
        except BindingConflict:
            raise
        except sqlite3.IntegrityError:
            row = self.store.read(job_id)
            return self.store._receipt(row, duplicate=True)
        except sqlite3.Error as exc:
            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
        row["request"] = json.loads(row["request_json"])
        self.store._mirror(row)
        return self.store._receipt(row, duplicate=False)
    def lease_job(
        self,
        job_id: str,
        *,
        lease_id: str,
        lineage_anchor_oid: str,
        current_head_oid: str,
        generation: int,
        lease_expires_at: str,
        expected_revision: int,
    ) -> JobReceipt:
        """Atomically create a branch lease and move its Job to LEASED."""
        if generation < 1 or any(len(oid) != 40 for oid in (lineage_anchor_oid, current_head_oid)):
            raise JobError("LEASE_BINDING_INVALID")
        try:
            with self.store._connect() as connection:
                connection.execute("BEGIN IMMEDIATE")
                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
                if row is None:
                    raise JobError("JOB_NOT_FOUND")
                if int(row["revision"]) != expected_revision:
                    raise JobError("REVISION_CAS_CONFLICT")
                if row["branch"] in {"main", "master"}:
                    raise JobError("PROTECTED_BRANCH_REJECTED")
                now = utc_now()
                connection.execute("INSERT INTO branch_leases(lease_id,job_id,branch,lineage_anchor_oid,current_head_oid,generation,lease_expires_at,state,revision) VALUES(?,?,?,?,?,?,?,?,?)", (lease_id, job_id, row["branch"], lineage_anchor_oid, current_head_oid, generation, lease_expires_at, "ACTIVE", 0))
                next_revision = expected_revision + 1
                updated = connection.execute("UPDATE jobs SET state=?,side_effect_state=?,revision=?,updated_at=? WHERE job_id=? AND revision=?", (JobState.LEASED.value, "LEASED", next_revision, now, job_id, expected_revision))
                if updated.rowcount != 1:
                    raise JobError("REVISION_CAS_CONFLICT")
                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, row["state"], JobState.LEASED.value, next_revision, "LEASED", now))
                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
                connection.commit()
        except sqlite3.IntegrityError as exc:
            raise JobError("LEASE_CONFLICT") from exc
        except (JobError, BindingConflict):
            raise
        except sqlite3.Error as exc:
            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
        result["request"] = json.loads(result["request_json"])
        self.store._mirror(result)
        return self.store._receipt(result, duplicate=True)
    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE", lease_expires_at: str | None = None) -> None:
        if len(current_head_oid) != 40 or generation < 1:
            raise JobError("LEASE_BINDING_INVALID")
        try:
            with self.store._connect() as connection:
                connection.execute("BEGIN IMMEDIATE")
                if lease_expires_at is None:
                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
                else:
                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,lease_expires_at=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, lease_expires_at, state, lease_id, expected_revision))
                if updated.rowcount != 1:
                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
                connection.commit()
        except JobError:
            raise
        except sqlite3.Error as exc:
            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
    def renew_lease(
        self,
        *,
        branch: str,
        lineage_anchor_oid: str,
        current_head_oid: str,
        generation: int,
        lease_expires_at: str,
    ) -> LeaseRenewalResult:
        if (
            not branch
            or len(lineage_anchor_oid) != 40
            or len(current_head_oid) != 40
            or generation < 1
            or not lease_expires_at.strip()
        ):
            raise JobError("LEASE_BINDING_INVALID")
        try:
            with self.store._connect() as connection:
                connection.execute("BEGIN IMMEDIATE")
                rows = connection.execute(
                    "SELECT lease_id, revision, generation, state, lease_expires_at "
                    "FROM branch_leases "
                    "WHERE branch=? AND lineage_anchor_oid=? AND current_head_oid=? "
                    "AND generation=? AND state='ACTIVE' ORDER BY revision DESC",
                    (branch, lineage_anchor_oid, current_head_oid, generation),
                ).fetchall()
                if not rows:
                    connection.commit()
                    return LeaseRenewalResult(False, False, False, None)
                if len(rows) != 1:
                    raise JobError("LEASE_BINDING_CONFLICT")
                row = rows[0]
                try:
                    current_expires_at = parse_utc(str(row["lease_expires_at"]))
                    requested_expires_at = parse_utc(lease_expires_at)
                except (TypeError, ValueError) as exc:
                    raise JobError("LEASE_EXPIRY_INVALID") from exc
                now = datetime.now(timezone.utc)
                if requested_expires_at <= now:
                    raise JobError("LEASE_EXPIRY_INVALID")
                if current_expires_at > now:
                    connection.commit()
                    return LeaseRenewalResult(
                        False,
                        True,
                        True,
                        str(row["lease_expires_at"]),
                    )
                updated = connection.execute(
                    "UPDATE branch_leases SET lease_expires_at=?,revision=revision+1 "
                    "WHERE lease_id=? AND revision=? AND generation=? "
                    "AND state='ACTIVE' AND lease_expires_at=?",
                    (
                        lease_expires_at,
                        row["lease_id"],
                        int(row["revision"]),
                        generation,
                        row["lease_expires_at"],
                    ),
                )
                if updated.rowcount != 1:
                    current = connection.execute(
                        "SELECT lease_expires_at, generation, state FROM branch_leases "
                        "WHERE lease_id=?",
                        (row["lease_id"],),
                    ).fetchone()
                    if (
                        current is not None
                        and int(current["generation"]) == generation
                        and current["state"] == "ACTIVE"
                        and parse_utc(str(current["lease_expires_at"])) > now
                    ):
                        connection.commit()
                        return LeaseRenewalResult(
                            False,
                            True,
                            True,
                            str(current["lease_expires_at"]),
                        )
                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
                connection.commit()
                return LeaseRenewalResult(True, False, True, lease_expires_at)
        except JobError:
            raise
        except sqlite3.Error as exc:
            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
    def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
        return self._advance(
            job_id,
            state,
            side_effect_state=side_effect_state,
            receipt=receipt,
            expected_revision=expected_revision,
        )
    def _advance(
        self,
        job_id: str,
        state: JobState,
        *,
        side_effect_state: str,
        receipt: Mapping[str, Any] | None = None,
        expected_revision: int | None = None,
        _allow_verified_external_recovery: bool = False,
    ) -> JobReceipt:
        try:
            with self.store._connect() as connection:
                connection.execute("BEGIN IMMEDIATE")
                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
                if row is None:
                    raise JobError("JOB_NOT_FOUND")
                previous = JobState(row["state"])
                revision = int(row["revision"])
                if expected_revision is not None and expected_revision != revision:
                    raise JobError("REVISION_CAS_CONFLICT")
                recovery_transition = (
                    _allow_verified_external_recovery
                    and previous == JobState.MANUAL_OWNER_REVIEW_REQUIRED
                    and state == JobState.COMPLETED
                )
                if previous in _TERMINAL and state != previous and not recovery_transition:
                    raise JobError("JOB_TERMINAL")
                if state not in _RECOVERABLE | {JobState.RECONCILING, JobState.MANUAL_OWNER_REVIEW_REQUIRED}:
                    if previous in _RECOVERABLE:
                        raise JobError("RECONCILE_REQUIRED")
                    if previous != JobState.RECONCILING and _ORDER.get(state, -1) < _ORDER.get(previous, -1):
                        raise JobError("JOB_STATE_REGRESSION")
                next_revision = revision + 1
                receipt_json = json.dumps(dict(receipt), sort_keys=True) if receipt is not None else row["receipt_json"]
                now = utc_now()
                updated = connection.execute("UPDATE jobs SET state=?,side_effect_state=?,revision=?,receipt_json=?,updated_at=? WHERE job_id=? AND revision=?", (state.value, side_effect_state, next_revision, receipt_json, now, job_id, revision))
                if updated.rowcount != 1:
                    raise JobError("REVISION_CAS_CONFLICT")
                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, previous.value, state.value, next_revision, side_effect_state, now))
                if receipt is not None:
                    digest = hashlib.sha256(canonical_json(receipt)).hexdigest()
                    connection.execute("INSERT INTO receipts(receipt_id,job_id,kind,digest,payload_json,created_at) VALUES(?,?,?,?,?,?)", (f"receipt-{job_id}-{next_revision}", job_id, state.value, digest, json.dumps(dict(receipt), sort_keys=True), now))
                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
                connection.commit()
        except (JobError, BindingConflict):
            raise
        except sqlite3.Error as exc:
            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
        result["request"] = json.loads(result["request_json"])
        self.store._mirror(result)
        return self.store._receipt(result, duplicate=True)
    @staticmethod
    def _validate_verified_external_merge_proof(
        job_id: str,
        binding: Mapping[str, Any],
        proof: Mapping[str, Any],
    ) -> dict[str, Any]:
        if not isinstance(proof, Mapping):
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
        def require_oid(field: str) -> str:
            value = proof.get(field)
            if not isinstance(value, str) or len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
                raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
            return value
        if proof.get("proof_schema") != "aios.job-recovery.v1":
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
        if proof.get("job_id") != job_id:
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
        if proof.get("operation") != "PROTECTED_MERGE" or binding.get("operation") != "PROTECTED_MERGE":
            raise JobError("EXTERNAL_SIDE_EFFECT_OPERATION_REJECTED")
        if proof.get("pr_number") != 53 or str(binding.get("pr_number")) != "53":
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
        if proof.get("pr_merged") is not True or proof.get("protected_merge") is not True:
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
        if proof.get("force_push") is not False:
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
        if proof.get("machine_actor") != "aios-autonomy-agent":
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
        expected_head = str(binding.get("expected_branch_oid", ""))
        expected_base = str(binding.get("expected_main_oid", ""))
        head_oid = require_oid("head_oid")
        base_oid = require_oid("base_oid")
        merged_main = require_oid("main_oid_after_protected_merge")
        gitea_merged_main = require_oid("gitea_main_oid_after_protected_merge")
        authority_merged_main = require_oid("authority_main_oid_after_protected_merge")
        current_gitea = require_oid("current_gitea_main_oid")
        current_authority = require_oid("current_authority_main_oid")
        if head_oid != expected_head or base_oid != expected_base:
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
        if not (merged_main == gitea_merged_main == authority_merged_main == head_oid):
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
        if current_gitea != current_authority or proof.get("current_main_descends_from_protected_merge") is not True:
            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
        return dict(proof)
    def complete_verified_external_side_effect(
        self,
        job_id: str,
        proof: Mapping[str, Any],
        *,
        expected_revision: int | None = None,
    ) -> JobReceipt:
        """Close one historical manual job from independently verified proof.
        This is deliberately narrower than advance: it is only valid for the
        known protected PR53 recovery shape and preserves the old receipt.
        The actual state change still uses the normal revision-CAS path.
        """
        current = self.store.read(job_id)
        revision = int(current["revision"])
        if expected_revision is not None and expected_revision != revision:
            raise JobError("REVISION_CAS_CONFLICT")
        request = json.loads(current["request_json"])
        binding = request.get("binding", request)
        normalized_proof = self._validate_verified_external_merge_proof(job_id, binding, proof)
        existing_receipt = json.loads(current["receipt_json"]) if current["receipt_json"] else None
        if JobState(current["state"]) == JobState.COMPLETED:
            if (
                existing_receipt
                and existing_receipt.get("recovered_from_historical_manual") is True
                and existing_receipt.get("proof") == normalized_proof
            ):
                return self.store._receipt(current, duplicate=True)
            raise JobError("JOB_TERMINAL")
        if JobState(current["state"]) != JobState.MANUAL_OWNER_REVIEW_REQUIRED:
            raise JobError("EXTERNAL_SIDE_EFFECT_RECOVERY_STATE_INVALID")
        recovery_receipt = {
            "recovered_from_historical_manual": True,
            "recovery_kind": "VERIFIED_EXTERNAL_SIDE_EFFECT",
            "historical_receipt": existing_receipt,
            "proof": normalized_proof,
        }
        return self._advance(
            job_id,
            JobState.COMPLETED,
            side_effect_state="REMOTE_VERIFIED",
            receipt=recovery_receipt,
            expected_revision=revision,
            _allow_verified_external_recovery=True,
        )
    def reconcile(self, job_id: str, observer: Callable[[Mapping[str, Any]], Mapping[str, Any]]) -> JobReceipt:
        current = self.store.read(job_id)
        if JobState(current["state"]) not in _RECOVERABLE:
            return self.store._receipt(current, duplicate=True)
        self.advance(job_id, JobState.RECONCILING, side_effect_state="IN_PROGRESS")
        try:
            observed = dict(observer(current))
            stable = JobState(observed.get("state", JobState.REQUESTED.value))
            if stable in {JobState.RECOVERABLE_FAILURE, JobState.RECONCILING}:
                raise JobError("RECONCILIATION_UNSTABLE")
            return self.advance(job_id, stable, side_effect_state=str(observed.get("side_effect_state", "NONE")), receipt=observed.get("receipt"))
        except Exception as exc:
            self.advance(job_id, JobState.RECONCILIATION_REQUIRED, side_effect_state="UNKNOWN", receipt={"error_code": type(exc).__name__})
            raise JobError("RECONCILIATION_REQUIRED") from exc
    def resume(self, job_id: str) -> JobReceipt:
        current = self.store.read(job_id)
        if JobState(current["state"]) in _TERMINAL:
            raise JobError("JOB_TERMINAL")
        return self.reconcile(job_id, lambda _current: {"state": JobState.REQUESTED.value, "side_effect_state": "RESUME_SAME_JOB"})
@@ -1,279 +0,0 @@
 """Durable Job side-effect executor for the AIOS campaign control plane."""
 from __future__ import annotations
 import argparse
 import base64
 from dataclasses import dataclass, replace
 import json
 from pathlib import Path
 from typing import Any, Mapping
 from aios_authority_git_executor import AuthorityGitExecutor, AuthorityGitError
 from aios_campaign_recovery import RecoveryEvidenceError, load_recovered_authorization
 from aios_gitea_machine_broker import CampaignCapabilityReceipt, GiteaMachineBroker, MachineBrokerError
 from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore
 TASK_ID = "AIOS_AUTONOMOUS_RELEASE_CAMPAIGN_V1"
 CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
 REPOSITORY = "aios/aios"
 BRANCH = "agent/autonomous-release-campaign-v1-20260807"
 EXPECTED_BRANCH_OID = "bba675fab3b7e0c5fba7066720252b3c91b9f20d"
 AUTHORIZATION_DIGEST = "6b0bf550eb702126e967eeff2d561fa808444b924d8a71f5399accad508ed3b2"
 LINEAGE_ANCHOR = "69b45e81dcd2c3707c367003b08c55fd361faae8"
 class JobExecutionError(RuntimeError):
    pass
@dataclass(slots=True)
 class DurableJobExecutor:
    controller: GitOpsJobController
    authority: AuthorityGitExecutor
    broker: GiteaMachineBroker
    recovery_path: Path
    def _request(self, job_id: str) -> tuple[dict[str, Any], dict[str, Any]]:
        row = self.controller.store.read(job_id)
        try:
            request = json.loads(row["request_json"])
        except (KeyError, TypeError, json.JSONDecodeError) as exc:
            raise JobExecutionError("JOB_REQUEST_INVALID") from exc
        return row, dict(request.get("binding") or {})
    def _validate_campaign(self, request: Mapping[str, Any]) -> str:
        operation = str(request.get("operation", ""))
        expected_branch_oid = request.get("expected_branch_oid")
        required = {
            "task_id": TASK_ID,
            "campaign_id": CAMPAIGN_ID,
            "repository": REPOSITORY,
            "branch": BRANCH,
            "authorization_recovery_digest": AUTHORIZATION_DIGEST,
        }
        for key, expected in required.items():
            if request.get(key) != expected:
                raise JobExecutionError(f"JOB_{key.upper()}_MISMATCH")
        new_oid = request.get("new_branch_oid")
        if not isinstance(new_oid, str) or len(new_oid) != 40 or any(ch not in "0123456789abcdef" for ch in new_oid):
            raise JobExecutionError("NEW_BRANCH_OID_INVALID")
        if not isinstance(expected_branch_oid, str) or len(expected_branch_oid) != 40 or any(ch not in "0123456789abcdef" for ch in expected_branch_oid):
            raise JobExecutionError("EXPECTED_BRANCH_OID_INVALID")
        if operation == "ADVANCE_EXISTING_CAMPAIGN_BRANCH" and expected_branch_oid == new_oid:
            raise JobExecutionError("EXPECTED_BRANCH_OID_INVALID")
        if operation != "ADVANCE_EXISTING_CAMPAIGN_BRANCH" and expected_branch_oid != new_oid:
            raise JobExecutionError("POST_ADVANCE_HEAD_BINDING_INVALID")
        try:
            recovery = load_recovered_authorization(self.recovery_path)
        except RecoveryEvidenceError as exc:
            raise JobExecutionError(str(exc)) from exc
        if recovery["digest"] != AUTHORIZATION_DIGEST:
            raise JobExecutionError("RECOVERY_DIGEST_MISMATCH")
        for key, expected in required.items():
            if key == "campaign_id":
                actual = recovery.get(key)
            elif key == "authorization_recovery_digest":
                continue
            else:
                actual = recovery.get({"expected_branch_oid": "expected_branch_oid"}.get(key, key))
            if actual is not None and actual != expected:
                raise JobExecutionError("RECOVERY_BINDING_MISMATCH")
        if recovery.get("expected_branch_oid") != EXPECTED_BRANCH_OID:
            raise JobExecutionError("RECOVERY_BRANCH_OID_MISMATCH")
        authority_head = self.authority.read_ref(f"refs/heads/{BRANCH}")
        if authority_head not in {expected_branch_oid, new_oid}:
            raise JobExecutionError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
        if not self.authority.ancestry_check(expected_branch_oid, new_oid):
            raise JobExecutionError("NEW_OID_NOT_DESCENDANT")
        if not self.authority.ancestry_check(EXPECTED_BRANCH_OID, new_oid):
            raise JobExecutionError("NEW_OID_OUTSIDE_AUTHORIZED_LINEAGE")
        identity = self.broker.verify_identity()
        if identity.get("repository") != REPOSITORY or identity.get("login") == "aiman":
            raise JobExecutionError("MACHINE_IDENTITY_SCOPE_INVALID")
        return new_oid
    def dry_run(self, job_id: str) -> dict[str, Any]:
        _row, request = self._request(job_id)
        new_oid = self._validate_campaign(request)
        remote = self.broker.readback()
        if remote is None:
            action = "CREATE_REQUIRED"
        elif remote == new_oid:
            action = "ALREADY_IN_SYNC"
        elif remote == request["expected_branch_oid"]:
            action = "FAST_FORWARD_REQUIRED"
        else:
            action = "MANUAL_OWNER_REVIEW_REQUIRED"
        if action == "MANUAL_OWNER_REVIEW_REQUIRED":
            raise JobExecutionError("GITEA_BRANCH_CONFLICT")
        return {
            "decision": "SAFE_TO_ADVANCE",
            "authority_action": "CAS_REQUIRED",
            "gitea_action": action,
            "previous_branch_oid": request["expected_branch_oid"],
            "final_branch_oid": new_oid,
            "force_push": False,
        }
    def _recover_requested(self, job_id: str) -> dict[str, Any]:
        row = self.controller.store.read(job_id)
        if JobState(row["state"]) in {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}:
            self.controller.resume(job_id)
            row = self.controller.store.read(job_id)
        return row
    def execute(self, job_id: str, *, dry_run: bool = False) -> dict[str, Any]:
        try:
            return self._execute_unprotected(job_id, dry_run=dry_run)
        except Exception as exc:
            try:
                row = self.controller.store.read(job_id)
                state = JobState(row["state"])
                if state not in {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED, JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}:
                    self.controller.advance(job_id, JobState.RECOVERABLE_FAILURE, side_effect_state="UNKNOWN", receipt={"error_code": type(exc).__name__})
            except Exception:
                pass
            raise
    def _execute_unprotected(self, job_id: str, *, dry_run: bool = False) -> dict[str, Any]:
        row, request = self._request(job_id)
        operation = request.get("operation")
        if operation == "ADVANCE_EXISTING_CAMPAIGN_BRANCH":
            if dry_run:
                return self.dry_run(job_id)
            return self._advance_campaign(job_id)
        if operation == "COMMIT_FILE":
            return self._commit_file(job_id, request)
        if operation == "SYNC_TASK_BRANCH_TO_GITEA":
            new_oid = self._validate_campaign(request)
            final = self.broker.push_branch(new_oid)
            return {"operation": operation, "remote_verified": final == new_oid, "final_network_oid": final}
        if operation == "CREATE_PR":
            self._validate_campaign(request)
            return dict(self.broker.create_pr("AIOS autonomous release control plane", "Durable campaign continuation; exact head and recovery evidence are bound in the Job."))
        if operation == "PUBLISH_CHECK":
            self._validate_campaign(request)
            context = request.get("check_context", "aios/durable-release")
            state = request.get("check_state", "success")
            description = request.get("check_description", "Durable campaign control-plane check passed")
            return dict(self.broker.status(str(state), str(description), str(context)))
        if operation == "PROTECTED_MERGE":
            self._validate_campaign(request)
            number = int(request.get("pr_number", "0"))
            self.broker.transport.expected_merge_head = request["expected_branch_oid"]
            expected_main = request.get("expected_main_oid")
            if expected_main is not None:
                self.broker.transport.expected_merge_base = expected_main
            return dict(self.broker.merge(number))
        if operation == "RECONCILE_AUTHORITY_MAIN":
            self._validate_campaign(request)
            old = request.get("expected_main_oid")
            new = request.get("new_branch_oid")
            if not isinstance(old, str) or not isinstance(new, str):
                raise JobExecutionError("MAIN_RECONCILIATION_BINDING_INVALID")
            gitea_main = self.broker.transport.read_branch("main")
            if gitea_main != new:
                raise JobExecutionError("GITEA_MAIN_EXPECTATION_MISMATCH")
            if not self.authority.ancestry_check(old, new):
                raise JobExecutionError("MAIN_OID_NOT_DESCENDANT")
            return {"authority_main": self.authority.ff_CAS_main_after_verified_protected_merge(old, new)}
        raise JobExecutionError("OPERATION_NOT_ALLOWED")
    def _advance_campaign(self, job_id: str) -> dict[str, Any]:
        self._recover_requested(job_id)
        row, request = self._request(job_id)
        new_oid = self._validate_campaign(request)
        expected_oid = request["expected_branch_oid"]
        state = JobState(row["state"])
        if state == JobState.REQUESTED:
            receipt = self.controller.advance(job_id, JobState.AUTHORIZED, side_effect_state="AUTHORIZED", receipt={"authorization_digest": AUTHORIZATION_DIGEST, "task_id": TASK_ID})
            row = self.controller.store.read(job_id)
        if JobState(row["state"]) == JobState.AUTHORIZED:
            self.controller.lease_job(job_id, lease_id=f"lease-{job_id}", lineage_anchor_oid=LINEAGE_ANCHOR, current_head_oid=expected_oid, generation=1, lease_expires_at="2099-01-01T00:00:00Z", expected_revision=int(row["revision"]))
            row = self.controller.store.read(job_id)
        if JobState(row["state"]) == JobState.LEASED:
            self.controller.advance(job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY", receipt={"branch": BRANCH, "expected_oid": expected_oid})
            row = self.controller.store.read(job_id)
        if JobState(row["state"]) == JobState.WORKTREE_READY:
            self.controller.advance(job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
            row = self.controller.store.read(job_id)
        authority_before = self.authority.read_ref(f"refs/heads/{BRANCH}")
        if authority_before == expected_oid:
            authority_oid = self.authority.advance_task_branch_CAS(f"refs/heads/{BRANCH}", expected_oid, new_oid)
        elif authority_before == new_oid:
            authority_oid = new_oid
        else:
            raise JobExecutionError("AUTHORITY_BRANCH_CONFLICT")
        row = self.controller.store.read(job_id)
        if JobState(row["state"]) == JobState.EXECUTING:
            self.controller.advance(job_id, JobState.LOCAL_VERIFIED, side_effect_state="LOCAL_VERIFIED", receipt={"authority": {"branch": BRANCH, "previous_oid": expected_oid, "new_oid": new_oid, "CAS_success": True, "readback_oid": authority_oid}})
        row = self.controller.store.read(job_id)
        remote_before = self.broker.readback()
        if remote_before != new_oid:
            if remote_before not in {None, expected_oid}:
                raise JobExecutionError("GITEA_BRANCH_CONFLICT")
            if JobState(row["state"]) == JobState.LOCAL_VERIFIED:
                if hasattr(self.broker, "receipt"):
                    self.broker.receipt = replace(self.broker.receipt, expected_oid=expected_oid)
                self.controller.advance(job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS", receipt={"gitea": {"previous_oid": remote_before, "desired_oid": new_oid, "force_push": False}})
            final_network = self.broker.push_branch(new_oid)
        else:
            final_network = new_oid
        final_api = self.broker.readback()
        if final_api != new_oid:
            raise JobExecutionError("GITEA_BRANCH_READBACK_MISMATCH")
        row = self.controller.store.read(job_id)
        if JobState(row["state"]) in {JobState.LOCAL_VERIFIED, JobState.REMOTE_SYNCING}:
            self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt={"gitea": {"machine_actor": "aios-autonomy-agent", "previous_oid": remote_before, "desired_oid": new_oid, "final_network_oid": final_network, "final_API_oid": final_api, "force_push": False}})
        row = self.controller.store.read(job_id)
        if JobState(row["state"]) == JobState.REMOTE_VERIFIED:
            self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt={"authority_oid": authority_oid, "network_oid": final_network, "gitea_api_oid": final_api, "force_push": False})
        return self.controller.store._receipt(self.controller.store.read(job_id), duplicate=True).as_dict()
    def _commit_file(self, job_id: str, request: Mapping[str, Any]) -> dict[str, Any]:
        row = self.controller.store.read(job_id)
        payload_ref = request.get("payload_ref")
        if not payload_ref:
            raise JobExecutionError("PAYLOAD_REQUIRED")
        payload = self.controller.store.payloads.read_verified(payload_ref, row["payload_digest"], int(request["payload_size"]))
        try:
            spec = json.loads(payload.decode())
            path = str(spec["path"])
            content = base64.b64decode(spec["content_base64"], validate=True)
        except Exception as exc:
            raise JobExecutionError("COMMIT_FILE_PAYLOAD_INVALID") from exc
        new_oid = self.authority.commit_file_in_isolated_worktree(base_oid=row["expected_branch_oid"], files={path: content}, message="chore(gitops): durable commit-file", worktree_name=job_id)
        return {"operation": "COMMIT_FILE", "new_oid": new_oid}
 def build_from_environment(job_root: Path) -> DurableJobExecutor:
    from aios_gitea_machine_transport import GiteaMachineTransport
    from aios_gitea_machine_broker import MachineCredentialProjection
    account = __import__("os").environ.get("AIOS_GITEA_MACHINE_ACCOUNT", "aios-autonomy-agent")
    api = __import__("os").environ.get("AIOS_GITEA_API", "https://g.cnnetmkt.top/git/api/v1")
    remote = __import__("os").environ.get("AIOS_GITEA_REMOTE", "https://g.cnnetmkt.top/git/aios/aios.git")
    authority_dir = Path(__import__("os").environ.get("AIOS_GITOPS_AUTHORITY_GIT_DIR", "/data/aios-gitops/repo.git"))
    worktree_root = Path(__import__("os").environ.get("AIOS_GITOPS_WORKTREE_ROOT", "/var/lib/aios-gitops/worktrees"))
    recovery = Path(__import__("os").environ.get("AIOS_RELEASE_RECOVERY_RECEIPT", "/var/lib/aios-gitops/release-campaigns/AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807/authorization-recovery.json"))
    transport = GiteaMachineTransport(api, REPOSITORY, remote, authority_dir)
    credential = MachineCredentialProjection.from_mapping({"scheme": "systemd-credential", "name": "gitea-machine-token", "account": account})
    receipt = CampaignCapabilityReceipt(CAMPAIGN_ID, TASK_ID, REPOSITORY, BRANCH, EXPECTED_BRANCH_OID, frozenset({"exact_task_branch_push", "pr_create_update", "status_publish", "protected_merge", "remote_readback"}), frozenset({"direct_main_push", "force_push", "tag_update", "tag_delete", "baseline_write", "production_deploy"}))
    return DurableJobExecutor(GitOpsJobController(JobStore(job_root)), AuthorityGitExecutor(authority_dir, worktree_root), GiteaMachineBroker(transport, credential, receipt), recovery)
 def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--job-root", required=True, type=Path)
    parser.add_argument("--job-id", required=True)
    parser.add_argument("--dry-run", action="store_true")
    args = parser.parse_args(argv)
    result = build_from_environment(args.job_root).execute(args.job_id, dry_run=args.dry_run)
    print(json.dumps(result, sort_keys=True))
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,80 +0,0 @@
 """Pure, observation-first decisions for governed GitOps reconciliation."""
 from __future__ import annotations
 from dataclasses import dataclass
 from enum import Enum
 import re
 from typing import Optional
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 class ReconciliationAction(str, Enum):
    NOOP = "NOOP"
    PUSH_EXACT = "PUSH_EXACT"
    VERIFY_REMOTE = "VERIFY_REMOTE"
    MARK_REMOTE_VERIFIED = "MARK_REMOTE_VERIFIED"
    MARK_RECONCILIATION_REQUIRED = "MARK_RECONCILIATION_REQUIRED"
    FAIL_CONFLICT = "FAIL_CONFLICT"
@dataclass(frozen=True, slots=True)
 class RemoteObservation:
    repository_identity: str
    branch: str
    desired_oid: str
    authority_oid: Optional[str]
    remote_git_oid: Optional[str]
    remote_api_oid: Optional[str]
    commit_visible: bool
    observed_at: str
    expected_oid: Optional[str] = None
    @property
    def all_equal(self) -> bool:
        values = (self.authority_oid, self.remote_git_oid, self.remote_api_oid, self.desired_oid)
        return all(isinstance(value, str) for value in values) and len(set(values)) == 1
@dataclass(frozen=True, slots=True)
 class ReconciliationDecision:
    action: ReconciliationAction
    state: str
    reason: str
    retry_safe: bool = False
 def _valid_oid(value: Optional[str]) -> bool:
    return value is None or bool(OID_RE.fullmatch(value))
 def decide_reconciliation(observation: RemoteObservation) -> ReconciliationDecision:
    """Decide from a fresh observation; never complete on a missing remote."""
    if observation.repository_identity != "aios/aios":
        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "REPOSITORY_IDENTITY_MISMATCH")
    if not observation.branch.startswith("agent/"):
        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "BRANCH_SCOPE_DENIED")
    if not _valid_oid(observation.desired_oid) or not _valid_oid(observation.expected_oid):
        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "OID_INVALID")
    if observation.authority_oid is None:
        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "AUTHORITY_UNAVAILABLE")
    if observation.authority_oid != observation.desired_oid:
        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "AUTHORITY_CONFLICT")
    present = [oid for oid in (observation.remote_git_oid, observation.remote_api_oid) if oid is not None]
    if any(oid not in {observation.desired_oid, observation.expected_oid} for oid in present):
        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "REMOTE_OID_CONFLICT")
    if observation.all_equal and observation.commit_visible:
        return ReconciliationDecision(ReconciliationAction.MARK_REMOTE_VERIFIED, "REMOTE_VERIFIED", "ALL_OIDS_EQUAL_AND_VISIBLE")
    if observation.remote_git_oid is None and observation.remote_api_oid is None:
        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "REMOTE_PUSH_PENDING", "AUTHORITY_DESIRED_REMOTE_MISSING")
    if observation.remote_git_oid == observation.desired_oid or observation.remote_api_oid == observation.desired_oid:
        return ReconciliationDecision(ReconciliationAction.VERIFY_REMOTE, "REMOTE_VERIFY_PENDING", "REMOTE_PROOF_PARTIAL")
    if observation.expected_oid is not None and observation.remote_git_oid == observation.expected_oid and observation.remote_api_oid == observation.expected_oid:
        return ReconciliationDecision(ReconciliationAction.PUSH_EXACT, "REMOTE_PUSH_PENDING", "SAFE_EXACT_FAST_FORWARD_RETRY", retry_safe=True)
    if not observation.commit_visible:
        return ReconciliationDecision(ReconciliationAction.VERIFY_REMOTE, "COMMIT_VISIBILITY_PENDING", "COMMIT_VISIBILITY_LAG")
    return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "PARTIAL_REMOTE_OBSERVATION")
 def reconcile_observation(**kwargs: object) -> ReconciliationDecision:
    return decide_reconciliation(RemoteObservation(**kwargs))
@@ -1,100 +0,0 @@
 """Single supervised socket-activated worker for durable GitOps Jobs.
 The worker consumes durable requests and reconciliation queries. Repository
 mutation is a separate injected executor and remains impossible while the
 legacy global write gate is false.
 """
 from __future__ import annotations
 import argparse
 import json
 import os
 from pathlib import Path
 import signal
 import socket
 import threading
 from typing import Any, Mapping
 from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore, ServiceUnavailable
 def runtime_policy(environment: Mapping[str, str] | None = None) -> dict[str, bool]:
    env = environment or os.environ
    legacy = env.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() in {"1", "true", "yes", "on"}
    durable = env.get("AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED", "false").lower() in {"1", "true", "yes", "on"}
    # Legacy direct Git mutation remains disabled. Authorized durable Jobs use
    # their own campaign/task capability and may mutate only through the
    # worker's lease/CAS path while the legacy gate stays false.
    return {"legacy_global_write": legacy, "durable_job_execution": durable, "repository_mutation_allowed": durable}
 def handle_request(controller: GitOpsJobController, request: Mapping[str, Any], executor: Any | None = None) -> dict[str, Any]:
    job_id = str(request.get("job_id") or "")
    if not job_id:
        raise JobError("JOB_ID_REQUIRED")
    if request.get("action") == "execute":
        if executor is None:
            raise JobError("JOB_EXECUTOR_UNAVAILABLE")
        result = executor.execute(job_id, dry_run=bool(request.get("dry_run", False)))
        receipt = controller.store._receipt(controller.store.read(job_id), duplicate=True)
        return {"job": result, **receipt.as_dict()}
    if request.get("action") == "resume":
        receipt = controller.resume(job_id)
    else:
        row = controller.store.read(job_id)
        receipt = controller.store._receipt(row, duplicate=True)
    return receipt.as_dict()
 def serve_socket(sock: socket.socket, controller: GitOpsJobController, stopping: threading.Event, executor: Any | None = None) -> None:
    sock.listen(32)
    sock.settimeout(1.0)
    while not stopping.is_set():
        try:
            connection, _ = sock.accept()
        except socket.timeout:
            continue
        with connection:
            try:
                raw = connection.makefile("rb").readline(1_048_576)
                request = json.loads(raw.decode("utf-8"))
                response = {"status": "ok", **handle_request(controller, request, executor)}
            except ServiceUnavailable as exc:
                response = {"status": "error", "error": str(exc), "retryable": True, "side_effect_state": "UNKNOWN"}
            except Exception as exc:
                response = {"status": "error", "error": type(exc).__name__, "retryable": False}
            connection.sendall((json.dumps(response, sort_keys=True) + "\n").encode("utf-8"))
 def socket_from_systemd() -> socket.socket:
    if os.environ.get("LISTEN_FDS") != "1":
        raise RuntimeError("SOCKET_ACTIVATION_REQUIRED")
    return socket.fromfd(3, socket.AF_UNIX, socket.SOCK_STREAM)
 def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--job-root", required=True, type=Path)
    args = parser.parse_args(argv)
    policy = runtime_policy()
    if policy["legacy_global_write"]:
        raise RuntimeError("LEGACY_GLOBAL_WRITES_MUST_REMAIN_FALSE")
    if not policy["durable_job_execution"]:
        raise RuntimeError("DURABLE_JOB_EXECUTION_GATE_CLOSED")
    controller = GitOpsJobController(JobStore(args.job_root))
    from aios_gitops_job_executor import build_from_environment
    executor = build_from_environment(args.job_root)
    stopping = threading.Event()
    signal.signal(signal.SIGTERM, lambda *_: stopping.set())
    signal.signal(signal.SIGINT, lambda *_: stopping.set())
    sock = socket_from_systemd()
    try:
        serve_socket(sock, controller, stopping, executor)
    finally:
        sock.close()
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,69 +0,0 @@
 """CLI client for the governed local writer service."""
 from __future__ import annotations
 import argparse
 import json
 import os
 import socket
 import sys
 def _parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description="Send one governed-local-writer request")
    parser.add_argument("--socket", required=True, help="AF_UNIX socket path")
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument("--request", help="Request JSON string")
    group.add_argument("--request-file", help="Path to JSON request file")
    return parser.parse_args()
 def _load_request_text(args: argparse.Namespace) -> str:
    if args.request is not None:
        return args.request
    request_path = os.fspath(args.request_file)
    with open(request_path, "r", encoding="utf-8") as request_file:
        return request_file.read()
 def send_request(socket_path: str, request_text: str) -> dict[str, object]:
    """Open one Unix socket, send one NDJSON request, and parse one NDJSON response."""
    payload = json.loads(request_text)
    if not isinstance(payload, dict):
        raise ValueError("request must be a JSON object")
    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
        client.connect(socket_path)
        client.sendall((json.dumps(payload) + "\n").encode("utf-8"))
        response_chunks: list[str] = []
        while True:
            chunk = client.recv(1024 * 1024).decode("utf-8")
            if not chunk:
                break
            response_chunks.append(chunk)
            if "\n" in chunk:
                break
        response_text = "".join(response_chunks)
    response_line = response_text.split("\n", 1)[0].strip()
    if not response_line:
        raise RuntimeError("empty response")
    response = json.loads(response_line)
    if not isinstance(response, dict):
        raise RuntimeError("invalid response")
    return response
 def main() -> None:
    args = _parse_args()
    request_text = _load_request_text(args)
    response = send_request(args.socket, request_text)
    print(json.dumps(response, separators=(",", ":"), sort_keys=True))
 if __name__ == "__main__":
    try:
        main()
    except Exception as exc:  # pragma: no cover - CLI entrypoint behavior
        print(json.dumps({"status": "error", "error": str(exc)}), file=sys.stderr)
        raise SystemExit(1)
@@ -1,931 +0,0 @@
 """Unix-socket service for governed local writer operations."""
 from __future__ import annotations
 import json
 import hashlib
 import argparse
 import importlib.util
 import os
 import re
 import socket
 import subprocess
 import sys
 import tempfile
 import uuid
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Callable, Mapping, Protocol
 from governed_local_writer import (
    AppendCommitRequest,
    AuthorizationError,
    BranchPolicy,
    CreateBranchRequest,
    GovernedAuthorization,
    PeerIdentity,
    PRINCIPAL,
    TASK_ID,
    extract_peer_identity,
    contains_secret_like_content,
    load_authorization_file,
    validate_file_changes,
 )
 class ExistingGitOpsHandler:
    """Delegate repository mutations to the installed GitOps handler seam."""
    def __init__(
        self,
        *,
        workspace_by_branch: Mapping[str, str | os.PathLike[str]],
        bare_repo: str | os.PathLike[str],
        api_source: str | os.PathLike[str],
    ) -> None:
        self.workspace_by_branch = {str(k): Path(v) for k, v in workspace_by_branch.items()}
        self.bare_repo = Path(bare_repo)
        self.api_source = Path(api_source)
    @staticmethod
    def _restore_env(previous: Mapping[str, str | None]) -> None:
        for key, value in previous.items():
            if value is None:
                os.environ.pop(key, None)
            else:
                os.environ[key] = value
    def _load_api(self, workspace: Path):
        if not self.api_source.is_file() or self.api_source.is_symlink():
            raise RuntimeError("installed GitOps handler source is unavailable")
        keys = (
            "AIOS_GITOPS_WORKSPACE",
            "AIOS_GITOPS_BARE_REPO",
            "AIOS_GITOPS_WRITES_ENABLED",
            "PYTHONDONTWRITEBYTECODE",
            "GIT_CONFIG_COUNT",
            "GIT_CONFIG_KEY_0",
            "GIT_CONFIG_VALUE_0",
            "GIT_CONFIG_KEY_1",
            "GIT_CONFIG_VALUE_1",
        )
        previous = {key: os.environ.get(key) for key in keys}
        os.environ.update(
            {
                "AIOS_GITOPS_WORKSPACE": str(workspace),
                "AIOS_GITOPS_BARE_REPO": str(self.bare_repo),
                "AIOS_GITOPS_WRITES_ENABLED": "true",
                "PYTHONDONTWRITEBYTECODE": "1",
                "GIT_CONFIG_COUNT": "2",
                "GIT_CONFIG_KEY_0": "safe.directory",
                "GIT_CONFIG_VALUE_0": str(workspace),
                "GIT_CONFIG_KEY_1": "safe.directory",
                "GIT_CONFIG_VALUE_1": str(self.bare_repo),
            }
        )
        module_name = f"_governed_gitops_api_{uuid.uuid4().hex}"
        try:
            spec = importlib.util.spec_from_file_location(module_name, self.api_source)
            if spec is None or spec.loader is None:
                raise RuntimeError("unable to load installed GitOps handler")
            module = importlib.util.module_from_spec(spec)
            sys.modules[module_name] = module
            spec.loader.exec_module(module)
            decision = module.evaluate_git_write(module.WS)
            if not decision.allowed:
                raise RuntimeError("existing GitOps write gate denied bootstrap")
            return module, previous, module_name
        except Exception:
            sys.modules.pop(module_name, None)
            self._restore_env(previous)
            raise
    def _workspace(self, branch: str) -> Path:
        workspace = self.workspace_by_branch.get(branch)
        if workspace is None or not workspace.is_dir():
            raise RuntimeError("branch workspace is not authorized")
        return workspace
    @staticmethod
    def _git(workspace: Path, args: list[str]) -> str:
        result = subprocess.run(
            ["git", *args], cwd=workspace, text=True, capture_output=True, check=False
        )
        if result.returncode != 0:
            raise RuntimeError("governed handler git probe failed")
        return result.stdout.strip()
    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
        workspace = self._workspace(request.branch)
        # A prior handler call may have completed the fast-forward sync before
        # the process observed a post-commit error. Reconcile only an exact,
        # metadata-only result; never overwrite or move an existing ref here.
        try:
            existing = self._git(
                workspace,
                [
                    "--git-dir",
                    str(self.bare_repo),
                    "rev-parse",
                    f"refs/heads/{request.branch}",
                ],
            )
        except RuntimeError:
            existing = ""
        if existing:
            parent = self._git(workspace, ["--git-dir", str(self.bare_repo), "rev-parse", f"{existing}^1"])
            changed = self._git(
                workspace,
                [
                    "--git-dir",
                    str(self.bare_repo),
                    "diff-tree",
                    "--no-commit-id",
                    "--name-only",
                    "-r",
                    existing,
                ],
            ).splitlines()
            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
            if parent != request.base_oid or changed != [f"patches/{safe_branch}.branch.json"]:
                raise RuntimeError("existing branch is not an exact metadata-only bootstrap")
            return {"head_oid": existing, "parent_oid": parent, "handler_status": "reconciled"}
        module, previous, module_name = self._load_api(workspace)
        phase = "loaded"
        try:
            phase = "verify_base"
            parent = self._git(
                workspace,
                ["--git-dir", str(self.bare_repo), "rev-parse", "refs/heads/main"],
            )
            if parent != request.base_oid:
                raise RuntimeError("authorized base OID drift")
            phase = "checkout"
            module.checkout(request.branch, base=request.base_oid, create=True)
            phase = "write_metadata"
            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
            metadata_path = f"patches/{safe_branch}.branch.json"
            module.write_json(
                metadata_path,
                {
                    "schema": "aios.governed-local-writer-bootstrap.v1",
                    "task_id": TASK_ID,
                    "principal": PRINCIPAL,
                    "branch": request.branch,
                    "parent_oid": request.base_oid,
                    "authorization_sha256": request.authorization_digest,
                },
            )
            phase = "commit_and_sync"
            result = module.commit(
                [metadata_path], "chore(governance): bootstrap repair lease branch"
            )
            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
            if first_parent != request.base_oid or (request.head_oid and head_oid != request.head_oid):
                raise RuntimeError("bootstrap branch lineage check failed")
            return {
                "head_oid": head_oid,
                "parent_oid": first_parent,
                "handler_status": str(result.get("status")),
            }
        except Exception as exc:
            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
        finally:
            sys.modules.pop(module_name, None)
            self._restore_env(previous)
    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
        workspace = self._workspace(request.branch)
        module, previous, module_name = self._load_api(workspace)
        phase = "loaded"
        try:
            phase = "verify_head"
            current = self._git(workspace, ["rev-parse", "HEAD"])
            if current != request.expected_head_oid:
                raise RuntimeError("branch head advanced or is stale")
            phase = "checkout"
            module.checkout(request.branch, base=request.expected_head_oid, create=False)
            phase = "write_files"
            paths: list[str] = []
            for change in request.changes:
                paths.append(module.write_file(change.path, change.content))
            phase = "commit_and_sync"
            result = module.commit(paths, request.commit_message)
            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
            if first_parent != request.expected_head_oid or head_oid == first_parent:
                raise RuntimeError("append commit lineage check failed")
            return {
                "head_oid": head_oid,
                "parent_oid": first_parent,
                "handler_status": str(result.get("status")),
            }
        except Exception as exc:
            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
        finally:
            sys.modules.pop(module_name, None)
            self._restore_env(previous)
 class GovernedWriterHandler(Protocol):
    """Small adapter interface for real writer backend handlers."""
    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
        """Create a branch using internal repo services."""
    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
        """Append a commit using internal repo services."""
 class AuditSink(Protocol):
    """Pluggable sink for sanitized audit records."""
    def append(self, record: "AuditRecord") -> None:
        """Persist one audit record."""
@dataclass
 class AuditRecord:
    """Sanitized audit log entry."""
    authorization_digest: str
    peer_pid: int
    peer_uid: int
    peer_gid: int
    peer_executable: str | None
    timestamp: datetime
    operation: str
    branch: str
    result: str
 class InMemoryAuditSink:
    """Simple in-memory audit log used by tests."""
    def __init__(self) -> None:
        self.records: list[AuditRecord] = []
    def append(self, record: AuditRecord) -> None:
        self.records.append(record)
@dataclass
 class _AuthorizationState:
    """Tracks one-shot operation consumption."""
    create_done: set[str] = field(default_factory=set)
    append_done: set[str] = field(default_factory=set)
    consumed: bool = False
 class GovernedLocalWriterService:
    """Policy-aware AF_UNIX service that calls an injected handler."""
    def __init__(
        self,
        socket_path: str | os.PathLike[str],
        authorization: GovernedAuthorization,
        handler: GovernedWriterHandler,
        *,
        audit_sink: AuditSink | None = None,
        peer_identity_fn: Callable[[socket.socket], PeerIdentity] | None = None,
        state_path: str | os.PathLike[str] | None = None,
    ) -> None:
        self.socket_path = Path(socket_path)
        self.authorization = authorization
        self.handler = handler
        self.peer_identity_fn = peer_identity_fn or extract_peer_identity
        self.state = _AuthorizationState()
        self.audit_sink = audit_sink or InMemoryAuditSink()
        self.state_path = Path(state_path) if state_path is not None else None
        self._load_state()
    def _load_state(self) -> None:
        """Restore one-shot state without restoring request or secret material."""
        if self.state_path is None or not self.state_path.exists():
            return
        try:
            raw = json.loads(self.state_path.read_text(encoding="utf-8"))
            if not isinstance(raw, dict):
                raise ValueError("state must be an object")
            if raw.get("authorization_sha256") != self.authorization.authorization_sha256:
                raise ValueError("state authorization digest mismatch")
            self.state.create_done = {str(v) for v in raw.get("create_done", [])}
            self.state.append_done = {str(v) for v in raw.get("append_done", [])}
            self.state.consumed = bool(raw.get("consumed", False))
        except (OSError, ValueError, TypeError, json.JSONDecodeError) as exc:
            raise AuthorizationError("authorization state is invalid") from exc
    def _persist_state(self) -> None:
        if self.state_path is None:
            return
        self.state_path.parent.mkdir(parents=True, exist_ok=True)
        payload = {
            "authorization_sha256": self.authorization.authorization_sha256,
            "create_done": sorted(self.state.create_done),
            "append_done": sorted(self.state.append_done),
            "consumed": self.state.consumed,
        }
        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
        try:
            os.fchmod(fd, 0o600)
            with os.fdopen(fd, "w", encoding="utf-8") as stream:
                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
                stream.write("\n")
            os.replace(temp_name, self.state_path)
            os.chmod(self.state_path, 0o600)
        finally:
            if os.path.exists(temp_name):
                os.unlink(temp_name)
    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> None:
        self.audit_sink.append(
            AuditRecord(
                authorization_digest=self.authorization.authorization_sha256,
                peer_pid=peer.pid,
                peer_uid=peer.uid,
                peer_gid=peer.gid,
                peer_executable=peer.executable,
                timestamp=datetime.now(tz=timezone.utc),
                operation=operation,
                branch=branch,
                result=result,
            )
        )
    def _require_request_field(self, request: Mapping[str, Any], field_name: str) -> str:
        value = request.get(field_name)
        if not isinstance(value, str) or not value:
            raise AuthorizationError(f"{field_name} must be a non-empty string")
        return value
    def _branch_policy(self, branch: str) -> BranchPolicy:
        policy = self.authorization.branch_operations.get(branch)
        if policy is None:
            raise AuthorizationError("branch is not authorized")
        return policy
    def _ensure_not_consumed(self) -> None:
        if self.state.consumed:
            raise AuthorizationError("authorization consumed")
        if datetime.now(tz=timezone.utc) >= self.authorization.expires_at:
            raise AuthorizationError("authorization expired")
    def _mark_success(self, op: str, branch: str) -> None:
        if op == "create_branch":
            self.state.create_done.add(branch)
        elif op == "append_commit":
            self.state.append_done.add(branch)
        if self.state.create_done.issuperset(self.authorization.create_branches) and self.state.append_done.issuperset(
            self.authorization.append_branches
        ):
            self.state.consumed = True
        self._persist_state()
    def _validate_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
        task_id = self._require_request_field(request, "task_id")
        if task_id != TASK_ID:
            raise AuthorizationError("invalid task_id")
        principal = self._require_request_field(request, "principal")
        if principal != PRINCIPAL:
            raise AuthorizationError("invalid principal")
        operation = self._require_request_field(request, "op")
        if operation not in {"create_branch", "append_commit"}:
            raise AuthorizationError("unsupported operation")
        if operation in self.authorization.denied_operations:
            raise AuthorizationError("operation denied by policy")
        branch = self._require_request_field(request, "branch")
        self._ensure_not_consumed()
        policy = self._branch_policy(branch)
        if operation == "create_branch":
            if policy.create_branch is None:
                raise AuthorizationError("branch does not allow create_branch")
            if branch in self.state.create_done:
                raise AuthorizationError("create_branch already used for this branch")
            base_oid = self._require_request_field(request, "base_oid")
            raw_head_oid = request.get("head_oid")
            if raw_head_oid is not None and (not isinstance(raw_head_oid, str) or not raw_head_oid):
                raise AuthorizationError("head_oid must be a non-empty string when supplied")
            head_oid = str(raw_head_oid) if raw_head_oid is not None else None
            if base_oid != policy.create_branch.base_oid:
                raise AuthorizationError("base_oid mismatch")
            if policy.create_branch.head_oid is not None and head_oid != policy.create_branch.head_oid:
                raise AuthorizationError("head_oid mismatch")
            return {
                "operation": operation,
                "branch": branch,
                "base_oid": base_oid,
                "head_oid": head_oid,
            }
        if policy.append_commit is None:
            raise AuthorizationError("branch does not allow append_commit")
        if policy.create_branch is not None and branch not in self.state.create_done:
            raise AuthorizationError("append_commit requires prior successful create_branch")
        if branch in self.state.append_done:
            raise AuthorizationError("append_commit already used for this branch")
        expected_head = policy.append_commit.expected_head_oid
        if "expected_head_oid" in request:
            supplied_head = self._require_request_field(request, "expected_head_oid")
        elif "current_head_oid" in request:
            supplied_head = self._require_request_field(request, "current_head_oid")
        else:
            raise AuthorizationError("expected_head_oid or current_head_oid required")
        if not re.fullmatch(r"[0-9a-fA-F]{40}", supplied_head):
            raise AuthorizationError("head check must be a full commit OID")
        if expected_head is not None and supplied_head != expected_head:
            raise AuthorizationError("head check failed")
        if request.get("force") is True or request.get("non_fast_forward") is True:
            raise AuthorizationError("non-fast-forward operations are not allowed")
        if request.get("history_rewrite") is True:
            raise AuthorizationError("history rewrite is not allowed")
        parent_oids = request.get("parent_oids")
        if parent_oids is not None:
            if not isinstance(parent_oids, list) or parent_oids != [supplied_head]:
                raise AuthorizationError("parent_oids must contain exactly expected_head_oid")
        changes = request.get("changes")
        if not isinstance(changes, list):
            raise AuthorizationError("changes must be a list")
        validated_changes = validate_file_changes(changes, policy.append_commit.allowed_paths)
        commit_message = request.get("commit_message", "chore(governance): append governed commit")
        if not isinstance(commit_message, str) or not commit_message.strip() or len(commit_message) > 200:
            raise AuthorizationError("commit_message must be a short non-empty string")
        if "\n" in commit_message or "\r" in commit_message or contains_secret_like_content(commit_message):
            raise AuthorizationError("commit_message failed policy")
        return {
            "operation": operation,
            "branch": branch,
            "expected_head_oid": supplied_head,
            "changes": validated_changes,
            "commit_message": commit_message.strip(),
        }
    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
        """Run one request through policy checks and handler adapter."""
        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
        try:
            details = self._validate_request(raw_request)
            operation = str(details["operation"])
            branch = str(details["branch"])
            if operation == "create_branch":
                self.handler.create_branch(
                    CreateBranchRequest(
                        branch=branch,
                        base_oid=str(details["base_oid"]),
                        head_oid=(
                            str(details["head_oid"])
                            if details.get("head_oid") is not None
                            else None
                        ),
                        authorization_digest=self.authorization.authorization_sha256,
                    )
                )
                self._mark_success("create_branch", branch)
                self._new_audit(peer, operation, branch, "ok")
                return {
                    "status": "ok",
                    "operation": operation,
                    "branch": branch,
                    "result": "applied",
                }
            self.handler.append_commit(
                AppendCommitRequest(
                    branch=branch,
                    expected_head_oid=str(details["expected_head_oid"]),
                    changes=tuple(details["changes"]),
                    authorization_digest=self.authorization.authorization_sha256,
                    commit_message=str(details["commit_message"]),
                )
            )
            self._mark_success("append_commit", branch)
            self._new_audit(peer, operation, branch, "ok")
            return {
                "status": "ok",
                "operation": operation,
                "branch": branch,
                "result": "applied",
            }
        except Exception as error:
            self._new_audit(peer, operation or "unknown", branch, f"error:{error.__class__.__name__}")
            if isinstance(error, PermissionError):
                code = "permission_denied"
            elif isinstance(error, AuthorizationError):
                code = "request_denied"
            else:
                code = "handler_failed"
            if code == "handler_failed" and str(error).startswith("handler_phase="):
                code = str(error)
            return {
                "status": "error",
                "operation": operation or "unknown",
                "branch": branch,
                "error": code,
            }
    def _write_json(self, connection: socket.socket, payload: Mapping[str, Any]) -> None:
        connection.sendall((json.dumps(payload) + "\n").encode("utf-8"))
    def _handle_client(self, connection: socket.socket) -> None:
        with connection:
            try:
                peer = self.peer_identity_fn(connection)
            except Exception:
                self._write_json(
                    connection,
                    {
                        "status": "error",
                        "operation": "connection",
                        "branch": "",
                        "error": "peer identity validation failed",
                    },
                )
                return
            with connection.makefile("r", encoding="utf-8") as stream:
                for raw_line in stream:
                    line = raw_line.strip()
                    if not line:
                        continue
                    try:
                        request = json.loads(line)
                    except json.JSONDecodeError:
                        self._write_json(
                            connection,
                            {
                                "status": "error",
                                "operation": "request",
                                "branch": "",
                                "error": "invalid json",
                            },
                        )
                        continue
                    if not isinstance(request, Mapping):
                        self._write_json(
                            connection,
                            {
                                "status": "error",
                                "operation": "request",
                                "branch": "",
                                "error": "request must be a JSON object",
                            },
                        )
                        continue
                    self._write_json(connection, self.process_request(request, peer))
    def _bind_socket(self) -> socket.socket:
        if self.socket_path.exists():
            raise RuntimeError("governed writer socket already exists")
        parent = self.socket_path.parent
        if not parent.is_dir():
            raise RuntimeError("governed writer socket parent is missing")
        if parent.is_symlink():
            raise RuntimeError("governed writer socket parent must not be a symlink")
        server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
        server.bind(str(self.socket_path))
        os.chmod(self.socket_path, 0o600)
        server.listen(16)
        return server
    def serve(self) -> None:
        """Serve newline-delimited JSON over a filesystem AF_UNIX socket."""
        server = self._bind_socket()
        try:
            while True:
                connection, _ = server.accept()
                self._handle_client(connection)
        finally:
            server.close()
            if self.socket_path.exists():
                self.socket_path.unlink()
 class JsonAuditSink:
    """Append-only root-owned audit sink containing no request payloads."""
    def __init__(self, path: str | os.PathLike[str]) -> None:
        self.path = Path(path)
        self.path.parent.mkdir(parents=True, exist_ok=True)
    def append(self, record: AuditRecord) -> None:
        payload = {
            "authorization_sha256": record.authorization_digest,
            "peer_pid": record.peer_pid,
            "peer_uid": record.peer_uid,
            "peer_gid": record.peer_gid,
            "peer_executable": record.peer_executable,
            "timestamp": record.timestamp.isoformat(),
            "operation": record.operation,
            "branch": record.branch,
            "result": record.result,
        }
        line = (json.dumps(payload, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
        fd = os.open(self.path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
        try:
            os.fchmod(fd, 0o600)
            os.write(fd, line)
        finally:
            os.close(fd)
 # V2R1C6 durable receipt overlay.  This subclasses the original root-only
 # writer in-place so the existing AF_UNIX/SO_PEERCRED and handler policy remain
 # the only mutation path.
 _LegacyGovernedLocalWriterService = GovernedLocalWriterService
 class GovernedLocalWriterService(_LegacyGovernedLocalWriterService):
    """Existing writer with durable request receipts and safe recovery."""
    def _load_state(self) -> None:
        super()._load_state()
        self.state.receipts = {}
        if self.state_path is None or not self.state_path.exists():
            return
        raw = json.loads(self.state_path.read_text(encoding="utf-8"))
        if not isinstance(raw, dict):
            raise AuthorizationError("authorization state is invalid")
        receipts = raw.get("receipts", {})
        if not isinstance(receipts, dict):
            raise AuthorizationError("authorization receipts are invalid")
        self.state.receipts = {
            str(key): dict(value)
            for key, value in receipts.items()
            if isinstance(value, dict)
        }
    def _persist_state(self) -> None:
        if self.state_path is None:
            return
        self.state_path.parent.mkdir(parents=True, exist_ok=True)
        payload = {
            "authorization_sha256": self.authorization.authorization_sha256,
            "create_done": sorted(self.state.create_done),
            "append_done": sorted(self.state.append_done),
            "consumed": bool(self.state.consumed),
            "receipts": self.state.receipts,
        }
        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
        try:
            os.fchmod(fd, 0o600)
            with os.fdopen(fd, "w", encoding="utf-8") as stream:
                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
                stream.write("\n")
            os.replace(temp_name, self.state_path)
            os.chmod(self.state_path, 0o600)
        finally:
            if os.path.exists(temp_name):
                os.unlink(temp_name)
    def _request_identity(self, request: Mapping[str, Any]) -> dict[str, str]:
        canonical = json.dumps(dict(request), sort_keys=True, separators=(",", ":"), ensure_ascii=True)
        fallback = hashlib.sha256(canonical.encode("utf-8")).hexdigest()
        request_id = request.get("request_id")
        idempotency_key = request.get("idempotency_key")
        request_id = request_id.strip() if isinstance(request_id, str) and request_id.strip() else "legacy-" + fallback
        idempotency_key = idempotency_key.strip() if isinstance(idempotency_key, str) and idempotency_key.strip() else "legacy-" + fallback
        for field_name, value in (("request_id", request_id), ("idempotency_key", idempotency_key)):
            if len(value) > 200 or "\n" in value or "\r" in value:
                raise AuthorizationError(field_name + " is invalid")
        return {
            "request_id": request_id,
            "idempotency_key": idempotency_key,
            "request_fingerprint": fallback,
        }
    def _find_receipt(self, details: Mapping[str, Any], compare_fingerprint: bool = True):
        request_id = str(details["request_id"])
        idempotency_key = str(details["idempotency_key"])
        fingerprint = str(details.get("request_fingerprint", ""))
        for receipt in self.state.receipts.values():
            if receipt.get("request_id") == request_id or receipt.get("idempotency_key") == idempotency_key:
                if compare_fingerprint and receipt.get("request_fingerprint") != fingerprint:
                    raise AuthorizationError("idempotency key reused with different request")
                return receipt
        return None
    @staticmethod
    def _receipt_response(receipt: Mapping[str, object], status: str = "receipt") -> dict[str, object]:
        response = {
            "status": status,
            "request_id": receipt.get("request_id"),
            "idempotency_key": receipt.get("idempotency_key"),
            "operation": receipt.get("operation"),
            "branch": receipt.get("branch", ""),
            "receipt_status": receipt.get("status"),
        }
        for field_name in ("commit_oid", "final_head", "parent_oid", "audit_sha256", "error_code", "safe_to_retry"):
            if field_name in receipt:
                response[field_name] = receipt[field_name]
        return response
    def _new_receipt(self, details: Mapping[str, Any]) -> dict[str, object]:
        return {
            "request_id": str(details["request_id"]),
            "idempotency_key": str(details["idempotency_key"]),
            "request_fingerprint": str(details["request_fingerprint"]),
            "operation": str(details["operation"]),
            "branch": str(details.get("branch", "")),
            "expected_head_oid": str(details.get("expected_head_oid", "")),
            "status": "accepted",
            "created_at": datetime.now(tz=timezone.utc).isoformat(),
            "safe_to_retry": False,
        }
    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> str:
        super()._new_audit(peer, operation, branch, result)
        payload = {
            "authorization_sha256": self.authorization.authorization_sha256,
            "peer_pid": peer.pid,
            "peer_uid": peer.uid,
            "peer_gid": peer.gid,
            "peer_executable": peer.executable,
            "operation": operation,
            "branch": branch,
            "result": result,
        }
        return hashlib.sha256(json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
    def _mark_success(self, op: str, branch: str) -> None:
        if op == "create_branch":
            self.state.create_done.add(branch)
        elif op in {"append_commit", "append_files", "append_batch"}:
            self.state.append_done.add(branch)
        # The provisioning grant is one-shot; the task writer lease itself must
        # support multiple append receipts for the exact authorized branches.
        self.state.consumed = False
        self._persist_state()
    def _validate_durable(self, raw_request: Mapping[str, Any]) -> dict[str, Any]:
        operation = self._require_request_field(raw_request, "op")
        identity = self._request_identity(raw_request)
        if operation == "query_receipt":
            return {"operation": operation, **identity}
        if operation == "recover_request":
            branch = self._require_request_field(raw_request, "branch")
            policy = self._branch_policy(branch)
            if policy.append_commit is None:
                raise AuthorizationError("branch does not allow recovery")
            expected = raw_request.get("expected_head_oid") or policy.append_commit.expected_head_oid
            if not isinstance(expected, str) or not re.fullmatch(r"[0-9a-fA-F]{40}", expected):
                raise AuthorizationError("recovery requires expected_head_oid")
            return {"operation": operation, "branch": branch, "expected_head_oid": expected.lower(), **identity}
        if operation not in {"create_branch", "append_commit", "append_files", "append_batch"}:
            raise AuthorizationError("unsupported operation")
        request = dict(raw_request)
        if operation in {"append_files", "append_batch"}:
            request["op"] = "append_commit"
        if operation in {"append_commit", "append_files", "append_batch"}:
            self.state.consumed = False
        branch = request.get("branch")
        removed = False
        dynamic_expected = False
        if isinstance(branch, str) and branch in self.state.append_done:
            self.state.append_done.remove(branch)
            removed = True
            policy = self.authorization.branch_operations.get(branch)
            if policy is not None and policy.append_commit is not None and policy.append_commit.expected_head_oid is not None:
                from governed_local_writer import BranchAppendPolicy, BranchPolicy
                self.authorization.branch_operations[branch] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=branch, expected_head_oid=None, allowed_paths=policy.append_commit.allowed_paths))
                dynamic_expected = True
        try:
            details = super()._validate_request(request)
        finally:
            if dynamic_expected:
                policy = self.authorization.branch_operations.get(str(branch))
                if policy is not None and policy.append_commit is not None:
                    from governed_local_writer import BranchAppendPolicy, BranchPolicy
                    self.authorization.branch_operations[str(branch)] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=str(branch), expected_head_oid=str(raw_request.get("expected_head_oid") or ""), allowed_paths=policy.append_commit.allowed_paths))
            if removed:
                self.state.append_done.add(str(branch))
        details.update(identity)
        details["operation"] = operation
        return details
    def _recover_backend(self, details: Mapping[str, Any]) -> dict[str, object]:
        if not hasattr(self.handler, "_workspace") or not hasattr(self.handler, "_git"):
            raise RuntimeError("recovery backend unavailable")
        workspace = self.handler._workspace(str(details["branch"]))
        expected = str(details["expected_head_oid"])
        current = self.handler._git(workspace, ["rev-parse", "HEAD"])
        if current == expected:
            return {"status": "not_started", "final_head": current}
        parent = self.handler._git(workspace, ["rev-parse", "HEAD^1"])
        if parent != expected:
            raise RuntimeError("external branch advance during recovery")
        return {"status": "applied", "commit_oid": current, "final_head": current, "parent_oid": parent}
    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
        try:
            details = self._validate_durable(raw_request)
            operation = str(details["operation"])
            branch = str(details.get("branch", ""))
            if operation == "query_receipt":
                receipt = self._find_receipt(details, compare_fingerprint=False)
                return self._receipt_response(receipt) if receipt is not None else {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"]}
            if operation == "recover_request":
                receipt = self._find_receipt(details, compare_fingerprint=False)
                if receipt is None:
                    return {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"], "safe_to_retry": True}
                if receipt.get("status") == "applied":
                    return self._receipt_response(receipt)
                recovered = self._recover_backend(details)
                if recovered.get("status") == "applied":
                    receipt.update({"status": "applied", "commit_oid": recovered.get("commit_oid"), "final_head": recovered.get("final_head"), "parent_oid": recovered.get("parent_oid"), "safe_to_retry": False})
                    self._mark_success("append_commit", branch)
                    return self._receipt_response(receipt)
                receipt["safe_to_retry"] = True
                self._persist_state()
                return self._receipt_response(receipt)
            receipt = self._find_receipt(details)
            if receipt is not None:
                return self._receipt_response(receipt)
            receipt = self._new_receipt(details)
            self.state.receipts[str(details["request_id"])] = receipt
            self._persist_state()
            if operation == "create_branch":
                result = self.handler.create_branch(CreateBranchRequest(branch=branch, base_oid=str(details["base_oid"]), head_oid=str(details["head_oid"]) if details.get("head_oid") is not None else None, authorization_digest=self.authorization.authorization_sha256))
                commit_oid = str(result.get("head_oid", ""))
                parent_oid = str(result.get("parent_oid", ""))
                audit_sha = self._new_audit(peer, operation, branch, "ok")
                receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
                self._mark_success("create_branch", branch)
                return self._receipt_response(receipt, status="ok") | {"result": "applied"}
            result = self.handler.append_commit(AppendCommitRequest(branch=branch, expected_head_oid=str(details["expected_head_oid"]), changes=tuple(details["changes"]), authorization_digest=self.authorization.authorization_sha256, commit_message=str(details["commit_message"])))
            commit_oid = str(result.get("head_oid", ""))
            parent_oid = str(result.get("parent_oid", ""))
            audit_sha = self._new_audit(peer, operation, branch, "ok")
            receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
            self._mark_success("append_commit", branch)
            return self._receipt_response(receipt, status="ok") | {"result": "applied"}
        except Exception as error:
            try:
                identity = self._request_identity(raw_request)
                receipt = self.state.receipts.get(identity["request_id"])
                if receipt is not None and receipt.get("status") == "accepted":
                    receipt.update({"status": "failed", "error_code": error.__class__.__name__, "safe_to_retry": False})
                    self._persist_state()
            except Exception:
                pass
            self._new_audit(peer, operation, branch, "error:" + error.__class__.__name__)
            return {"status": "error", "operation": operation, "branch": branch, "error": "request_denied" if isinstance(error, AuthorizationError) else "handler_failed"}
 def _parse_args() -> argparse.Namespace:
    parser = argparse.ArgumentParser(description="AIOS governed local writer")
    parser.add_argument("--socket", required=True)
    parser.add_argument("--authorization", required=True)
    parser.add_argument("--state", required=True)
    parser.add_argument("--audit", required=True)
    parser.add_argument("--repair-branch", required=True)
    parser.add_argument("--repair-workspace", required=True)
    parser.add_argument("--candidate-branch", required=True)
    parser.add_argument("--candidate-workspace", required=True)
    parser.add_argument("--bare-repo", required=True)
    parser.add_argument("--api-source", required=True)
    return parser.parse_args()
 def main() -> int:
    if hasattr(os, "geteuid") and os.geteuid() != 0:
        print("governed local writer requires uid 0", file=sys.stderr)
        return 2
    args = _parse_args()
    authorization = load_authorization_file(args.authorization)
    handler = ExistingGitOpsHandler(
        workspace_by_branch={
            args.repair_branch: args.repair_workspace,
            args.candidate_branch: args.candidate_workspace,
        },
        bare_repo=args.bare_repo,
        api_source=args.api_source,
    )
    service = GovernedLocalWriterService(
        args.socket,
        authorization,
        handler,
        audit_sink=JsonAuditSink(args.audit),
        state_path=args.state,
    )
    service.serve()
    return 0
 if __name__ == "__main__":  # pragma: no cover - systemd entrypoint
    raise SystemExit(main())
@@ -1,59 +0,0 @@
 """Central fail-closed policy seam for governed task and continuation requests."""
 from __future__ import annotations
 from dataclasses import dataclass
 import re
 from typing import Any, Mapping
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
@dataclass(frozen=True, slots=True)
 class GovernedPolicyInput:
    identity: str
    task_id: str
    repository: str
    operation: str
    base_oid: str
    expected_branch_oid: str
    target_branch: str
    generation: int
    risk: str = "engineering"
    requested_capabilities: tuple[str, ...] = ()
    previous_generation: int | None = None
@dataclass(frozen=True, slots=True)
 class PolicyDecision:
    decision: str
    reason: str
    def as_dict(self) -> dict[str, str]:
        return {"decision": self.decision, "reason": self.reason}
 def evaluate_policy(value: GovernedPolicyInput | Mapping[str, Any]) -> PolicyDecision:
    if isinstance(value, Mapping):
        value = GovernedPolicyInput(**value)
    if value.repository != "aios/aios":
        return PolicyDecision("DENY", "REPOSITORY_IDENTITY_MISMATCH")
    if not OID_RE.fullmatch(value.base_oid) or not OID_RE.fullmatch(value.expected_branch_oid):
        return PolicyDecision("DENY", "OID_INVALID")
    if not value.target_branch.startswith("agent/") or value.target_branch in {"main", "master"}:
        return PolicyDecision("DENY", "BRANCH_SCOPE_DENIED")
    if "force_push" in value.requested_capabilities or "force" in value.operation.lower():
        return PolicyDecision("DENY", "FORCE_PUSH_DENIED")
    if {"main_write", "tag_write", "baseline_write", "production_write", "production_deploy", "tag_mutation", "baseline_mutation"}.intersection(value.requested_capabilities):
        return PolicyDecision("DENY", "MUTATION_SCOPE_DENIED")
    if not isinstance(value.generation, int) or isinstance(value.generation, bool) or value.generation < 1:
        return PolicyDecision("DENY", "GENERATION_INVALID")
    if value.previous_generation is not None and value.generation <= value.previous_generation:
        return PolicyDecision("MANUAL_OWNER_REVIEW_REQUIRED", "GENERATION_NOT_MONOTONIC")
    if not value.task_id:
        return PolicyDecision("DENY", "TASK_ID_INVALID")
    return PolicyDecision("ALLOW", "GOVERNED_ENGINEERING_SCOPE")
 class GovernedPolicy:
    def decide(self, request: GovernedPolicyInput | Mapping[str, Any]) -> PolicyDecision:
        return evaluate_policy(request)
@@ -1,84 +0,0 @@
 """Durable governed task binding for CREATE_NEW and CONTINUE_EXISTING."""
 from __future__ import annotations
 from dataclasses import dataclass, asdict
 import hashlib
 import json
 from pathlib import Path
 import re
 from typing import Any, Mapping
 from aios_gitops_job_controller import GitOpsJobController, JobStore
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
 class BootstrapError(RuntimeError):
    pass
@dataclass(frozen=True, slots=True)
 class GovernedTaskBinding:
    task_id: str
    repository: str
    base_oid: str
    target_branch: str
    risk: str
    description: str
    idempotency_key: str
    expected_branch_oid: str
    branch_mode: str
    generation: int
    job_id: str | None = None
    def response(self, *, idempotent: bool = False) -> dict[str, Any]:
        return {"task_id": self.task_id, "repository": self.repository, "base_oid": self.base_oid, "target_branch": self.target_branch, "expected_branch_oid": self.expected_branch_oid, "generation": self.generation, "branch_mode": self.branch_mode, "create_target_branch": self.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if self.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True, "idempotent": idempotent, "state": "BOUND", "job_id": self.job_id}
 def _safe(value: str) -> str:
    return re.sub(r"[^A-Za-z0-9_.-]+", "-", value).strip("-")[:120] or "task"
 class GovernedTaskBootstrap:
    def __init__(self, authority: Any, root: Path, *, remote_name: str, token_path: Path, ssh_key_path: Path, api_base: str = "https://g.cnnetmkt.top/git/api/v1") -> None:
        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True)
    def _store(self, task_id: str) -> tuple[JobStore, GitOpsJobController]:
        root = self.job_root / _safe(task_id); store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
    def _metadata(self, task_id: str) -> Path:
        return self.task_meta_root / (_safe(task_id) + ".json")
    def _read_existing(self, task_id: str) -> GovernedTaskBinding | None:
        path = self._metadata(task_id)
        if not path.is_file() or path.is_symlink(): return None
        return GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
    def _write(self, binding: GovernedTaskBinding) -> None:
        path = self._metadata(binding.task_id); temporary = path.with_suffix(".tmp"); temporary.write_text(json.dumps(asdict(binding), sort_keys=True), encoding="utf-8"); temporary.replace(path)
    def create(self, request: Mapping[str, Any]) -> dict[str, Any]:
        values = {key: str(request[key]) for key in ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")}
        if values["repository"] != "aios/aios" or not OID_RE.fullmatch(values["base_oid"]): raise BootstrapError("TASK_BINDING_INVALID")
        if not BRANCH_RE.fullmatch(values["target_branch"]): raise BootstrapError("TARGET_BRANCH_INVALID")
        existing = self._read_existing(values["task_id"])
        if existing is not None:
            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description")): raise BootstrapError("TASK_BINDING_CONFLICT")
            return existing.response(idempotent=True)
        if not self.authority.commit_exists(values["base_oid"]): raise BootstrapError("BASE_COMMIT_NOT_FOUND")
        current = self.authority.read_ref("refs/heads/" + values["target_branch"])
        expected = str(request.get("expected_branch_oid") or values["base_oid"])
        if current is None:
            mode, generation = "CREATE_NEW", 1
            if expected != values["base_oid"]: raise BootstrapError("EXPECTED_BASE_CONFLICT")
        else:
            if expected != current: raise BootstrapError("EXISTING_BRANCH_OID_CONFLICT")
            mode, generation = "CONTINUE_EXISTING", int(request.get("generation", 2))
            if generation < 1: raise BootstrapError("GENERATION_INVALID")
        payload = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
        _, controller = self._store(values["task_id"])
        receipt = controller.submit({"idempotency_key": values["idempotency_key"], "campaign_id": values["task_id"], "task_id": values["task_id"], "repository": values["repository"], "operation": "GOVERNED_TASK_CREATE", "branch": values["target_branch"], "expected_branch_oid": expected, "payload_digest": hashlib.sha256(payload).hexdigest(), "lineage_anchor_oid": values["base_oid"]}, payload=payload)
        binding = GovernedTaskBinding(**values, expected_branch_oid=expected, branch_mode=mode, generation=generation, job_id=receipt.job_id)
        self._write(binding)
        return binding.response()
@@ -1,306 +0,0 @@
 """Uncredentialed deterministic executor for governed Online Agent changes.
 This process never receives Agent/Owner/Bridge credentials and never writes Git refs.
 It operates only on an exchange bundle and returns hash-bound changed files + test evidence.
 """
 from __future__ import annotations
 import base64
 from dataclasses import dataclass
 import errno
 import hashlib
 import io
 import json
 import os
 from pathlib import Path
 import re
 import shutil
 import socket
 import subprocess
 import tarfile
 import tempfile
 import time
 from typing import Any, Mapping, Sequence
 ALLOWED_PROGRAMS = {"/usr/bin/python3", "/usr/bin/git", "/bin/true", "/usr/bin/true"}
 MAX_ARCHIVE_BYTES = 64 * 1024 * 1024
 MAX_FILE_BYTES = 4 * 1024 * 1024
 SECRET_ENV_TOKENS = ("TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "AUTHORIZATION", "PRIVATE_KEY")
 REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{15,254}$")
 SENSITIVE_VALUE_RE = re.compile(
    r"(?i)(authorization\s*[:=]\s*bearer\s+\S+|authorization\s+bearer\s+\S+|"
    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)"
 )
 class IsolatedExecutorError(RuntimeError):
    pass
 def sha256(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()
 def canonical(value: object) -> bytes:
    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
 def safe_relative(value: object) -> str:
    if not isinstance(value, str) or not value or value.startswith("/"):
        raise IsolatedExecutorError("PATH_INVALID")
    path = Path(value)
    if ".." in path.parts or "." in path.parts or any(part in {"", ".git"} for part in path.parts):
        raise IsolatedExecutorError("PATH_INVALID")
    return path.as_posix()
 def resolve_under(root: Path, relative: str) -> Path:
    root = root.resolve()
    path = (root / safe_relative(relative)).resolve(strict=False)
    if path == root or root not in path.parents:
        raise IsolatedExecutorError("PATH_ESCAPE")
    return path
 def _credential_exposure(directory: Path) -> str | None:
    """Return an exposure code; EACCES is the intended credential isolation proof."""
    try:
        if not directory.exists():
            return None
        if directory.is_symlink():
            return "CREDENTIAL_MOUNT_SYMLINK"
        if os.access(directory, os.R_OK):
            return "CREDENTIAL_MOUNT_ACCESSIBLE"
        if directory.is_dir():
            for child in directory.iterdir():
                if child.is_file() and os.access(child, os.R_OK):
                    return "CREDENTIAL_FILE_ACCESSIBLE"
    except PermissionError:
        return None
    return None
 def assert_uncredentialed() -> None:
    credentials = Path("/run/credentials")
    candidates = {credentials}
    credentials_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
    candidates.add(credentials_directory)
    leaked = sorted(
        key for key, value in os.environ.items()
        if value
        and (any(token in key.upper() for token in SECRET_ENV_TOKENS) or SENSITIVE_VALUE_RE.search(str(value)))
    )
    if leaked:
        raise IsolatedExecutorError("CREDENTIAL_ENV_EXPOSED:" + ",".join(leaked))
    for directory in candidates:
        exposure = _credential_exposure(directory)
        if exposure is not None:
            raise IsolatedExecutorError(exposure)
    # In the intended PrivateNetwork namespace host loopback services are unreachable.
    try:
        probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    except OSError as exc:
        if exc.errno in {errno.EACCES, errno.EPERM, errno.EAFNOSUPPORT}:
            return
        raise IsolatedExecutorError("NETWORK_ISOLATION_PROBE_FAILED") from exc
    probe.settimeout(0.15)
    try:
        if probe.connect_ex(("127.0.0.1", 18892)) == 0:
            raise IsolatedExecutorError("GOVERNED_BRIDGE_REACHABLE")
    finally:
        probe.close()
 def extract_source(archive: Path, root: Path) -> None:
    if archive.is_symlink() or not archive.is_file() or archive.stat().st_size > MAX_ARCHIVE_BYTES:
        raise IsolatedExecutorError("SOURCE_ARCHIVE_INVALID")
    with tarfile.open(archive, "r:gz") as tf:
        for member in tf.getmembers():
            path = Path(member.name)
            if path.is_absolute() or ".." in path.parts or ".git" in path.parts:
                raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
            if member.issym() or member.islnk():
                raise IsolatedExecutorError("SOURCE_ARCHIVE_LINK_DENY")
        tf.extractall(root, filter="data")
 def run_command(item: Mapping[str, Any], root: Path) -> dict[str, Any]:
    argv = item.get("argv")
    if not isinstance(argv, Sequence) or isinstance(argv, (str, bytes)) or not argv:
        raise IsolatedExecutorError("COMMAND_INVALID")
    argv = [str(part) for part in argv]
    if argv[0] not in ALLOWED_PROGRAMS:
        raise IsolatedExecutorError("COMMAND_PROGRAM_DENY")
    if argv[0] == "/usr/bin/python3" and "-m" in argv:
        index = argv.index("-m")
        if index + 1 >= len(argv) or argv[index + 1] not in {"pytest", "py_compile"}:
            raise IsolatedExecutorError("PYTHON_MODULE_DENY")
    if argv[0] == "/usr/bin/git" and any(
        token in {"push", "update-ref", "commit", "merge", "rebase", "reset", "clean", "branch"}
        for token in argv[1:]
    ):
        raise IsolatedExecutorError("GIT_MUTATION_DENY")
    timeout = int(item.get("timeout_seconds") or 300)
    if not 1 <= timeout <= 1800:
        raise IsolatedExecutorError("COMMAND_TIMEOUT_INVALID")
    cwd = root if item.get("cwd", ".") == "." else resolve_under(root, str(item.get("cwd")))
    started = time.monotonic()
    completed = subprocess.run(
        argv,
        cwd=cwd,
        capture_output=True,
        text=True,
        check=False,
        timeout=timeout,
        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
    )
    result = {
        "label": str(item.get("label") or "command"),
        "exit_code": completed.returncode,
        "stdout_sha256": sha256(completed.stdout.encode("utf-8", "replace")),
        "stderr_sha256": sha256(completed.stderr.encode("utf-8", "replace")),
        "duration_ms": int((time.monotonic() - started) * 1000),
    }
    if completed.returncode != 0:
        raise IsolatedExecutorError(
            "COMMAND_FAILED:" + result["label"] + ":" + str(completed.returncode)
        )
    return result
 def apply_changes(request: Mapping[str, Any], root: Path) -> list[str]:
    changes = request.get("change_set")
    if not isinstance(changes, list) or not changes:
        raise IsolatedExecutorError("CHANGE_SET_INVALID")
    changed: list[str] = []
    for change in changes:
        if not isinstance(change, Mapping):
            raise IsolatedExecutorError("CHANGE_INVALID")
        relative = safe_relative(change.get("path"))
        path = resolve_under(root, relative)
        current = path.read_bytes() if path.is_file() else None
        expected = change.get("expected_sha256")
        if expected is not None and (current is None or sha256(current) != expected):
            raise IsolatedExecutorError("SOURCE_DRIFT:" + relative)
        operation = change.get("operation")
        if operation == "write_file":
            content = change.get("content")
            if not isinstance(content, str):
                raise IsolatedExecutorError("WRITE_CONTENT_INVALID")
            path.parent.mkdir(parents=True, exist_ok=True)
            path.write_text(content, encoding="utf-8")
        elif operation == "replace_text":
            if current is None:
                raise IsolatedExecutorError("REPLACE_SOURCE_MISSING")
            old = str(change.get("old"))
            new = str(change.get("new"))
            count = int(change.get("count", 1))
            text = current.decode("utf-8")
            if text.count(old) != count:
                raise IsolatedExecutorError("REPLACE_COUNT_INVALID:" + relative)
            path.write_text(text.replace(old, new), encoding="utf-8")
        elif operation == "delete_file":
            if path.exists():
                path.unlink()
        else:
            raise IsolatedExecutorError("CHANGE_OPERATION_INVALID")
        changed.append(relative)
    return sorted(set(changed))
 def changed_bundle(root: Path, changed: list[str]) -> list[dict[str, Any]]:
    files = []
    for relative in changed:
        path = resolve_under(root, relative)
        if path.exists():
            data = path.read_bytes()
            if len(data) > MAX_FILE_BYTES:
                raise IsolatedExecutorError("CHANGED_FILE_TOO_LARGE:" + relative)
            files.append({
                "path": relative,
                "deleted": False,
                "sha256": sha256(data),
                "content_b64": base64.b64encode(data).decode("ascii"),
            })
        else:
            files.append({"path": relative, "deleted": True, "sha256": None, "content_b64": None})
    return files
 def execute_request(request_path: Path, result_path: Path) -> None:
    assert_uncredentialed()
    request = json.loads(request_path.read_text(encoding="utf-8"))
    if request.get("schema") != "aios.isolated-execution.request.v1":
        raise IsolatedExecutorError("REQUEST_SCHEMA_INVALID")
    request_id = request.get("request_id")
    if not isinstance(request_id, str) or not REQUEST_ID_RE.fullmatch(request_id):
        raise IsolatedExecutorError("REQUEST_ID_INVALID")
    source_archive = Path(str(request.get("source_archive") or ""))
    if not source_archive.is_absolute():
        raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
    expected_archive_sha = str(request.get("source_archive_sha256") or "")
    if sha256(source_archive.read_bytes()) != expected_archive_sha:
        raise IsolatedExecutorError("SOURCE_ARCHIVE_SHA_MISMATCH")
    with tempfile.TemporaryDirectory(prefix="aios-isolated-executor-") as temporary:
        root = Path(temporary) / "workspace"
        root.mkdir()
        extract_source(source_archive, root)
        changed = apply_changes(request, root)
        commands = [
            run_command(item, root)
            for item in request.get("verification", [])
            if isinstance(item, Mapping)
        ]
        result = {
            "schema": "aios.isolated-execution.result.v1",
            "request_id": request_id,
            "request_sha256": sha256(canonical(request)),
            "changed_files": changed_bundle(root, changed),
            "verification": commands,
            "credential_isolation": {
                "credential_env_absent": True,
                "credential_mount_inaccessible": True,
                "governed_bridge_unreachable": True,
            },
        }
        result["result_sha256"] = sha256(canonical(result))
        temporary_result = result_path.with_suffix(".tmp")
        temporary_result.write_text(json.dumps(result, sort_keys=True, separators=(",", ":")), encoding="utf-8")
        os.replace(temporary_result, result_path)
 def serve(root: Path) -> None:
    assert_uncredentialed()
    requests = root / "requests"
    results = root / "results"
    failed = root / "failed"
    for path in (requests, results, failed):
        path.mkdir(parents=True, exist_ok=True)
    while True:
        for request in sorted(requests.glob("*.json")):
            if request.is_symlink():
                continue
            result = results / request.name
            try:
                execute_request(request, result)
                request.unlink()
            except Exception as exc:
                (failed / request.name).write_text(
                    json.dumps({"error": str(exc) or type(exc).__name__}, sort_keys=True),
                    encoding="utf-8",
                )
                request.unlink(missing_ok=True)
        time.sleep(0.5)
 if __name__ == "__main__":
    import argparse
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", default="/var/lib/aios-online-agent-executor")
    parser.add_argument("--request")
    parser.add_argument("--result")
    args = parser.parse_args()
    if args.request and args.result:
        execute_request(Path(args.request), Path(args.result))
    else:
        serve(Path(args.root))
@@ -0,0 +1,23 @@
 """Task-bound Integration Refresh control-plane primitives."""
 from .integration_merge_writer import IntegrationMergeWriter, MergeError, MergeRequest
 from .integration_refresh import (
    AppendOnlyAudit,
    Binding,
    GiteaBranchReadProjection,
    GrantStore,
    IntegrationRefreshProvisioner,
    ProvisioningError,
 )
 __all__ = [
    "AppendOnlyAudit",
    "Binding",
    "GiteaBranchReadProjection",
    "GrantStore",
    "IntegrationMergeWriter",
    "IntegrationRefreshProvisioner",
    "MergeError",
    "MergeRequest",
    "ProvisioningError",
 ]
@@ -0,0 +1,90 @@
 """Constrained integration-only merge writer with rollback and reconciliation states."""
 from __future__ import annotations
 import subprocess
 from dataclasses import dataclass
 from pathlib import Path
 import re
 class MergeError(RuntimeError):
    def __init__(self, code: str, status: int = 409):
        super().__init__(code); self.code, self.status = code, status
@dataclass(frozen=True)
 class MergeRequest:
    integration_branch: str
    source_branch: str
    approved_source_oid: str
 class IntegrationMergeWriter:
    def __init__(self, workspace: Path | str, remote: str, projection):
        self.workspace, self.remote, self.projection = Path(workspace), remote, projection
    def _git(self, *args: str, check=True) -> str:
        p = subprocess.run(["git", *args], cwd=self.workspace, text=True, capture_output=True)
        if check and p.returncode:
            raise MergeError("git_operation_failed", 500)
        return p.stdout.strip()
    def merge(self, request: MergeRequest) -> dict:
        def bad(value: str) -> bool:
            return (
                value == "main"
                or value.startswith("main/")
                or value == "governance"
                or value.startswith("governance/")
                or value == "approvals"
                or value.startswith("refs/")
                or value.startswith("tags/")
            )
        if (bad(request.integration_branch) or bad(request.source_branch) or
                not request.integration_branch.startswith("integration/") or
                re.fullmatch(r"[0-9a-fA-F]{40}", request.approved_source_oid) is None):
            raise MergeError("integration_merge_scope_rejected", 403)
        for branch in (request.integration_branch, request.source_branch):
            if subprocess.run(["git", "check-ref-format", "--branch", branch], cwd=self.workspace,
                              text=True, capture_output=True).returncode:
                raise MergeError("integration_merge_scope_rejected", 403)
        if self._git("rev-parse", "--abbrev-ref", "HEAD") != request.integration_branch:
            raise MergeError("integration_branch_checkout_required")
        before = self._git("rev-parse", "HEAD")
        remote_before = self.projection(request.integration_branch)
        if remote_before != before:
            raise MergeError("integration_remote_advanced")
        source = self._git("rev-parse", "--verify", f"refs/heads/{request.source_branch}^{{commit}}")
        if source != request.approved_source_oid:
            raise MergeError("integration_source_not_approved", 403)
        attempt = subprocess.run(["git", "merge", "--no-ff", "--no-commit", request.source_branch], cwd=self.workspace, text=True, capture_output=True)
        if attempt.returncode:
            subprocess.run(["git", "merge", "--abort"], cwd=self.workspace, text=True, capture_output=True)
            raise MergeError("integration_merge_conflict")
        try:
            self._git("commit", "-m", "merge(integration): approved source")
            merged = self._git("rev-parse", "HEAD")
            parents = self._git("show", "-s", "--format=%P", "HEAD").split()
            if parents != [before, source]:
                raise MergeError("integration_parent_invariant_failed", 500)
            pushed = subprocess.run(["git", "push", "--porcelain", self.remote, f"HEAD:refs/heads/{request.integration_branch}"], cwd=self.workspace, text=True, capture_output=True)
            if pushed.returncode:
                try:
                    observed = self.projection(request.integration_branch)
                except Exception:
                    return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
                if observed == before:
                    self._git("reset", "--hard", before)
                    return {"state": "PUSH_FAILED_RESTORED", "pre_merge_oid": before}
                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
            try:
                observed = self.projection(request.integration_branch)
            except Exception:
                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
            if observed != merged:
                return {"state": "RECONCILIATION_REQUIRED", "pre_merge_oid": before, "merge_oid": merged}
            return {"state": "COMPLETED", "pre_merge_oid": before, "merge_oid": merged}
        except MergeError:
            if self._git("rev-parse", "HEAD") != before:
                self._git("reset", "--hard", before)
            raise
@@ -0,0 +1,257 @@
 """Fail-closed, task-bound integration refresh provisioning primitives.
 This module deliberately has no HTTP or credential-provider dependency.  The
 caller supplies a branch-read projection and an apply callback, making the
 authorization and recovery boundary independently testable.
 """
 from __future__ import annotations
 import hashlib
 import json
 import os
 import argparse
 import secrets
 import sqlite3
 import threading
 import re
 from contextlib import contextmanager
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Callable
 class ProvisioningError(RuntimeError):
    def __init__(self, code: str, status: int = 403):
        super().__init__(code)
        self.code, self.status = code, status
 def _now() -> datetime:
    return datetime.now(timezone.utc)
 def _digest(secret: str) -> str:
    return hashlib.sha256(secret.encode("utf-8")).hexdigest()
 def _canonical(value: dict) -> str:
    return hashlib.sha256(json.dumps(value, sort_keys=True, separators=(",", ":")).encode()).hexdigest()
 def _is_oid(value: object) -> bool:
    return isinstance(value, str) and re.fullmatch(r"[0-9a-fA-F]{40}", value) is not None
@dataclass(frozen=True)
 class Binding:
    task_id: str
    repository: str
    branch: str
    actor_identity: str
    audience: str
    paths: tuple[str, ...]
    quota: int
 class AppendOnlyAudit:
    """Append only redacted JSONL audit, durable before a result is returned."""
    def __init__(self, path: Path | str):
        self.path = Path(path)
        self.path.parent.mkdir(parents=True, exist_ok=True)
        self._lock = threading.Lock()
    def append(self, event: dict) -> None:
        with self._lock:
            safe = {key: value for key, value in event.items() if key not in {"token", "credential", "authorization"}}
            previous = "0" * 64
            if self.path.exists():
                lines = self.path.read_text(encoding="utf-8").splitlines()
                if lines:
                    previous = json.loads(lines[-1])["event_hash"]
            safe["previous_event_hash"] = previous
            safe["event_hash"] = _canonical(safe)
            encoded = (json.dumps(safe, sort_keys=True, separators=(",", ":")) + "\n").encode()
            fd = os.open(self.path, os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o600)
            try:
                os.write(fd, encoded)
                os.fsync(fd)
            finally:
                os.close(fd)
 class GrantStore:
    """Digest-only short grant registry; SQLite transactions serialize quota use."""
    def __init__(self, path: Path | str):
        self.path = Path(path)
        self.path.parent.mkdir(parents=True, exist_ok=True)
        with self._db() as db:
            db.execute("""CREATE TABLE IF NOT EXISTS grants(
                token_digest TEXT PRIMARY KEY, binding_json TEXT NOT NULL,
                expires_at TEXT NOT NULL, quota INTEGER NOT NULL, uses INTEGER NOT NULL,
                revoked INTEGER NOT NULL DEFAULT 0)""")
    @contextmanager
    def _db(self):
        db = sqlite3.connect(self.path, timeout=15, isolation_level=None)
        db.row_factory = sqlite3.Row
        try:
            yield db
        finally:
            db.close()
    def issue(self, binding: Binding, *, ttl_seconds: int = 300) -> str:
        if ttl_seconds < 1 or ttl_seconds > 1800 or binding.quota < 1 or not binding.paths:
            raise ValueError("invalid_short_grant")
        token = secrets.token_urlsafe(32)
        payload = json.dumps(binding.__dict__ | {"paths": list(binding.paths)}, sort_keys=True)
        with self._db() as db:
            db.execute("INSERT INTO grants VALUES(?,?,?,?,?,0)", (_digest(token), payload,
                (_now() + timedelta(seconds=ttl_seconds)).isoformat(), binding.quota, 0))
        return token
    def rotate(self, old_token: str, binding: Binding, *, revocation_probe, ttl_seconds: int = 300) -> str:
        self.revoke(old_token)
        try: status = revocation_probe(old_token)
        except TimeoutError as exc: raise ProvisioningError("revocation_probe_timeout", 503) from exc
        if status != 401: raise ProvisioningError("revocation_probe_rejected", 503)
        return self.issue(binding, ttl_seconds=ttl_seconds)
    def revoke(self, token: str) -> None:
        with self._db() as db:
            db.execute("BEGIN IMMEDIATE")
            db.execute("UPDATE grants SET revoked=1 WHERE token_digest=?", (_digest(token),))
            db.execute("COMMIT")
    def consume(self, token: str, binding: Binding, path: str) -> None:
        with self._db() as db:
            db.execute("BEGIN IMMEDIATE")
            row = db.execute("SELECT * FROM grants WHERE token_digest=?", (_digest(token),)).fetchone()
            if not row or row["revoked"]:
                db.execute("ROLLBACK"); raise ProvisioningError("credential_rejected", 401)
            if _now() >= datetime.fromisoformat(row["expires_at"]):
                db.execute("ROLLBACK"); raise ProvisioningError("credential_expired", 401)
            stored = json.loads(row["binding_json"])
            requested = binding.__dict__ | {"paths": list(binding.paths)}
            if stored != requested or path not in stored["paths"]:
                db.execute("ROLLBACK"); raise ProvisioningError("grant_binding_rejected")
            if row["uses"] >= row["quota"]:
                db.execute("ROLLBACK"); raise ProvisioningError("grant_quota_exhausted")
            db.execute("UPDATE grants SET uses=uses+1 WHERE token_digest=?", (_digest(token),))
            db.execute("COMMIT")
 class GiteaBranchReadProjection:
    """Normalizes a trusted task-scoped Gitea reader; every ambiguity fails closed."""
    def __init__(self, reader: Callable[[str, str], dict]):
        self.reader = reader
    def head(self, repository: str, branch: str) -> str:
        try:
            reply = self.reader(repository, branch)
        except TimeoutError as exc:
            raise ProvisioningError("gitea_projection_timeout", 503) from exc
        except Exception as exc:
            raise ProvisioningError("gitea_projection_unavailable", 503) from exc
        if not isinstance(reply, dict) or reply.get("status") in {401, 403}:
            raise ProvisioningError("gitea_projection_forbidden", 503)
        oid = reply.get("oid")
        if reply.get("status") != 200 or not _is_oid(oid):
            raise ProvisioningError("gitea_projection_invalid", 503)
        return oid.lower()
 class IntegrationRefreshProvisioner:
    _locks: dict[tuple[str, str], threading.Lock] = {}
    _locks_guard = threading.Lock()
    def __init__(self, *, grants: GrantStore, projection: GiteaBranchReadProjection,
                 ledger_path: Path | str, audit: AppendOnlyAudit, approved_binding: Binding):
        self.grants, self.projection, self.audit, self.approved_binding = grants, projection, audit, approved_binding
        self.ledger_path = Path(ledger_path); self.ledger_path.parent.mkdir(parents=True, exist_ok=True)
        with self._ledger() as db:
            db.execute("CREATE TABLE IF NOT EXISTS refreshes(operation_id TEXT PRIMARY KEY, digest TEXT NOT NULL, state TEXT NOT NULL, result_oid TEXT)")
    @contextmanager
    def _ledger(self):
        db = sqlite3.connect(self.ledger_path)
        try:
            yield db
            db.commit()
        finally:
            db.close()
    def refresh(self, *, token: str, binding: Binding, path: str, operation_id: str,
                target_head_oid: str, apply: Callable[[], str]) -> dict:
        if not operation_id or not _is_oid(target_head_oid):
            raise ProvisioningError("refresh_request_rejected")
        if binding != self.approved_binding:
            raise ProvisioningError("grant_binding_rejected")
        request = {"binding": binding.__dict__ | {"paths": list(binding.paths)}, "path": path, "target": target_head_oid}
        digest = _canonical(request)
        with self._locks_guard:
            lock = self._locks.setdefault((binding.repository, binding.branch), threading.Lock())
        with lock, self._ledger() as db:
            db.execute("BEGIN IMMEDIATE")
            row = db.execute("SELECT * FROM refreshes WHERE operation_id=?", (operation_id,)).fetchone()
            new_operation = row is None
            if row:
                if row[1] != digest:
                    db.execute("ROLLBACK"); raise ProvisioningError("operation_id_reuse_rejected", 409)
                if row[2] == "COMPLETED":
                    db.execute("COMMIT")
                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
                if row[2] not in {"PENDING", "RECOVERABLE"}:
                    db.execute("COMMIT")
                    return {"state": row[2], "operation_id": operation_id, "oid": row[3], "idempotent": True}
            else:
                db.execute("INSERT INTO refreshes VALUES(?,?,?,NULL)", (operation_id, digest, "PENDING"))
            db.execute("COMMIT")
            if new_operation:
                self.grants.consume(token, binding, path)
            current = self.projection.head(binding.repository, binding.branch)
            if current != target_head_oid.lower():
                self._state(operation_id, "STALE_TARGET")
                raise ProvisioningError("stale_target_head", 409)
            try:
                oid = apply()
                if not _is_oid(oid):
                    raise ProvisioningError("apply_result_invalid", 500)
                # Detect a competing remote advancement before claiming completion.
                observed = self.projection.head(binding.repository, binding.branch)
                if observed != oid.lower():
                    self._state(operation_id, "RECONCILIATION_REQUIRED")
                    raise ProvisioningError("remote_concurrent_advance", 409)
                self._state(operation_id, "COMPLETED", oid)
                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "COMPLETED"})
                return {"state": "COMPLETED", "operation_id": operation_id, "oid": oid, "idempotent": False}
            except ProvisioningError:
                raise
            except Exception as exc:
                self._state(operation_id, "RECOVERABLE")
                self.audit.append({"operation_id": operation_id, "task_id": binding.task_id, "repository": binding.repository,
                                   "branch": binding.branch, "actor_identity": binding.actor_identity, "audience": binding.audience, "path": path, "state": "RECOVERABLE"})
                raise ProvisioningError("refresh_apply_failed", 503) from exc
    def _state(self, operation_id: str, state: str, oid: str | None = None) -> None:
        with self._ledger() as db:
            db.execute("UPDATE refreshes SET state=?, result_oid=COALESCE(?,result_oid) WHERE operation_id=?", (state, oid, operation_id))
 def _sandbox_preflight(state_dir: Path) -> int:
    if os.environ.get("AIOS_GITOPS_WRITES_ENABLED") != "false":
        raise ProvisioningError("global_gitops_writes_must_remain_disabled", 500)
    state_dir.mkdir(parents=True, exist_ok=True)
    audit = AppendOnlyAudit(state_dir / "preflight-audit.jsonl")
    audit.append({"event": "SANDBOX_PREFLIGHT", "writes_enabled": False})
    print(json.dumps({"status": "READY", "mode": "sandbox", "writes_enabled": False}, sort_keys=True))
    return 0
 if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("--sandbox-preflight", action="store_true", required=True)
    parser.add_argument("--state-dir", type=Path, required=True)
    options = parser.parse_args()
    raise SystemExit(_sandbox_preflight(options.state_dir))
@@ -1,232 +0,0 @@
 #!/usr/bin/env python3
 """Root-owned Model Governance configuration reconciler.
 The config contains provider/model/policy metadata only. Raw credentials are rejected by
 aios_model_governance and never stored in the governance database.
 """
 from __future__ import annotations
 import argparse
 import hashlib
 import json
 from pathlib import Path
 from typing import Any, Mapping
 from aios_model_governance import (
    ModelGovernanceError,
    ModelGovernanceStore,
    ModelRecord,
    ProviderRecord,
    ScopePolicy,
 )
 SCHEMA = "aios.model-governance.bootstrap.v1"
 MAX_CONFIG_BYTES = 512 * 1024
 def canonical(value: object) -> bytes:
    return json.dumps(
        value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
    ).encode("utf-8")
 def fail(code: str) -> None:
    raise SystemExit(code)
 def _load(path: Path) -> dict[str, Any]:
    if path.is_symlink() or not path.is_file() or path.stat().st_size > MAX_CONFIG_BYTES:
        fail("MODEL_GOVERNANCE_CONFIG_INVALID")
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except json.JSONDecodeError:
        fail("MODEL_GOVERNANCE_CONFIG_INVALID")
    if not isinstance(value, Mapping) or value.get("schema") != SCHEMA:
        fail("MODEL_GOVERNANCE_CONFIG_SCHEMA_INVALID")
    return dict(value)
 def _provider_desired(value: Mapping[str, Any]) -> ProviderRecord:
    return ProviderRecord(
        provider_id=str(value.get("provider_id") or ""),
        credential_ref=value.get("credential_ref"),
        enabled=bool(value.get("enabled", True)),
        failure_domain=str(value.get("failure_domain") or "default"),
        max_failures=int(value.get("max_failures") or 3),
        cooldown_seconds=int(value.get("cooldown_seconds") or 60),
    )
 def _model_desired(value: Mapping[str, Any]) -> ModelRecord:
    return ModelRecord(
        model_id=str(value.get("model_id") or ""),
        provider_id=str(value.get("provider_id") or ""),
        version=str(value.get("version") or ""),
        capabilities=tuple(value.get("capabilities") or ()),
        input_cost_micros_per_1k=int(value.get("input_cost_micros_per_1k") or 0),
        output_cost_micros_per_1k=int(value.get("output_cost_micros_per_1k") or 0),
        max_input_tokens=int(value.get("max_input_tokens") or 0),
        max_output_tokens=int(value.get("max_output_tokens") or 0),
        evaluation_state=str(value.get("evaluation_state") or "APPROVED"),
        evaluation_sha256=str(value.get("evaluation_sha256") or ""),
        enabled=bool(value.get("enabled", True)),
        priority=int(value.get("priority") or 100),
    )
 def _policy_desired(value: Mapping[str, Any]) -> ScopePolicy:
    return ScopePolicy(
        scope_type=str(value.get("scope_type") or ""),
        tenant_id=value.get("tenant_id"),
        project_id=value.get("project_id"),
        allowed_models=tuple(value.get("allowed_models") or ()),
        denied_providers=tuple(value.get("denied_providers") or ()),
        required_capabilities=tuple(value.get("required_capabilities") or ()),
        pinned_model_id=value.get("pinned_model_id"),
        pinned_model_version=value.get("pinned_model_version"),
        max_input_tokens_per_request=int(value.get("max_input_tokens_per_request") or 0),
        max_output_tokens_per_request=int(value.get("max_output_tokens_per_request") or 0),
        daily_token_budget=int(value.get("daily_token_budget") or 0),
        daily_cost_budget_micros=int(value.get("daily_cost_budget_micros") or 0),
        fallback_limit=int(value.get("fallback_limit") or 0),
    )
 def _row_dict(row: object) -> dict[str, Any] | None:
    return dict(row) if row is not None else None
 def _provider_matches(row: Mapping[str, Any], desired: ProviderRecord) -> bool:
    return (
        row["credential_ref"] == desired.credential_ref
        and bool(row["enabled"]) == desired.enabled
        and row["failure_domain"] == desired.failure_domain
        and int(row["max_failures"]) == desired.max_failures
        and int(row["cooldown_seconds"]) == desired.cooldown_seconds
    )
 def _model_matches(row: Mapping[str, Any], desired: ModelRecord) -> bool:
    return (
        row["provider_id"] == desired.provider_id
        and row["version"] == desired.version
        and tuple(json.loads(row["capabilities_json"])) == tuple(sorted(set(desired.capabilities)))
        and int(row["input_cost_micros_per_1k"]) == desired.input_cost_micros_per_1k
        and int(row["output_cost_micros_per_1k"]) == desired.output_cost_micros_per_1k
        and int(row["max_input_tokens"]) == desired.max_input_tokens
        and int(row["max_output_tokens"]) == desired.max_output_tokens
        and row["evaluation_state"] == desired.evaluation_state
        and row["evaluation_sha256"] == desired.evaluation_sha256
        and bool(row["enabled"]) == desired.enabled
        and int(row["priority"]) == desired.priority
    )
 def _policy_matches(row: Mapping[str, Any], desired: ScopePolicy) -> bool:
    return (
        row["scope_type"] == desired.scope_type
        and row["tenant_id"] == desired.tenant_id
        and row["project_id"] == desired.project_id
        and tuple(json.loads(row["allowed_models_json"])) == tuple(sorted(set(desired.allowed_models)))
        and tuple(json.loads(row["denied_providers_json"])) == tuple(sorted(set(desired.denied_providers)))
        and tuple(json.loads(row["required_capabilities_json"])) == tuple(sorted(set(desired.required_capabilities)))
        and row["pinned_model_id"] == desired.pinned_model_id
        and row["pinned_model_version"] == desired.pinned_model_version
        and int(row["max_input_tokens_per_request"]) == desired.max_input_tokens_per_request
        and int(row["max_output_tokens_per_request"]) == desired.max_output_tokens_per_request
        and int(row["daily_token_budget"]) == desired.daily_token_budget
        and int(row["daily_cost_budget_micros"]) == desired.daily_cost_budget_micros
        and int(row["fallback_limit"]) == desired.fallback_limit
    )
 def apply_config(db_path: Path, config_path: Path) -> dict[str, Any]:
    config = _load(config_path)
    config_sha = hashlib.sha256(canonical(config)).hexdigest()
    providers = config.get("providers") or []
    models = config.get("models") or []
    policies = config.get("policies") or []
    if not all(isinstance(value, list) for value in (providers, models, policies)):
        fail("MODEL_GOVERNANCE_CONFIG_COLLECTION_INVALID")
    store = ModelGovernanceStore(db_path)
    changes = {"providers": 0, "models": 0, "policies": 0, "unchanged": 0}
    try:
        for item in providers:
            if not isinstance(item, Mapping):
                fail("MODEL_GOVERNANCE_PROVIDER_CONFIG_INVALID")
            desired = _provider_desired(item)
            row = store.conn.execute(
                "SELECT * FROM model_governance_providers WHERE provider_id=?",
                (desired.provider_id,),
            ).fetchone()
            if row is not None and _provider_matches(row, desired):
                changes["unchanged"] += 1
                continue
            expected = int(row["revision"]) if row is not None else 0
            store.register_provider(desired, expected_revision=expected)
            changes["providers"] += 1
        for item in models:
            if not isinstance(item, Mapping):
                fail("MODEL_GOVERNANCE_MODEL_CONFIG_INVALID")
            desired = _model_desired(item)
            row = store.conn.execute(
                "SELECT * FROM model_governance_models WHERE model_id=?",
                (desired.model_id,),
            ).fetchone()
            if row is not None and _model_matches(row, desired):
                changes["unchanged"] += 1
                continue
            expected = int(row["revision"]) if row is not None else 0
            store.register_model(desired, expected_revision=expected)
            changes["models"] += 1
        for item in policies:
            if not isinstance(item, Mapping):
                fail("MODEL_GOVERNANCE_POLICY_CONFIG_INVALID")
            desired = _policy_desired(item)
            row = store.conn.execute(
                "SELECT * FROM model_governance_scope_policies WHERE scope_key=?",
                (desired.scope_key,),
            ).fetchone()
            if row is not None and _policy_matches(row, desired):
                changes["unchanged"] += 1
                continue
            expected = int(row["revision"]) if row is not None else 0
            store.set_scope_policy(desired, expected_revision=expected)
            changes["policies"] += 1
        if not store.verify_audit_chain():
            fail("MODEL_GOVERNANCE_AUDIT_CHAIN_INVALID")
        return {
            "schema": "aios.model-governance.bootstrap-result.v1",
            "database": str(db_path),
            "config_sha256": config_sha,
            "changes": changes,
            "audit_chain_valid": True,
        }
    finally:
        store.close()
 def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--db", required=True)
    parser.add_argument("--config", required=True)
    parser.add_argument("--output")
    args = parser.parse_args()
    try:
        result = apply_config(Path(args.db), Path(args.config))
    except ModelGovernanceError as exc:
        print(json.dumps({"status": "FAILED", "error": exc.code}, sort_keys=True))
        return 20
    data = json.dumps(result, indent=2, sort_keys=True) + "\n"
    if args.output:
        Path(args.output).write_text(data, encoding="utf-8")
    print(data, end="")
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,302 +0,0 @@
 """Durable checkpoint journal for the generic Online Agent worker.
 The JSON task state remains a fast cache.  This SQLite journal is the durable,
 append-only evidence used for restart/resume/replay decisions.
 """
 from __future__ import annotations
 from dataclasses import dataclass
 from datetime import datetime, timezone
 import hashlib
 import json
 from pathlib import Path
 import sqlite3
 from typing import Any, Mapping
 PHASE_ORDER = {
    "claimed": 10,
    "workspace_prepared": 20,
    "verification_passed": 30,
    "agent_runtime_done": 40,
    "source_capture_done": 40,
    "commit_done": 40,
    "reconciliation_required": 45,
    "result_pending": 50,
    "result_submitted": 60,
 }
 class CheckpointError(RuntimeError):
    pass
 def canonical(value: object) -> bytes:
    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str).encode("utf-8")
 def sha256_json(value: object) -> str:
    return hashlib.sha256(canonical(value)).hexdigest()
 def now() -> str:
    return datetime.now(timezone.utc).isoformat()
@dataclass(frozen=True)
 class CheckpointBinding:
    task_id: str
    attempt: int
    execution_digest: str
    job_id: str
    repository: str
    base_oid: str
    expected_branch_oid: str
    target_branch: str
    generation: int
    def material(self) -> dict[str, Any]:
        return {
            "task_id": self.task_id,
            "attempt": self.attempt,
            "execution_digest": self.execution_digest,
            "job_id": self.job_id,
            "repository": self.repository,
            "base_oid": self.base_oid,
            "expected_branch_oid": self.expected_branch_oid,
            "target_branch": self.target_branch,
            "generation": self.generation,
        }
    @property
    def binding_sha256(self) -> str:
        return sha256_json(self.material())
 class CheckpointStore:
    def __init__(self, path: Path) -> None:
        self.path = Path(path)
        self.path.parent.mkdir(parents=True, exist_ok=True)
        with self._connect() as connection:
            connection.executescript(
                """
                CREATE TABLE IF NOT EXISTS checkpoints(
                  task_id TEXT NOT NULL,
                  attempt INTEGER NOT NULL,
                  sequence INTEGER NOT NULL,
                  phase TEXT NOT NULL,
                  phase_order INTEGER NOT NULL,
                  execution_digest TEXT NOT NULL,
                  job_id TEXT NOT NULL,
                  repository TEXT NOT NULL,
                  base_oid TEXT NOT NULL,
                  expected_branch_oid TEXT NOT NULL,
                  target_branch TEXT NOT NULL,
                  generation INTEGER NOT NULL,
                  binding_sha256 TEXT NOT NULL,
                  payload_json TEXT NOT NULL,
                  payload_sha256 TEXT NOT NULL,
                  created_at TEXT NOT NULL,
                  PRIMARY KEY(task_id, attempt, sequence)
                );
                CREATE INDEX IF NOT EXISTS idx_checkpoints_task_latest
                  ON checkpoints(task_id, attempt DESC, sequence DESC);
                CREATE UNIQUE INDEX IF NOT EXISTS idx_checkpoints_exact_replay
                  ON checkpoints(task_id, attempt, phase, payload_sha256);
                CREATE TABLE IF NOT EXISTS checkpoint_heads(
                  task_id TEXT PRIMARY KEY,
                  attempt INTEGER NOT NULL,
                  sequence INTEGER NOT NULL,
                  phase TEXT NOT NULL,
                  phase_order INTEGER NOT NULL,
                  execution_digest TEXT NOT NULL,
                  binding_sha256 TEXT NOT NULL,
                  payload_sha256 TEXT NOT NULL,
                  updated_at TEXT NOT NULL
                );
                """
            )
    def _connect(self) -> sqlite3.Connection:
        connection = sqlite3.connect(self.path, timeout=30.0)
        connection.row_factory = sqlite3.Row
        connection.execute("PRAGMA foreign_keys=ON")
        connection.execute("PRAGMA journal_mode=WAL")
        connection.execute("PRAGMA synchronous=FULL")
        connection.execute("PRAGMA busy_timeout=30000")
        return connection
    @staticmethod
    def _phase_order(phase: str) -> int:
        try:
            return PHASE_ORDER[phase]
        except KeyError as exc:
            raise CheckpointError("CHECKPOINT_PHASE_INVALID") from exc
    def append(
        self,
        binding: CheckpointBinding,
        phase: str,
        payload: Mapping[str, Any],
    ) -> dict[str, Any]:
        order = self._phase_order(phase)
        payload_value = dict(payload)
        payload_sha = sha256_json(payload_value)
        with self._connect() as connection:
            connection.execute("BEGIN IMMEDIATE")
            replay = connection.execute(
                """
                SELECT * FROM checkpoints
                 WHERE task_id=? AND attempt=? AND phase=? AND payload_sha256=?
                """,
                (binding.task_id, binding.attempt, phase, payload_sha),
            ).fetchone()
            if replay is not None:
                connection.commit()
                return dict(replay)
            head = connection.execute(
                "SELECT * FROM checkpoint_heads WHERE task_id=?",
                (binding.task_id,),
            ).fetchone()
            if head is not None:
                head_attempt = int(head["attempt"])
                head_order = int(head["phase_order"])
                if binding.attempt < head_attempt:
                    raise CheckpointError("CHECKPOINT_ATTEMPT_REGRESSION")
                if binding.attempt == head_attempt:
                    if head["execution_digest"] != binding.execution_digest:
                        raise CheckpointError("CHECKPOINT_EXECUTION_DIGEST_CONFLICT")
                    if head["binding_sha256"] != binding.binding_sha256:
                        raise CheckpointError("CHECKPOINT_SCOPE_MISMATCH_DENY")
                    if order < head_order and phase != "reconciliation_required":
                        raise CheckpointError("CHECKPOINT_PHASE_REGRESSION")
                    sequence = int(head["sequence"]) + 1
                else:
                    sequence = 1
            else:
                sequence = 1
            created_at = now()
            connection.execute(
                """
                INSERT INTO checkpoints(
                  task_id,attempt,sequence,phase,phase_order,execution_digest,job_id,
                  repository,base_oid,expected_branch_oid,target_branch,generation,
                  binding_sha256,payload_json,payload_sha256,created_at
                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
                """,
                (
                    binding.task_id,
                    binding.attempt,
                    sequence,
                    phase,
                    order,
                    binding.execution_digest,
                    binding.job_id,
                    binding.repository,
                    binding.base_oid,
                    binding.expected_branch_oid,
                    binding.target_branch,
                    binding.generation,
                    binding.binding_sha256,
                    canonical(payload_value).decode("utf-8"),
                    payload_sha,
                    created_at,
                ),
            )
            connection.execute(
                """
                INSERT INTO checkpoint_heads(
                  task_id,attempt,sequence,phase,phase_order,execution_digest,
                  binding_sha256,payload_sha256,updated_at
                ) VALUES (?,?,?,?,?,?,?,?,?)
                ON CONFLICT(task_id) DO UPDATE SET
                  attempt=excluded.attempt,
                  sequence=excluded.sequence,
                  phase=excluded.phase,
                  phase_order=excluded.phase_order,
                  execution_digest=excluded.execution_digest,
                  binding_sha256=excluded.binding_sha256,
                  payload_sha256=excluded.payload_sha256,
                  updated_at=excluded.updated_at
                """,
                (
                    binding.task_id,
                    binding.attempt,
                    sequence,
                    phase,
                    order,
                    binding.execution_digest,
                    binding.binding_sha256,
                    payload_sha,
                    created_at,
                ),
            )
            connection.commit()
            row = connection.execute(
                "SELECT * FROM checkpoints WHERE task_id=? AND attempt=? AND sequence=?",
                (binding.task_id, binding.attempt, sequence),
            ).fetchone()
            return dict(row)
    def latest(self, task_id: str) -> dict[str, Any] | None:
        with self._connect() as connection:
            row = connection.execute(
                """
                SELECT * FROM checkpoints
                 WHERE task_id=?
                 ORDER BY attempt DESC, sequence DESC
                 LIMIT 1
                """,
                (task_id,),
            ).fetchone()
            if row is None:
                return None
            value = dict(row)
            value["payload"] = json.loads(value.pop("payload_json"))
            return value
    def latest_for_attempt(self, task_id: str, attempt: int) -> dict[str, Any] | None:
        with self._connect() as connection:
            row = connection.execute(
                """
                SELECT * FROM checkpoints
                 WHERE task_id=? AND attempt=?
                 ORDER BY sequence DESC
                 LIMIT 1
                """,
                (task_id, attempt),
            ).fetchone()
            if row is None:
                return None
            value = dict(row)
            value["payload"] = json.loads(value.pop("payload_json"))
            return value
    def verify_latest_binding(self, binding: CheckpointBinding) -> dict[str, Any] | None:
        value = self.latest(binding.task_id)
        if value is None:
            return None
        if int(value["attempt"]) > binding.attempt:
            raise CheckpointError("CHECKPOINT_FUTURE_ATTEMPT")
        # A previous attempt may be reused only when the immutable execution/scope binding matches.
        if value["execution_digest"] != binding.execution_digest:
            return None
        expected = CheckpointBinding(
            task_id=value["task_id"],
            attempt=int(value["attempt"]),
            execution_digest=value["execution_digest"],
            job_id=value["job_id"],
            repository=value["repository"],
            base_oid=value["base_oid"],
            expected_branch_oid=value["expected_branch_oid"],
            target_branch=value["target_branch"],
            generation=int(value["generation"]),
        )
        current_scope = binding.material()
        historical_scope = expected.material()
        current_scope.pop("attempt", None)
        historical_scope.pop("attempt", None)
        if sha256_json(current_scope) != sha256_json(historical_scope):
            raise CheckpointError("CHECKPOINT_SCOPE_MISMATCH_DENY")
        return value
@@ -1,463 +0,0 @@
 """Bounded read-only repository interface map for governed Online Agent analysis.
 The compact map intentionally returns symbols and short source excerpts rather than a
 source archive. It is designed for control-plane consumers that cannot safely ingest a
 multi-megabyte repository snapshot.
 """
 from __future__ import annotations
 import ast
 import hashlib
 import json
 from pathlib import Path
 import re
 from typing import Any, Iterable, Mapping, Sequence
 SCHEMA = "aios.engineering.interface-map.v1"
 MAX_RESULT_BYTES = 120 * 1024
 TARGET_RESULT_BYTES = 108 * 1024
 MAX_MODULES = 40
 MAX_SYMBOLS = 80
 MAX_TESTS = 40
 MAX_EXCERPTS = 25
 MAX_EXCERPT_CHARS = 1200
 MAX_FILE_BYTES = 2 * 1024 * 1024
 ROOTS = (
    "active-runtime/app",
    "runtime/agent-os",
    "tests",
    "db/migrations",
    "migrations",
    "deploy/systemd",
    "docs/task-plane",
    "docs/superpowers/specs",
 )
 SUFFIXES = {".py", ".sql", ".service", ".md", ".json", ".yaml", ".yml"}
 DEFAULT_TERMS = {
    "agent", "worker", "fleet", "scheduler", "scheduling", "task", "claim", "lease",
    "heartbeat", "capacity", "concurrency", "priority", "fairness", "queue", "retry",
    "backoff", "circuit", "health", "liveness", "scope", "tenant", "project", "trace",
    "message", "checkpoint", "recovery", "idempotency", "dispatch", "assignment",
 }
 FLEET_CONTRACT_TERMS: dict[str, tuple[str, ...]] = {
    "FLEET_AGENT_REGISTRATION": ("agent", "register", "worker", "capability", "version"),
    "FLEET_CAPACITY_SCHEDULING": ("capacity", "slot", "concurrency", "scheduler", "queue"),
    "FLEET_FAIRNESS": ("fair", "priority", "queue", "tenant", "project", "starvation"),
    "FLEET_FAULT_ISOLATION": ("failure", "health", "liveness", "timeout", "circuit", "poison"),
    "FLEET_WORKER_REASSIGNMENT": ("reassign", "assignment", "claim", "lease", "retry", "worker"),
    "FLEET_SCOPE_ISOLATION": ("tenant", "project", "scope", "conversation", "task", "run"),
    "FLEET_IDEMPOTENT_DISPATCH": ("idempot", "dispatch", "claim", "lease", "result", "attempt"),
    "FLEET_FAILURE_RECOVERY": ("checkpoint", "resume", "recover", "retry", "cleanup", "receipt"),
 }
 MODEL_GOVERNANCE_CONTRACT_TERMS: dict[str, tuple[str, ...]] = {
    "MODEL_PROVIDER_REGISTRY": ("model", "provider", "registry", "endpoint", "capability"),
    "MODEL_SELECTION_POLICY": ("model", "select", "route", "policy", "capability"),
    "MODEL_VERSION_PINNING": ("model", "version", "pin", "revision", "snapshot"),
    "MODEL_BUDGET_ACCOUNTING": ("budget", "token", "cost", "quota", "usage"),
    "MODEL_FALLBACK_POLICY": ("fallback", "retry", "route", "provider", "model"),
    "MODEL_SCOPE_ISOLATION": ("tenant", "project", "scope", "policy", "model"),
    "MODEL_CREDENTIAL_BOUNDARY": ("credential", "secret", "provider", "tool", "token"),
    "MODEL_TRACE_AUDIT": ("trace", "audit", "model", "provider", "request"),
    "MODEL_EVALUATION_GATE": ("eval", "evaluation", "approval", "quality", "gate"),
    "MODEL_ROUTING_RESILIENCE": ("route", "retry", "fallback", "timeout", "health"),
 }
 PROFILE_CLASSIFICATION = {
    "fleet": "P2_INTERFACE_MAP_CAPTURED",
    "model_governance": "MODEL_GOVERNANCE_INTERFACE_MAP_CAPTURED",
 }
 MODEL_PROFILE_MARKERS = {
    "model", "provider", "llm", "inference", "routing", "router", "budget",
    "token", "cost", "quota", "fallback", "evaluation", "eval", "approval",
    "version", "pinning",
 }
 SENSITIVE_RE = re.compile(
    r"(?i)(authorization\s*:\s*bearer\s+\S+|"
    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*['\"]?[^'\"\s,;]+)"
 )
 SQL_TABLE_RE = re.compile(
    r"(?is)\bcreate\s+table\s+(?:if\s+not\s+exists\s+)?[\"`[]?([A-Za-z_][A-Za-z0-9_.-]*)"
 )
 class CompactInterfaceMapError(RuntimeError):
    pass
 def _sha(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()
 def _bounded_excerpt(text: str, start_line: int, end_line: int) -> str:
    lines = text.splitlines()
    start = max(0, start_line - 2)
    end = min(len(lines), max(end_line + 1, start + 1))
    excerpt = "\n".join(lines[start:end])
    excerpt = SENSITIVE_RE.sub("<redacted-sensitive-source-pattern>", excerpt)
    if len(excerpt) > MAX_EXCERPT_CHARS:
        excerpt = excerpt[: MAX_EXCERPT_CHARS - 1] + "…"
    return excerpt
 def _signal_terms(signals: Sequence[str]) -> set[str]:
    terms = set(DEFAULT_TERMS)
    for signal in signals:
        if not isinstance(signal, str):
            continue
        terms.update(
            token.lower()
            for token in re.findall(r"[A-Za-z][A-Za-z0-9_.-]{2,63}", signal)
        )
    return set(sorted(terms)[:96])
 def _profile(source_signals: Sequence[str]) -> str:
    tokens: set[str] = set()
    for signal in source_signals:
        if not isinstance(signal, str):
            continue
        tokens.update(
            token.lower()
            for token in re.findall(r"[A-Za-z][A-Za-z0-9_.-]{2,63}", signal)
        )
    model_score = len(tokens & MODEL_PROFILE_MARKERS)
    return "model_governance" if model_score >= 2 else "fleet"
 def _contract_terms(profile: str) -> Mapping[str, tuple[str, ...]]:
    if profile == "model_governance":
        return MODEL_GOVERNANCE_CONTRACT_TERMS
    if profile == "fleet":
        return FLEET_CONTRACT_TERMS
    raise CompactInterfaceMapError("INTERFACE_MAP_PROFILE_INVALID")
 def _candidate_files(root: Path, terms: set[str]) -> list[dict[str, Any]]:
    root = root.resolve()
    candidates: list[dict[str, Any]] = []
    for relative_root in ROOTS:
        directory = (root / relative_root).resolve(strict=False)
        if directory == root or root not in directory.parents:
            raise CompactInterfaceMapError("INTERFACE_MAP_SCOPE_INVALID")
        if not directory.is_dir() or directory.is_symlink():
            continue
        for path in sorted(directory.rglob("*")):
            if path.is_symlink() or not path.is_file() or path.suffix.lower() not in SUFFIXES:
                continue
            resolved = path.resolve(strict=True)
            if root not in resolved.parents:
                raise CompactInterfaceMapError("INTERFACE_MAP_PATH_ESCAPE")
            data = path.read_bytes()
            if len(data) > MAX_FILE_BYTES:
                continue
            relative = path.relative_to(root).as_posix()
            text = data.decode("utf-8", "ignore")
            searchable = (relative + "\n" + text[:384000]).lower()
            matched = sorted(term for term in terms if term in searchable)
            if not matched:
                continue
            path_bonus = sum(3 for term in terms if term in relative.lower())
            test_bonus = 3 if relative.startswith("tests/") else 0
            score = min(250, len(matched) + path_bonus + test_bonus)
            candidates.append(
                {
                    "path": relative,
                    "sha256": _sha(data),
                    "bytes": len(data),
                    "score": score,
                    "text": text,
                    "suffix": path.suffix.lower(),
                }
            )
    candidates.sort(key=lambda item: (-item["score"], item["path"]))
    return candidates
 def _python_symbols(item: Mapping[str, Any], terms: set[str]) -> list[dict[str, Any]]:
    try:
        tree = ast.parse(str(item["text"]), filename=str(item["path"]))
    except SyntaxError:
        return []
    result: list[dict[str, Any]] = []
    class Visitor(ast.NodeVisitor):
        def __init__(self) -> None:
            self.stack: list[str] = []
        def _record(self, node: ast.AST, kind: str, name: str) -> None:
            qualified = ".".join([*self.stack, name]) if self.stack else name
            haystack = f"{item['path']} {qualified}".lower()
            score = sum(3 if term in haystack else 0 for term in terms)
            if name.startswith("test_"):
                score += 12
            result.append(
                {
                    "path": item["path"],
                    "symbol": qualified,
                    "kind": kind,
                    "line": int(getattr(node, "lineno", 1)),
                    "end_line": int(getattr(node, "end_lineno", getattr(node, "lineno", 1))),
                    "score": score + int(item["score"]),
                }
            )
        def visit_ClassDef(self, node: ast.ClassDef) -> Any:
            self._record(node, "class", node.name)
            self.stack.append(node.name)
            self.generic_visit(node)
            self.stack.pop()
        def visit_FunctionDef(self, node: ast.FunctionDef) -> Any:
            self._record(node, "function", node.name)
            self.stack.append(node.name)
            self.generic_visit(node)
            self.stack.pop()
        def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef) -> Any:
            self._record(node, "async_function", node.name)
            self.stack.append(node.name)
            self.generic_visit(node)
            self.stack.pop()
    Visitor().visit(tree)
    return result
 def _surface_ref(symbol: Mapping[str, Any]) -> str:
    return f"{symbol['path']}::{symbol['symbol']}"
 def _contract_map(
    symbols: Sequence[Mapping[str, Any]],
    modules: Sequence[Mapping[str, Any]],
    contract_terms: Mapping[str, tuple[str, ...]],
 ) -> dict[str, Any]:
    result: dict[str, Any] = {}
    module_paths = [str(item["path"]) for item in modules]
    for contract, terms in contract_terms.items():
        scored: list[tuple[int, str]] = []
        for symbol in symbols:
            haystack = _surface_ref(symbol).lower()
            score = sum(1 for term in terms if term in haystack)
            if score:
                scored.append((score, _surface_ref(symbol)))
        scored.sort(key=lambda item: (-item[0], item[1]))
        surfaces = [value for _, value in scored[:6]]
        if not surfaces:
            for path in module_paths:
                score = sum(1 for term in terms if term in path.lower())
                if score:
                    surfaces.append(path)
                if len(surfaces) == 6:
                    break
        result[contract] = {
            "status": "PARTIAL" if surfaces else "GAP",
            "surfaces": surfaces,
        }
    return result
 def _gap_evidence(
    symbols: Sequence[Mapping[str, Any]],
    profile: str,
 ) -> tuple[list[str], list[str], list[str]]:
    haystack = "\n".join(_surface_ref(item).lower() for item in symbols)
    if profile == "model_governance":
        invariants = [
            "Online Task claim/heartbeat remains the authoritative worker ownership boundary.",
            "Provider/model credentials remain outside uncredentialed planner/executor processes.",
            "P0-A tenant/project scope and P0-C trace/audit lineage must constrain model routing.",
            "P1 retry/checkpoint semantics remain authoritative for model-call execution recovery.",
        ]
        failure_windows: list[str] = []
        if "provider" not in haystack and "model" not in haystack:
            failure_windows.append("No first-class model/provider registry surface detected.")
        if "budget" not in haystack and "cost" not in haystack and "quota" not in haystack:
            failure_windows.append("No explicit durable model budget/cost/quota accounting surface detected.")
        if "fallback" not in haystack and "route" not in haystack:
            failure_windows.append("No explicit model fallback/routing policy surface detected.")
        if "eval" not in haystack and "approval" not in haystack:
            failure_windows.append("No explicit evaluation/approval gate surface detected for model changes.")
        if "version" not in haystack and "pin" not in haystack:
            failure_windows.append("No explicit model-version pinning surface detected.")
        desired = (
            ("trace", "P0-C trace/audit lineage"),
            ("scope", "P0-A tenant/project scope isolation"),
            ("credential", "P0-C credential governance"),
            ("checkpoint", "P1 durable execution recovery"),
            ("message", "P0-B MessageEnvelope/handoff"),
            ("retry", "P1 retry/idempotency"),
        )
    else:
        invariants = [
            "Online Task claim/heartbeat remains the authoritative worker ownership boundary.",
            "Governed mutation remains separated from read-only analysis and requires WriterLease.",
            "P1 attempt-aware result idempotency and durable checkpoint recovery are reusable fleet primitives.",
            "Scope/trace/message lineage must remain attached when work is scheduled or reassigned.",
        ]
        failure_windows = []
        if "scheduler" not in haystack:
            failure_windows.append("No first-class durable fleet scheduler symbol detected; worker-local polling may still be the scheduling mechanism.")
        if "capacity" not in haystack and "slot" not in haystack:
            failure_windows.append("No explicit durable worker-capacity/slot primitive detected.")
        if "fair" not in haystack and "starvation" not in haystack:
            failure_windows.append("No explicit fairness/starvation policy symbol detected.")
        if "circuit" not in haystack:
            failure_windows.append("No explicit circuit-breaker primitive detected for repeated worker/task failures.")
        if "reassign" not in haystack:
            failure_windows.append("No explicit worker-reassignment primitive detected beyond lease expiry/retry semantics.")
        desired = (
            ("checkpoint", "P1 durable checkpoint/resume"),
            ("message", "P0-B MessageEnvelope/handoff"),
            ("trace", "P0-C trace correlation"),
            ("scope", "P0-A scope isolation"),
            ("lease", "claim/WriterLease ownership"),
            ("heartbeat", "worker liveness"),
            ("idempot", "retry-safe dispatch/result"),
        )
    reuse_points: list[str] = []
    for token, label in desired:
        match = next((item for item in symbols if token in _surface_ref(item).lower()), None)
        if match is not None:
            reuse_points.append(f"{label}: {_surface_ref(match)}")
    return invariants, failure_windows, reuse_points
 def _trim_to_budget(value: dict[str, Any]) -> dict[str, Any]:
    def size() -> int:
        return len(json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8"))
    while size() > TARGET_RESULT_BYTES and value["bounded_excerpts"]:
        value["bounded_excerpts"].pop()
    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["functions"]) > 20:
        value["implementation_map"]["functions"].pop()
    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["classes"]) > 15:
        value["implementation_map"]["classes"].pop()
    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["tests"]) > 15:
        value["implementation_map"]["tests"].pop()
    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["modules"]) > 20:
        value["implementation_map"]["modules"].pop()
    final_size = size()
    if final_size > MAX_RESULT_BYTES:
        raise CompactInterfaceMapError("INTERFACE_MAP_RESULT_TOO_LARGE")
    value["result_bytes"] = final_size
    return value
 def build_compact_interface_map(
    worktree: Path,
    source_signals: Sequence[str],
    *,
    source_commit: str,
 ) -> dict[str, Any]:
    root = Path(worktree)
    if not root.is_dir() or root.is_symlink():
        raise CompactInterfaceMapError("INTERFACE_MAP_WORKTREE_INVALID")
    if re.fullmatch(r"[0-9a-f]{40}", source_commit) is None:
        raise CompactInterfaceMapError("INTERFACE_MAP_SOURCE_COMMIT_INVALID")
    profile = _profile(source_signals)
    terms = _signal_terms(source_signals)
    candidates = _candidate_files(root, terms)
    if not candidates:
        raise CompactInterfaceMapError("INTERFACE_MAP_EMPTY")
    module_candidates = candidates[:MAX_MODULES]
    modules = [
        {
            "path": item["path"],
            "sha256": item["sha256"],
            "bytes": item["bytes"],
            "score": item["score"],
        }
        for item in module_candidates
    ]
    symbols: list[dict[str, Any]] = []
    tables: list[dict[str, Any]] = []
    systemd_units: list[dict[str, Any]] = []
    for item in candidates:
        if item["suffix"] == ".py":
            symbols.extend(_python_symbols(item, terms))
        elif item["suffix"] == ".sql":
            for table in SQL_TABLE_RE.findall(str(item["text"])):
                tables.append({"path": item["path"], "table": table, "sha256": item["sha256"]})
        elif item["suffix"] == ".service":
            systemd_units.append({"path": item["path"], "unit": Path(str(item["path"])).name, "sha256": item["sha256"]})
    symbols.sort(key=lambda item: (-int(item["score"]), str(item["path"]), str(item["symbol"])))
    all_symbols = list(symbols)
    test_symbols = [
        item for item in all_symbols
        if str(item["path"]).startswith("tests/") or str(item["symbol"]).split(".")[-1].startswith("test_")
    ][: min(MAX_TESTS, 24)]
    non_test_symbols = [
        item for item in all_symbols
        if item not in test_symbols
    ][: max(0, MAX_SYMBOLS - len(test_symbols))]
    symbols = [*test_symbols, *non_test_symbols]
    symbols.sort(key=lambda item: (-int(item["score"]), str(item["path"]), str(item["symbol"])))
    classes = [
        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
        for item in symbols
        if item["kind"] == "class"
    ]
    functions = [
        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
        for item in symbols
        if item["kind"] in {"function", "async_function"} and not str(item["symbol"]).split(".")[-1].startswith("test_")
    ]
    tests = [
        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
        for item in symbols
        if str(item["path"]).startswith("tests/") or str(item["symbol"]).split(".")[-1].startswith("test_")
    ][:MAX_TESTS]
    excerpts: list[dict[str, Any]] = []
    by_path = {str(item["path"]): item for item in candidates}
    for symbol in symbols:
        if len(excerpts) == MAX_EXCERPTS:
            break
        item = by_path.get(str(symbol["path"]))
        if item is None:
            continue
        excerpt = _bounded_excerpt(str(item["text"]), int(symbol["line"]), int(symbol["end_line"]))
        if not excerpt.strip():
            continue
        excerpts.append(
            {
                "path": symbol["path"],
                "symbol": symbol["symbol"],
                "sha256": item["sha256"],
                "excerpt": excerpt,
            }
        )
    invariants, failure_windows, reuse_points = _gap_evidence(all_symbols, profile)
    result = {
        "schema": SCHEMA,
        "profile": profile,
        "classification": PROFILE_CLASSIFICATION[profile],
        "source_commit": source_commit,
        "implementation_map": {
            "modules": modules,
            "classes": classes[:MAX_SYMBOLS],
            "functions": functions[:MAX_SYMBOLS],
            "tables": tables[:40],
            "systemd_units": systemd_units[:20],
            "tests": tests,
            "current_invariants": invariants,
            "failure_windows": failure_windows,
            "reuse_points": reuse_points,
        },
        "bounded_excerpts": excerpts,
        "contracts": _contract_map(all_symbols, modules, _contract_terms(profile)),
    }
    return _trim_to_budget(result)
@@ -1,528 +0,0 @@
 """Canonical governed execution projection for Online Agent Tasks.
 The durable governed binding is authoritative.  Natural-language task fields and
 worker configuration are never allowed to invent repository, ref, generation, or
 idempotency coordinates.
 """
 from __future__ import annotations
 from dataclasses import asdict, dataclass
 import hashlib
 import json
 import re
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 import urllib.error
 import urllib.request
 EXECUTION_SCHEMA = "aios.online-agent.execution.v2"
 PROJECTION_SCHEMA = "aios.online-agent.task-projection.v1"
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
 BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
 KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
 PROTECTED_PREFIXES = ("main", "master", "refs/", "tags/", "tag/", "release/", "baseline/", "production/")
 MUTATION_ACTIONS = frozenset({"deterministic"})
 READ_ONLY_ACTIONS = frozenset({"source_capture", "agent_runtime"})
 SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture", "agent_runtime"})
 AGENT_RUNTIME_ADAPTERS = frozenset({"hermes", "openclaw"})
 MAX_AGENT_RUNTIME_INPUT_BYTES = 64 * 1024
 class ExecutionProjectionError(RuntimeError):
    """A canonical fail-closed projection or validation error."""
 class OnlineTaskProjectionClient:
    """Official HTTP projection client using only a control credential reference."""
    def __init__(self, api_base: str, control_token_path: Path) -> None:
        self.api_base = api_base.rstrip("/")
        self.control_token_path = Path(control_token_path)
    def _token(self) -> str:
        path = self.control_token_path
        if path.is_symlink() or not path.is_file():
            _error("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
        value = path.read_text(encoding="utf-8").strip()
        if len(value) < 32:
            _error("ONLINE_TASK_PROJECTION_CONTROL_INVALID")
        return value
    def create(
        self,
        projected_task: Mapping[str, Any],
        *,
        binding: "GovernedExecutionBinding",
    ) -> dict[str, Any]:
        body = dict(projected_task)
        payload = _canonical(body).encode("utf-8")
        request = urllib.request.Request(
            self.api_base + "/v1/tasks",
            method="POST",
            data=payload,
            headers={
                "Authorization": "Bearer " + self._token(),
                "Content-Type": "application/json",
                "Accept": "application/json",
            },
        )
        try:
            with urllib.request.urlopen(request, timeout=15) as response:
                result = json.loads(response.read().decode("utf-8"))
                status = response.status
        except urllib.error.HTTPError as exc:
            raw = exc.read(8192).decode("utf-8", "replace")
            try:
                error = json.loads(raw).get("error")
            except (AttributeError, json.JSONDecodeError):
                error = "HTTP_ERROR"
            raise ExecutionProjectionError(f"ONLINE_TASK_PROJECTION_FAILED:{exc.code}:{error}") from exc
        except (OSError, urllib.error.URLError, TimeoutError) as exc:
            raise ExecutionProjectionError("ONLINE_TASK_PROJECTION_UNAVAILABLE") from exc
        if status not in {200, 201} or not isinstance(result, dict):
            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
        if result.get("task_id") != binding.task_id or result.get("status") not in {"QUEUED", "VERIFYING", "SUCCEEDED"}:
            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
        metadata = result.get("metadata")
        if not isinstance(metadata, Mapping):
            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
        returned_execution = validate_execution_envelope(
            _object(metadata.get("execution"), "ONLINE_TASK_PROJECTION_RESPONSE_INVALID"),
            binding=binding,
        )
        submitted_metadata = _object(body.get("metadata"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID")
        submitted_execution = validate_execution_envelope(
            _object(submitted_metadata.get("execution"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID"),
            binding=binding,
        )
        if _canonical(returned_execution) != _canonical(submitted_execution):
            _error("ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID")
        return result
 def _error(code: str) -> None:
    raise ExecutionProjectionError(code)
 def _object(value: object, code: str) -> dict[str, Any]:
    if not isinstance(value, Mapping):
        _error(code)
    return dict(value)
 def _string(value: object, code: str) -> str:
    if not isinstance(value, str) or not value.strip():
        _error(code)
    return value.strip()
 def _task_id(value: object) -> str:
    value = _string(value, "TASK_ID_INVALID")
    if TASK_RE.fullmatch(value) is None:
        _error("TASK_ID_INVALID")
    return value
 def _oid(value: object, code: str) -> str:
    value = _string(value, code)
    if OID_RE.fullmatch(value) is None:
        _error(code)
    return value
 def _branch(value: object) -> str:
    value = _string(value, "TARGET_BRANCH_INVALID")
    if BRANCH_RE.fullmatch(value) is None or value.startswith(PROTECTED_PREFIXES):
        _error("TARGET_BRANCH_INVALID")
    return value
 def _generation(value: object) -> int:
    if not isinstance(value, int) or isinstance(value, bool) or value < 1:
        _error("GENERATION_INVALID")
    return value
 def _canonical(value: object) -> str:
    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
 def _digest(value: object) -> str:
    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
 def _source_signals(value: object) -> tuple[str, ...]:
    """Normalize untrusted natural-language hints before they enter a signed envelope."""
    if value is None:
        return ()
    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
        _error("SOURCE_CAPTURE_SIGNALS_INVALID")
    result: list[str] = []
    for item in value:
        if not isinstance(item, str):
            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
        text = " ".join(item.split()).strip()
        if not text:
            continue
        # Projection may accept long task prose, but execution envelopes stay bounded.
        text = text[:512].rstrip()
        if text not in result:
            result.append(text)
        if len(result) == 16:
            break
    return tuple(result)
 def _agent_runtime_input(value: object) -> dict[str, Any]:
    if not isinstance(value, Mapping):
        _error("AGENT_RUNTIME_INPUT_REQUIRED")
    raw = dict(value)
    allowed = {
        "goal", "instructions", "success_criteria", "constraints",
        "scope", "trace_id",
    }
    if set(raw) - allowed:
        _error("AGENT_RUNTIME_INPUT_FIELDS_INVALID")
    goal = _string(raw.get("goal"), "AGENT_RUNTIME_GOAL_REQUIRED")
    instructions = raw.get("instructions", "")
    if not isinstance(instructions, str):
        _error("AGENT_RUNTIME_INSTRUCTIONS_INVALID")
    criteria = raw.get("success_criteria", [])
    if not isinstance(criteria, list) or len(criteria) > 32:
        _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
    normalized_criteria: list[dict[str, str]] = []
    for item in criteria:
        if not isinstance(item, Mapping):
            _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
        criterion_id = _string(item.get("id"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
        description = _string(
            item.get("description"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID"
        )
        normalized_criteria.append(
            {"id": criterion_id[:120], "description": description[:1000]}
        )
    constraints = raw.get("constraints", {})
    if not isinstance(constraints, Mapping):
        _error("AGENT_RUNTIME_CONSTRAINTS_INVALID")
    sensitive_markers = ("token", "secret", "password", "credential", "authorization", "api_key", "apikey")
    for key in constraints:
        lowered = str(key).lower()
        if any(marker in lowered for marker in sensitive_markers):
            _error("AGENT_RUNTIME_SECRET_FIELD_DENY")
    scope = raw.get("scope", {})
    if not isinstance(scope, Mapping):
        _error("AGENT_RUNTIME_SCOPE_INVALID")
    scope = {
        "scope_type": str(scope.get("scope_type") or "legacy"),
        "tenant_id": scope.get("tenant_id"),
        "project_id": scope.get("project_id"),
    }
    if scope["scope_type"] not in {"legacy", "system", "tenant"}:
        _error("AGENT_RUNTIME_SCOPE_INVALID")
    if scope["scope_type"] == "tenant":
        if not isinstance(scope["tenant_id"], str) or not scope["tenant_id"].strip():
            _error("AGENT_RUNTIME_SCOPE_INVALID")
    elif scope["tenant_id"] not in (None, "") or scope["project_id"] not in (None, ""):
        _error("AGENT_RUNTIME_SCOPE_INVALID")
    trace_id = str(raw.get("trace_id") or "").strip()
    if not trace_id or len(trace_id) > 255:
        _error("AGENT_RUNTIME_TRACE_ID_INVALID")
    normalized = {
        "goal": goal[:12000],
        "instructions": instructions[:32000],
        "success_criteria": normalized_criteria,
        "constraints": dict(constraints),
        "scope": scope,
        "trace_id": trace_id,
    }
    if len(_canonical(normalized).encode("utf-8")) > MAX_AGENT_RUNTIME_INPUT_BYTES:
        _error("AGENT_RUNTIME_INPUT_TOO_LARGE")
    return normalized
 def _capabilities(value: object) -> tuple[str, ...]:
    if value is None:
        return ()
    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
        _error("CAPABILITY_SCOPE_INVALID")
    result = tuple(sorted({_string(item, "CAPABILITY_SCOPE_INVALID") for item in value}))
    if any(len(item) > 120 for item in result):
        _error("CAPABILITY_SCOPE_INVALID")
    return result
@dataclass(frozen=True, slots=True)
 class GovernedExecutionBinding:
    task_id: str
    job_id: str
    repository: str
    base_oid: str
    expected_branch_oid: str
    target_branch: str
    branch_mode: str
    generation: int
    idempotency_key: str
    @classmethod
    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedExecutionBinding":
        data = dict(value)
        task_id = _task_id(data.get("task_id"))
        job_id = _string(data.get("job_id"), "JOB_ID_REQUIRED")
        if TASK_RE.fullmatch(job_id) is None:
            _error("JOB_ID_INVALID")
        repository = _string(data.get("repository"), "REPOSITORY_INVALID")
        if repository != "aios/aios":
            _error("WRONG_REPOSITORY_ENVELOPE_DENY")
        base_oid = _oid(data.get("base_oid"), "BASE_OID_INVALID")
        expected = _oid(data.get("expected_branch_oid"), "EXPECTED_BRANCH_OID_INVALID")
        target = _branch(data.get("target_branch"))
        mode = _string(data.get("branch_mode"), "BRANCH_MODE_MISSING")
        if mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
            _error("BRANCH_MODE_INVALID")
        generation = _generation(data.get("generation"))
        if mode == "CREATE_NEW" and expected != base_oid:
            _error("EXPECTED_BASE_CONFLICT")
        key = _string(data.get("idempotency_key"), "IDEMPOTENCY_KEY_INVALID")
        if KEY_RE.fullmatch(key) is None:
            _error("IDEMPOTENCY_KEY_INVALID")
        return cls(task_id, job_id, repository, base_oid, expected, target, mode, generation, key)
    def public(self) -> dict[str, Any]:
        return asdict(self)
 def binding_from_bootstrap(value: Mapping[str, Any]) -> GovernedExecutionBinding:
    return GovernedExecutionBinding.from_mapping(value)
 def validate_execution_envelope(
    value: Mapping[str, Any],
    *,
    binding: GovernedExecutionBinding | None = None,
    worker_capabilities: Sequence[str] | None = None,
 ) -> dict[str, Any]:
    envelope = dict(value)
    if envelope.get("schema") != EXECUTION_SCHEMA:
        _error("EXECUTION_ENVELOPE_SCHEMA_VALIDATION")
    candidate = GovernedExecutionBinding.from_mapping(envelope)
    if binding is not None and candidate != binding:
        comparisons = (
            (candidate.task_id, binding.task_id, "TASK_BINDING_CONFLICT"),
            (candidate.job_id, binding.job_id, "JOB_BINDING_CONFLICT"),
            (candidate.repository, binding.repository, "WRONG_REPOSITORY_ENVELOPE_DENY"),
            (candidate.base_oid, binding.base_oid, "WRONG_BASE_ENVELOPE_DENY"),
            (candidate.expected_branch_oid, binding.expected_branch_oid, "WRONG_EXPECTED_HEAD_ENVELOPE_DENY"),
            (candidate.target_branch, binding.target_branch, "WRONG_BRANCH_ENVELOPE_DENY"),
            (candidate.generation, binding.generation, "WRONG_GENERATION_ENVELOPE_DENY"),
            (candidate.branch_mode, binding.branch_mode, "BRANCH_MODE_BINDING_CONFLICT"),
            (candidate.idempotency_key, binding.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
        )
        for actual, expected, code in comparisons:
            if actual != expected:
                _error(code)
    action = _string(envelope.get("action"), "EXECUTION_ACTION_MISSING")
    if action not in SUPPORTED_ACTIONS:
        _error("EXECUTION_ACTION_UNSUPPORTED")
    capability_scope = _capabilities(envelope.get("capability_scope"))
    if worker_capabilities is not None and not set(capability_scope).issubset(set(worker_capabilities)):
        _error("CAPABILITY_MISMATCH_DENY")
    workspace = _object(envelope.get("workspace"), "WORKSPACE_POLICY_REQUIRED")
    if workspace.get("authority_git_dir") != "/data/aios-gitops/repo.git" or workspace.get("read_only_repository") is not True:
        _error("WORKSPACE_POLICY_DENY")
    governance = _object(envelope.get("governance"), "GOVERNANCE_POLICY_REQUIRED")
    governed_coordinates = (
        (governance.get("task_id"), candidate.task_id, "TASK_BINDING_CONFLICT"),
        (governance.get("job_id"), candidate.job_id, "JOB_BINDING_CONFLICT"),
        (governance.get("idempotency_key"), candidate.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
    )
    for actual_coordinate, expected_coordinate, code in governed_coordinates:
        if actual_coordinate != expected_coordinate:
            _error(code)
    commit_key = _string(governance.get("commit_idempotency_key"), "COMMIT_IDEMPOTENCY_KEY_INVALID")
    if KEY_RE.fullmatch(commit_key) is None:
        _error("COMMIT_IDEMPOTENCY_KEY_INVALID")
    if governance.get("writer_lease") is not (action in MUTATION_ACTIONS):
        _error("WRITER_LEASE_POLICY_DENY")
    for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"):
        if governance.get(field, False) is not False:
            _error("POLICY_DENY")
    changes = envelope.get("change_set")
    verification = envelope.get("verification")
    if not isinstance(changes, list) or not isinstance(verification, list):
        _error("EXECUTION_OPERATIONS_INVALID")
    if action == "source_capture":
        if changes or verification:
            _error("SOURCE_CAPTURE_MUTATION_DENY")
        signals = list(_source_signals(envelope.get("source_signals") or []))
        if envelope.get("source_signals") != signals:
            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
        if envelope.get("runtime_input") not in (None, {}):
            _error("SOURCE_CAPTURE_RUNTIME_INPUT_DENY")
    elif action == "agent_runtime":
        if changes or verification:
            _error("AGENT_RUNTIME_MUTATION_DENY")
        adapter = str(envelope.get("adapter") or "")
        if adapter not in AGENT_RUNTIME_ADAPTERS:
            _error("AGENT_RUNTIME_ADAPTER_INVALID")
        runtime_input = _agent_runtime_input(envelope.get("runtime_input"))
        if envelope.get("runtime_input") != runtime_input:
            _error("AGENT_RUNTIME_INPUT_NOT_CANONICAL")
        required_runtime_capability = f"agent.runtime.{adapter}"
        if required_runtime_capability not in capability_scope:
            _error("AGENT_RUNTIME_CAPABILITY_REQUIRED")
        if envelope.get("source_signals") not in (None, []):
            _error("AGENT_RUNTIME_SOURCE_SIGNALS_DENY")
    elif not changes:
        _error("CHANGE_SET_INVALID")
    declared = str(envelope.get("execution_digest") or "")
    material = {key: item for key, item in envelope.items() if key != "execution_digest"}
    actual = _digest(material)
    if declared != actual:
        _error("EXECUTION_DIGEST_INVALID")
    return {**material, "execution_digest": actual}
 def project_execution_envelope(
    binding: GovernedExecutionBinding,
    execution_request: Mapping[str, Any] | None = None,
    *,
    required_capabilities: Sequence[str] = (),
 ) -> dict[str, Any]:
    request = dict(execution_request or {})
    action = str(request.get("action") or "source_capture")
    if action not in SUPPORTED_ACTIONS:
        _error("EXECUTION_ACTION_UNSUPPORTED")
    capabilities = _capabilities(request.get("capability_scope", required_capabilities))
    governance = {
        "task_id": binding.task_id,
        "job_id": binding.job_id,
        "idempotency_key": binding.idempotency_key,
        "commit_idempotency_key": str(request.get("commit_idempotency_key") or f"{binding.task_id}-commit-g{binding.generation}"),
        "writer_lease": action in MUTATION_ACTIONS,
        "main_write": False,
        "production_write": False,
        "tag_write": False,
        "baseline_write": False,
        "force_push": False,
        "protected_ref_bypass": False,
    }
    supplied_governance = request.get("governance")
    if supplied_governance is not None:
        governance.update(_object(supplied_governance, "GOVERNANCE_POLICY_REQUIRED"))
    material: dict[str, Any] = {
        "schema": EXECUTION_SCHEMA,
        **binding.public(),
        "action": action,
        "adapter": str(
            request.get("adapter")
            or ("deterministic" if action == "deterministic" else "source_capture")
        ),
        "capability_scope": list(capabilities),
        "change_set": list(request.get("change_set") or []),
        "verification": list(request.get("verification") or []),
        "source_signals": list(_source_signals(request.get("source_signals") or [])) if action == "source_capture" else [],
        "runtime_input": _agent_runtime_input(request.get("runtime_input")) if action == "agent_runtime" else {},
        "governance": governance,
        "workspace": {
            "authority_git_dir": "/data/aios-gitops/repo.git",
            "read_only_repository": True,
            "cleanup_policy": "always",
        },
    }
    envelope = {**material, "execution_digest": _digest(material)}
    return validate_execution_envelope(envelope, binding=binding)
 def project_online_task(
    binding: GovernedExecutionBinding,
    task_request: Mapping[str, Any],
    execution_request: Mapping[str, Any] | None = None,
 ) -> dict[str, Any]:
    request = dict(task_request)
    required = _capabilities(request.get("required_capabilities"))
    execution_value = dict(execution_request or {})
    if str(execution_value.get("action") or "source_capture") == "agent_runtime":
        adapter = str(execution_value.get("adapter") or "")
        if adapter not in AGENT_RUNTIME_ADAPTERS:
            _error("AGENT_RUNTIME_ADAPTER_INVALID")
        runtime_input = execution_value.get("runtime_input")
        tenant_id = request.get("tenant_id")
        project_id = request.get("project_id")
        declared_scope = str(
            request.get("scope_type")
            or ("tenant" if isinstance(tenant_id, str) and tenant_id.strip() else "legacy")
        )
        if runtime_input is None:
            runtime_input = {
                "goal": request.get("goal"),
                "instructions": request.get("instructions") or "",
                "success_criteria": request.get("success_criteria") or [],
                "constraints": request.get("constraints") or {},
            }
        elif not isinstance(runtime_input, Mapping):
            _error("AGENT_RUNTIME_INPUT_REQUIRED")
        runtime_input = dict(runtime_input)
        # Scope/trace are authoritative Task identity, never caller-selected runtime hints.
        runtime_input["scope"] = {
            "scope_type": declared_scope,
            "tenant_id": tenant_id,
            "project_id": project_id,
        }
        runtime_input["trace_id"] = str(
            request.get("trace_id")
            or request.get("run_id")
            or binding.task_id
        )
        execution_value["runtime_input"] = runtime_input
    execution = project_execution_envelope(
        binding,
        execution_value,
        required_capabilities=required,
    )
    metadata = dict(request.get("metadata") or {})
    if "execution" in metadata:
        validate_execution_envelope(_object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"), binding=binding)
        if metadata["execution"] != execution:
            _error("EXECUTION_PROJECTION_CONFLICT")
    metadata["execution"] = execution
    metadata["execution_projection"] = {
        "schema": PROJECTION_SCHEMA,
        "task_id": binding.task_id,
        "job_id": binding.job_id,
        "execution_digest": execution["execution_digest"],
    }
    return {
        **request,
        "task_id": binding.task_id,
        "metadata": metadata,
        "required_capabilities": list(required),
        "idempotency_key": str(request.get("idempotency_key") or f"online-task:{binding.idempotency_key}"),
    }
 def resolve_task_execution(
    task: Mapping[str, Any],
    binding: GovernedExecutionBinding,
    *,
    worker_capabilities: Sequence[str] | None = None,
 ) -> tuple[dict[str, Any], str]:
    metadata = task.get("metadata")
    if isinstance(metadata, Mapping) and "execution" in metadata:
        value = validate_execution_envelope(
            _object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"),
            binding=binding,
            worker_capabilities=worker_capabilities,
        )
        return value, "persisted"
    projected = project_execution_envelope(
        binding,
        {"action": "source_capture", "capability_scope": task.get("required_capabilities") or []},
        required_capabilities=task.get("required_capabilities") or [],
    )
    validate_execution_envelope(projected, binding=binding, worker_capabilities=worker_capabilities)
    return projected, "recovered_projection"
@@ -1,187 +0,0 @@
 """Durable, authority-bound deterministic execution plans for Online Agent Tasks."""
 from __future__ import annotations
 from contextlib import contextmanager
 from dataclasses import dataclass
 import fcntl
 import hashlib
 import json
 from pathlib import Path
 from typing import Any, Mapping
 from aios_online_agent_execution import (
    GovernedExecutionBinding,
    project_execution_envelope,
 )
 class ExecutionPlanError(RuntimeError):
    pass
 def _canonical(value: object) -> bytes:
    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
 def _digest(value: object) -> str:
    return hashlib.sha256(_canonical(value)).hexdigest()
 def _task_key(task_id: str) -> str:
    readable = "".join(ch if ch.isalnum() or ch in "._-" else "-" for ch in task_id).strip("-")[:72] or "task"
    return readable + "-" + hashlib.sha256(task_id.encode("utf-8")).hexdigest()[:24]
@dataclass(frozen=True)
 class ExecutionPlanRecord:
    task_id: str
    job_id: str
    source_head_oid: str
    generation: int
    idempotency_key: str
    plan_digest: str
    execution: dict[str, Any]
    def public(self) -> dict[str, Any]:
        return {
            "schema": "aios.online-agent.plan-record.v1",
            "task_id": self.task_id,
            "job_id": self.job_id,
            "source_head_oid": self.source_head_oid,
            "generation": self.generation,
            "idempotency_key": self.idempotency_key,
            "plan_digest": self.plan_digest,
            "execution": dict(self.execution),
        }
 class ExecutionPlanStore:
    def __init__(self, root: Path) -> None:
        self.root = Path(root)
        self.root.mkdir(parents=True, exist_ok=True)
    def _path(self, task_id: str) -> Path:
        return self.root / (_task_key(task_id) + ".json")
    @contextmanager
    def _lock(self, task_id: str):
        path = self.root / (_task_key(task_id) + ".lock")
        with path.open("a+b") as handle:
            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
            try:
                yield
            finally:
                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
    @staticmethod
    def _source_head(binding: GovernedExecutionBinding) -> str:
        return binding.expected_branch_oid if binding.branch_mode == "CONTINUE_EXISTING" else binding.base_oid
    def _read(self, task_id: str) -> ExecutionPlanRecord | None:
        path = self._path(task_id)
        if not path.is_file() or path.is_symlink():
            return None
        value = json.loads(path.read_text(encoding="utf-8"))
        if not isinstance(value, Mapping) or value.get("schema") != "aios.online-agent.plan-record.v1":
            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
        execution = value.get("execution")
        if not isinstance(execution, Mapping):
            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
        return ExecutionPlanRecord(
            task_id=str(value.get("task_id") or ""),
            job_id=str(value.get("job_id") or ""),
            source_head_oid=str(value.get("source_head_oid") or ""),
            generation=int(value.get("generation") or 0),
            idempotency_key=str(value.get("idempotency_key") or ""),
            plan_digest=str(value.get("plan_digest") or ""),
            execution=dict(execution),
        )
    def register(
        self,
        binding: GovernedExecutionBinding,
        request: Mapping[str, Any],
    ) -> dict[str, Any]:
        with self._lock(binding.task_id):
            return self._register_locked(binding, request)
    def _register_locked(
        self,
        binding: GovernedExecutionBinding,
        request: Mapping[str, Any],
    ) -> dict[str, Any]:
        if request.get("schema") != "aios.online-agent.plan.v1":
            raise ExecutionPlanError("EXECUTION_PLAN_SCHEMA_INVALID")
        if request.get("task_id") != binding.task_id or request.get("job_id") != binding.job_id:
            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
        if int(request.get("generation") or 0) != binding.generation:
            raise ExecutionPlanError("EXECUTION_PLAN_GENERATION_CONFLICT")
        source_head = str(request.get("source_head_oid") or "")
        if source_head != self._source_head(binding):
            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_CONFLICT")
        key = str(request.get("idempotency_key") or "")
        if len(key) < 8:
            raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_INVALID")
        execution_request = request.get("execution")
        if not isinstance(execution_request, Mapping) or execution_request.get("action") != "deterministic":
            raise ExecutionPlanError("EXECUTION_PLAN_DETERMINISTIC_REQUIRED")
        envelope = project_execution_envelope(binding, execution_request)
        material = {
            "task_id": binding.task_id,
            "job_id": binding.job_id,
            "source_head_oid": source_head,
            "generation": binding.generation,
            "idempotency_key": key,
            "execution": dict(execution_request),
        }
        plan_digest = _digest(material)
        existing = self._read(binding.task_id)
        expected_previous = request.get("expected_previous_plan_digest")
        if existing is not None:
            if existing.idempotency_key == key:
                if existing.plan_digest != plan_digest:
                    raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_CONFLICT")
                return {**existing.public(), "idempotent": True, "execution_digest": envelope["execution_digest"]}
            if expected_previous != existing.plan_digest:
                raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
            if existing.source_head_oid != source_head:
                raise ExecutionPlanError("EXECUTION_PLAN_STALE_REPLACEMENT_DENY")
        elif expected_previous not in (None, ""):
            raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
        record = ExecutionPlanRecord(
            task_id=binding.task_id,
            job_id=binding.job_id,
            source_head_oid=source_head,
            generation=binding.generation,
            idempotency_key=key,
            plan_digest=plan_digest,
            execution=dict(execution_request),
        )
        path = self._path(binding.task_id)
        temporary = path.with_suffix(".tmp")
        temporary.write_text(
            json.dumps(record.public(), sort_keys=True, separators=(",", ":")),
            encoding="utf-8",
        )
        temporary.replace(path)
        return {**record.public(), "idempotent": False, "execution_digest": envelope["execution_digest"]}
    def resolve(self, binding: GovernedExecutionBinding) -> dict[str, Any] | None:
        record = self._read(binding.task_id)
        if record is None:
            return None
        if (
            record.task_id != binding.task_id
            or record.job_id != binding.job_id
            or record.generation != binding.generation
        ):
            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
        if record.source_head_oid != self._source_head(binding):
            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_DRIFT")
        envelope = project_execution_envelope(binding, record.execution)
        return {
            "execution": dict(record.execution),
            "plan_digest": record.plan_digest,
            "execution_digest": envelope["execution_digest"],
        }
@@ -1,144 +0,0 @@
 """HTTP adapter for audited Owner authorization and writer provisioning.
 This module layers on top of ``aios_authorized_task_writer_api`` so existing
 routes and the legacy exact ``writer:provision`` route remain available. The
 new endpoint does not mint or modify bearer credentials. It authenticates an
 existing, non-wildcard, explicitly allow-listed Owner credential and then
 invokes the audited broker.
 Endpoint:
    POST /api/governance/owner-authorizations
 """
 from __future__ import annotations
 import os
 import urllib.parse
 from typing import Any, Mapping
 import aios_authorized_task_writer_api as bridge_api
 from authorized_task_writer_provisioning import ProvisioningError
 from owner_authorization_broker import (
    OwnerAuthorizationBroker,
    OwnerAuthorizationError,
    OwnerPrincipal,
 )
 api = bridge_api.api
 _original_do_post = api.H.do_POST
 _ENDPOINT = "/api/governance/owner-authorizations"
 def _enabled() -> bool:
    return os.getenv(
        "AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED", ""
    ).strip().lower() in {"1", "true", "yes", "on"}
 def _configured_intake_scope() -> str:
    scopes = [
        item.strip()
        for item in os.getenv(
            "AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES", ""
        ).split(",")
        if item.strip()
    ]
    if len(scopes) != 1:
        raise OwnerAuthorizationError(
            "EXACTLY_ONE_HTTP_INTAKE_SCOPE_REQUIRED", 503
        )
    scope = scopes[0]
    if scope == "writer:provision" or scope == "*" or scope.endswith(":*"):
        raise OwnerAuthorizationError("HTTP_INTAKE_SCOPE_REJECTED", 503)
    return scope
 def _scope_set(auth: Mapping[str, Any]) -> frozenset[str]:
    raw = auth.get("scopes")
    if raw is None:
        raw = auth.get("scope")
    if raw is None:
        return frozenset()
    if isinstance(raw, str):
        candidates = raw.replace(",", " ").split()
    elif isinstance(raw, (list, tuple, set, frozenset)):
        candidates = [str(item) for item in raw]
    else:
        raise OwnerAuthorizationError("OWNER_SCOPE_EVIDENCE_INVALID", 403)
    return frozenset(item.strip() for item in candidates if item.strip())
 def _credential_id(auth: Mapping[str, Any]) -> str:
    for name in (
        "credential_id",
        "token_id",
        "key_id",
        "auth_id",
    ):
        value = str(auth.get(name) or "").strip()
        if value:
            return value
    return ""
 def _authenticate_existing_owner(handler) -> OwnerPrincipal | None:
    scope = _configured_intake_scope()
    auth = handler.need(scope)
    if not auth:
        return None
    if auth.get("role") != "owner":
        handler.sendj({"error": "OWNER_ROLE_REQUIRED"}, 403)
        return None
    identity = str(auth.get("account") or auth.get("identity") or "").strip()
    if not identity:
        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
        return None
    scopes = _scope_set(auth)
    if any(item == "*" or item.endswith(":*") for item in scopes):
        handler.sendj(
            {"error": "WILDCARD_OWNER_CREDENTIAL_REJECTED"}, 403
        )
        return None
    return OwnerPrincipal(
        identity=identity,
        role="owner",
        authenticated_scope=scope,
        token_scopes=scopes,
        credential_id=_credential_id(auth),
    )
 def _broker_do_post(self):
    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
    if path != _ENDPOINT:
        return _original_do_post(self)
    if not _enabled():
        return self.sendj(
            {"error": "OWNER_AUTHORIZATION_BROKER_DISABLED"}, 503
        )
    try:
        principal = _authenticate_existing_owner(self)
        if principal is None:
            return
        data = self.body()
        result = OwnerAuthorizationBroker().authorize_and_provision(
            data, principal
        )
        return self.sendj(result)
    except (OwnerAuthorizationError, ProvisioningError) as exc:
        body = {"error": exc.code}
        if exc.details:
            body["details"] = exc.details
        return self.sendj(body, exc.status)
    except Exception:
        # Never expose registry data, bearer tokens, signer output or traceback.
        return self.sendj(
            {"error": "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR"}, 500
        )
 api.H.do_POST = _broker_do_post
 if __name__ == "__main__":
    api.main()
@@ -1,160 +0,0 @@
 #!/usr/bin/env python3
 """Loopback-only HTTP API for the task identity overlay.
 Endpoints:
  GET  /healthz
  POST /api/governance/owner-authorizations
 The API authenticates only the short-lived overlay credential. It does not read
 or modify the global bearer-token registry.
 """
 from __future__ import annotations
 import json
 import os
 import urllib.parse
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from typing import Any
 from authorized_task_writer_provisioning import ProvisioningError
 from owner_authorization_broker import OwnerAuthorizationError
 from task_identity_overlay import (
    MAX_BODY_BYTES,
    IdentityOverlayConfig,
    IdentityOverlayError,
    TaskIdentityOverlayService,
 )
 _ENDPOINT = "/api/governance/owner-authorizations"
 def _enabled() -> bool:
    return os.getenv(
        "AIOS_GITOPS_IDENTITY_OVERLAY_ENABLED", ""
    ).strip().lower() in {"1", "true", "yes", "on"}
 def _bearer(header: str) -> str:
    prefix = "Bearer "
    if not header.startswith(prefix):
        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
    token = header[len(prefix):].strip()
    if not token or len(token) > 4096:
        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
    return token
 class OverlayHandler(BaseHTTPRequestHandler):
    server_version = "aios-task-identity-overlay/1"
    sys_version = ""
    @property
    def overlay(self) -> TaskIdentityOverlayService:
        return self.server.overlay  # type: ignore[attr-defined]
    def log_message(self, format: str, *args: Any) -> None:
        # Never log Authorization or request bodies.
        return
    def _send(self, status: int, value: dict[str, Any]) -> None:
        payload = (
            json.dumps(
                value,
                ensure_ascii=False,
                sort_keys=True,
                separators=(",", ":"),
            )
            + "\n"
        ).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Cache-Control", "no-store")
        self.send_header("Content-Length", str(len(payload)))
        self.end_headers()
        self.wfile.write(payload)
    def _body(self) -> dict[str, Any]:
        try:
            length = int(self.headers.get("Content-Length", "0"))
        except ValueError:
            raise IdentityOverlayError("OVERLAY_CONTENT_LENGTH_INVALID") from None
        if length <= 0 or length > MAX_BODY_BYTES:
            raise IdentityOverlayError("OVERLAY_BODY_SIZE_REJECTED", 413)
        raw = self.rfile.read(length)
        try:
            value = json.loads(raw)
        except (UnicodeDecodeError, json.JSONDecodeError):
            raise IdentityOverlayError("OVERLAY_BODY_JSON_INVALID") from None
        if not isinstance(value, dict):
            raise IdentityOverlayError("OVERLAY_BODY_OBJECT_REQUIRED")
        return value
    def do_GET(self) -> None:
        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
        if path != "/healthz":
            self._send(404, {"error": "NOT_FOUND"})
            return
        self._send(
            200,
            {
                "service": "aios-task-identity-overlay",
                "status": "active" if _enabled() else "disabled",
                "global_token_registry_used": False,
                "loopback_only": True,
            },
        )
    def do_POST(self) -> None:
        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
        if path != _ENDPOINT:
            self._send(404, {"error": "NOT_FOUND"})
            return
        if not _enabled():
            self._send(503, {"error": "IDENTITY_OVERLAY_DISABLED"})
            return
        try:
            token = _bearer(self.headers.get("Authorization", ""))
            result = self.overlay.provision(self._body(), token)
            self._send(200, result)
        except (IdentityOverlayError, OwnerAuthorizationError, ProvisioningError) as exc:
            body: dict[str, Any] = {"error": exc.code}
            if getattr(exc, "details", None):
                body["details"] = exc.details
            self._send(exc.status, body)
        except Exception:
            self._send(500, {"error": "IDENTITY_OVERLAY_API_INTERNAL_ERROR"})
 class OverlayServer(ThreadingHTTPServer):
    allow_reuse_address = True
    def __init__(
        self,
        address: tuple[str, int],
        overlay: TaskIdentityOverlayService,
    ) -> None:
        super().__init__(address, OverlayHandler)
        self.overlay = overlay
 def main() -> None:
    host = os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_HOST", "127.0.0.1")
    if host not in {"127.0.0.1", "::1", "localhost"}:
        raise SystemExit("identity overlay must listen on loopback")
    try:
        port = int(os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_PORT", "19864"))
    except ValueError:
        raise SystemExit("invalid overlay port") from None
    if not 1024 <= port <= 65535:
        raise SystemExit("invalid overlay port")
    config = IdentityOverlayConfig.from_environment()
    server = OverlayServer(
        (host, port),
        TaskIdentityOverlayService(config),
    )
    server.serve_forever(poll_interval=0.25)
 if __name__ == "__main__":
    main()
@@ -1,92 +0,0 @@
 #!/usr/bin/env python3
 """Root-governed CLI for issuing and revoking task identity overlays.
 The CLI never prints the bearer token. It returns only the root-owned secret
 reference and non-secret metadata.
 """
 from __future__ import annotations
 import argparse
 import json
 import os
 import sys
 from pathlib import Path
 from task_identity_overlay import (
    IdentityOverlayConfig,
    IdentityOverlayError,
    TaskIdentityOverlayStore,
 )
 def _write_result(path: str, value: dict) -> None:
    data = json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n"
    if path == "-":
        sys.stdout.write(data)
        return
    target = Path(path)
    target.parent.mkdir(parents=True, exist_ok=True)
    target.write_text(data, encoding="utf-8")
    os.chmod(target, 0o600)
 def parser() -> argparse.ArgumentParser:
    value = argparse.ArgumentParser(
        description="Issue/status/revoke a task-scoped identity overlay"
    )
    sub = value.add_subparsers(dest="command", required=True)
    issue = sub.add_parser("issue")
    issue.add_argument("--ttl-seconds", type=int, default=900)
    issue.add_argument("--authorization-assertion-ref", required=True)
    issue.add_argument(
        "--operator-identity",
        default=os.getenv("SUDO_USER") or os.getenv("USER") or "root",
    )
    issue.add_argument("--result-json", default="-")
    status = sub.add_parser("status")
    status.add_argument("--overlay-id", required=True)
    status.add_argument("--result-json", default="-")
    revoke = sub.add_parser("revoke")
    revoke.add_argument("--overlay-id", required=True)
    revoke.add_argument("--reason", required=True)
    revoke.add_argument("--result-json", default="-")
    return value
 def main() -> int:
    args = parser().parse_args()
    try:
        store = TaskIdentityOverlayStore(
            IdentityOverlayConfig.from_environment()
        )
        if args.command == "issue":
            result = store.issue(
                ttl_seconds=args.ttl_seconds,
                authorization_assertion_ref=args.authorization_assertion_ref,
                operator_identity=args.operator_identity,
            )
        elif args.command == "status":
            result = store.status(args.overlay_id)
        else:
            result = store.revoke(args.overlay_id, reason=args.reason)
        _write_result(args.result_json, result)
        return 0
    except IdentityOverlayError as exc:
        body = {"status": "BLOCKED", "error": exc.code}
        if exc.details:
            body["details"] = exc.details
        _write_result(getattr(args, "result_json", "-"), body)
        return 2
    except Exception:
        _write_result(
            getattr(args, "result_json", "-"),
            {"status": "FAILED", "error": "IDENTITY_OVERLAY_CLI_INTERNAL_ERROR"},
        )
        return 1
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,462 +0,0 @@
 """Self-healing availability guard for persistent Online Agent workers.
 The guard never claims Tasks and never writes Task/Job/Git databases. It only:
 - ensures required worker/executor systemd units are enabled + active;
 - checks worker-owned liveness JSON written by the real poll/heartbeat loop;
 - restarts an active worker only when its liveness is stale;
 - honors an explicit maintenance inhibit file;
 - writes a bounded status JSON under /run for observability.
 Idle liveness is the successful poll loop itself. Busy liveness is refreshed by the
 Task lease-heartbeat thread, so long-running Tasks are not mistaken for hung workers.
 """
 from __future__ import annotations
 from dataclasses import asdict, dataclass
 import argparse
 import json
 import os
 from pathlib import Path
 import shlex
 import subprocess
 import tempfile
 import time
 from typing import Any, Callable, Mapping, Sequence
 SCHEMA = "aios.worker-availability.status.v1"
 DEFAULT_WORKER_UNITS = (
    "aios-online-agent-worker-20260815.service",
    "aios-hermes-online-agent-worker.service",
    "aios-openclaw-online-agent-worker.service",
 )
 DEFAULT_DEPENDENCY_UNITS = (
    "aios-external-agent-executor.service",
 )
 DEFAULT_RUN_ROOT = Path("/run/aios-worker-availability")
 DEFAULT_STATUS = DEFAULT_RUN_ROOT / "status.json"
 DEFAULT_RECOVERY = DEFAULT_RUN_ROOT / "recovery.json"
 DEFAULT_INHIBIT = DEFAULT_RUN_ROOT / "maintenance.lock"
 DEFAULT_MAX_STALE_SECONDS = 90
 DEFAULT_RESTART_COOLDOWN_SECONDS = 60
 DEFAULT_STARTUP_WAIT_SECONDS = 10
 ACCEPTED_ENABLED_STATES = frozenset({"enabled", "enabled-runtime", "static", "indirect", "generated"})
 class AvailabilityGuardError(RuntimeError):
    pass
@dataclass(frozen=True)
 class UnitSnapshot:
    unit: str
    role: str
    load_state: str
    active_state: str
    unit_file_state: str
    enabled_ok: bool
    liveness_path: str | None = None
    liveness_state: str | None = None
    last_seen_epoch: float | None = None
    liveness_age_seconds: float | None = None
    fresh: bool | None = None
    action: str = "NONE"
    detail: str | None = None
 class Systemd:
    def __init__(
        self,
        runner: Callable[..., subprocess.CompletedProcess[str]] | None = None,
    ) -> None:
        self.runner = runner or subprocess.run
    def _run(self, args: Sequence[str], *, check: bool = False) -> subprocess.CompletedProcess[str]:
        result = self.runner(
            ["/usr/bin/systemctl", *args],
            text=True,
            capture_output=True,
            check=False,
            timeout=20,
        )
        if check and result.returncode != 0:
            raise AvailabilityGuardError(
                "SYSTEMD_COMMAND_FAILED:"
                + ":".join(args)
                + ":"
                + str(result.returncode)
            )
        return result
    def property(self, unit: str, name: str) -> str:
        result = self._run(["show", unit, f"--property={name}", "--value"])
        if result.returncode != 0:
            return ""
        return result.stdout.strip()
    def environment(self, unit: str) -> dict[str, str]:
        text = self.property(unit, "Environment")
        result: dict[str, str] = {}
        for item in shlex.split(text):
            if "=" not in item:
                continue
            key, value = item.split("=", 1)
            result[key] = value
        return result
    def enable(self, unit: str) -> None:
        self._run(["enable", unit], check=True)
    def start(self, unit: str) -> None:
        self._run(["start", unit], check=True)
    def restart(self, unit: str) -> None:
        self._run(["restart", unit], check=True)
 def _atomic_json(path: Path, value: Mapping[str, Any]) -> None:
    path.parent.mkdir(parents=True, exist_ok=True, mode=0o755)
    if path.parent.is_symlink() or path.is_symlink():
        raise AvailabilityGuardError("STATUS_PATH_SYMLINK_REJECTED")
    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
    try:
        os.fchmod(fd, 0o644)
        with os.fdopen(fd, "w", encoding="utf-8") as handle:
            json.dump(value, handle, ensure_ascii=False, sort_keys=True, indent=2)
            handle.write("\n")
            handle.flush()
            os.fsync(handle.fileno())
        os.replace(temporary, path)
        os.chmod(path, 0o644)
    finally:
        if os.path.exists(temporary):
            os.unlink(temporary)
 def _load_json(path: Path) -> dict[str, Any] | None:
    if path.is_symlink() or not path.is_file():
        return None
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (OSError, json.JSONDecodeError):
        return None
    return dict(value) if isinstance(value, Mapping) else None
 def _state_root(environment: Mapping[str, str], unit: str) -> Path:
    explicit = environment.get("AIOS_WORKER_STATE_ROOT")
    if explicit:
        return Path(explicit)
    fallbacks = {
        "aios-online-agent-worker-20260815.service": Path(
            "/var/lib/aios-online-agent-worker-20260815"
        ),
        "aios-hermes-online-agent-worker.service": Path(
            "/var/lib/aios-online-agent-hermes"
        ),
        "aios-openclaw-online-agent-worker.service": Path(
            "/var/lib/aios-online-agent-openclaw"
        ),
    }
    if unit not in fallbacks:
        raise AvailabilityGuardError("WORKER_STATE_ROOT_UNAVAILABLE:" + unit)
    return fallbacks[unit]
 def _liveness_path(environment: Mapping[str, str], unit: str) -> Path:
    explicit = environment.get("AIOS_WORKER_LIVENESS_PATH")
    if explicit:
        return Path(explicit)
    return _state_root(environment, unit) / "worker-liveness.json"
 class AvailabilityGuard:
    def __init__(
        self,
        *,
        systemd: Systemd | None = None,
        worker_units: Sequence[str] = DEFAULT_WORKER_UNITS,
        dependency_units: Sequence[str] = DEFAULT_DEPENDENCY_UNITS,
        status_path: Path = DEFAULT_STATUS,
        recovery_path: Path = DEFAULT_RECOVERY,
        inhibit_path: Path = DEFAULT_INHIBIT,
        max_stale_seconds: int = DEFAULT_MAX_STALE_SECONDS,
        restart_cooldown_seconds: int = DEFAULT_RESTART_COOLDOWN_SECONDS,
        startup_wait_seconds: int = DEFAULT_STARTUP_WAIT_SECONDS,
        now_fn: Callable[[], float] = time.time,
        sleep_fn: Callable[[float], None] = time.sleep,
    ) -> None:
        self.systemd = systemd or Systemd()
        self.worker_units = tuple(worker_units)
        self.dependency_units = tuple(dependency_units)
        self.status_path = Path(status_path)
        self.recovery_path = Path(recovery_path)
        self.inhibit_path = Path(inhibit_path)
        self.max_stale_seconds = int(max_stale_seconds)
        self.restart_cooldown_seconds = int(restart_cooldown_seconds)
        self.startup_wait_seconds = int(startup_wait_seconds)
        self.now_fn = now_fn
        self.sleep_fn = sleep_fn
        if self.max_stale_seconds < 15:
            raise AvailabilityGuardError("MAX_STALE_SECONDS_TOO_SMALL")
        if self.restart_cooldown_seconds < 15:
            raise AvailabilityGuardError("RESTART_COOLDOWN_TOO_SMALL")
        if self.startup_wait_seconds < 0 or self.startup_wait_seconds > 60:
            raise AvailabilityGuardError("STARTUP_WAIT_INVALID")
    def _recovery_state(self) -> dict[str, float]:
        value = _load_json(self.recovery_path) or {}
        raw = value.get("last_restart_epoch")
        if not isinstance(raw, Mapping):
            return {}
        result: dict[str, float] = {}
        for unit, epoch in raw.items():
            try:
                result[str(unit)] = float(epoch)
            except (TypeError, ValueError):
                continue
        return result
    def _save_recovery_state(self, state: Mapping[str, float]) -> None:
        _atomic_json(
            self.recovery_path,
            {
                "schema": "aios.worker-availability.recovery.v1",
                "last_restart_epoch": dict(state),
            },
        )
    def _basic_snapshot(self, unit: str, role: str) -> tuple[str, str, str, bool]:
        load = self.systemd.property(unit, "LoadState")
        active = self.systemd.property(unit, "ActiveState")
        enabled = self.systemd.property(unit, "UnitFileState")
        return load, active, enabled, enabled in ACCEPTED_ENABLED_STATES
    def _ensure_enabled_active(self, unit: str, role: str) -> tuple[str, bool]:
        load, active, enabled, enabled_ok = self._basic_snapshot(unit, role)
        if load != "loaded":
            raise AvailabilityGuardError("REQUIRED_UNIT_NOT_LOADED:" + unit)
        action = "NONE"
        if not enabled_ok:
            self.systemd.enable(unit)
            action = "ENABLE"
        if active != "active":
            self.systemd.start(unit)
            action = "START" if action == "NONE" else "ENABLE_START"
        return action, active == "active"
    def _wait_for_liveness(self, path: Path) -> dict[str, Any] | None:
        deadline = self.now_fn() + self.startup_wait_seconds
        while True:
            value = _load_json(path)
            if value is not None:
                try:
                    epoch = float(value.get("last_seen_epoch"))
                except (TypeError, ValueError):
                    epoch = 0.0
                if epoch > 0 and self.now_fn() - epoch <= self.max_stale_seconds:
                    return value
            if self.now_fn() >= deadline:
                return value
            self.sleep_fn(0.5)
    def run(self, *, heal: bool) -> dict[str, Any]:
        now = self.now_fn()
        if self.inhibit_path.exists():
            result = {
                "schema": SCHEMA,
                "status": "MAINTENANCE_INHIBITED",
                "generated_at_epoch": now,
                "maintenance_inhibit": str(self.inhibit_path),
                "workers": [],
                "dependencies": [],
                "all_fresh": False,
                "actions": [],
            }
            _atomic_json(self.status_path, result)
            return result
        actions: list[dict[str, str]] = []
        dependencies: list[UnitSnapshot] = []
        for unit in self.dependency_units:
            load, active, enabled, enabled_ok = self._basic_snapshot(unit, "dependency")
            action = "NONE"
            if heal:
                if load != "loaded":
                    raise AvailabilityGuardError("REQUIRED_UNIT_NOT_LOADED:" + unit)
                if not enabled_ok:
                    self.systemd.enable(unit)
                    action = "ENABLE"
                if active != "active":
                    self.systemd.start(unit)
                    action = "START" if action == "NONE" else "ENABLE_START"
                if action != "NONE":
                    actions.append({"unit": unit, "action": action})
                load, active, enabled, enabled_ok = self._basic_snapshot(unit, "dependency")
            dependencies.append(
                UnitSnapshot(
                    unit=unit,
                    role="dependency",
                    load_state=load,
                    active_state=active,
                    unit_file_state=enabled,
                    enabled_ok=enabled_ok,
                    fresh=(active == "active"),
                    action=action,
                )
            )
        recovery = self._recovery_state()
        workers: list[UnitSnapshot] = []
        for unit in self.worker_units:
            load, active, enabled, enabled_ok = self._basic_snapshot(unit, "worker")
            environment = self.systemd.environment(unit) if load == "loaded" else {}
            path = _liveness_path(environment, unit) if load == "loaded" else None
            action = "NONE"
            if heal:
                if load != "loaded":
                    raise AvailabilityGuardError("REQUIRED_UNIT_NOT_LOADED:" + unit)
                if not enabled_ok:
                    self.systemd.enable(unit)
                    action = "ENABLE"
                if active != "active":
                    self.systemd.start(unit)
                    action = "START" if action == "NONE" else "ENABLE_START"
                    actions.append({"unit": unit, "action": action})
                    if path is not None:
                        self._wait_for_liveness(path)
                load, active, enabled, enabled_ok = self._basic_snapshot(unit, "worker")
            live = _load_json(path) if path is not None else None
            last_seen: float | None = None
            state: str | None = None
            age: float | None = None
            fresh = False
            detail: str | None = None
            if live is not None:
                state = str(live.get("state") or "")
                try:
                    last_seen = float(live.get("last_seen_epoch"))
                except (TypeError, ValueError):
                    last_seen = None
                if last_seen is not None:
                    age = max(0.0, now - last_seen)
                    fresh = age <= self.max_stale_seconds
                if live.get("agent_id") in (None, ""):
                    fresh = False
                    detail = "LIVENESS_AGENT_ID_MISSING"
            else:
                detail = "LIVENESS_MISSING"
            if heal and active == "active" and not fresh:
                previous = float(recovery.get(unit, 0.0))
                if now - previous >= self.restart_cooldown_seconds:
                    self.systemd.restart(unit)
                    recovery[unit] = now
                    action = "RESTART_STALE"
                    actions.append({"unit": unit, "action": action})
                    if path is not None:
                        live = self._wait_for_liveness(path)
                    load, active, enabled, enabled_ok = self._basic_snapshot(unit, "worker")
                    if live is not None:
                        state = str(live.get("state") or "")
                        try:
                            last_seen = float(live.get("last_seen_epoch"))
                        except (TypeError, ValueError):
                            last_seen = None
                        if last_seen is not None:
                            age = max(0.0, self.now_fn() - last_seen)
                            fresh = age <= self.max_stale_seconds
                            detail = None if fresh else "LIVENESS_STALE_AFTER_RESTART"
                else:
                    detail = "RESTART_COOLDOWN_ACTIVE"
            workers.append(
                UnitSnapshot(
                    unit=unit,
                    role="worker",
                    load_state=load,
                    active_state=active,
                    unit_file_state=enabled,
                    enabled_ok=enabled_ok,
                    liveness_path=str(path) if path is not None else None,
                    liveness_state=state,
                    last_seen_epoch=last_seen,
                    liveness_age_seconds=age,
                    fresh=bool(active == "active" and enabled_ok and fresh),
                    action=action,
                    detail=detail,
                )
            )
        if heal:
            self._save_recovery_state(recovery)
        all_fresh = (
            all(item.active_state == "active" and item.enabled_ok and item.fresh for item in workers)
            and all(item.active_state == "active" for item in dependencies)
        )
        result = {
            "schema": SCHEMA,
            "status": "HEALTHY" if all_fresh else "DEGRADED",
            "generated_at_epoch": self.now_fn(),
            "max_stale_seconds": self.max_stale_seconds,
            "maintenance_inhibit": str(self.inhibit_path),
            "workers": [asdict(item) for item in workers],
            "dependencies": [asdict(item) for item in dependencies],
            "all_fresh": all_fresh,
            "actions": actions,
        }
        _atomic_json(self.status_path, result)
        return result
 def main() -> int:
    parser = argparse.ArgumentParser()
    mode = parser.add_mutually_exclusive_group(required=True)
    mode.add_argument("--heal", action="store_true")
    mode.add_argument("--check", action="store_true")
    parser.add_argument("--status-file", default=str(DEFAULT_STATUS))
    parser.add_argument("--recovery-file", default=str(DEFAULT_RECOVERY))
    parser.add_argument("--inhibit-file", default=str(DEFAULT_INHIBIT))
    parser.add_argument(
        "--max-stale-seconds",
        type=int,
        default=int(
            os.environ.get(
                "AIOS_WORKER_AVAILABILITY_MAX_STALE_SECONDS",
                str(DEFAULT_MAX_STALE_SECONDS),
            )
        ),
    )
    parser.add_argument(
        "--restart-cooldown-seconds",
        type=int,
        default=int(
            os.environ.get(
                "AIOS_WORKER_AVAILABILITY_RESTART_COOLDOWN_SECONDS",
                str(DEFAULT_RESTART_COOLDOWN_SECONDS),
            )
        ),
    )
    args = parser.parse_args()
    guard = AvailabilityGuard(
        status_path=Path(args.status_file),
        recovery_path=Path(args.recovery_file),
        inhibit_path=Path(args.inhibit_file),
        max_stale_seconds=args.max_stale_seconds,
        restart_cooldown_seconds=args.restart_cooldown_seconds,
    )
    try:
        result = guard.run(heal=args.heal)
    except AvailabilityGuardError as exc:
        print(json.dumps({"status": "FAILED", "error": str(exc)}, sort_keys=True))
        return 20
    print(json.dumps(result, ensure_ascii=False, sort_keys=True))
    if args.check and not result.get("all_fresh"):
        return 10
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,652 +0,0 @@
 #!/usr/bin/env python3
 """One-shot governed executor for an already approved exact release binding.
 This module deliberately does not build release artifacts. The build/staging
 evidence is completed before Owner production approval. Production execution
 consumes that immutable binding, revalidates it, and performs narrow
 side-effects through adapters in a durable fail-closed order.
 Adapter protocol:
  stdin: JSON request with operation = "probe" | "apply" | "rollback"
  stdout: one JSON object on the final non-empty line
  shell: never used
 The executor never rewrites tags, never writes refs/heads/main, and records
 Baseline last.
 """
 from __future__ import annotations
 import argparse
 import dataclasses
 import fcntl
 import hashlib
 import json
 import os
 import re
 import stat
 import subprocess
 import sys
 import tempfile
 import time
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA_RE = re.compile(r"^[0-9a-f]{64}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
 REQUIRED_V2R1C7_MEMBERS = {
    "payload/VERSION",
    "payload/active-runtime/app/deployment_state.py",
    "payload/active-runtime/app/v2r1c6_privacy_tools.py",
    "payload/active-runtime/app/v2r1c7_health_service.py",
    "payload/deploy/aios-v2/systemd/aios-v2r1c7-production.service",
    "payload/deploy/aios-v2/v2r1c7-runtime-config.json",
    "payload/deploy/aios-v2/v2r1c7-rollback.json",
    "payload/scripts/probe_v2r1c7_health.py",
    "payload/scripts/rollback_v2r1c7_release.sh",
    "payload/BUILD-METADATA.json",
    "payload/ARTIFACT-MANIFEST.json",
    "payload/ROLLBACK-METADATA.json",
 }
 class ReleaseBlocked(RuntimeError):
    pass
 class ManualOwnerReviewRequired(ReleaseBlocked):
    pass
 class ReconciliationRequired(ReleaseBlocked):
    pass
@dataclasses.dataclass(frozen=True)
 class Binding:
    version: str
    target_oid: str
    evidence_closure_oid: str
    artifact_sha256: str
    approval_plan_id: str
    artifact_path: str
    artifact_size: int
    production_service: str
    production_port: int
    repository_identity: str = "aios/aios"
    def __post_init__(self) -> None:
        if not self.version or not OID_RE.fullmatch(self.target_oid):
            raise ValueError("invalid release target binding")
        if not OID_RE.fullmatch(self.evidence_closure_oid):
            raise ValueError("invalid evidence closure OID")
        if not SHA_RE.fullmatch(self.artifact_sha256):
            raise ValueError("invalid artifact SHA-256")
        if not PLAN_RE.fullmatch(self.approval_plan_id):
            raise ValueError("invalid approval plan id")
        if self.artifact_size <= 0:
            raise ValueError("invalid artifact size")
        if not self.production_service:
            raise ValueError("production service is required")
        if not 1024 <= self.production_port <= 65535:
            raise ValueError("invalid production port")
        if self.repository_identity != "aios/aios":
            raise ValueError("unexpected repository identity")
    @property
    def tag(self) -> str:
        return self.version
    @property
    def fingerprint(self) -> str:
        payload = {
            "version": self.version,
            "target_oid": self.target_oid,
            "evidence_closure_oid": self.evidence_closure_oid,
            "artifact_sha256": self.artifact_sha256,
            "approval_plan_id": self.approval_plan_id,
            "artifact_size": self.artifact_size,
            "production_service": self.production_service,
            "production_port": self.production_port,
            "repository_identity": self.repository_identity,
        }
        return hashlib.sha256(canonical_json(payload)).hexdigest()
    def request(self, operation: str) -> dict[str, Any]:
        return {
            "schema": "aios.production-executor-request.v1",
            "operation": operation,
            "binding_fingerprint": self.fingerprint,
            "version": self.version,
            "tag": self.tag,
            "target_oid": self.target_oid,
            "evidence_closure_oid": self.evidence_closure_oid,
            "artifact_sha256": self.artifact_sha256,
            "artifact_path": self.artifact_path,
            "artifact_size": self.artifact_size,
            "approval_plan_id": self.approval_plan_id,
            "production_service": self.production_service,
            "production_port": self.production_port,
            "repository_identity": self.repository_identity,
        }
 def canonical_json(value: object) -> bytes:
    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
 def secure_json(path: Path) -> dict[str, Any]:
    st = path.lstat()
    if not stat.S_ISREG(st.st_mode) or path.is_symlink():
        raise ReleaseBlocked(f"non-regular authorization file: {path}")
    if st.st_uid != 0:
        raise ReleaseBlocked(f"authorization file must be root-owned: {path}")
    if st.st_mode & 0o022:
        raise ReleaseBlocked(f"authorization file is group/world writable: {path}")
    data = json.loads(path.read_text(encoding="utf-8"))
    if not isinstance(data, dict):
        raise ReleaseBlocked("authorization receipt must be a JSON object")
    return data
 def sha256_file(path: Path) -> str:
    if path.is_symlink() or not path.is_file():
        raise ReleaseBlocked("artifact must be a regular non-symlink file")
    digest = hashlib.sha256()
    with path.open("rb") as source:
        for block in iter(lambda: source.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()
 def run_git(git_dir: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        ["git", f"--git-dir={git_dir}", *args],
        check=check,
        capture_output=True,
        text=True,
        timeout=30,
        env={"PATH": os.environ.get("PATH", "")},
    )
 def verify_git_lineage(git_dir: Path, binding: Binding) -> dict[str, Any]:
    authority_main = run_git(git_dir, "rev-parse", "refs/heads/main").stdout.strip()
    if not OID_RE.fullmatch(authority_main):
        raise ReleaseBlocked("Authority main OID is invalid")
    target_type = run_git(git_dir, "cat-file", "-t", binding.target_oid).stdout.strip()
    if target_type != "commit":
        raise ReleaseBlocked("target_oid is not a commit")
    evidence_type = run_git(
        git_dir, "cat-file", "-t", binding.evidence_closure_oid
    ).stdout.strip()
    if evidence_type != "commit":
        raise ReleaseBlocked("evidence_closure_oid is not a commit")
    # A control-plane-only patch may advance main after release approval.
    # The approved release target remains valid only while it is still on main.
    target_on_main = run_git(
        git_dir,
        "merge-base",
        "--is-ancestor",
        binding.target_oid,
        authority_main,
        check=False,
    ).returncode == 0
    if not target_on_main:
        raise ManualOwnerReviewRequired(
            "approved target is no longer an ancestor of Authority main"
        )
    target_in_evidence = run_git(
        git_dir,
        "merge-base",
        "--is-ancestor",
        binding.target_oid,
        binding.evidence_closure_oid,
        check=False,
    ).returncode == 0
    if not target_in_evidence:
        raise ReleaseBlocked("approved target is not an ancestor of evidence closure")
    return {
        "authority_main_oid": authority_main,
        "target_oid": binding.target_oid,
        "target_is_ancestor_of_main": True,
        "evidence_closure_oid": binding.evidence_closure_oid,
        "evidence_object_type": evidence_type,
        "target_is_ancestor_of_evidence": True,
    }
 def verify_artifact(binding: Binding) -> dict[str, Any]:
    path = Path(binding.artifact_path)
    if path.stat().st_size != binding.artifact_size:
        raise ReleaseBlocked("artifact size mismatch")
    actual = sha256_file(path)
    if actual != binding.artifact_sha256:
        raise ReleaseBlocked("artifact SHA-256 mismatch")
    if binding.version == "V2R1C7":
        # Python tarfile may not have zstd support on the target host, so
        # decompress into a private temporary tar and inspect it there.
        with tempfile.TemporaryDirectory(prefix="aios-artifact-verify-") as temp_dir:
            tar_path = Path(temp_dir) / "release.tar"
            with tar_path.open("wb") as output:
                completed = subprocess.run(
                    ["zstd", "-dc", str(path)],
                    check=False,
                    stdout=output,
                    stderr=subprocess.PIPE,
                    timeout=60,
                    env={"PATH": os.environ.get("PATH", "")},
                )
            if completed.returncode != 0:
                raise ReleaseBlocked("artifact zstd decompression failed")
            import tarfile
            with tarfile.open(tar_path, "r:") as archive:
                names: set[str] = set()
                for member in archive.getmembers():
                    candidate = Path(member.name)
                    if (
                        candidate.is_absolute()
                        or ".." in candidate.parts
                        or member.issym()
                        or member.islnk()
                        or not (member.isfile() or member.isdir())
                    ):
                        raise ReleaseBlocked(f"unsafe artifact member: {member.name}")
                    names.add(member.name)
            missing = sorted(REQUIRED_V2R1C7_MEMBERS - names)
            if missing:
                raise ReleaseBlocked(
                    "artifact missing required members: " + ",".join(missing)
                )
    return {
        "artifact_path": str(path),
        "artifact_sha256": actual,
        "artifact_size": binding.artifact_size,
        "verified": True,
    }
 def verify_authorization(receipt: Mapping[str, Any], binding: Binding) -> dict[str, Any]:
    if receipt.get("accepted") is not True:
        raise ReleaseBlocked("Owner production authorization is not accepted")
    if receipt.get("binding_replaced") not in (None, False):
        raise ManualOwnerReviewRequired("Owner binding was replaced")
    expected = {
        "version": binding.version,
        "target_oid": binding.target_oid,
        "evidence_closure_oid": binding.evidence_closure_oid,
        "artifact_sha256": binding.artifact_sha256,
        "approval_plan_id": binding.approval_plan_id,
    }
    for key, value in expected.items():
        if receipt.get(key) != value:
            raise ManualOwnerReviewRequired(f"Owner authorization mismatch: {key}")
    return {"accepted": True, **expected}
 class DurableState:
    def __init__(self, root: Path, binding: Binding):
        self.root = root
        self.root.mkdir(parents=True, exist_ok=True)
        os.chmod(self.root, 0o700)
        self.path = self.root / "execution.json"
        self.binding = binding
        self.value: dict[str, Any]
        if self.path.exists():
            existing = json.loads(self.path.read_text(encoding="utf-8"))
            if existing.get("binding_fingerprint") != binding.fingerprint:
                raise ManualOwnerReviewRequired(
                    "state root contains a different production binding"
                )
            self.value = existing
        else:
            self.value = {
                "schema": "aios.production-execution-state.v1",
                "binding_fingerprint": binding.fingerprint,
                "version": binding.version,
                "target_oid": binding.target_oid,
                "state": "AUTHORIZED",
                "completed": {},
                "history": [],
            }
            self.save()
    def save(self) -> None:
        temporary = self.path.with_suffix(".tmp")
        temporary.write_bytes(canonical_json(self.value))
        os.chmod(temporary, 0o600)
        os.replace(temporary, self.path)
    def record(self, state: str, step: str, result: Mapping[str, Any]) -> None:
        now = time.time()
        sanitized = json.loads(json.dumps(result))
        self.value["state"] = state
        self.value["completed"][step] = sanitized
        self.value["history"].append(
            {"at": now, "state": state, "step": step, "result": sanitized}
        )
        self.save()
    def fail(self, state: str, reason: str) -> None:
        self.value["state"] = state
        self.value["history"].append(
            {"at": time.time(), "state": state, "reason": reason}
        )
        self.save()
 class FileLock:
    def __init__(self, path: Path):
        self.path = path
        self.handle = None
    def __enter__(self) -> "FileLock":
        self.path.parent.mkdir(parents=True, exist_ok=True)
        self.handle = self.path.open("a+", encoding="utf-8")
        os.chmod(self.path, 0o600)
        try:
            fcntl.flock(
                self.handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB
            )
        except BlockingIOError as exc:
            raise ReleaseBlocked("production executor is already running") from exc
        return self
    def __exit__(self, exc_type, exc, tb) -> None:
        if self.handle is not None:
            fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
            self.handle.close()
 def parse_command(values: Sequence[str]) -> list[str]:
    command = [str(x) for x in values if str(x)]
    if not command:
        raise ValueError("adapter command is required")
    if not os.path.isabs(command[0]):
        raise ValueError("adapter executable must be an absolute path")
    return command
 def run_adapter(command: Sequence[str], request: Mapping[str, Any]) -> dict[str, Any]:
    completed = subprocess.run(
        list(command),
        input=canonical_json(request),
        check=False,
        capture_output=True,
        timeout=180,
        env={"PATH": os.environ.get("PATH", "")},
    )
    if completed.returncode != 0:
        raise ReleaseBlocked(
            f"adapter failed: {Path(command[0]).name} rc={completed.returncode}"
        )
    lines = [line for line in completed.stdout.decode("utf-8").splitlines() if line.strip()]
    if not lines:
        raise ReleaseBlocked("adapter returned no JSON result")
    try:
        value = json.loads(lines[-1])
    except ValueError as exc:
        raise ReleaseBlocked("adapter returned invalid JSON") from exc
    if not isinstance(value, dict):
        raise ReleaseBlocked("adapter result must be an object")
    return value
 def require_exact_response(result: Mapping[str, Any], binding: Binding) -> None:
    for key, expected in {
        "version": binding.version,
        "target_oid": binding.target_oid,
        "evidence_closure_oid": binding.evidence_closure_oid,
        "artifact_sha256": binding.artifact_sha256,
        "approval_plan_id": binding.approval_plan_id,
    }.items():
        if key in result and result[key] != expected:
            raise ManualOwnerReviewRequired(f"adapter binding mismatch: {key}")
 def tag_step(command: Sequence[str], binding: Binding) -> dict[str, Any]:
    request = binding.request("probe")
    probe = run_adapter(command, request)
    require_exact_response(probe, binding)
    state = probe.get("status")
    if state == "CONFLICT":
        raise ManualOwnerReviewRequired("same-name tag conflicts with approved binding")
    if state == "INDETERMINATE":
        raise ReconciliationRequired("tag publication state is indeterminate")
    if state not in {"APPLIED_VERIFIED", "NOT_APPLIED", "PARTIAL_LOCAL"}:
        raise ReleaseBlocked(f"unsupported tag probe status: {state}")
    if state != "APPLIED_VERIFIED":
        applied = run_adapter(command, binding.request("apply"))
        require_exact_response(applied, binding)
        if applied.get("status") == "CONFLICT":
            raise ManualOwnerReviewRequired("tag conflict during publication")
        probe = run_adapter(command, request)
        require_exact_response(probe, binding)
    if probe.get("status") != "APPLIED_VERIFIED":
        raise ReconciliationRequired("tag was not independently verified")
    if probe.get("peeled_target_oid") != binding.target_oid:
        raise ManualOwnerReviewRequired("published tag peeled target mismatch")
    tag_oid = probe.get("tag_oid")
    if not isinstance(tag_oid, str) or not OID_RE.fullmatch(tag_oid):
        raise ReleaseBlocked("verified annotated tag object OID missing")
    return dict(probe)
 def deploy_step(command: Sequence[str], binding: Binding) -> dict[str, Any]:
    probe = run_adapter(command, binding.request("probe"))
    require_exact_response(probe, binding)
    if probe.get("status") == "ACTIVE_VERIFIED":
        return dict(probe)
    if probe.get("status") == "CONFLICT":
        raise ManualOwnerReviewRequired("production runtime has conflicting binding")
    applied = run_adapter(command, binding.request("apply"))
    require_exact_response(applied, binding)
    probe = run_adapter(command, binding.request("probe"))
    require_exact_response(probe, binding)
    if probe.get("status") != "ACTIVE_VERIFIED":
        try:
            run_adapter(command, binding.request("rollback"))
        except Exception:
            pass
        raise ReconciliationRequired("production runtime did not verify after apply")
    if (
        probe.get("deployment_state") != "ACTIVE"
        or probe.get("production_deployed") is not True
    ):
        raise ReconciliationRequired("production health contract is not ACTIVE")
    return dict(probe)
 def finalize_step(
    command: Sequence[str],
    binding: Binding,
    *,
    name: str,
    tag_oid: str,
 ) -> dict[str, Any]:
    request = binding.request("probe")
    request["tag_oid"] = tag_oid
    probe = run_adapter(command, request)
    require_exact_response(probe, binding)
    if probe.get("status") == "CONFLICT":
        raise ManualOwnerReviewRequired(f"{name} has conflicting release binding")
    if probe.get("status") != "VERIFIED":
        apply_request = binding.request("apply")
        apply_request["tag_oid"] = tag_oid
        applied = run_adapter(command, apply_request)
        require_exact_response(applied, binding)
        probe = run_adapter(command, request)
        require_exact_response(probe, binding)
    if probe.get("status") != "VERIFIED":
        raise ReconciliationRequired(f"{name} did not verify after apply")
    if probe.get("tag_oid") not in (None, tag_oid):
        raise ManualOwnerReviewRequired(f"{name} tag object mismatch")
    return dict(probe)
 def execute(
    *,
    binding: Binding,
    authorization_path: Path,
    repository: Path,
    state_root: Path,
    tag_command: Sequence[str],
    deploy_command: Sequence[str],
    registry_command: Sequence[str],
    baseline_command: Sequence[str],
 ) -> dict[str, Any]:
    authorization = verify_authorization(secure_json(authorization_path), binding)
    lineage = verify_git_lineage(repository, binding)
    artifact = verify_artifact(binding)
    state = DurableState(state_root, binding)
    with FileLock(state_root / "executor.lock"):
        state.record(
            "PREFLIGHT_VERIFIED",
            "preflight",
            {"authorization": authorization, "lineage": lineage, "artifact": artifact},
        )
        tag: dict[str, Any] | None = None
        runtime: dict[str, Any] | None = None
        try:
            tag = tag_step(tag_command, binding)
            state.record("TAG_VERIFIED", "tag", tag)
            runtime = deploy_step(deploy_command, binding)
            state.record("RUNTIME_VERIFIED", "runtime", runtime)
            registry = finalize_step(
                registry_command,
                binding,
                name="registry",
                tag_oid=tag["tag_oid"],
            )
            state.record("REGISTRY_VERIFIED", "registry", registry)
            baseline = finalize_step(
                baseline_command,
                binding,
                name="baseline",
                tag_oid=tag["tag_oid"],
            )
            state.record("BASELINE_VERIFIED", "baseline", baseline)
            # Final readback: no mutation, all four planes must still agree.
            final_tag = tag_step(tag_command, binding)
            final_runtime = run_adapter(deploy_command, binding.request("probe"))
            final_registry_request = binding.request("probe")
            final_registry_request["tag_oid"] = tag["tag_oid"]
            final_registry = run_adapter(registry_command, final_registry_request)
            final_baseline_request = binding.request("probe")
            final_baseline_request["tag_oid"] = tag["tag_oid"]
            final_baseline = run_adapter(baseline_command, final_baseline_request)
            for value in (final_runtime, final_registry, final_baseline):
                require_exact_response(value, binding)
            if final_runtime.get("status") != "ACTIVE_VERIFIED":
                raise ReconciliationRequired("final runtime readback failed")
            if final_registry.get("status") != "VERIFIED":
                raise ReconciliationRequired("final Registry readback failed")
            if final_baseline.get("status") != "VERIFIED":
                raise ReconciliationRequired("final Baseline readback failed")
            final = {
                "status": "PRODUCTION_ACCEPTED",
                "version": binding.version,
                "target_oid": binding.target_oid,
                "evidence_closure_oid": binding.evidence_closure_oid,
                "artifact_sha256": binding.artifact_sha256,
                "approval_plan_id": binding.approval_plan_id,
                "tag_oid": tag["tag_oid"],
                "tag": final_tag,
                "runtime": final_runtime,
                "registry": final_registry,
                "baseline": final_baseline,
                "force_push_used": False,
                "tag_rewritten": False,
                "direct_main_push": False,
                "secrets_committed": False,
            }
            state.record("COMPLETED", "final_consistency", final)
            return final
        except ManualOwnerReviewRequired as exc:
            state.fail("MANUAL_OWNER_REVIEW_REQUIRED", str(exc))
            raise
        except ReconciliationRequired as exc:
            state.fail("RECONCILIATION_REQUIRED", str(exc))
            raise
        except Exception as exc:
            # Once a formal tag has been verified, no later error is a clean
            # pre-side-effect failure. Preserve the tag and require idempotent
            # reconciliation rather than pretending the release never started.
            if tag is not None:
                reason = f"{type(exc).__name__}: {exc}"
                state.fail("RECONCILIATION_REQUIRED", reason)
                raise ReconciliationRequired(reason) from exc
            state.fail("FAIL_CLOSED", f"{type(exc).__name__}: {exc}")
            raise
 def parser() -> argparse.ArgumentParser:
    p = argparse.ArgumentParser()
    p.add_argument("--authorization", required=True, type=Path)
    p.add_argument("--repository", required=True, type=Path)
    p.add_argument("--state-root", required=True, type=Path)
    p.add_argument("--artifact", required=True, type=Path)
    p.add_argument("--artifact-size", required=True, type=int)
    p.add_argument("--version", required=True)
    p.add_argument("--target-oid", required=True)
    p.add_argument("--evidence-closure-oid", required=True)
    p.add_argument("--artifact-sha256", required=True)
    p.add_argument("--approval-plan-id", required=True)
    p.add_argument("--production-service", required=True)
    p.add_argument("--production-port", required=True, type=int)
    p.add_argument("--repository-identity", default="aios/aios")
    p.add_argument("--tag-adapter", required=True, nargs="+")
    p.add_argument("--deploy-adapter", required=True, nargs="+")
    p.add_argument("--registry-adapter", required=True, nargs="+")
    p.add_argument("--baseline-adapter", required=True, nargs="+")
    return p
 def main() -> int:
    args = parser().parse_args()
    binding = Binding(
        version=args.version,
        target_oid=args.target_oid,
        evidence_closure_oid=args.evidence_closure_oid,
        artifact_sha256=args.artifact_sha256,
        approval_plan_id=args.approval_plan_id,
        artifact_path=str(args.artifact),
        artifact_size=args.artifact_size,
        production_service=args.production_service,
        production_port=args.production_port,
        repository_identity=args.repository_identity,
    )
    try:
        result = execute(
            binding=binding,
            authorization_path=args.authorization,
            repository=args.repository,
            state_root=args.state_root,
            tag_command=parse_command(args.tag_adapter),
            deploy_command=parse_command(args.deploy_adapter),
            registry_command=parse_command(args.registry_adapter),
            baseline_command=parse_command(args.baseline_adapter),
        )
        print(json.dumps(result, sort_keys=True))
        return 0
    except ManualOwnerReviewRequired as exc:
        print(json.dumps({"status": "MANUAL_OWNER_REVIEW_REQUIRED", "reason": str(exc)}, sort_keys=True))
        return 20
    except ReconciliationRequired as exc:
        print(json.dumps({"status": "RECONCILIATION_REQUIRED", "reason": str(exc)}, sort_keys=True))
        return 21
    except Exception as exc:
        print(json.dumps({"status": "FAIL_CLOSED", "error": type(exc).__name__, "reason": str(exc)}, sort_keys=True))
        return 22
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,89 +0,0 @@
 """Durable Owner/GPT notification outbox with retry and acknowledgement."""
 from __future__ import annotations
 import json
 import sqlite3
 import time
 import uuid
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Callable, Mapping
@dataclass(frozen=True)
 class OutboxEvent:
    event_id: str
    recipient: str
    kind: str
    payload: Mapping[str, Any]
    attempts: int
    available_at: float
    acknowledged: bool
 class DurableOutbox:
    RECIPIENTS = ("owner", "gpt")
    def __init__(self, path: str | Path) -> None:
        self.path = str(path)
        self.db = sqlite3.connect(self.path)
        self.db.execute("PRAGMA journal_mode=WAL")
        self.db.execute("CREATE TABLE IF NOT EXISTS outbox (event_id TEXT PRIMARY KEY, recipient TEXT NOT NULL, kind TEXT NOT NULL, payload TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, available_at REAL NOT NULL, delivered_at REAL, acknowledged INTEGER NOT NULL DEFAULT 0, last_error TEXT)")
        self.db.commit()
    def enqueue(self, kind: str, payload: Mapping[str, Any], *, event_id: str | None = None, recipients: tuple[str, ...] = RECIPIENTS) -> list[str]:
        ids: list[str] = []
        for recipient in recipients:
            if recipient not in self.RECIPIENTS:
                raise ValueError("recipient is outside the governed notification plane")
            eid = event_id or str(uuid.uuid4())
            if event_id is not None and len(recipients) > 1:
                eid = f"{event_id}:{recipient}"
            self.db.execute("INSERT OR IGNORE INTO outbox(event_id,recipient,kind,payload,available_at) VALUES(?,?,?,?,?)", (eid, recipient, kind, json.dumps(dict(payload), sort_keys=True), time.time()))
            ids.append(eid)
        self.db.commit()
        return ids
    def due(self, *, now: float | None = None, limit: int = 20) -> list[OutboxEvent]:
        now = time.time() if now is None else now
        rows = self.db.execute("SELECT event_id,recipient,kind,payload,attempts,available_at,acknowledged FROM outbox WHERE delivered_at IS NULL AND available_at<=? ORDER BY available_at,event_id LIMIT ?", (now, limit)).fetchall()
        return [OutboxEvent(r[0], r[1], r[2], json.loads(r[3]), r[4], r[5], bool(r[6])) for r in rows]
    def delivered(self, event_id: str, *, now: float | None = None) -> None:
        self.db.execute("UPDATE outbox SET delivered_at=? WHERE event_id=?", (time.time() if now is None else now, event_id))
        self.db.commit()
    def failed(self, event_id: str, error: str, *, now: float | None = None, max_backoff: float = 300.0) -> None:
        now = time.time() if now is None else now
        row = self.db.execute("SELECT attempts FROM outbox WHERE event_id=?", (event_id,)).fetchone()
        attempts = int(row[0]) + 1 if row else 1
        delay = min(max_backoff, 2 ** min(attempts, 8))
        self.db.execute("UPDATE outbox SET attempts=?,available_at=?,last_error=? WHERE event_id=?", (attempts, now + delay, error[:200], event_id))
        self.db.commit()
    def acknowledge(self, event_id: str) -> None:
        self.db.execute("UPDATE outbox SET acknowledged=1 WHERE event_id=?", (event_id,))
        self.db.commit()
    def close(self) -> None:
        self.db.close()
 class NotificationPlane:
    def __init__(self, outbox: DurableOutbox) -> None:
        self.outbox = outbox
    def emit(self, kind: str, payload: Mapping[str, Any], *, event_id: str | None = None) -> list[str]:
        return self.outbox.enqueue(kind, payload, event_id=event_id)
    def deliver_once(self, send: Callable[[OutboxEvent], None], *, now: float | None = None) -> list[str]:
        delivered: list[str] = []
        for event in self.outbox.due(now=now):
            try:
                send(event)
            except Exception as exc:
                self.outbox.failed(event.event_id, type(exc).__name__, now=now)
            else:
                self.outbox.delivered(event.event_id, now=now)
                delivered.append(event.event_id)
        return delivered
@@ -1,84 +0,0 @@
 #!/usr/bin/env python3
 """Single canonical Production Baseline authority for the GitOps reader.
 The API and the one-shot writer import this module.  Workspace and release
 copies are projections only; they are never selected as a fallback source.
 """
 from __future__ import annotations
 import hashlib
 import json
 import os
 from pathlib import Path
 from typing import Any
 AUTHORITY_PATH = Path(os.getenv(
    "AIOS_GITOPS_BASELINE_AUTHORITY",
    "/var/lib/aios-gitops-runtime-anchor/baseline/current.json",
 ))
 AUTHORITY_SHA_PATH = AUTHORITY_PATH.with_suffix(".sha256")
 class BaselineAuthorityError(RuntimeError):
    """Fail-closed error raised for an unavailable or inconsistent authority."""
 class BaselineAuthority:
    def __init__(self, path: Path | str = AUTHORITY_PATH):
        self.path = Path(path)
        self.sha_path = self.path.with_suffix(".sha256")
    def _raw(self) -> bytes:
        try:
            raw = self.path.read_bytes()
        except OSError as exc:
            raise BaselineAuthorityError(f"authority_unavailable:{exc}") from exc
        if not raw:
            raise BaselineAuthorityError("authority_empty")
        return raw
    def read(self) -> dict[str, Any]:
        raw = self._raw()
        digest = hashlib.sha256(raw).hexdigest()
        try:
            value = json.loads(raw.decode("utf-8"))
        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
            raise BaselineAuthorityError("authority_invalid_json") from exc
        if not isinstance(value, dict):
            raise BaselineAuthorityError("authority_not_object")
        expected = str(value.get("authority_sha256", ""))
        if expected and expected != digest:
            raise BaselineAuthorityError("authority_embedded_digest_mismatch")
        if self.sha_path.exists():
            sidecar = self.sha_path.read_text(encoding="utf-8").strip().split()[0]
            if sidecar != digest:
                raise BaselineAuthorityError("authority_sidecar_digest_mismatch")
        required = {
            "current_baseline", "previous_baseline", "target_oid", "tag_oid",
            "evidence_closure_oid", "approval_plan_id", "status", "generation",
            "source_identity",
        }
        missing = sorted(required.difference(value))
        if missing:
            raise BaselineAuthorityError("authority_missing:" + ",".join(missing))
        value = dict(value)
        value["authority_sha256"] = digest
        value["authority_path"] = str(self.path)
        return value
    def read_consistent(self, policy: dict[str, Any] | None = None) -> dict[str, Any]:
        value = self.read()
        if policy:
            expected = policy.get("release_binding", policy)
            for key, field in (("version", "current_baseline"),
                               ("previous_version", "previous_baseline"),
                               ("target_oid", "target_oid"),
                               ("tag_oid", "tag_oid"),
                               ("evidence_closure_oid", "evidence_closure_oid"),
                               ("approval_plan_id", "approval_plan_id")):
                wanted = expected.get(key)
                if wanted is not None and value.get(field) != wanted:
                    raise BaselineAuthorityError(f"authority_binding_mismatch:{field}")
        return value
@@ -1,491 +0,0 @@
 """Fail-closed, branch-bound repair leases for governed AIOS GitOps work."""
 from __future__ import annotations
 import hashlib
 import json
 import os
 import posixpath
 import re
 import secrets
 import subprocess
 import tempfile
 import uuid
 from dataclasses import asdict, dataclass, field
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Iterable, Mapping, Protocol, Sequence
 TASK_ID = "V2R1C6_GOVERNED_LOCAL_BOOTSTRAP"
 MAX_LEASE_SECONDS = 86_400
 OID_RE = re.compile(r"^[0-9a-fA-F]{40}$")
 DENIED_BRANCHES = {"main", "master", "HEAD"}
 PROTECTED_PREFIXES = (
    ".git",
    "VERSION",
    "versions/V2R1C5.json",
    "artifacts/V2R1C5",
    "baseline",
    "config/gitops.tokens",
    "gitops.tokens",
    "secrets",
    "credentials",
 )
 SECRET_PATTERNS = (
    re.compile(r"(?i)-----BEGIN [A-Z ]*PRIVATE KEY-----"),
    re.compile(r"(?i)(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+"),
    re.compile(r"\b(?:sk|HPUA|SDC)-[A-Za-z0-9_-]{16,}\b"),
 )
 class LeaseError(Exception):
    """Raised for any invalid, stale, expired, or prohibited lease action."""
 class GitProbeProtocol(Protocol):
    """Read-only Git seam used by the lease manager."""
    def branch_head(self, branch: str) -> str: ...
    def parent(self, commit: str) -> str: ...
    def is_ancestor(self, older: str, newer: str) -> bool: ...
    def changed_paths(self, commit: str) -> tuple[str, ...]: ...
    def commits_between(self, older: str, newer: str) -> tuple[str, ...]: ...
 def _now() -> datetime:
    return datetime.now(timezone.utc)
 def _ts(value: datetime) -> str:
    return value.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
 def _parse_ts(value: str) -> datetime:
    if value.endswith("Z"):
        value = value[:-1] + "+00:00"
    parsed = datetime.fromisoformat(value)
    return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
 def _oid(value: str, field: str = "oid") -> str:
    if not isinstance(value, str) or not OID_RE.fullmatch(value):
        raise LeaseError(f"{field} must be a full commit OID")
    return value.lower()
 def normalize_path(path: str) -> str:
    """Normalize a repository-relative path without resolving through the FS."""
    if not isinstance(path, str) or not path.strip():
        raise LeaseError("path must be a non-empty string")
    value = path.replace("\\", "/").strip()
    if value.startswith("/") or "\x00" in value:
        raise LeaseError("path must be relative")
    parts = value.split("/")
    if any(part in {"", ".", ".."} for part in parts):
        raise LeaseError("path contains a prohibited component")
    normalized = posixpath.normpath(value)
    if normalized == "." or normalized.startswith("../"):
        raise LeaseError("path is not normalized")
    return normalized
 def path_is_protected(path: str) -> bool:
    normalized = normalize_path(path)
    lower = normalized.lower()
    return any(
        lower == prefix.lower() or lower.startswith(prefix.lower().rstrip("/") + "/")
        for prefix in PROTECTED_PREFIXES
    ) or lower.startswith("refs/")
 def contains_secret_like_content(content: str) -> bool:
    return any(pattern.search(content or "") for pattern in SECRET_PATTERNS)
 def validate_paths(paths: Iterable[str], allowed_paths: Sequence[str]) -> tuple[str, ...]:
    allowed = tuple(normalize_path(path) for path in allowed_paths)
    if not allowed:
        raise LeaseError("allowed_paths must not be empty")
    result: list[str] = []
    for raw in paths:
        path = normalize_path(raw)
        if path_is_protected(path):
            raise LeaseError("protected path is not lease-writable")
        if not any(path == prefix or path.startswith(prefix + "/") for prefix in allowed):
            raise LeaseError("path is outside the lease allowlist")
        if path not in result:
            result.append(path)
    if not result:
        raise LeaseError("at least one changed path is required")
    return tuple(result)
@dataclass
 class CommitEntry:
    commit_oid: str
    parent_oid: str
    paths: tuple[str, ...]
    recorded_at: str
@dataclass
 class RepairLease:
    lease_id: str
    task_id: str
    owner_identity: str
    branch: str
    description: str
    allowed_paths: tuple[str, ...]
    initial_head_oid: str
    current_head_oid: str
    created_at: str
    expires_at: str
    max_expires_at: str
    state: str = "ACTIVE"
    revision: int = 0
    commits: list[CommitEntry] = field(default_factory=list)
    attached: bool = False
    def to_json(self) -> dict[str, Any]:
        payload = asdict(self)
        payload["allowed_paths"] = list(self.allowed_paths)
        payload["commits"] = [asdict(entry) for entry in self.commits]
        return payload
    @classmethod
    def from_json(cls, raw: dict[str, Any]) -> "RepairLease":
        commits = tuple(
            CommitEntry(
                commit_oid=_oid(item["commit_oid"], "commit_oid"),
                parent_oid=_oid(item["parent_oid"], "parent_oid"),
                paths=tuple(normalize_path(path) for path in item["paths"]),
                recorded_at=str(item["recorded_at"]),
            )
            for item in raw.get("commits", [])
        )
        return cls(
            lease_id=str(raw["lease_id"]),
            task_id=str(raw["task_id"]),
            owner_identity=str(raw["owner_identity"]),
            branch=str(raw["branch"]),
            description=str(raw["description"]),
            allowed_paths=tuple(normalize_path(path) for path in raw["allowed_paths"]),
            initial_head_oid=_oid(raw["initial_head_oid"], "initial_head_oid"),
            current_head_oid=_oid(raw["current_head_oid"], "current_head_oid"),
            created_at=str(raw["created_at"]),
            expires_at=str(raw["expires_at"]),
            max_expires_at=str(raw["max_expires_at"]),
            state=str(raw.get("state", "ACTIVE")),
            revision=int(raw.get("revision", 0)),
            commits=list(commits),
            attached=bool(raw.get("attached", False)),
        )
 class LeaseStore:
    """Atomic JSON store for restart-recoverable lease state."""
    def __init__(self, directory: str | os.PathLike[str]) -> None:
        self.directory = Path(directory)
        self.directory.mkdir(parents=True, exist_ok=True)
        if self.directory.is_symlink():
            raise LeaseError("lease store must not be a symlink")
        os.chmod(self.directory, 0o700)
    def _path(self, lease_id: str) -> Path:
        if not re.fullmatch(r"lease-[0-9a-f]{32}", lease_id):
            raise LeaseError("invalid lease id")
        return self.directory / f"{lease_id}.json"
    def create(self, lease: RepairLease) -> None:
        path = self._path(lease.lease_id)
        if path.exists() or path.is_symlink():
            raise LeaseError("lease already exists")
        self._write(path, lease.to_json(), exclusive=True)
    def load(self, lease_id: str) -> RepairLease:
        path = self._path(lease_id)
        try:
            raw = json.loads(path.read_text(encoding="utf-8"))
        except (OSError, json.JSONDecodeError, TypeError) as exc:
            raise LeaseError("lease state is unavailable or invalid") from exc
        if not isinstance(raw, dict):
            raise LeaseError("lease state must be an object")
        return RepairLease.from_json(raw)
    def save(self, lease: RepairLease) -> None:
        self._write(self._path(lease.lease_id), lease.to_json())
    @staticmethod
    def _write(path: Path, payload: dict[str, Any], *, exclusive: bool = False) -> None:
        flags = os.O_WRONLY | os.O_CREAT | (os.O_EXCL if exclusive else 0)
        fd, temp_name = tempfile.mkstemp(prefix=".lease-", dir=path.parent)
        try:
            os.fchmod(fd, 0o600)
            with os.fdopen(fd, "w", encoding="utf-8") as stream:
                json.dump(payload, stream, ensure_ascii=True, sort_keys=True, separators=(",", ":"))
                stream.write("\n")
            if exclusive:
                os.link(temp_name, path)
                os.unlink(temp_name)
            else:
                os.replace(temp_name, path)
            os.chmod(path, 0o600)
        except Exception:
            try:
                os.unlink(temp_name)
            except FileNotFoundError:
                pass
            raise
 class GitProbe:
    """Read-only Git implementation; it never changes a ref or working tree."""
    def __init__(self, bare_repo: str | os.PathLike[str]) -> None:
        self.bare_repo = Path(bare_repo)
    def _run(self, args: list[str]) -> str:
        result = subprocess.run(
            ["git", "--git-dir", str(self.bare_repo), *args],
            text=True,
            capture_output=True,
            check=False,
        )
        if result.returncode != 0:
            raise LeaseError("read-only Git probe failed")
        return result.stdout.strip()
    def branch_head(self, branch: str) -> str:
        return _oid(self._run(["rev-parse", f"refs/heads/{branch}"]), "branch_head")
    def parent(self, commit: str) -> str:
        return _oid(self._run(["rev-parse", f"{_oid(commit)}^1"]), "parent")
    def is_ancestor(self, older: str, newer: str) -> bool:
        old, new = _oid(older), _oid(newer)
        result = subprocess.run(
            ["git", "--git-dir", str(self.bare_repo), "merge-base", "--is-ancestor", old, new],
            check=False,
        )
        return result.returncode == 0
    def changed_paths(self, commit: str) -> tuple[str, ...]:
        raw = self._run(["diff-tree", "--no-commit-id", "--name-only", "-r", _oid(commit)])
        return tuple(normalize_path(line) for line in raw.splitlines() if line.strip())
    def commits_between(self, older: str, newer: str) -> tuple[str, ...]:
        raw = self._run(["rev-list", "--reverse", f"{_oid(older)}..{_oid(newer)}"])
        return tuple(_oid(line, "commit") for line in raw.splitlines() if line.strip())
 class RepairLeaseManager:
    """Issue, recover, renew, and close branch-bound repair leases."""
    def __init__(self, store: LeaseStore, git: GitProbeProtocol, *, clock=_now) -> None:
        self.store = store
        self.git = git
        self.clock = clock
    def _require_owner(self, lease: RepairLease, owner_identity: str) -> None:
        if owner_identity != lease.owner_identity:
            raise LeaseError("lease identity mismatch")
    def _active(self, lease: RepairLease) -> RepairLease:
        now = self.clock()
        if lease.state != "ACTIVE":
            raise LeaseError(f"lease is {lease.state.lower()}")
        if now >= _parse_ts(lease.expires_at):
            lease.state = "EXPIRED"
            self.store.save(lease)
            raise LeaseError("lease expired")
        return lease
    def issue(
        self,
        *,
        task_id: str,
        owner_identity: str,
        branch: str,
        description: str,
        allowed_paths: Sequence[str],
        ttl_seconds: int = 3600,
    ) -> RepairLease:
        if task_id != TASK_ID:
            raise LeaseError("unexpected task id")
        if not owner_identity or not description or len(description) > 240:
            raise LeaseError("owner identity and description are required")
        if "\n" in description or "\r" in description:
            raise LeaseError("description must be a single line")
        if branch in DENIED_BRANCHES or branch.startswith(("main/", "refs/", "tags/")):
            raise LeaseError("protected branch cannot receive a repair lease")
        if not isinstance(ttl_seconds, int) or not 0 < ttl_seconds <= MAX_LEASE_SECONDS:
            raise LeaseError("lease TTL exceeds the maximum")
        allowed = tuple(normalize_path(path) for path in allowed_paths)
        if any(path_is_protected(path) for path in allowed):
            raise LeaseError("protected path in lease allowlist")
        head = self.git.branch_head(branch)
        created = self.clock()
        expires = created + timedelta(seconds=ttl_seconds)
        max_expires = created + timedelta(seconds=MAX_LEASE_SECONDS)
        lease_id = "lease-" + secrets.token_hex(16)
        lease = RepairLease(
            lease_id=lease_id,
            task_id=task_id,
            owner_identity=owner_identity,
            branch=branch,
            description=description,
            allowed_paths=allowed,
            initial_head_oid=head,
            current_head_oid=head,
            created_at=_ts(created),
            expires_at=_ts(expires),
            max_expires_at=_ts(max_expires),
        )
        self.store.create(lease)
        return lease
    def attach_existing_branch(
        self, lease_id: str, *, owner_identity: str, expected_head_oid: str
    ) -> RepairLease:
        lease = self._active(self.store.load(lease_id))
        self._require_owner(lease, owner_identity)
        current = self.git.branch_head(lease.branch)
        expected = _oid(expected_head_oid, "expected_head_oid")
        if current != expected or current != lease.current_head_oid:
            raise LeaseError("branch head does not match the lease")
        lease.attached = True
        lease.revision += 1
        self.store.save(lease)
        return lease
    def authorize_commit(
        self,
        lease_id: str,
        *,
        owner_identity: str,
        expected_head_oid: str,
        paths: Sequence[str],
        content: Mapping[str, str] | None = None,
    ) -> RepairLease:
        lease = self._active(self.store.load(lease_id))
        self._require_owner(lease, owner_identity)
        expected = _oid(expected_head_oid, "expected_head_oid")
        current = self.git.branch_head(lease.branch)
        if current != expected or current != lease.current_head_oid:
            raise LeaseError("stale or externally advanced branch head")
        if not lease.attached:
            raise LeaseError("lease is not attached")
        validate_paths(paths, lease.allowed_paths)
        if content and any(contains_secret_like_content(value) for value in content.values()):
            raise LeaseError("secret-like content rejected")
        return lease
    def record_commit(
        self,
        lease_id: str,
        *,
        owner_identity: str,
        expected_head_oid: str,
        new_head_oid: str,
        paths: Sequence[str],
    ) -> RepairLease:
        lease = self._active(self.store.load(lease_id))
        self._require_owner(lease, owner_identity)
        new_head = _oid(new_head_oid, "new_head_oid")
        expected = _oid(expected_head_oid, "expected_head_oid")
        if not lease.attached or lease.current_head_oid != expected:
            raise LeaseError("stale lease head")
        if self.git.branch_head(lease.branch) != new_head:
            raise LeaseError("branch head does not match committed head")
        validate_paths(paths, lease.allowed_paths)
        if self.git.parent(new_head) != expected or not self.git.is_ancestor(expected, new_head):
            raise LeaseError("commit is not a fast-forward child of the expected head")
        actual_paths = self.git.changed_paths(new_head)
        allowed = validate_paths(actual_paths, lease.allowed_paths)
        requested = set(validate_paths(paths, lease.allowed_paths))
        if not set(allowed).issubset(requested):
            raise LeaseError("commit changed an unrequested path")
        lease.current_head_oid = new_head
        lease.revision += 1
        lease.commits.append(
            CommitEntry(
                commit_oid=new_head,
                parent_oid=expected,
                paths=allowed,
                recorded_at=_ts(self.clock()),
            )
        )
        self.store.save(lease)
        return lease
    def recover(self, lease_id: str, *, owner_identity: str) -> RepairLease:
        lease = self._active(self.store.load(lease_id))
        self._require_owner(lease, owner_identity)
        current = self.git.branch_head(lease.branch)
        if current == lease.current_head_oid:
            return lease
        if not self.git.is_ancestor(lease.current_head_oid, current):
            raise LeaseError("branch moved non-fast-forward")
        commits = self.git.commits_between(lease.current_head_oid, current)
        for commit in commits:
            actual = self.git.changed_paths(commit)
            validate_paths(actual, lease.allowed_paths)
        lease.current_head_oid = current
        lease.revision += 1
        self.store.save(lease)
        return lease
    def renew(self, lease_id: str, *, owner_identity: str, ttl_seconds: int) -> RepairLease:
        lease = self._active(self.store.load(lease_id))
        self._require_owner(lease, owner_identity)
        if not isinstance(ttl_seconds, int) or ttl_seconds <= 0:
            raise LeaseError("renewal TTL must be positive")
        candidate = self.clock() + timedelta(seconds=ttl_seconds)
        maximum = _parse_ts(lease.max_expires_at)
        if candidate > maximum:
            raise LeaseError("renewal exceeds maximum lease lifetime")
        lease.expires_at = _ts(candidate)
        lease.revision += 1
        self.store.save(lease)
        return lease
    def complete(self, lease_id: str, *, owner_identity: str) -> RepairLease:
        lease = self._active(self.store.load(lease_id))
        self._require_owner(lease, owner_identity)
        lease.state = "COMPLETED"
        lease.revision += 1
        self.store.save(lease)
        return lease
    def revoke(self, lease_id: str, *, owner_identity: str) -> RepairLease:
        lease = self._active(self.store.load(lease_id))
        self._require_owner(lease, owner_identity)
        lease.state = "REVOKED"
        lease.revision += 1
        self.store.save(lease)
        return lease
 def sanitized_lease_view(lease: RepairLease) -> dict[str, Any]:
    """Return lease metadata only; no content, token, or credential values."""
    return {
        "lease_id": lease.lease_id,
        "task_id": lease.task_id,
        "owner_identity": lease.owner_identity,
        "branch": lease.branch,
        "description": lease.description,
        "initial_head_oid": lease.initial_head_oid,
        "current_head_oid": lease.current_head_oid,
        "created_at": lease.created_at,
        "expires_at": lease.expires_at,
        "state": lease.state,
        "revision": lease.revision,
        "commit_count": len(lease.commits),
        "attached": lease.attached,
    }
@@ -1,108 +0,0 @@
 """Atomic, predicate-bound activation of the durable release campaign."""
 from __future__ import annotations
 import hashlib
 import json
 import os
 from pathlib import Path
 import re
 import tempfile
 from typing import Any, Mapping
 from release_campaign_authorization import CampaignError, validate_policy
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
 class CampaignActivationError(CampaignError):
    pass
 def canonical_json(value: Any) -> bytes:
    return (json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n").encode("utf-8")
 def digest_bytes(value: bytes) -> str:
    return hashlib.sha256(value).hexdigest()
 def build_active_policy(current: Mapping[str, Any], facts: Mapping[str, Any]) -> dict[str, Any]:
    policy = validate_policy(dict(current))
    required = {
        "campaign_id",
        "repository",
        "source_main_oid",
        "gitea_main_oid",
        "authority_main_oid",
        "runtime_source_oid",
        "durable_job_state",
        "writer_ready",
        "gitea_machine_authenticated",
        "governance_executor_ready",
        "preapproval_publisher_ready",
        "runtime_exact_main",
        "main_lineage_verified",
        "campaign_revoked",
    }
    if set(facts) != required:
        raise CampaignActivationError("ACTIVATION_FACTS_SCHEMA_INVALID")
    if policy["activation_state"] != "PENDING_CONTROL_PLANE_MERGE" or policy["active"] is not False:
        raise CampaignActivationError("CAMPAIGN_NOT_PENDING")
    if policy["campaign_id"] != CAMPAIGN_ID or facts["campaign_id"] != CAMPAIGN_ID:
        raise CampaignActivationError("CAMPAIGN_ID_MISMATCH")
    if facts["repository"] != "aios/aios" or policy["repository"] != facts["repository"]:
        raise CampaignActivationError("REPOSITORY_MISMATCH")
    for name in ("source_main_oid", "gitea_main_oid", "authority_main_oid", "runtime_source_oid"):
        if not isinstance(facts[name], str) or not OID_RE.fullmatch(facts[name]):
            raise CampaignActivationError("ACTIVATION_OID_INVALID")
    if not (
        facts["source_main_oid"]
        == facts["gitea_main_oid"]
        == facts["authority_main_oid"]
        == facts["runtime_source_oid"]
    ):
        raise CampaignActivationError("ACTIVATION_MAIN_DIVERGENCE")
    if facts["durable_job_state"] != "COMPLETED":
        raise CampaignActivationError("DURABLE_JOB_NOT_COMPLETED")
    boolean_fields = (
        "writer_ready",
        "gitea_machine_authenticated",
        "governance_executor_ready",
        "preapproval_publisher_ready",
        "runtime_exact_main",
        "main_lineage_verified",
    )
    if any(facts[name] is not True for name in boolean_fields) or facts["campaign_revoked"] is not False:
        raise CampaignActivationError("ACTIVATION_PREDICATE_FAILED")
    activated = dict(policy)
    activated["activation_state"] = "ACTIVE"
    activated["active"] = True
    return validate_policy(activated)
 def atomic_write_policy(path: Path, sidecar: Path, receipt_path: Path, policy: Mapping[str, Any], receipt: Mapping[str, Any]) -> str:
    if path.is_symlink() or sidecar.is_symlink() or receipt_path.exists() or receipt_path.is_symlink():
        raise CampaignActivationError("ACTIVATION_PATH_INVALID")
    path.parent.mkdir(parents=True, exist_ok=True)
    raw = canonical_json(dict(policy))
    digest = digest_bytes(raw)
    for target, data, mode in (
        (path, raw, "wb"),
        (sidecar, f"{digest}  {path.name}\n".encode("ascii"), "wb"),
        (receipt_path, canonical_json(dict(receipt)), "wb"),
    ):
        fd, temporary = tempfile.mkstemp(prefix=f".{target.name}.", dir=target.parent)
        try:
            os.fchmod(fd, 0o600)
            with os.fdopen(fd, mode) as stream:
                stream.write(data)
                stream.flush()
                os.fsync(stream.fileno())
            os.replace(temporary, target)
            os.chmod(target, 0o600)
        finally:
            if os.path.exists(temporary):
                os.unlink(temporary)
    return digest
@@ -1,106 +0,0 @@
 #!/usr/bin/env python3
 """Machine campaign approval gate for protected engineering PRs."""
 from __future__ import annotations
 import argparse
 import json
 from pathlib import Path
 import subprocess
 from typing import Any, Mapping
 from release_campaign_authorization import CampaignAuthorization, CampaignError
 class GateError(RuntimeError):
    pass
 def git_is_ancestor(repository: Path, ancestor: str, descendant: str) -> bool:
    result = subprocess.run(
        [
            "git",
            f"--git-dir={repository}",
            "merge-base",
            "--is-ancestor",
            ancestor,
            descendant,
        ],
        check=False,
        capture_output=True,
    )
    if result.returncode == 0:
        return True
    if result.returncode == 1:
        return False
    raise GateError("git_ancestor_check_failed")
 def evaluate(
    campaign: CampaignAuthorization,
    facts: Mapping[str, Any],
    repository: Path,
 ) -> dict[str, Any]:
    required = {
        "repository",
        "pr_number",
        "base_ref",
        "base_oid",
        "head_oid",
        "required_checks_all_success",
        "required_checks_same_head",
        "unresolved_conversations",
        "mergeable",
        "protected_target",
    }
    if set(facts) != required:
        raise GateError("pr_facts_fields_invalid")
    if facts["repository"] != "aios/aios":
        raise GateError("repository_mismatch")
    if facts["base_ref"] != "refs/heads/main" or facts["protected_target"] != "main":
        raise GateError("protected_main_required")
    if facts["required_checks_all_success"] is not True:
        raise GateError("required_checks_not_success")
    if facts["required_checks_same_head"] is not True:
        raise GateError("required_checks_stale")
    if facts["unresolved_conversations"] != 0:
        raise GateError("unresolved_conversations")
    if facts["mergeable"] is not True:
        raise GateError("pr_not_mergeable")
    if not git_is_ancestor(repository, campaign.anchor_oid, str(facts["base_oid"])):
        raise GateError("base_outside_campaign_lineage")
    if not git_is_ancestor(repository, str(facts["base_oid"]), str(facts["head_oid"])):
        raise GateError("head_outside_pr_lineage")
    campaign.assert_operation("protected_merge")
    return {
        "schema": "aios.campaign-approval-gate-result.v1",
        "status": "SUCCESS",
        "campaign_id": campaign.campaign_id,
        "pr_number": facts["pr_number"],
        "head_oid": facts["head_oid"],
        "owner_ui_interaction_required": False,
    }
 def main() -> int:
    p = argparse.ArgumentParser()
    p.add_argument("--campaign", type=Path, required=True)
    p.add_argument("--revocation", type=Path)
    p.add_argument("--pr-facts", type=Path, required=True)
    p.add_argument("--repository", type=Path, required=True)
    a = p.parse_args()
    campaign = CampaignAuthorization.load(
        a.campaign,
        revocation=a.revocation,
        require_active=True,
    )
    facts = json.loads(a.pr_facts.read_text(encoding="utf-8"))
    print(json.dumps(evaluate(campaign, facts, a.repository), sort_keys=True))
    return 0
 if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except (CampaignError, GateError) as exc:
        print(json.dumps({"status": "FAILURE", "reason": str(exc)}, sort_keys=True))
        raise SystemExit(2)
@@ -1,150 +0,0 @@
 #!/usr/bin/env python3
 """Automatically accept an exact release binding under an ACTIVE campaign."""
 from __future__ import annotations
 import argparse
 import hashlib
 import json
 import os
 from pathlib import Path
 import stat
 import tempfile
 from typing import Any, Mapping
 from release_campaign_authorization import CampaignAuthorization, CampaignError
 class AcceptanceError(RuntimeError):
    pass
 def secure_json(path: Path) -> dict[str, Any]:
    if path.is_symlink() or not path.is_file():
        raise AcceptanceError(f"invalid_file:{path}")
    st = path.lstat()
    if st.st_uid != 0 or stat.S_IMODE(st.st_mode) & 0o022:
        raise AcceptanceError(f"unsafe_file:{path}")
    value = json.loads(path.read_text(encoding="utf-8"))
    if not isinstance(value, dict):
        raise AcceptanceError(f"json_object_required:{path}")
    return value
 def atomic_new(path: Path, value: Mapping[str, Any]) -> None:
    if path.exists() or path.is_symlink():
        raise AcceptanceError("acceptance_receipt_exists")
    path.parent.mkdir(parents=True, exist_ok=True)
    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
    try:
        os.fchmod(fd, 0o600)
        if os.geteuid() == 0:
            os.fchown(fd, 0, 0)
        with os.fdopen(fd, "w", encoding="utf-8", closefd=True) as stream:
            json.dump(dict(value), stream, sort_keys=True, indent=2)
            stream.write("\n")
            stream.flush()
            os.fsync(stream.fileno())
        os.replace(name, path)
        os.chmod(path, 0o600)
    finally:
        try:
            os.unlink(name)
        except FileNotFoundError:
            pass
 def evaluate(
    campaign: CampaignAuthorization,
    binding: Mapping[str, Any],
    evidence: Mapping[str, Any],
    artifact: Mapping[str, Any],
    staging: Mapping[str, Any],
    main: Mapping[str, Any],
    tag: Mapping[str, Any],
 ) -> dict[str, Any]:
    required_binding = {
        "version",
        "target_oid",
        "evidence_closure_oid",
        "artifact_sha256",
        "artifact_size",
        "approval_plan_id",
    }
    if set(binding) != required_binding:
        raise AcceptanceError("binding_fields_invalid")
    if main.get("repository") != "aios/aios":
        raise AcceptanceError("repository_identity_mismatch")
    if main.get("target_in_main_lineage") is not True:
        raise AcceptanceError("target_outside_main_lineage")
    if evidence.get("object_type") != "commit":
        raise AcceptanceError("evidence_not_commit")
    if evidence.get("target_is_ancestor") is not True:
        raise AcceptanceError("target_not_evidence_ancestor")
    if evidence.get("closure_oid") != binding["evidence_closure_oid"]:
        raise AcceptanceError("evidence_oid_mismatch")
    if artifact.get("sha256") != binding["artifact_sha256"]:
        raise AcceptanceError("artifact_digest_mismatch")
    if artifact.get("size") != binding["artifact_size"]:
        raise AcceptanceError("artifact_size_mismatch")
    if artifact.get("retained") is not True:
        raise AcceptanceError("artifact_not_retained")
    if staging.get("install") != "PASS":
        raise AcceptanceError("staging_install_failed")
    if staging.get("health") != "PASS":
        raise AcceptanceError("staging_health_failed")
    if staging.get("restart") != "PASS":
        raise AcceptanceError("staging_restart_failed")
    if staging.get("rollback_readiness") != "PASS":
        raise AcceptanceError("rollback_readiness_failed")
    if tag.get("conflict") is not False:
        raise AcceptanceError("tag_conflict")
    campaign.assert_operation("derive_campaign_acceptance")
    return {
        "schema": "aios.campaign-release-acceptance.v1",
        "accepted": True,
        "binding_replaced": False,
        "campaign_id": campaign.campaign_id,
        "campaign_generation": campaign.data["generation"],
        **dict(binding),
        "owner_interaction_required": False,
    }
 def main() -> int:
    p = argparse.ArgumentParser()
    p.add_argument("--campaign", type=Path, required=True)
    p.add_argument("--revocation", type=Path)
    p.add_argument("--binding", type=Path, required=True)
    p.add_argument("--evidence", type=Path, required=True)
    p.add_argument("--artifact", type=Path, required=True)
    p.add_argument("--staging", type=Path, required=True)
    p.add_argument("--main-facts", type=Path, required=True)
    p.add_argument("--tag-facts", type=Path, required=True)
    p.add_argument("--output", type=Path, required=True)
    a = p.parse_args()
    campaign = CampaignAuthorization.load(
        a.campaign,
        revocation=a.revocation,
        require_active=True,
    )
    receipt = evaluate(
        campaign,
        secure_json(a.binding),
        secure_json(a.evidence),
        secure_json(a.artifact),
        secure_json(a.staging),
        secure_json(a.main_facts),
        secure_json(a.tag_facts),
    )
    atomic_new(a.output, receipt)
    print(json.dumps(receipt, sort_keys=True))
    return 0
 if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except (CampaignError, AcceptanceError) as exc:
        print(json.dumps({"status": "BLOCKED", "reason": str(exc)}, sort_keys=True))
        raise SystemExit(2)
@@ -1,67 +0,0 @@
 """Runtime deployment-state provider for governed health contracts."""
 from __future__ import annotations
 import datetime as dt
 import json
 import os
 import re
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Mapping
 _OID = re.compile(r"^[0-9a-f]{40}$")
 _SHA = re.compile(r"^[0-9a-f]{64}$")
 _STATES = {"STAGED", "ACTIVE", "ROLLED_BACK"}
@dataclass(frozen=True)
 class RuntimeDeploymentState:
    version: str
    commit_oid: str
    artifact_sha256: str
    deployment_state: str
    @property
    def production_deployed(self) -> bool:
        return self.deployment_state == "ACTIVE"
    def health_payload(self) -> dict[str, Any]:
        return {
            "status": "ok",
            "version": self.version,
            "commit_oid": self.commit_oid,
            "artifact_sha256": self.artifact_sha256,
            "deployment_state": self.deployment_state,
            "production_deployed": self.production_deployed,
            "health_timestamp": dt.datetime.now(dt.timezone.utc).isoformat(),
        }
    @classmethod
    def from_environment(cls, environ: Mapping[str, str] | None = None) -> "RuntimeDeploymentState":
        env = dict(environ or os.environ)
        values: dict[str, Any] = {}
        state_file = env.get("DEPLOYMENT_STATE_FILE", "").strip()
        if state_file:
            path = Path(state_file)
            if path.is_file() and not path.is_symlink():
                loaded = json.loads(path.read_text(encoding="utf-8"))
                if not isinstance(loaded, dict):
                    raise ValueError("deployment_state_file_object_required")
                values.update(loaded)
        file_deployment_state = values.get("deployment_state")
        values.update({k: v for k, v in {
            "version": env.get("RELEASE_VERSION", values.get("version", "")),
            "commit_oid": env.get("TARGET_OID", values.get("commit_oid", "")),
            "artifact_sha256": env.get("ARTIFACT_SHA256", values.get("artifact_sha256", "")),
            "deployment_state": env.get("DEPLOYMENT_STATE", values.get("deployment_state", "")),
        }.items() if v != ""})
        if file_deployment_state not in (None, ""):
            values["deployment_state"] = file_deployment_state
        version = str(values.get("version", ""))
        commit_oid = str(values.get("commit_oid", ""))
        artifact_sha256 = str(values.get("artifact_sha256", ""))
        deployment_state = str(values.get("deployment_state", ""))
        if not version or not _OID.fullmatch(commit_oid) or not _SHA.fullmatch(artifact_sha256):
            raise ValueError("deployment_binding_invalid")
        if deployment_state not in _STATES:
            raise ValueError("deployment_state_invalid")
        return cls(version, commit_oid, artifact_sha256, deployment_state)
@@ -1 +0,0 @@
 """Permanent AIOS governance source components."""
@@ -1,75 +0,0 @@
 #!/usr/bin/env python3
 import json
 import pathlib
 import socket
 import time
 SOCKET = '/run/aios-governance-executor/executor.sock'
 STATE = pathlib.Path('/var/lib/aios-gitops/governance-executor/drift-monitor.json')
 APPROVED = pathlib.Path('/var/lib/aios-gitops/runtime/tasks/AIOS-PROTECTION-SNAPSHOT-DRIFT-FORENSICS-V1/protection-drift/semantic-analysis.json')
 def call():
    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    sock.settimeout(20)
    sock.connect(SOCKET)
    request = {'operation': 'GET_BRANCH_PROTECTION', 'payload': {'repository': 'aios/aios', 'branch': 'main'}}
    sock.sendall((json.dumps(request, separators=(',', ':')) + '\n').encode())
    chunks = []
    while True:
        part = sock.recv(1024 * 1024)
        if not part:
            break
        chunks.append(part)
        if b'\n' in part:
            break
    sock.close()
    return json.loads(b''.join(chunks).splitlines()[0])
 def main():
    try:
        result = call()
        if result.get('status') != 'PASS':
            raise RuntimeError(str(result.get('code') or 'EXECUTOR_GET_FAILED'))
        approved = json.loads(APPROVED.read_text(encoding='utf-8'))
        approved_transport = approved['approved_transport_digest_from_evidence']
        approved_semantic = approved['approved_semantic_digest']
        transport = result['transport_digest']
        semantic = result['semantic_digest']
        if semantic != approved_semantic:
            state = 'GOVERNANCE_POLICY_DRIFT'
        elif transport != approved_transport:
            state = 'GOVERNANCE_TRANSPORT_METADATA_CHANGED'
        else:
            state = 'NO_DRIFT'
        payload = {
            'schema': 'aios.governance-drift-monitor.v1',
            'observed_at_unix': int(time.time()),
            'status': state,
            'release_blocking': False,
            'approved_transport_digest': approved_transport,
            'observed_transport_digest': transport,
            'approved_semantic_digest': approved_semantic,
            'observed_semantic_digest': semantic,
            'semantic_schema': result.get('semantic_schema'),
            'source': 'Dedicated Governance Executor GET_BRANCH_PROTECTION',
        }
    except Exception as exc:
        payload = {
            'schema': 'aios.governance-drift-monitor.v1',
            'observed_at_unix': int(time.time()),
            'status': 'MONITOR_UNAVAILABLE',
            'release_blocking': False,
            'error_code': str(exc),
        }
    STATE.parent.mkdir(parents=True, exist_ok=True)
    temporary = STATE.with_suffix('.tmp')
    temporary.write_text(json.dumps(payload, sort_keys=True, separators=(',', ':'), ensure_ascii=False) + '\n', encoding='utf-8')
    temporary.replace(STATE)
    STATE.chmod(0o640)
    print(json.dumps(payload, sort_keys=True, separators=(',', ':'), ensure_ascii=False))
 if __name__ == '__main__':
    main()
@@ -1,417 +0,0 @@
 #!/usr/bin/env python3
 import base64
 import copy
 import hashlib
 import json
 import os
 import pathlib
 import socket
 import time
 import urllib.error
 import urllib.parse
 import urllib.request
 SOURCE_GOVERNANCE = "/opt/aios/aios-control-plane/current/active-runtime/app/governance"
 if SOURCE_GOVERNANCE not in __import__("sys").path:
    __import__("sys").path.insert(0, SOURCE_GOVERNANCE)
 from stage2_gate_migration import (
    CAMPAIGN_GATE,
    CAMPAIGN_ID,
    OWNER_GATE,
    STAGE1_SEMANTIC_SHA,
    Stage2GateError,
    build_target,
    semantic_digest as stage2_semantic_digest,
    validate_stage2_facts,
 )
 API = "http://127.0.0.1:3000"
 REPO = "aios/aios"
 SOCKET = "/run/aios-governance-executor/executor.sock"
 JOURNAL = pathlib.Path("/var/lib/aios-gitops/governance-executor/executor-journal.jsonl")
 RECONCILIATION_BINDING_PATH = pathlib.Path("/var/lib/aios-gitops/governance-executor/reconciliation-binding.json")
 PR54_HEAD = "015185d7e5191d18c5c1596160807ac228782a0a"
 PR54_REVIEW = 104
 PR54_MANIFEST_SHA = "1b11ee42d53a9f6c1646e5f5ddd8ce5b7ecf301483b9f3d47a068290d541ba4b"
 PR54_PREVIOUS_PROTECTION_SHA = "8b3370add21cd23c2b4f41d8d84d3eaaa09ddf0451549b72c7941bbd92d5d60a"
 SEMANTIC_SCHEMA = "aios.semantic-protection.v1"
 APPROVED_SEMANTIC_SHA = "ba15d512ed8c1f43e5f72c84125a3a71a7347ef59e18000bbfca24d6e69f1b19"
 STAGE1_SEMANTIC_SHA = "d911e856f71de6105b8efa08e13338a448e0b6d37536332decd80c9f409ecf27"
 USER_IDS = {"owner": 2, "aios-autonomy-agent": 153}
 def canon(value):
    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
 def sha(value):
    return hashlib.sha256(canon(value)).hexdigest()
 def token():
    value = (pathlib.Path(os.environ["CREDENTIALS_DIRECTORY"]) / "gitea-governance-executor-token").read_text().strip()
    if len(value) < 16:
        raise RuntimeError("EXECUTOR_CREDENTIAL_INVALID")
    return value
 def api(method, path, value, body=None, expected=(200,)):
    raw = None if body is None else json.dumps(body, separators=(",", ":")).encode()
    req = urllib.request.Request(API + path, data=raw, method=method)
    req.add_header("Authorization", "token " + value)
    req.add_header("Accept", "application/json")
    if raw is not None:
        req.add_header("Content-Type", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=20) as response:
            status = response.status
            payload = response.read()
    except urllib.error.HTTPError as exc:
        if exc.code in expected:
            payload = exc.read()
            return exc.code, json.loads(payload) if payload else None
        raise RuntimeError("GITEA_HTTP_" + str(exc.code))
    if status not in expected:
        raise RuntimeError("GITEA_HTTP_" + str(status))
    if not payload or not payload.strip():
        raise RuntimeError("GITEA_EMPTY_JSON:" + path)
    try:
        decoded = json.loads(payload)
    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
        raise RuntimeError("GITEA_INVALID_JSON:" + path) from exc
    return status, decoded
 def journal(event, **fields):
    JOURNAL.parent.mkdir(parents=True, exist_ok=True)
    record = {"schema": "aios.governance-executor-journal.v2", "event": event, "unix": int(time.time()), **fields}
    with JOURNAL.open("a", encoding="utf-8") as stream:
        stream.write(json.dumps(record, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n")
        stream.flush()
        os.fsync(stream.fileno())
 def typed_json(value):
    if value in (None, "null"):
        return []
    if isinstance(value, str):
        return json.loads(value)
    return value
 def user_ids(names):
    result = []
    for name in names or []:
        if name not in USER_IDS:
            raise RuntimeError("UNKNOWN_GOVERNANCE_USER:" + str(name))
        result.append(USER_IDS[name])
    return sorted(result)
 def semantic_policy(value):
    policy = {
        "schema_version": SEMANTIC_SCHEMA,
        "repo_id": 1,
        "protection_id": 2,
        "branch_name": value.get("branch_name"),
        "can_push": value.get("enable_push"),
        "can_force_push": value.get("enable_force_push"),
        "enable_merge_whitelist": value.get("enable_merge_whitelist"),
        "merge_whitelist_user_ids": user_ids(value.get("merge_whitelist_usernames")),
        "merge_whitelist_team_ids": [],
        "required_approvals": value.get("required_approvals"),
        "enable_status_check": value.get("enable_status_check"),
        "status_check_contexts": sorted(value.get("status_check_contexts") or []),
        "block_admin_merge_override": value.get("block_admin_merge_override"),
        "block_on_official_review_requests": value.get("block_on_official_review_requests"),
        "block_on_outdated_branch": value.get("block_on_outdated_branch"),
        "block_on_rejected_reviews": value.get("block_on_rejected_reviews"),
        "dismiss_stale_approvals": value.get("dismiss_stale_approvals"),
        "ignore_stale_approvals": value.get("ignore_stale_approvals"),
        "enable_approvals_whitelist": value.get("enable_approvals_whitelist"),
        "approvals_whitelist_user_ids": user_ids(value.get("approvals_whitelist_username")),
        "approvals_whitelist_team_ids": [],
        "enable_bypass_allowlist": value.get("enable_bypass_allowlist"),
        "bypass_allowlist_user_ids": user_ids(value.get("bypass_allowlist_usernames")),
        "bypass_allowlist_team_ids": [],
        "enable_force_push_allowlist": value.get("enable_force_push_allowlist"),
        "force_push_allowlist_user_ids": user_ids(value.get("force_push_allowlist_usernames")),
        "force_push_allowlist_team_ids": [],
        "enable_whitelist": value.get("enable_push_whitelist"),
        "whitelist_user_ids": user_ids(value.get("push_whitelist_usernames")),
        "whitelist_team_ids": [],
        "force_push_allowlist_deploy_keys": value.get("force_push_allowlist_deploy_keys"),
        "whitelist_deploy_keys": value.get("push_whitelist_deploy_keys"),
        "require_signed_commits": value.get("require_signed_commits"),
        "priority": value.get("priority"),
        "protected_file_patterns": value.get("protected_file_patterns"),
        "unprotected_file_patterns": value.get("unprotected_file_patterns"),
    }
    return policy
 def semantic_sha(value):
    return sha(semantic_policy(value))
 def verify_binding(binding, value):
    required = {
        "governance_request_PR", "exact_request_head", "Owner_review_id", "Owner_review_exact_head",
        "manifest_sha256", "expected_previous_snapshot_sha256", "approved_delta",
        "semantic_reconciliation_request_id", "semantic_reconciliation_head",
        "semantic_reconciliation_review_id", "semantic_reconciliation_review_head",
        "approved_semantic_digest",
    }
    if set(binding) != required:
        raise RuntimeError("GOVERNANCE_BINDING_SCHEMA_INVALID")
    if binding["governance_request_PR"] != 54 or binding["exact_request_head"] != PR54_HEAD:
        raise RuntimeError("GOVERNANCE_BINDING_PR54_MISMATCH")
    if binding["Owner_review_id"] != PR54_REVIEW or binding["Owner_review_exact_head"] != PR54_HEAD:
        raise RuntimeError("GOVERNANCE_BINDING_REVIEW_MISMATCH")
    if binding["manifest_sha256"] != PR54_MANIFEST_SHA:
        raise RuntimeError("GOVERNANCE_BINDING_MANIFEST_MISMATCH")
    if binding["expected_previous_snapshot_sha256"] != PR54_PREVIOUS_PROTECTION_SHA:
        raise RuntimeError("GOVERNANCE_BINDING_SNAPSHOT_MISMATCH")
    if binding["approved_delta"] != {"add_merge_whitelist_user_id": 153}:
        raise RuntimeError("GOVERNANCE_BINDING_DELTA_DENIED")
    if binding["approved_semantic_digest"] != APPROVED_SEMANTIC_SHA:
        raise RuntimeError("GOVERNANCE_BINDING_SEMANTIC_DIGEST_MISMATCH")
    if not RECONCILIATION_BINDING_PATH.is_file():
        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_REQUIRED")
    try:
        reconciliation = json.loads(RECONCILIATION_BINDING_PATH.read_text(encoding="utf-8"))
    except (OSError, ValueError):
        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_INVALID") from None
    required_reconciliation = {
        "schema", "request_id", "pr_number", "request_head", "owner_review_id",
        "owner_review_head", "approved_semantic_digest", "approved_delta",
    }
    if set(reconciliation) != required_reconciliation or reconciliation.get("schema") != "aios.semantic-reconciliation-binding.v1":
        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_INVALID")
    if reconciliation["approved_semantic_digest"] != APPROVED_SEMANTIC_SHA or reconciliation["approved_delta"] != binding["approved_delta"]:
        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_MISMATCH")
    if (
        reconciliation["request_id"] != binding["semantic_reconciliation_request_id"]
        or reconciliation["request_head"] != binding["semantic_reconciliation_head"]
        or reconciliation["owner_review_id"] != binding["semantic_reconciliation_review_id"]
        or reconciliation["owner_review_head"] != binding["semantic_reconciliation_review_head"]
    ):
        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_MISMATCH")
    _, reconciliation_pr = api("GET", f"/api/v1/repos/{REPO}/pulls/{reconciliation['pr_number']}", value)
    if (
        reconciliation_pr.get("state") != "open"
        or reconciliation_pr.get("merged")
        or reconciliation_pr.get("head", {}).get("sha") != reconciliation["request_head"]
        or reconciliation_pr.get("base", {}).get("ref") != "governance/approvals"
    ):
        raise RuntimeError("SEMANTIC_RECONCILIATION_REQUEST_STALE")
    _, reconciliation_reviews = api("GET", f"/api/v1/repos/{REPO}/pulls/{reconciliation['pr_number']}/reviews", value)
    reconciliation_review = next((x for x in reconciliation_reviews if x.get("id") == reconciliation["owner_review_id"]), None)
    if (
        not reconciliation_review
        or reconciliation_review.get("user", {}).get("id") != 2
        or reconciliation_review.get("state") != "APPROVED"
        or reconciliation_review.get("commit_id") != reconciliation["owner_review_head"]
        or reconciliation_review.get("dismissed") is not False
    ):
        raise RuntimeError("SEMANTIC_RECONCILIATION_OWNER_REVIEW_STALE")
    _, pr = api("GET", f"/api/v1/repos/{REPO}/pulls/54", value)
    if pr.get("state") != "open" or pr.get("merged") or pr.get("head", {}).get("sha") != PR54_HEAD:
        raise RuntimeError("PR54_APPROVAL_STALE")
    _, reviews = api("GET", f"/api/v1/repos/{REPO}/pulls/54/reviews", value)
    review = next((x for x in reviews if x.get("id") == PR54_REVIEW), None)
    if not review or review.get("user", {}).get("id") != 2 or review.get("state") != "APPROVED" or review.get("commit_id") != PR54_HEAD or review.get("dismissed") is not False:
        raise RuntimeError("PR54_APPROVAL_STALE")
    manifest_path = "approvals/governance-policy/AIOS-AUTONOMOUS-MERGE-GOVERNANCE-SCOPE-EXTENSION-V1.json"
    _, content = api("GET", f"/api/v1/repos/{REPO}/contents/{urllib.parse.quote(manifest_path, safe='/')}?ref={PR54_HEAD}", value)
    raw = base64.b64decode("".join(content.get("content", "").split()))
    if hashlib.sha256(raw).hexdigest() != PR54_MANIFEST_SHA:
        raise RuntimeError("PR54_MANIFEST_STALE")
 def get_protection(value, branch):
    if branch not in {"main", "governance/approvals"}:
        raise RuntimeError("BRANCH_DENIED")
    _, protection = api("GET", f"/api/v1/repos/{REPO}/branch_protections/{urllib.parse.quote(branch, safe='')}", value)
    return protection
 def mutation_receipt(before, after, binding, target_semantic):
    return {
        "before": {"transport_digest": sha(before), "semantic_digest": semantic_sha(before)},
        "approved": {
            "mutation_predicate_digest": sha({"operation": "ADD_MERGE_EXECUTOR", "subject_user_id": 153, "preserve_all_unmodified_security_fields": True}),
            "Owner_review_id": binding["Owner_review_id"],
            "semantic_policy_digest": APPROVED_SEMANTIC_SHA,
        },
        "after": {"transport_digest": sha(after), "semantic_digest": semantic_sha(after)},
        "delta": {"add_merge_whitelist_user_id": 153},
        "target_semantic_digest": sha(target_semantic),
        "unmodified_security_fields": {"verified": True},
    }
 def apply_stage1(binding, value):
    verify_binding(binding, value)
    before = get_protection(value, "main")
    before_semantic = semantic_policy(before)
    before_semantic_sha = sha(before_semantic)
    names = list(before.get("merge_whitelist_usernames") or [])
    name_ids = user_ids(names)
    if name_ids not in ([2], [2, 153]):
        raise RuntimeError("PROTECTION_WHITELIST_PRESTATE_INVALID")
    target_names = ["owner", "aios-autonomy-agent"]
    target_semantic = copy.deepcopy(before_semantic)
    target_semantic["merge_whitelist_user_ids"] = [2, 153]
    if name_ids == [2, 153]:
        if before_semantic_sha != STAGE1_SEMANTIC_SHA:
            journal("APPLY_BLOCKED_STAGE1_IDEMPOTENCY_SEMANTIC_CONFLICT", transport_digest=sha(before), semantic_digest=before_semantic_sha, expected_semantic_digest=STAGE1_SEMANTIC_SHA)
            raise RuntimeError("PROTECTION_STAGE1_SEMANTIC_CONFLICT")
        receipt = mutation_receipt(before, before, binding, target_semantic)
        journal("APPLY_APPROVED_PROTECTION_DELTA_IDEMPOTENT_SUCCESS", receipt=receipt)
        return {"status": "IDEMPOTENT_SUCCESS", "protection": before, "transport_digest": sha(before), "semantic_digest": before_semantic_sha, "target_semantic_digest": sha(target_semantic)}
    if before_semantic_sha != APPROVED_SEMANTIC_SHA:
        journal("APPLY_BLOCKED_SEMANTIC_CAS", transport_digest=sha(before), semantic_digest=before_semantic_sha, expected_semantic_digest=APPROVED_SEMANTIC_SHA)
        raise RuntimeError("PROTECTION_SEMANTIC_CAS_CONFLICT")
    after_api = api("PATCH", f"/api/v1/repos/{REPO}/branch_protections/main", value, {"merge_whitelist_usernames": target_names})[1]
    after = get_protection(value, "main")
    for key in before:
        if key in {"updated_at", "merge_whitelist_usernames"}:
            continue
        if after.get(key) != before.get(key):
            raise RuntimeError("PROTECTION_UNAPPROVED_FIELD_CHANGED:" + key)
    if user_ids(after.get("merge_whitelist_usernames")) != [2, 153]:
        raise RuntimeError("PROTECTION_TARGET_READBACK_FAILED")
    after_semantic = semantic_policy(after)
    if after_semantic != target_semantic:
        raise RuntimeError("PROTECTION_SEMANTIC_TARGET_READBACK_FAILED")
    receipt = mutation_receipt(before, after, binding, target_semantic)
    journal("APPLY_APPROVED_PROTECTION_DELTA_COMPLETED", receipt=receipt)
    return {"status": "APPLIED", "protection": after, "previous_transport_digest": sha(before), "previous_semantic_digest": before_semantic_sha, "transport_digest": sha(after), "semantic_digest": sha(after_semantic), "receipt": receipt}
 def apply_stage2(binding, facts, value):
    verify_binding(binding, value)
    validate_stage2_facts(facts)
    before = get_protection(value, "main")
    if OWNER_GATE in (before.get("status_check_contexts") or []) and stage2_semantic_digest(before) != STAGE1_SEMANTIC_SHA:
        raise RuntimeError("STAGE2_SEMANTIC_PRECONDITION_INVALID")
    try:
        status, target = build_target(before)
    except Stage2GateError as exc:
        journal("MIGRATE_APPROVED_GATE_BLOCKED", reason=str(exc), semantic_digest=stage2_semantic_digest(before))
        raise RuntimeError(str(exc)) from exc
    target_digest = stage2_semantic_digest(target)
    if status == "IDEMPOTENT_SUCCESS":
        journal(
            "MIGRATE_APPROVED_GATE_IDEMPOTENT_SUCCESS",
            before_semantic_digest=stage2_semantic_digest(before),
            target_semantic_digest=target_digest,
            campaign_id=CAMPAIGN_ID,
        )
        return {
            "status": status,
            "protection": before,
            "transport_digest": sha(before),
            "semantic_digest": stage2_semantic_digest(before),
            "target_semantic_digest": target_digest,
            "gate_transition": {"removed": OWNER_GATE, "required": CAMPAIGN_GATE},
        }
    after_api = api(
        "PATCH",
        f"/api/v1/repos/{REPO}/branch_protections/main",
        value,
        {"status_check_contexts": target["status_check_contexts"]},
    )[1]
    after = get_protection(value, "main")
    for key in before:
        if key in {"updated_at", "status_check_contexts"}:
            continue
        if after.get(key) != before.get(key):
            raise RuntimeError("PROTECTION_UNAPPROVED_FIELD_CHANGED:" + key)
    if after.get("status_check_contexts") != target["status_check_contexts"]:
        raise RuntimeError("STAGE2_GATE_TARGET_READBACK_FAILED")
    if stage2_semantic_digest(after) != target_digest:
        raise RuntimeError("STAGE2_SEMANTIC_TARGET_READBACK_FAILED")
    receipt = {
        "before_transport_digest": sha(before),
        "before_semantic_digest": stage2_semantic_digest(before),
        "after_transport_digest": sha(after),
        "after_semantic_digest": stage2_semantic_digest(after),
        "target_semantic_digest": target_digest,
        "campaign_id": CAMPAIGN_ID,
        "gate_transition": {"removed": OWNER_GATE, "required": CAMPAIGN_GATE},
        "preserved_security_fields": True,
        "facts_digest": sha(facts),
    }
    journal("MIGRATE_APPROVED_GATE_COMPLETED", receipt=receipt)
    return {
        "status": "APPLIED",
        "protection": after,
        "previous_transport_digest": sha(before),
        "previous_semantic_digest": stage2_semantic_digest(before),
        "transport_digest": sha(after),
        "semantic_digest": stage2_semantic_digest(after),
        "target_semantic_digest": target_digest,
        "receipt": receipt,
    }
 def handle(request, value):
    if not isinstance(request, dict) or set(request) != {"operation", "payload"}:
        raise RuntimeError("REQUEST_SCHEMA_INVALID")
    operation = request["operation"]
    payload = request["payload"]
    if not isinstance(payload, dict) or payload.get("repository") != REPO:
        raise RuntimeError("REPOSITORY_DENIED")
    if operation == "GET_BRANCH_PROTECTION":
        protection = get_protection(value, payload.get("branch"))
        journal("GET_BRANCH_PROTECTION", branch=payload.get("branch"), transport_digest=sha(protection), semantic_digest=semantic_sha(protection))
        return {"status": "PASS", "protection": protection, "snapshot_sha256": sha(protection), "transport_digest": sha(protection), "semantic_digest": semantic_sha(protection), "semantic_schema": SEMANTIC_SCHEMA}
    if operation == "READBACK_BRANCH_PROTECTION":
        protection = get_protection(value, payload.get("branch"))
        return {"status": "PASS", "protection": protection, "snapshot_sha256": sha(protection), "transport_digest": sha(protection), "semantic_digest": semantic_sha(protection), "semantic_schema": SEMANTIC_SCHEMA}
    if operation == "APPLY_APPROVED_PROTECTION_DELTA":
        binding = payload.get("GovernanceExecutionBinding")
        if not isinstance(binding, dict):
            raise RuntimeError("GOVERNANCE_BINDING_REQUIRED")
        return apply_stage1(binding, value)
    if operation == "MIGRATE_APPROVED_GATE":
        binding = payload.get("GovernanceExecutionBinding")
        facts = payload.get("Stage2Facts")
        if not isinstance(binding, dict) or not isinstance(facts, dict):
            raise RuntimeError("STAGE2_BINDING_OR_FACTS_REQUIRED")
        return apply_stage2(binding, facts, value)
    raise RuntimeError("OPERATION_DENIED")
 def main():
    value = token()
    sock_path = pathlib.Path(SOCKET)
    sock_path.unlink(missing_ok=True)
    server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    server.bind(SOCKET)
    os.chmod(SOCKET, 0o660)
    server.listen(16)
    journal("EXECUTOR_STARTED", api_surface=["GET_BRANCH_PROTECTION", "APPLY_APPROVED_PROTECTION_DELTA", "MIGRATE_APPROVED_GATE", "READBACK_BRANCH_PROTECTION"], semantic_schema=SEMANTIC_SCHEMA, approved_semantic_digest=APPROVED_SEMANTIC_SHA, stage1_semantic_digest=STAGE1_SEMANTIC_SHA, campaign_gate=CAMPAIGN_GATE)
    try:
        while True:
            conn, _ = server.accept()
            with conn:
                data = conn.recv(1024 * 1024 + 1)
                if len(data) > 1024 * 1024:
                    result = {"status": "FAIL", "code": "REQUEST_TOO_LARGE"}
                else:
                    try:
                        request = json.loads(data.decode())
                        result = handle(request, value)
                    except Exception as exc:
                        result = {"status": "FAIL", "code": str(exc)}
                conn.sendall((json.dumps(result, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n").encode())
    finally:
        server.close()
        sock_path.unlink(missing_ok=True)
 if __name__ == "__main__":
    main()
@@ -1,347 +0,0 @@
 #!/usr/bin/env python3
 import base64
 import hashlib
 import json
 import os
 import pathlib
 import shutil
 import socket
 import subprocess
 import tempfile
 import time
 import urllib.error
 import urllib.parse
 import urllib.request
 LOCAL_API = 'http://127.0.0.1:3000/api/v1'
 NETWORK_API = 'https://g.cnnetmkt.top/git/api/v1'
 NETWORK_REMOTE = 'https://g.cnnetmkt.top/git/aios/aios.git'
 REPO = 'aios/aios'
 BASE_BRANCH = 'governance/approvals'
 REQUEST_BRANCH = 'governance/request/protection-semantic-reconciliation-v1-20260808'
 SOCKET_PATH = '/run/aios-governance-preapproval-publisher/publisher.sock'
 CREDENTIAL_NAME = 'gitea-machine-token'
 AUTHORITY_REPO = '/data/aios-gitops/repo.git'
 TASK_ROOT = pathlib.Path('/var/lib/aios-gitops/runtime/tasks/AIOS-PROTECTION-SNAPSHOT-DRIFT-FORENSICS-V1')
 INPUT_ROOT = TASK_ROOT / 'publication-input'
 RECEIPT = TASK_ROOT / 'publication-receipt.json'
 MANIFEST_REL = 'approvals/governance-policy/AIOS-PROTECTION-SEMANTIC-SNAPSHOT-RECONCILIATION-V1.json'
 EVIDENCE_REL = 'approvals/governance-policy/AIOS-PROTECTION-SEMANTIC-SNAPSHOT-RECONCILIATION-V1.evidence.json'
 def digest_bytes(data):
    return hashlib.sha256(data).hexdigest()
 def digest_json(value):
    return digest_bytes(json.dumps(value, sort_keys=True, separators=(',', ':'), ensure_ascii=False).encode())
 def load_token():
    path = pathlib.Path(os.environ['CREDENTIALS_DIRECTORY']) / CREDENTIAL_NAME
    value = path.read_text(encoding='utf-8').strip()
    if len(value) < 16:
        raise RuntimeError('MACHINE_CREDENTIAL_INVALID')
    return value
 def api(base, method, path, token, body=None, expected=(200,)):
    raw = None if body is None else json.dumps(body, separators=(',', ':'), ensure_ascii=False).encode()
    request = urllib.request.Request(base + path, data=raw, method=method)
    request.add_header('Authorization', 'token ' + token)
    request.add_header('Accept', 'application/json')
    if raw is not None:
        request.add_header('Content-Type', 'application/json')
    try:
        with urllib.request.urlopen(request, timeout=20) as response:
            payload = response.read()
            if response.status not in expected:
                raise RuntimeError('GITEA_HTTP_' + str(response.status))
            return response.status, json.loads(payload) if payload else None
    except urllib.error.HTTPError as exc:
        payload = exc.read()
        if exc.code in expected:
            return exc.code, json.loads(payload) if payload else None
        raise RuntimeError('GITEA_HTTP_' + str(exc.code) + ':' + method + ':' + path) from None
 def authority_head():
    result = subprocess.run(
        ['git', '--git-dir=' + AUTHORITY_REPO, 'rev-parse', 'refs/heads/' + BASE_BRANCH],
        text=True, capture_output=True, check=False,
    )
    if result.returncode != 0:
        raise RuntimeError('AUTHORITY_BASE_UNAVAILABLE')
    return result.stdout.strip()
 def branch_api(base, token, branch, expected=(200,)):
    return api(base, 'GET', '/repos/' + REPO + '/branches/' + urllib.parse.quote(branch, safe=''), token, expected=expected)
 def verify_base(token):
    authority = authority_head()
    _, local = branch_api(LOCAL_API, token, BASE_BRANCH)
    _, network = branch_api(NETWORK_API, token, BASE_BRANCH)
    local_oid = local.get('commit', {}).get('id')
    network_oid = network.get('commit', {}).get('id')
    if not authority or authority != local_oid or authority != network_oid:
        raise RuntimeError('RECONCILIATION_REQUIRED')
    return authority
 def verify_identity(token):
    _, user = api(LOCAL_API, 'GET', '/user', token)
    if user.get('login') != 'aios-autonomy-agent' or user.get('id') != 153 or user.get('is_admin') is not False:
        raise RuntimeError('MACHINE_IDENTITY_REJECTED')
    return {'login': user['login'], 'id': user['id'], 'owner': user.get('is_admin')}
 def load_inputs():
    manifest = json.dumps(json.loads((INPUT_ROOT / 'manifest.json').read_text(encoding='utf-8')), sort_keys=True, separators=(',', ':'), ensure_ascii=False).encode()
    evidence = json.dumps(json.loads((INPUT_ROOT / 'evidence.json').read_text(encoding='utf-8')), sort_keys=True, separators=(',', ':'), ensure_ascii=False).encode()
    for data in (manifest, evidence):
        if any(secret in data.lower() for secret in (b'authorization:', b'ghp_', b'github_pat_', b'secret=', b'token=')):
            raise RuntimeError('SECRET_CONTENT_REJECTED')
    return manifest, evidence
 def publication_key(base_oid, manifest_sha, evidence_sha):
    payload = REPO + base_oid + REQUEST_BRANCH + manifest_sha + evidence_sha
    return hashlib.sha256(payload.encode()).hexdigest()
 def write_receipt(state, **fields):
    record = {
        'schema': 'aios.governance-preapproval-publication.v1',
        'operation': 'SEMANTIC_RECONCILIATION_REQUEST',
        'state': state,
        'recorded_unix': int(time.time()),
        'request_branch': REQUEST_BRANCH,
        'manifest_path': MANIFEST_REL,
        'evidence_path': EVIDENCE_REL,
        'machine_actor': 'aios-autonomy-agent',
        'owner': False,
        'credential_ref': {'scheme': 'systemd-credential', 'name': CREDENTIAL_NAME},
        'governance_capability_executed': False,
        'protection_mutation': False,
        'force_push': False,
        **fields,
    }
    RECEIPT.parent.mkdir(parents=True, exist_ok=True)
    temporary = RECEIPT.with_suffix('.tmp')
    temporary.write_text(json.dumps(record, sort_keys=True, separators=(',', ':'), ensure_ascii=False) + '\n', encoding='utf-8')
    temporary.replace(RECEIPT)
    RECEIPT.chmod(0o640)
    return record
 def existing_prs(token):
    _, prs = api(LOCAL_API, 'GET', '/repos/' + REPO + '/pulls?state=all&base=' + urllib.parse.quote(BASE_BRANCH, safe='') + '&limit=100', token)
    return [pr for pr in prs if pr.get('head', {}).get('ref') == REQUEST_BRANCH and pr.get('base', {}).get('ref') == BASE_BRANCH]
 def verify_existing_branch(token, branch_oid, manifest, evidence):
    _, commit = api(LOCAL_API, 'GET', '/repos/' + REPO + '/git/commits/' + branch_oid, token)
    if commit.get('parents', [{}])[0].get('sha') is None:
        raise RuntimeError('REQUEST_BRANCH_COMMIT_INVALID')
    for relative, expected in ((MANIFEST_REL, manifest), (EVIDENCE_REL, evidence)):
        _, content = api(LOCAL_API, 'GET', '/repos/' + REPO + '/contents/' + urllib.parse.quote(relative, safe='/') + '?ref=' + branch_oid, token)
        actual = base64.b64decode(''.join(content.get('content', '').split()))
        if actual != expected:
            raise RuntimeError('GOVERNANCE_REQUEST_BRANCH_CONFLICT')
 def push_one_commit(token, base_oid, manifest, evidence):
    work_root = TASK_ROOT / 'publisher-work'
    work_root.mkdir(parents=True, exist_ok=True)
    temporary = pathlib.Path(tempfile.mkdtemp(prefix='semantic-reconciliation-', dir=work_root))
    askpass = temporary / 'askpass.sh'
    clone = temporary / 'repo'
    credential_path = pathlib.Path(os.environ['CREDENTIALS_DIRECTORY']) / CREDENTIAL_NAME
    askpass.write_text(
        '#!/bin/sh\ncase "$1" in *Username*) printf "%s\\n" "$GITEA_MACHINE_ACTOR";; *) cat "$CREDENTIAL_FILE";; esac\n',
        encoding='utf-8',
    )
    askpass.chmod(0o700)
    env = os.environ.copy()
    env.update({
        'GIT_ASKPASS': str(askpass),
        'GIT_TERMINAL_PROMPT': '0',
        'GITEA_MACHINE_ACTOR': 'aios-autonomy-agent',
        'CREDENTIAL_FILE': str(credential_path),
        'GIT_CONFIG_COUNT': '1',
        'GIT_CONFIG_KEY_0': 'safe.directory',
        'GIT_CONFIG_VALUE_0': AUTHORITY_REPO,
    })
    try:
        run = subprocess.run(
            ['git', 'clone', '--branch', BASE_BRANCH, '--single-branch', '--quiet', NETWORK_REMOTE, str(clone)],
            text=True, capture_output=True, env=env, check=False,
        )
        if run.returncode != 0:
            detail = ' '.join(run.stderr.strip().split())[:240]
            raise RuntimeError('PUBLISHER_CLONE_FAILED:' + detail)
        def git(*args, push_env=None):
            result = subprocess.run(['git', *args], cwd=clone, text=True, capture_output=True, env=push_env or env, check=False)
            if result.returncode != 0:
                raise RuntimeError('PUBLISHER_GIT_OPERATION_FAILED')
            return result.stdout.strip()
        git('checkout', '--detach', base_oid)
        git('switch', '--create', REQUEST_BRANCH)
        manifest_path = clone / MANIFEST_REL
        evidence_path = clone / EVIDENCE_REL
        manifest_path.parent.mkdir(parents=True, exist_ok=True)
        evidence_path.parent.mkdir(parents=True, exist_ok=True)
        manifest_path.write_bytes(manifest)
        evidence_path.write_bytes(evidence)
        git('add', '--', MANIFEST_REL, EVIDENCE_REL)
        staged = git('diff', '--cached', '--name-only').splitlines()
        if staged != sorted([MANIFEST_REL, EVIDENCE_REL]):
            raise RuntimeError('PUBLISHER_PATH_ALLOWLIST_FAILED')
        git('-c', 'user.name=aios-autonomy-agent', '-c', 'user.email=aios-autonomy-agent@aios.invalid', 'commit', '--quiet', '-m', '[governance] publish semantic reconciliation evidence')
        if git('rev-list', '--count', base_oid + '..HEAD') != '1':
            raise RuntimeError('PUBLISHER_COMMIT_COUNT_FAILED')
        git('push', '--porcelain', NETWORK_REMOTE, 'HEAD:refs/heads/' + REQUEST_BRANCH, push_env=env)
        head = git('rev-parse', 'HEAD')
        return head
    finally:
        shutil.rmtree(temporary, ignore_errors=True)
 def publish():
    token = load_token()
    identity = verify_identity(token)
    base_oid = verify_base(token)
    manifest, evidence = load_inputs()
    manifest_sha = digest_bytes(manifest)
    evidence_sha = digest_bytes(evidence)
    key = publication_key(base_oid, manifest_sha, evidence_sha)
    write_receipt('REQUESTED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, machine_identity=identity)
    write_receipt('LOCAL_CANDIDATE_VERIFIED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, machine_identity=identity)
    branch_status, branch = branch_api(LOCAL_API, token, REQUEST_BRANCH, expected=(200, 404))
    if branch_status == 200:
        branch_oid = branch.get('commit', {}).get('id')
        verify_existing_branch(token, branch_oid, manifest, evidence)
    else:
        branch_oid = push_one_commit(token, base_oid, manifest, evidence)
        verify_existing_branch(token, branch_oid, manifest, evidence)
    write_receipt('BRANCH_PUSHED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, request_head_oid=branch_oid, machine_identity=identity)
    prs = existing_prs(token)
    if len(prs) > 1:
        raise RuntimeError('MULTIPLE_MATCHING_APPROVAL_PRS')
    if prs:
        pr = prs[0]
        if pr.get('head', {}).get('sha') != branch_oid:
            raise RuntimeError('APPROVAL_PR_HEAD_MISMATCH')
        pr_number = pr.get('number')
    else:
        _, pr = api(LOCAL_API, 'POST', '/repos/' + REPO + '/pulls', token, {
            'title': '[GOVERNANCE RECONCILIATION] Semantic protection snapshot schema migration',
            'head': REQUEST_BRANCH,
            'base': BASE_BRANCH,
            'body': 'Schema-only reconciliation for the existing PR54 Stage-1 and Stage-2 predicates. No new governance capability; Owner exact-head re-attestation required.',
        }, expected=(201,))
        pr_number = pr.get('number')
    write_receipt('PR_CREATED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, request_head_oid=branch_oid, pr_number=pr_number, machine_identity=identity)
    _, remote_branch = branch_api(NETWORK_API, token, REQUEST_BRANCH)
    if remote_branch.get('commit', {}).get('id') != branch_oid:
        raise RuntimeError('NETWORK_BRANCH_READBACK_MISMATCH')
    _, read_pr = api(LOCAL_API, 'GET', '/repos/' + REPO + '/pulls/' + str(pr_number), token)
    if read_pr.get('head', {}).get('sha') != branch_oid or read_pr.get('base', {}).get('ref') != BASE_BRANCH:
        raise RuntimeError('PR_READBACK_MISMATCH')
    result = write_receipt('COMPLETED', governance_base_oid=base_oid, manifest_sha256=manifest_sha, evidence_sha256=evidence_sha, idempotency_key=key, request_head_oid=branch_oid, pr_number=pr_number, pr_head_oid=read_pr.get('head', {}).get('sha'), machine_identity=identity)
    return result
 def self_test():
    token = load_token()
    identity = verify_identity(token)
    base_oid = verify_base(token)
    branch_status, _ = branch_api(LOCAL_API, token, REQUEST_BRANCH, expected=(200, 404))
    return {
        'status': 'PASS',
        'governance_base_oid': base_oid,
        'machine_identity': identity,
        'credential_ref': {'scheme': 'systemd-credential', 'name': CREDENTIAL_NAME},
        'branch_namespace': 'refs/heads/governance/request/*',
        'target_base': BASE_BRANCH,
        'request_branch_status': 'EXISTS' if branch_status == 200 else 'ABSENT',
        'operation_allowlist': ['READ_BASE', 'CREATE_ONE_REQUEST_BRANCH', 'WRITE_TWO_EVIDENCE_PATHS_ONE_COMMIT', 'CREATE_OR_READ_ONE_APPROVAL_PR', 'READBACK'],
        'denied': ['MAIN_WRITE', 'DIRECT_APPROVALS_WRITE', 'BRANCH_PROTECTION', 'MERGE', 'FORCE_PUSH', 'TAG', 'PRODUCTION', 'CREDENTIAL_MUTATION'],
        'governance_capability_executed': False,
    }
 def read_publication_status():
    token = load_token()
    receipt = json.loads(RECEIPT.read_text(encoding='utf-8'))
    pr_number = receipt.get('pr_number')
    if not pr_number:
        raise RuntimeError('PUBLICATION_RECEIPT_PR_MISSING')
    _, pr = api(LOCAL_API, 'GET', '/repos/' + REPO + '/pulls/' + str(pr_number), token)
    _, reviews = api(LOCAL_API, 'GET', '/repos/' + REPO + '/pulls/' + str(pr_number) + '/reviews', token)
    _, branch = branch_api(LOCAL_API, token, REQUEST_BRANCH)
    _, network_branch = branch_api(NETWORK_API, token, REQUEST_BRANCH)
    return {
        'status': 'PASS',
        'request_branch': REQUEST_BRANCH,
        'branch_head': branch.get('commit', {}).get('id'),
        'network_branch_head': network_branch.get('commit', {}).get('id'),
        'pr_number': pr.get('number'),
        'pr_state': pr.get('state'),
        'pr_merged': pr.get('merged'),
        'pr_head': pr.get('head', {}).get('sha'),
        'pr_base': pr.get('base', {}).get('ref'),
        'reviews': [
            {
                'id': item.get('id'),
                'reviewer_id': item.get('user', {}).get('id'),
                'state': item.get('state'),
                'commit_id': item.get('commit_id'),
                'dismissed': item.get('dismissed'),
            }
            for item in reviews
        ],
        'governance_capability_executed': False,
        'protection_mutation': False,
    }
 def handle(request):
    if not isinstance(request, dict) or set(request) != {'operation'}:
        raise RuntimeError('REQUEST_SCHEMA_INVALID')
    if request['operation'] == 'DRY_RUN_SELF_TEST':
        return self_test()
    if request['operation'] == 'PUBLISH_SEMANTIC_RECONCILIATION':
        return publish()
    if request['operation'] == 'READ_SEMANTIC_RECONCILIATION_STATUS':
        return read_publication_status()
    raise RuntimeError('OPERATION_DENIED')
 def serve(listener):
    conn, _ = listener.accept()
    with conn:
        try:
            data = conn.recv(1024 * 1024 + 1)
            if len(data) > 1024 * 1024:
                raise RuntimeError('REQUEST_TOO_LARGE')
            result = handle(json.loads(data.decode()))
        except Exception as exc:
            result = {'status': 'FAIL', 'code': str(exc)}
        conn.sendall((json.dumps(result, sort_keys=True, separators=(',', ':'), ensure_ascii=False) + '\n').encode())
 def main():
    if os.environ.get('LISTEN_FDS') != '1':
        raise SystemExit('SOCKET_ACTIVATION_REQUIRED')
    listener = socket.fromfd(3, socket.AF_UNIX, socket.SOCK_STREAM)
    serve(listener)
 if __name__ == '__main__':
    main()
@@ -1,73 +0,0 @@
 """Fail-closed Authority/Gitea ref reconciliation after protected merge."""
 from __future__ import annotations
 from dataclasses import dataclass
 from pathlib import Path
 import subprocess
 class RefReconciliationError(RuntimeError):
    pass
 def _oid(value: str, field: str) -> str:
    if not isinstance(value, str) or len(value) != 40 or any(char not in "0123456789abcdef" for char in value):
        raise RefReconciliationError(field + "_INVALID")
    return value
@dataclass(frozen=True, slots=True)
 class RefReconciler:
    git_dir: Path
    def read(self, ref: str) -> str:
        result = subprocess.run(
            ["git", f"--git-dir={self.git_dir}", "rev-parse", "--verify", ref],
            text=True,
            capture_output=True,
            check=False,
        )
        if result.returncode != 0:
            raise RefReconciliationError("AUTHORITY_REF_UNAVAILABLE")
        return result.stdout.strip()
    def is_ancestor(self, ancestor: str, descendant: str) -> bool:
        _oid(ancestor, "ancestor")
        _oid(descendant, "descendant")
        result = subprocess.run(
            ["git", f"--git-dir={self.git_dir}", "merge-base", "--is-ancestor", ancestor, descendant],
            text=True,
            capture_output=True,
            check=False,
        )
        if result.returncode == 0:
            return True
        if result.returncode == 1:
            return False
        raise RefReconciliationError("AUTHORITY_ANCESTRY_CHECK_FAILED")
    def reconcile_main(self, *, expected_oid: str, merged_oid: str, gitea_main_oid: str) -> str:
        _oid(expected_oid, "expected_oid")
        _oid(merged_oid, "merged_oid")
        _oid(gitea_main_oid, "gitea_main_oid")
        if gitea_main_oid != merged_oid:
            raise RefReconciliationError("GITEA_MAIN_EXPECTATION_MISMATCH")
        if not self.is_ancestor(expected_oid, merged_oid):
            raise RefReconciliationError("MAIN_FF_REQUIRED")
        current = self.read("refs/heads/main")
        if current == merged_oid:
            return merged_oid
        if current != expected_oid:
            raise RefReconciliationError("AUTHORITY_MAIN_EXPECTATION_MISMATCH")
        result = subprocess.run(
            ["git", f"--git-dir={self.git_dir}", "update-ref", "refs/heads/main", merged_oid, expected_oid],
            text=True,
            capture_output=True,
            check=False,
        )
        if result.returncode != 0:
            raise RefReconciliationError("AUTHORITY_MAIN_CAS_FAILED")
        if self.read("refs/heads/main") != merged_oid:
            raise RefReconciliationError("AUTHORITY_MAIN_CAS_READBACK_MISMATCH")
        return merged_oid
@@ -1,81 +0,0 @@
 """Canonical semantic branch-protection model used by AIOS governance gates."""
 from __future__ import annotations
 import hashlib
 import json
 from typing import Any, Mapping
 SCHEMA = "aios.semantic-protection.v1"
 USER_IDS = {"owner": 2, "aios-autonomy-agent": 153}
 def canonical_json(value: Any) -> bytes:
    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
 def _typed_json(value: Any) -> list[Any]:
    if value in (None, "null"):
        return []
    if isinstance(value, str):
        return json.loads(value)
    return list(value)
 def _user_ids(names: Any) -> list[int]:
    result = []
    for name in names or []:
        if name not in USER_IDS:
            raise ValueError("UNKNOWN_GOVERNANCE_USER:" + str(name))
        result.append(USER_IDS[name])
    return sorted(result)
 def semantic_policy(protection: Mapping[str, Any]) -> dict[str, Any]:
    """Drop transport metadata and canonicalize semantic security fields."""
    return {
        "schema_version": SCHEMA,
        "repo_id": 1,
        "protection_id": 2,
        "branch_name": protection.get("branch_name"),
        "can_push": protection.get("enable_push"),
        "can_force_push": protection.get("enable_force_push"),
        "enable_merge_whitelist": protection.get("enable_merge_whitelist"),
        "merge_whitelist_user_ids": _user_ids(protection.get("merge_whitelist_usernames")),
        "merge_whitelist_team_ids": [],
        "required_approvals": protection.get("required_approvals"),
        "enable_status_check": protection.get("enable_status_check"),
        "status_check_contexts": sorted(protection.get("status_check_contexts") or []),
        "block_admin_merge_override": protection.get("block_admin_merge_override"),
        "block_on_official_review_requests": protection.get("block_on_official_review_requests"),
        "block_on_outdated_branch": protection.get("block_on_outdated_branch"),
        "block_on_rejected_reviews": protection.get("block_on_rejected_reviews"),
        "dismiss_stale_approvals": protection.get("dismiss_stale_approvals"),
        "ignore_stale_approvals": protection.get("ignore_stale_approvals"),
        "enable_approvals_whitelist": protection.get("enable_approvals_whitelist"),
        "approvals_whitelist_user_ids": _user_ids(protection.get("approvals_whitelist_username")),
        "approvals_whitelist_team_ids": [],
        "enable_bypass_allowlist": protection.get("enable_bypass_allowlist"),
        "bypass_allowlist_user_ids": _user_ids(protection.get("bypass_allowlist_usernames")),
        "bypass_allowlist_team_ids": [],
        "enable_force_push_allowlist": protection.get("enable_force_push_allowlist"),
        "force_push_allowlist_user_ids": _user_ids(protection.get("force_push_allowlist_usernames")),
        "enable_whitelist": protection.get("enable_push_whitelist"),
        "whitelist_user_ids": _user_ids(protection.get("push_whitelist_usernames")),
        "whitelist_team_ids": [],
        "force_push_allowlist_deploy_keys": protection.get("force_push_allowlist_deploy_keys"),
        "whitelist_deploy_keys": protection.get("push_whitelist_deploy_keys"),
        "require_signed_commits": protection.get("require_signed_commits"),
        "priority": protection.get("priority"),
        "protected_file_patterns": _typed_json(protection.get("protected_file_patterns")),
        "unprotected_file_patterns": _typed_json(protection.get("unprotected_file_patterns")),
    }
 def semantic_digest(protection: Mapping[str, Any]) -> str:
    return hashlib.sha256(canonical_json(semantic_policy(protection))).hexdigest()
 def transport_digest(protection: Mapping[str, Any]) -> str:
    return hashlib.sha256(canonical_json(protection)).hexdigest()
@@ -1,141 +0,0 @@
 """Fail-closed Stage-2 campaign gate migration predicates."""
 from __future__ import annotations
 import copy
 import hashlib
 import json
 import re
 from typing import Any, Mapping
 SEMANTIC_SCHEMA = "aios.semantic-protection.v1"
 STAGE1_SEMANTIC_SHA = "d911e856f71de6105b8efa08e13338a448e0b6d37536332decd80c9f409ecf27"
 CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
 OWNER_GATE = "owner-approval-gate"
 CAMPAIGN_GATE = "campaign-approval-gate"
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 class Stage2GateError(RuntimeError):
    pass
 def canonical_json(value: Any) -> bytes:
    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
 def _typed_json(value: Any) -> list[Any]:
    if value in (None, "", "null"):
        return []
    if isinstance(value, str):
        return json.loads(value)
    return list(value)
 def _user_ids(names: Any) -> list[int]:
    mapping = {"owner": 2, "aios-autonomy-agent": 153}
    result = []
    for name in names or []:
        if name not in mapping:
            raise Stage2GateError("UNKNOWN_GOVERNANCE_USER")
        result.append(mapping[name])
    return sorted(result)
 def semantic_policy(protection: Mapping[str, Any]) -> dict[str, Any]:
    return {
        "schema_version": SEMANTIC_SCHEMA,
        "repo_id": 1,
        "protection_id": 2,
        "branch_name": protection.get("branch_name"),
        "can_push": protection.get("enable_push"),
        "can_force_push": protection.get("enable_force_push"),
        "enable_merge_whitelist": protection.get("enable_merge_whitelist"),
        "merge_whitelist_user_ids": _user_ids(protection.get("merge_whitelist_usernames")),
        "merge_whitelist_team_ids": [],
        "required_approvals": protection.get("required_approvals"),
        "enable_status_check": protection.get("enable_status_check"),
        "status_check_contexts": sorted(protection.get("status_check_contexts") or []),
        "block_admin_merge_override": protection.get("block_admin_merge_override"),
        "block_on_official_review_requests": protection.get("block_on_official_review_requests"),
        "block_on_outdated_branch": protection.get("block_on_outdated_branch"),
        "block_on_rejected_reviews": protection.get("block_on_rejected_reviews"),
        "dismiss_stale_approvals": protection.get("dismiss_stale_approvals"),
        "ignore_stale_approvals": protection.get("ignore_stale_approvals"),
        "enable_approvals_whitelist": protection.get("enable_approvals_whitelist"),
        "approvals_whitelist_user_ids": _user_ids(protection.get("approvals_whitelist_username")),
        "approvals_whitelist_team_ids": [],
        "enable_bypass_allowlist": protection.get("enable_bypass_allowlist"),
        "bypass_allowlist_user_ids": _user_ids(protection.get("bypass_allowlist_usernames")),
        "bypass_allowlist_team_ids": [],
        "enable_force_push_allowlist": protection.get("enable_force_push_allowlist"),
        "force_push_allowlist_user_ids": _user_ids(protection.get("force_push_allowlist_usernames")),
        "force_push_allowlist_team_ids": [],
        "enable_whitelist": protection.get("enable_push_whitelist"),
        "whitelist_user_ids": _user_ids(protection.get("push_whitelist_usernames")),
        "whitelist_team_ids": [],
        "force_push_allowlist_deploy_keys": protection.get("force_push_allowlist_deploy_keys"),
        "whitelist_deploy_keys": protection.get("push_whitelist_deploy_keys"),
        "require_signed_commits": protection.get("require_signed_commits"),
        "priority": protection.get("priority"),
        "protected_file_patterns": protection.get("protected_file_patterns"),
        "unprotected_file_patterns": protection.get("unprotected_file_patterns"),
    }
 def semantic_digest(protection: Mapping[str, Any]) -> str:
    return hashlib.sha256(canonical_json(semantic_policy(protection))).hexdigest()
 def build_target(protection: Mapping[str, Any]) -> tuple[str, dict[str, Any]]:
    current = list(protection.get("status_check_contexts") or [])
    has_owner = OWNER_GATE in current
    has_campaign = CAMPAIGN_GATE in current
    if has_owner and has_campaign:
        raise Stage2GateError("GATE_PRESTATE_CONFLICT")
    if not has_owner and not has_campaign:
        raise Stage2GateError("OWNER_GATE_MISSING")
    if has_campaign:
        return "IDEMPOTENT_SUCCESS", copy.deepcopy(dict(protection))
    if semantic_digest(protection) != STAGE1_SEMANTIC_SHA:
        raise Stage2GateError("SEMANTIC_PRECONDITION_INVALID")
    target = copy.deepcopy(dict(protection))
    target["status_check_contexts"] = sorted(
        [gate for gate in current if gate != OWNER_GATE] + [CAMPAIGN_GATE]
    )
    return "READY", target
 def validate_stage2_facts(facts: Mapping[str, Any]) -> None:
    required = {
        "campaign_id",
        "campaign_active",
        "campaign_revoked",
        "machine_actor",
        "required_checks_all_success",
        "required_checks_same_head",
        "unresolved_conversations",
        "mergeable",
        "protected_target",
        "current_main_oid",
        "gitea_main_oid",
        "current_main_lineage_verified",
    }
    if set(facts) != required:
        raise Stage2GateError("STAGE2_FACTS_SCHEMA_INVALID")
    if facts["campaign_id"] != CAMPAIGN_ID or facts["campaign_active"] is not True or facts["campaign_revoked"] is not False:
        raise Stage2GateError("CAMPAIGN_NOT_ACTIVE")
    if facts["machine_actor"] != "aios-autonomy-agent":
        raise Stage2GateError("MACHINE_ACTOR_MISMATCH")
    if facts["required_checks_all_success"] is not True or facts["required_checks_same_head"] is not True:
        raise Stage2GateError("REQUIRED_CHECKS_NOT_CURRENT")
    if facts["unresolved_conversations"] != 0 or facts["mergeable"] is not True:
        raise Stage2GateError("CAMPAIGN_GATE_FACTS_INVALID")
    if facts["protected_target"] != "main" or facts["current_main_lineage_verified"] is not True:
        raise Stage2GateError("PROTECTED_TARGET_OR_LINEAGE_INVALID")
    if (
        not isinstance(facts["current_main_oid"], str)
        or not OID_RE.fullmatch(facts["current_main_oid"])
        or facts["gitea_main_oid"] != facts["current_main_oid"]
    ):
        raise Stage2GateError("MAIN_READBACK_MISMATCH")
@@ -1,473 +0,0 @@
 """Shared primitives for the V2R1C6 governed local writer contract."""
 from __future__ import annotations
 import hashlib
 import json
 import os
 import posixpath
 import re
 import socket
 import stat
 import struct
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 TASK_ID = "V2R1C6_GOVERNED_LOCAL_BOOTSTRAP"
 REPO = "aios/aios"
 PRINCIPAL = "governed-local-bootstrap"
 OIDSIZ = 40
 AUTHORIZATION_TTL = timedelta(hours=2)
 class GovernedLocalWriterError(Exception):
    """Base error for governed-local-writer validation and runtime failures."""
 class AuthorizationError(GovernedLocalWriterError):
    """Raised when authorization input is invalid, expired, or tampered."""
@dataclass(frozen=True)
 class BranchCreatePolicy:
    """Exact branch creation contract."""
    branch: str
    base_oid: str
    head_oid: str
@dataclass(frozen=True)
 class BranchAppendPolicy:
    """Exact append-commit contract for candidate branch updates."""
    branch: str
    expected_head_oid: str | None
    allowed_paths: tuple[str, ...]
@dataclass(frozen=True)
 class BranchPolicy:
    """Per-branch operation policies loaded from authorization."""
    create_branch: BranchCreatePolicy | None
    append_commit: BranchAppendPolicy | None
@dataclass(frozen=True)
 class GovernedAuthorization:
    """Parsed and validated authorization object."""
    task_id: str
    repo: str
    created_at: datetime
    expires_at: datetime
    authorization_sha256: str
    one_time_use: bool
    branch_operations: dict[str, BranchPolicy]
    denied_operations: tuple[str, ...]
    @property
    def create_branches(self) -> set[str]:
        """Branches that are allowed for branch-creation operations."""
        return {
            branch
            for branch, policy in self.branch_operations.items()
            if policy.create_branch is not None
        }
    @property
    def append_branches(self) -> set[str]:
        """Branches that are allowed for commit-append operations."""
        return {
            branch
            for branch, policy in self.branch_operations.items()
            if policy.append_commit is not None
        }
@dataclass(frozen=True)
 class PeerIdentity:
    """Verified peer identity from SO_PEERCRED."""
    pid: int
    uid: int
    gid: int
    executable: str | None
@dataclass(frozen=True)
 class FileChange:
    """Single file modification payload."""
    path: str
    content: str
@dataclass(frozen=True)
 class CreateBranchRequest:
    """Validated create-branch request payload."""
    branch: str
    base_oid: str
    head_oid: str | None
    authorization_digest: str
@dataclass(frozen=True)
 class AppendCommitRequest:
    """Validated append-commit request payload."""
    branch: str
    expected_head_oid: str
    changes: tuple[FileChange, ...]
    authorization_digest: str
    commit_message: str = "chore(governance): append governed commit"
 _OID_RE = re.compile(r"^[0-9a-fA-F]{40}$")
 _DENIED_PATH_SEGMENTS = (
    "main",
    "tag",
    "baseline",
    "credential",
    "credentials",
    "secret",
    "registry",
 )
 _SECRET_PATTERNS = (
    re.compile(r"(?i)-----BEGIN [A-Z ]*PRIVATE KEY-----"),
    re.compile(r"(?i)api[_-]?key\s*[:=]\s*\S+"),
    re.compile(r"(?i)secret\s*[:=]\s*\S+"),
    re.compile(r"(?i)password\s*[:=]\s*\S+"),
    re.compile(r"(?i)token\s*[:=]\s*\S+"),
 )
 _SAFE_SECRET_MARKERS = re.compile(
    r"(?i)(?:api[_-]?key|secret|password|token)\s*[:=]\s*(?:REDACTED|TEST_FIXTURE|NOT_A_SECRET)"
 )
 def canonicalize_authorization_payload(payload: Mapping[str, Any]) -> str:
    """Serialize authorization payload without the signature hash, in canonical form."""
    canonical = dict(payload)
    canonical.pop("authorization_sha256", None)
    return json.dumps(
        canonical, sort_keys=True, separators=(",", ":"), ensure_ascii=True
    )
 def compute_authorization_sha256(payload: Mapping[str, Any]) -> str:
    """Compute canonical sha256 over authorization payload."""
    digest = hashlib.sha256()
    digest.update(canonicalize_authorization_payload(payload).encode("utf-8"))
    return digest.hexdigest()
 def _assert_authorization_file_permissions(path: Path) -> None:
    """Fail-closed checks for root-only secret-like authorization files."""
    if path.is_symlink():
        raise AuthorizationError("authorization path must not be a symlink")
    st = path.stat()
    if not stat.S_ISREG(st.st_mode):
        raise AuthorizationError("authorization path must be a regular file")
    if (st.st_mode & 0o777) != 0o600:
        raise AuthorizationError("authorization file mode must be exactly 0600")
    if hasattr(st, "st_uid") and os.name != "nt" and st.st_uid != 0:
        raise AuthorizationError("authorization file owner must be uid 0")
 def _parse_iso8601(value: str) -> datetime:
    """Parse ISO 8601 timestamps used by authorization payloads."""
    try:
        if value.endswith("Z"):
            value = value[:-1] + "+00:00"
        parsed = datetime.fromisoformat(value)
    except (TypeError, ValueError) as exc:
        raise AuthorizationError("created_at must be an ISO 8601 timestamp") from exc
    if parsed.tzinfo is None:
        parsed = parsed.replace(tzinfo=timezone.utc)
    return parsed
 def _require_type(value: Any, expected: type, *, key: str) -> None:
    if not isinstance(value, expected):
        raise AuthorizationError(f"{key} must be {expected.__name__}")
 def _parse_oid(value: Any, *, field: str) -> str:
    if not isinstance(value, str):
        raise AuthorizationError(f"{field} must be a string")
    if not _OID_RE.fullmatch(value):
        raise AuthorizationError(f"{field} must be a 40-char hex object id")
    return value.lower()
 def _parse_allowed_paths(paths: Any) -> tuple[str, ...]:
    if not isinstance(paths, list) or not paths:
        raise AuthorizationError("allowed_paths must be a non-empty list")
    normalized: list[str] = []
    for path in paths:
        if not isinstance(path, str) or not path.strip():
            raise AuthorizationError("allowed_paths entries must be non-empty strings")
        normalized.append(path.strip())
    return tuple(normalized)
 def parse_authorization(
    raw: Mapping[str, Any], *, now: datetime | None = None
 ) -> GovernedAuthorization:
    """Validate an authorization payload and return a typed object."""
    _require_type(raw.get("task_id"), str, key="task_id")
    if raw["task_id"] != TASK_ID:
        raise AuthorizationError("unexpected task_id")
    _require_type(raw.get("repo"), str, key="repo")
    if raw["repo"] != REPO:
        raise AuthorizationError("unexpected repo value")
    created_at = _parse_iso8601(raw.get("created_at"))
    check_time = now or datetime.now(tz=timezone.utc)
    if created_at.tzinfo is None:
        created_at = created_at.replace(tzinfo=timezone.utc)
    if created_at - check_time > timedelta(seconds=30):
        raise AuthorizationError("authorization created_at is in the future")
    if check_time - created_at > AUTHORIZATION_TTL:
        raise AuthorizationError("authorization expired")
    raw_expires_at = raw.get("expires_at")
    expires_at = (
        _parse_iso8601(raw_expires_at)
        if raw_expires_at is not None
        else created_at + AUTHORIZATION_TTL
    )
    if expires_at <= check_time:
        raise AuthorizationError("authorization expiry is in the past")
    if expires_at > created_at + AUTHORIZATION_TTL:
        raise AuthorizationError("authorization expiry exceeds two-hour maximum")
    _require_type(raw.get("one_time_use"), bool, key="one_time_use")
    if raw["one_time_use"] is not True:
        raise AuthorizationError("one_time_use must be true")
    _require_type(raw.get("authorization_sha256"), str, key="authorization_sha256")
    expected_hash = compute_authorization_sha256(raw)
    provided_hash = str(raw["authorization_sha256"]).lower()
    if provided_hash != expected_hash:
        raise AuthorizationError("authorization_sha256 mismatch")
    op_map = raw.get("allowed_branch_operations")
    if not isinstance(op_map, dict) or not op_map:
        raise AuthorizationError("allowed_branch_operations must be a non-empty object")
    branch_operations: dict[str, BranchPolicy] = {}
    for branch, operation in op_map.items():
        if not isinstance(branch, str) or not branch.strip():
            raise AuthorizationError("branch names must be non-empty strings")
        if not isinstance(operation, dict):
            raise AuthorizationError("operation policy must be an object")
        create_block = operation.get("create_branch")
        append_block = operation.get("append_commit")
        create_policy: BranchCreatePolicy | None = None
        append_policy: BranchAppendPolicy | None = None
        if create_block is not None:
            if not isinstance(create_block, dict):
                raise AuthorizationError("create_branch block must be an object")
            raw_head_oid = create_block.get("head_oid")
            create_policy = BranchCreatePolicy(
                branch=branch,
                base_oid=_parse_oid(create_block.get("base_oid"), field="create_branch.base_oid"),
                head_oid=(
                    _parse_oid(raw_head_oid, field="create_branch.head_oid")
                    if raw_head_oid is not None
                    else None
                ),
            )
        if append_block is not None:
            if not isinstance(append_block, dict):
                raise AuthorizationError("append_commit block must be an object")
            raw_expected_head_oid = append_block.get("expected_head_oid")
            append_policy = BranchAppendPolicy(
                branch=branch,
                expected_head_oid=(
                    _parse_oid(
                        raw_expected_head_oid,
                        field="append_commit.expected_head_oid",
                    )
                    if raw_expected_head_oid is not None
                    else None
                ),
                allowed_paths=_parse_allowed_paths(append_block.get("allowed_paths")),
            )
        if create_policy is None and append_policy is None:
            raise AuthorizationError("branch policy must define at least one operation")
        branch_operations[branch] = BranchPolicy(
            create_branch=create_policy, append_commit=append_policy
        )
    denied_raw = raw.get("denied_operations", ())
    if not isinstance(denied_raw, list):
        raise AuthorizationError("denied_operations must be a list")
    denied_operations: list[str] = []
    for value in denied_raw:
        if not isinstance(value, str):
            raise AuthorizationError("denied operations must be strings")
        denied_operations.append(value.lower())
    return GovernedAuthorization(
        task_id=raw["task_id"],
        repo=raw["repo"],
        created_at=created_at,
        expires_at=expires_at,
        authorization_sha256=provided_hash,
        one_time_use=True,
        branch_operations=branch_operations,
        denied_operations=tuple(denied_operations),
    )
 def load_authorization_file(
    path: str | os.PathLike[str], *, now: datetime | None = None
 ) -> GovernedAuthorization:
    """Load and validate the root-only authorization file."""
    auth_path = Path(path)
    _assert_authorization_file_permissions(auth_path)
    try:
        raw_text = auth_path.read_text(encoding="utf-8")
    except (OSError, ValueError) as exc:
        raise AuthorizationError("unable to read authorization file") from exc
    try:
        raw_obj = json.loads(raw_text)
    except json.JSONDecodeError as exc:
        raise AuthorizationError("authorization must be JSON") from exc
    if not isinstance(raw_obj, dict):
        raise AuthorizationError("authorization top-level must be an object")
    return parse_authorization(raw_obj, now=now)
 def _resolve_peer_executable(pid: int) -> str | None:
    """Resolve peer executable from /proc/<pid>/exe when available."""
    if pid <= 0:
        return None
    exe_path = f"/proc/{pid}/exe"
    try:
        return os.readlink(exe_path)
    except OSError:
        return None
 def extract_peer_identity(
    connection: socket.socket, *, require_root_uid: bool = True
 ) -> PeerIdentity:
    """Validate SO_PEERCRED and return peer identity."""
    if not hasattr(socket, "SO_PEERCRED"):
        raise AuthorizationError("SO_PEERCRED not available on this platform")
    data = connection.getsockopt(
        socket.SOL_SOCKET,
        socket.SO_PEERCRED,
        struct.calcsize("3i"),
    )
    if len(data) != struct.calcsize("3i"):
        raise AuthorizationError("SO_PEERCRED payload size mismatch")
    pid, uid, gid = struct.unpack("3i", data)
    if require_root_uid and uid != 0:
        raise PermissionError("peer uid must be 0")
    return PeerIdentity(
        pid=pid,
        uid=uid,
        gid=gid,
        executable=_resolve_peer_executable(pid),
    )
 def _normalize_file_path(path: str) -> str:
    normalized = posixpath.normpath(path.replace("\\", "/").strip())
    return normalized.lstrip("/")
 def _path_has_disallowed_segment(path: str) -> bool:
    lowered = path.lower()
    if ".." in path.split("/"):
        return True
    parts = [p for p in lowered.split("/") if p]
    for part in parts:
        for segment in _DENIED_PATH_SEGMENTS:
            if part == segment or part.startswith(f"{segment}.") or segment in part:
                return True
    return False
 def _is_allowed_path(path: str, allowed_paths: Sequence[str]) -> bool:
    normalized = _normalize_file_path(path)
    for prefix in allowed_paths:
        normalized_prefix = _normalize_file_path(prefix)
        if normalized == normalized_prefix:
            return True
        if normalized.startswith(normalized_prefix + "/"):
            return True
    return False
 def contains_secret_like_content(content: str) -> bool:
    """Heuristic detector for obvious secret-like strings."""
    content = _SAFE_SECRET_MARKERS.sub("", content or "")
    for pattern in _SECRET_PATTERNS:
        if pattern.search(content):
            return True
    return False
 def validate_file_changes(
    changes: Any, allowed_paths: Sequence[str]
 ) -> tuple[FileChange, ...]:
    """Validate append-commit file changes against path and content policy."""
    if not isinstance(changes, list):
        raise AuthorizationError("changes must be a list")
    result: list[FileChange] = []
    for change in changes:
        if not isinstance(change, Mapping):
            raise AuthorizationError("each file change must be an object")
        raw_path = change.get("path")
        raw_content = change.get("content")
        if not isinstance(raw_path, str) or not raw_path.strip():
            raise AuthorizationError("file change path must be a non-empty string")
        if raw_path.startswith(("/", "\\")):
            raise AuthorizationError("file change path must be relative")
        if not isinstance(raw_content, str):
            raise AuthorizationError("file change content must be a string")
        normalized = _normalize_file_path(raw_path)
        if not normalized or normalized.startswith("../") or normalized == "..":
            raise AuthorizationError("file paths must be normalized relative paths")
        if not _is_allowed_path(normalized, allowed_paths):
            raise AuthorizationError("file path outside allowed_paths")
        if _path_has_disallowed_segment(normalized):
            raise AuthorizationError("file path uses denied segment")
        if contains_secret_like_content(raw_content):
            raise AuthorizationError("file content failed secret-like scan")
        result.append(FileChange(path=normalized, content=raw_content))
    return tuple(result)
@@ -1,47 +0,0 @@
 """Supplement Gitea native protection when review identity is not expressible."""
 from __future__ import annotations
 from dataclasses import dataclass
 from typing import Any, Mapping, Sequence
 class MergeGateDenied(RuntimeError):
    pass
@dataclass(frozen=True)
 class MergeGateDecision:
    allowed: bool
    owner_review_id: int
    required_contexts: tuple[str, ...]
 def validate_protected_merge(
    pull_request: Mapping[str, Any],
    reviews: Sequence[Mapping[str, Any]],
    statuses: Mapping[str, str],
    *,
    required_contexts: Sequence[str],
    unresolved_conversations: int,
    owner_login: str = "owner",
    owner_id: int = 2,
 ) -> MergeGateDecision:
    if pull_request.get("state") != "open" or pull_request.get("mergeable") is not True:
        raise MergeGateDenied("pull_request_not_mergeable")
    author = (pull_request.get("user") or {}).get("login")
    owner_review = None
    for review in reviews:
        user = review.get("user") or {}
        if review.get("state") == "APPROVED" and user.get("login") == owner_login and user.get("id") == owner_id:
            if author == owner_login or (pull_request.get("author_id") == owner_id):
                raise MergeGateDenied("pr_author_self_approval_denied")
            owner_review = review
    if owner_review is None:
        raise MergeGateDenied("owner_review_required")
    if unresolved_conversations != 0:
        raise MergeGateDenied("unresolved_conversations_block_merge")
    missing = [context for context in required_contexts if statuses.get(context) != "success"]
    if missing:
        raise MergeGateDenied("required_checks_missing:" + ",".join(missing))
    return MergeGateDecision(True, int(owner_review.get("id", 0)), tuple(required_contexts))
@@ -1,568 +0,0 @@
 """Governed V2R2C1 production release orchestration.
 This module is deliberately scoped to the Owner-approved V2R2C1 binding.  It
 uses the existing TagPublisher and metadata adapters; it does not introduce a
 second Git writer, a second durable job store, or an alternate baseline.
 """
 from __future__ import annotations
 import argparse
 import fcntl
 import hashlib
 import json
 import os
 import re
 import subprocess
 import tarfile
 import tempfile
 import time
 from dataclasses import dataclass
 from pathlib import Path
 from typing import Any, Mapping
 from gitea_tag_publication import (
    GiteaTagClient,
    GitTagBackend,
    PublicationManualOwnerReviewRequired,
    PublicationPending,
    PublicationReconciliationRequired,
    PublicationRequest,
    TagPublisher,
 )
 VERSION = "V2R2C1"
 TARGET_OID = "998d30304787e31e5ae607c0bd86b5edb2b0e5ad"
 EVIDENCE_CLOSURE_OID = "a8b906d1bc24088c19647e98de6a679268f6d0a2"
 APPROVAL_PLAN_ID = "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e"
 REPOSITORY = "aios/aios"
 SERVICE = "aios-v2r1c7-production.service"
 PORT = 18927
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA_RE = re.compile(r"^[0-9a-f]{64}$")
 class ReleaseBlocked(RuntimeError):
    """A release gate failed and no unsafe recovery is permitted."""
 class ManualOwnerReviewRequired(ReleaseBlocked):
    pass
 class ReconciliationRequired(ReleaseBlocked):
    pass
 def canonical(value: object) -> bytes:
    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode()
 def sha256_file(path: Path) -> str:
    if path.is_symlink() or not path.is_file():
        raise ReleaseBlocked("artifact must be a regular file")
    digest = hashlib.sha256()
    with path.open("rb") as stream:
        for block in iter(lambda: stream.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()
 def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o600) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    temporary = path.with_name(path.name + ".tmp")
    temporary.write_bytes(canonical(dict(value)))
    os.chmod(temporary, mode)
    os.replace(temporary, path)
@dataclass(frozen=True)
 class ReleaseBinding:
    version: str = VERSION
    target_oid: str = TARGET_OID
    evidence_closure_oid: str = EVIDENCE_CLOSURE_OID
    approval_plan_id: str = APPROVAL_PLAN_ID
    repository: str = REPOSITORY
    production_service: str = SERVICE
    production_port: int = PORT
    def validate(self) -> None:
        if self.version != VERSION or self.repository != REPOSITORY:
            raise ManualOwnerReviewRequired("release binding is outside V2R2C1 scope")
        if not OID_RE.fullmatch(self.target_oid) or self.target_oid != TARGET_OID:
            raise ManualOwnerReviewRequired("V2R2C1 target_oid mismatch")
        if not OID_RE.fullmatch(self.evidence_closure_oid) or self.evidence_closure_oid != EVIDENCE_CLOSURE_OID:
            raise ManualOwnerReviewRequired("V2R2C1 evidence closure mismatch")
        if self.approval_plan_id != APPROVAL_PLAN_ID:
            raise ManualOwnerReviewRequired("V2R2C1 approval plan mismatch")
        if self.production_service != SERVICE or int(self.production_port) != PORT:
            raise ManualOwnerReviewRequired("production service binding mismatch")
    def as_dict(self) -> dict[str, Any]:
        return {
            "version": self.version,
            "target_oid": self.target_oid,
            "evidence_closure_oid": self.evidence_closure_oid,
            "approval_plan_id": self.approval_plan_id,
            "repository": self.repository,
            "production_service": self.production_service,
            "production_port": self.production_port,
        }
 class StateLock:
    def __init__(self, path: Path):
        self.path = path
        self.handle = None
    def __enter__(self) -> "StateLock":
        self.path.parent.mkdir(parents=True, exist_ok=True)
        self.handle = self.path.open("a+", encoding="utf-8")
        fcntl.flock(self.handle.fileno(), fcntl.LOCK_EX)
        return self
    def __exit__(self, exc_type, exc, tb) -> None:
        if self.handle is not None:
            fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
            self.handle.close()
 class ReleaseState:
    def __init__(self, root: Path, binding: ReleaseBinding):
        self.root = root
        self.path = root / "release-state.json"
        self.binding = binding
        root.mkdir(parents=True, exist_ok=True)
        if self.path.exists():
            value = json.loads(self.path.read_text(encoding="utf-8"))
            if value.get("binding") != binding.as_dict():
                raise ManualOwnerReviewRequired("persisted release binding conflict")
            self.value = value
        else:
            self.value = {
                "schema": "aios.v2r2c1.governed-production-release-state.v1",
                "binding": binding.as_dict(),
                "state": "INITIAL",
                "completed": {},
                "history": [],
            }
            self.save()
    def save(self) -> None:
        atomic_json(self.path, self.value)
    def record(self, state: str, step: str, result: Mapping[str, Any]) -> None:
        safe = json.loads(json.dumps(dict(result)))
        self.value["state"] = state
        self.value.setdefault("completed", {})[step] = safe
        self.value.setdefault("history", []).append(
            {"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "step": step, "result": safe}
        )
        self.save()
    def fail(self, state: str, reason: str) -> None:
        self.value["state"] = state
        self.value.setdefault("history", []).append(
            {"at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()), "state": state, "reason": str(reason)[:500]}
        )
        self.save()
 def _git(git_dir: Path, *args: str, check: bool = True) -> str:
    completed = subprocess.run(
        ["git", f"--git-dir={git_dir}", *args],
        check=False,
        capture_output=True,
        text=True,
        timeout=45,
        env={"PATH": os.environ.get("PATH", "")},
    )
    if check and completed.returncode != 0:
        raise ReconciliationRequired(completed.stderr.strip() or "authoritative git query failed")
    return completed.stdout.strip()
 def _ancestor(git_dir: Path, ancestor: str, descendant: str) -> bool:
    return subprocess.run(
        ["git", f"--git-dir={git_dir}", "merge-base", "--is-ancestor", ancestor, descendant],
        check=False,
        capture_output=True,
        timeout=45,
        env={"PATH": os.environ.get("PATH", "")},
    ).returncode == 0
 def verify_lineage(git_dir: Path, binding: ReleaseBinding) -> dict[str, Any]:
    binding.validate()
    if _git(git_dir, "cat-file", "-t", binding.target_oid) != "commit":
        raise ReleaseBlocked("approved target_oid is not a commit")
    if _git(git_dir, "cat-file", "-t", binding.evidence_closure_oid) != "commit":
        raise ReleaseBlocked("evidence closure is not a commit")
    if not _ancestor(git_dir, binding.target_oid, binding.evidence_closure_oid):
        raise ManualOwnerReviewRequired("approved target is not an ancestor of evidence closure")
    return {
        "target_oid": binding.target_oid,
        "evidence_closure_oid": binding.evidence_closure_oid,
        "target_is_ancestor_of_evidence": True,
        "main_oid": _git(git_dir, "rev-parse", "refs/heads/main"),
    }
 def verify_owner_approval(value: Mapping[str, Any], binding: ReleaseBinding) -> dict[str, Any]:
    approval = value.get("owner_approval")
    if not isinstance(approval, Mapping):
        raise ReleaseBlocked("OWNER_APPROVAL_RECEIPT_REQUIRED")
    if approval.get("approved") is not True or approval.get("status") != "APPROVED":
        raise ReleaseBlocked("OWNER_APPROVAL_NOT_ACCEPTED")
    if approval.get("approved_by") != "aiman":
        raise ManualOwnerReviewRequired("OWNER_APPROVAL_ACTOR_MISMATCH")
    if approval.get("approval_source") != "explicit_owner_approval_in_chat":
        raise ManualOwnerReviewRequired("OWNER_APPROVAL_SOURCE_MISMATCH")
    for key, expected in binding.as_dict().items():
        if key in {"repository", "production_service", "production_port"}:
            continue
        if approval.get(key) != expected:
            raise ManualOwnerReviewRequired("OWNER_APPROVAL_BINDING_MISMATCH:" + key)
    return dict(approval)
 def _payload_file(git_dir: Path, oid: str, path: str) -> bytes:
    completed = subprocess.run(
        ["git", f"--git-dir={git_dir}", "show", f"{oid}:{path}"],
        check=False,
        capture_output=True,
        timeout=45,
        env={"PATH": os.environ.get("PATH", "")},
    )
    if completed.returncode != 0:
        raise ReleaseBlocked("required release source missing:" + path)
    return completed.stdout
 def _commit_epoch(git_dir: Path, oid: str) -> int:
    return int(_git(git_dir, "show", "-s", "--format=%ct", oid))
 def build_production_artifact(
    git_dir: Path,
    binding: ReleaseBinding,
    output_root: Path,
 ) -> dict[str, Any]:
    """Build a deterministic executable V2R2C1 health artifact from target_oid."""
    binding.validate()
    verify_lineage(git_dir, binding)
    epoch = _commit_epoch(git_dir, binding.target_oid)
    output_root.mkdir(parents=True, exist_ok=True)
    stem = f"aios-{VERSION}-{binding.target_oid[:12]}"
    output = output_root / (stem + ".tar.zst")
    with tempfile.TemporaryDirectory(prefix="v2r2c1-artifact-") as temp:
        root = Path(temp) / "payload"
        root.mkdir(parents=True)
        source_paths = {
            "active-runtime/app/deployment_state.py": "active-runtime/app/deployment_state.py",
            "active-runtime/app/v2r1c6_privacy_tools.py": "active-runtime/app/v2r1c6_privacy_tools.py",
        }
        for destination, source in source_paths.items():
            target = root / destination
            target.parent.mkdir(parents=True, exist_ok=True)
            target.write_bytes(_payload_file(git_dir, binding.target_oid, source))
        generated: dict[str, str] = {
            "VERSION": VERSION + "\n",
            "active-runtime/app/v2r2c1_health_service.py": (
                "from v2r1c6_privacy_tools import main\n\n"
                "if __name__ == '__main__':\n    raise SystemExit(main())\n"
            ),
            "deploy/aios-v2/systemd/aios-v2r1c7-production.service": (
                "[Unit]\nDescription=AIOS V2R2C1 governed health contract service\n"
                "After=network.target\n\n[Service]\nType=simple\n"
                "User=aios-v2r1c7\nGroup=aios-v2r1c7\n"
                "WorkingDirectory=/opt/aios/v2r2c1\n"
                "EnvironmentFile=/etc/aios/aios-v2r2c1.env\n"
                "ExecStart=/usr/bin/python3 /opt/aios/v2r2c1/active-runtime/app/v2r2c1_health_service.py --serve --host 127.0.0.1 --port ${AIOS_V2R1C7_PORT}\n"
                "Restart=on-failure\nRestartSec=5\nNoNewPrivileges=true\nPrivateTmp=true\n"
                "ProtectHome=true\nProtectSystem=strict\nProtectKernelLogs=true\n"
                "ProtectKernelModules=true\nProtectKernelTunables=true\nProtectControlGroups=true\n"
                "RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6\nIPAddressDeny=any\n"
                "IPAddressAllow=localhost\nUMask=0077\n\n[Install]\nWantedBy=multi-user.target\n"
            ),
            "deploy/aios-v2/v2r2c1-runtime-config.json": json.dumps({
                "schema": "aios.v2r2c1.production-runtime.v1",
                "version": VERSION,
                "target_oid": binding.target_oid,
                "service": SERVICE,
                "port": PORT,
                "health_path": "/health",
                "deployment_state_source": "environment_and_state_file",
            }, sort_keys=True, separators=(",", ":")) + "\n",
            "deploy/aios-v2/v2r2c1-rollback.json": json.dumps({
                "schema": "aios.v2r2c1.rollback-metadata.v1",
                "rollback_version": "V2R1C7",
                "rollback_service": SERVICE,
                "rollback_target_is_previous_production": True,
                "automatic_rollback": False,
            }, sort_keys=True, separators=(",", ":")) + "\n",
            "scripts/probe_v2r2c1_health.py": (
                "import json,sys,urllib.request\n"
                "url=sys.argv[1] if len(sys.argv)>1 else 'http://127.0.0.1:18927/health'\n"
                "with urllib.request.urlopen(url, timeout=5) as r: print(json.dumps(json.load(r), sort_keys=True))\n"
            ),
            "scripts/rollback_v2r2c1_release.sh": "#!/bin/sh\nset -eu\nprintf '%s\\n' 'rollback requires governed owner-approved executor'\nexit 2\n",
            "release-manifests/V2R2C1.json": json.dumps({
                "schema": "aios.release-source.v2",
                "version": VERSION,
                "repository": REPOSITORY,
                "target_oid": binding.target_oid,
                "evidence_closure_oid": binding.evidence_closure_oid,
                "production_deployed": False,
                "deployment_state": "STAGING",
                "artifact_kind": "executable-production-health",
            }, sort_keys=True, separators=(",", ":")) + "\n",
        }
        for rel, text in generated.items():
            target = root / rel
            target.parent.mkdir(parents=True, exist_ok=True)
            target.write_text(text, encoding="utf-8")
            if rel.startswith("scripts/"):
                target.chmod(0o755)
        metadata = {
            "schema": "aios.release-artifact-build.v3",
            "version": VERSION,
            "repository": REPOSITORY,
            "source_head_oid": binding.target_oid,
            "evidence_closure_oid": binding.evidence_closure_oid,
            "source_date_epoch": epoch,
            "clean_source": True,
            "executable_payload": True,
            "production_deployed": False,
            "tag_created": False,
            "baseline_changed": False,
            "secrets_included": False,
        }
        (root / "BUILD-METADATA.json").write_bytes(canonical(metadata))
        (root / "ROLLBACK-METADATA.json").write_bytes(canonical(json.loads((root / "deploy/aios-v2/v2r2c1-rollback.json").read_text(encoding="utf-8"))))
        names = sorted("payload/" + str(path.relative_to(root)).replace(os.sep, "/") for path in root.rglob("*") if path.is_file())
        (root / "ARTIFACT-MANIFEST.json").write_bytes(canonical({
            "schema": "aios.release-artifact-manifest.v3",
            "version": VERSION,
            "source_head_oid": binding.target_oid,
            "evidence_closure_oid": binding.evidence_closure_oid,
            "repository": REPOSITORY,
            "files": names + ["payload/ARTIFACT-MANIFEST.json"],
            "deployable": True,
            "executable_payload": True,
            "production_deployed": False,
            "tag_created": False,
            "baseline_changed": False,
        }))
        tar_path = Path(temp) / "release.tar"
        with tarfile.open(tar_path, "w") as archive:
            for path in sorted(root.rglob("*")):
                relative = str(path.relative_to(root)).replace(os.sep, "/")
                info = archive.gettarinfo(str(path), arcname="payload/" + relative)
                info.uid = info.gid = 0
                info.uname = "root"
                info.gname = "root"
                info.mtime = epoch
                info.mode = 0o755 if path.is_dir() or path.suffix == ".sh" else 0o644
                if path.is_file():
                    with path.open("rb") as stream:
                        archive.addfile(info, stream)
                else:
                    archive.addfile(info)
        subprocess.run(["zstd", "-T1", "-19", "--no-progress", "-q", "-f", str(tar_path), "-o", str(output)], check=True, timeout=120)
    digest = sha256_file(output)
    receipt = {
        "schema": "aios.release-artifact-receipt.v3",
        "version": VERSION,
        "repository": REPOSITORY,
        "source_head_oid": binding.target_oid,
        "evidence_closure_oid": binding.evidence_closure_oid,
        "artifact": str(output),
        "artifact_sha256": digest,
        "artifact_size": output.stat().st_size,
        "deployable": True,
        "executable_payload": True,
        "production_deployed": False,
        "tag_created": False,
        "baseline_changed": False,
    }
    atomic_json(output.with_suffix(output.suffix + ".receipt.json"), receipt, mode=0o640)
    return receipt
 class GovernedProductionReleaseExecutor:
    def __init__(self, config: Any):
        self.config = config
        self.binding = ReleaseBinding()
        self.binding.validate()
        self.root = Path(config.state_root) / "v2r2c1-governed-production-release"
        self.state = ReleaseState(self.root, self.binding)
        workspace = self.root / "publication-workspace"
        workspace.mkdir(parents=True, exist_ok=True)
        self.publisher = TagPublisher(
            workspace,
            GitTagBackend(workspace, authoritative_repo=Path(config.authoritative_git_dir)),
            GiteaTagClient(config.api_base, REPOSITORY, Path(config.token_path)),
            config.remote_name,
            state_root=self.root / "tag-publication",
        )
    def _request(self, request: Mapping[str, Any]) -> PublicationRequest:
        binding = self.binding
        for key, expected in binding.as_dict().items():
            if key in request and request[key] != expected:
                raise ManualOwnerReviewRequired("release request binding mismatch:" + key)
        return PublicationRequest(binding.version, binding.target_oid, binding.evidence_closure_oid, binding.approval_plan_id)
    def approval_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
        if request.get("execute") is not False:
            raise ReleaseBlocked("TAG_APPROVAL_REQUEST_MUST_BE_DRY_RUN")
        owner = verify_owner_approval(request, self.binding)
        with StateLock(self.root / "release.lock"):
            current = self.state.value.get("approval")
            approval_digest = hashlib.sha256(canonical(owner)).hexdigest()
            record = {
                "schema": "aios.v2r2c1.tag-approval-request.v1",
                "binding": self.binding.as_dict(),
                "owner_approval": owner,
                "owner_approval_digest_sha256": approval_digest,
                "execute": False,
                "recorded_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
            }
            if current and current != record:
                raise ManualOwnerReviewRequired("persisted Owner approval differs")
            self.state.value["approval"] = record
            self.state.record("APPROVAL_REQUEST_RECORDED", "tag_approval_request", record)
            return {"status": "RECORDED", "execute": False, "binding": self.binding.as_dict(), "owner_approval_digest_sha256": approval_digest}
    def _require_approval(self) -> None:
        approval = self.state.value.get("approval")
        if not isinstance(approval, Mapping) or approval.get("binding") != self.binding.as_dict():
            raise ReleaseBlocked("OWNER_APPROVAL_REQUEST_NOT_RECORDED")
    def publish_tag(self, request: Mapping[str, Any]) -> dict[str, Any]:
        if request.get("execute") is not True:
            raise ReleaseBlocked("TAG_PUBLICATION_REQUIRES_EXECUTE_TRUE")
        self._require_approval()
        publication = self._request(request)
        with StateLock(self.root / "release.lock"):
            try:
                verified = self.publisher._verify_publication(publication, allow_push=True, previously_deployed=False)
            except PublicationManualOwnerReviewRequired as exc:
                self.state.fail("MANUAL_OWNER_REVIEW_REQUIRED", str(exc))
                raise ManualOwnerReviewRequired(str(exc)) from exc
            except PublicationPending as exc:
                self.state.fail("REMOTE_PUSH_PENDING", str(exc))
                raise ReconciliationRequired(str(exc)) from exc
            except PublicationReconciliationRequired as exc:
                self.state.fail("RECONCILIATION_REQUIRED", str(exc))
                raise ReconciliationRequired(str(exc)) from exc
            result = dict(verified)
            self.state.record("TAG_VERIFIED", "tag", result)
            return {"status": "REMOTE_VERIFIED", **result}
    def tag_status(self, request: Mapping[str, Any]) -> dict[str, Any]:
        self._request(request)
        return self.publisher.get_tag_publication_status(VERSION)
    def build_artifact(self, request: Mapping[str, Any]) -> dict[str, Any]:
        self._require_approval()
        self._request(request)
        receipt = build_production_artifact(Path(self.config.authoritative_git_dir), self.binding, self.root / "artifacts")
        self.state.record("ARTIFACT_VERIFIED", "production_artifact", receipt)
        return {"status": "VERIFIED", **receipt}
    def execute_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
        self._require_approval()
        publication = self._request(request)
        tag_state = self.state.value.get("completed", {}).get("tag")
        if not isinstance(tag_state, Mapping) or tag_state.get("state") not in {"GITEA_API_CONFIRMED", "REMOTE_VERIFIED"}:
            raise ReleaseBlocked("REMOTE_TAG_PROOF_REQUIRED")
        artifact = self.state.value.get("completed", {}).get("production_artifact")
        if not isinstance(artifact, Mapping):
            artifact = self.build_artifact(request)
        value = {
            **self.binding.as_dict(),
            "tag_oid": tag_state.get("tag_oid") or tag_state.get("gitea_tag_oid"),
            "artifact_path": artifact["artifact"],
            "artifact_size": int(artifact["artifact_size"]),
            "artifact_sha256": artifact["artifact_sha256"],
        }
        # The production adapter is privileged and is run through the root
        # approved-release service boundary by the caller.  This handler is
        # still useful for a root-owned staging invocation and remains
        # fail-closed when the adapter is not available.
        import v2r2c1_production_adapter
        runtime = v2r2c1_production_adapter.execute_request({"schema": "aios.production-executor-request.v1", "operation": "apply", **value})
        if runtime.get("status") != "ACTIVE_VERIFIED":
            self.state.fail("RECONCILIATION_REQUIRED", "production health did not verify")
            raise ReconciliationRequired("production health did not verify")
        self.state.record("PRODUCTION_VERIFIED", "production", runtime)
        return {"status": "PRODUCTION_VERIFIED", "runtime": runtime, "artifact": artifact, "tag_oid": value["tag_oid"]}
    def consistency(self, request: Mapping[str, Any]) -> dict[str, Any]:
        publication = self._request(request)
        result = self.publisher.get_release_consistency(publication)
        result["release_binding"] = self.binding.as_dict()
        result["production_health"] = _health(self.config.health_url, self.binding, self.state.value.get("completed", {}).get("production_artifact", {}))
        result["registry"] = _read_json(Path(self.config.registry_root) / f"{VERSION}.json")
        result["baseline"] = _read_json(Path(self.config.baseline_path))
        return result
    def acceptance(self, request: Mapping[str, Any]) -> dict[str, Any]:
        result = self.consistency(request)
        result["accepted"] = result.get("status") == "PASS" and result.get("production_health", {}).get("status") == "ACTIVE_VERIFIED"
        self.state.record("ACCEPTED" if result["accepted"] else "RECONCILIATION_REQUIRED", "acceptance", result)
        return result
 def _read_json(path: Path) -> dict[str, Any]:
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except FileNotFoundError:
        return {"status": "MISSING", "path": str(path)}
    if not isinstance(value, dict):
        return {"status": "INVALID", "path": str(path)}
    return {"status": "PRESENT", "path": str(path), **value}
 def _health(url: str, binding: ReleaseBinding, artifact: Mapping[str, Any]) -> dict[str, Any]:
    import urllib.request
    try:
        with urllib.request.urlopen(url, timeout=5) as response:
            body = json.loads(response.read().decode("utf-8"))
            status = response.status
    except Exception as exc:
        return {"status": "UNAVAILABLE", "error": type(exc).__name__}
    expected_artifact = artifact.get("artifact_sha256")
    exact = (
        status == 200
        and body.get("version") == binding.version
        and body.get("commit_oid") == binding.target_oid
        and (not expected_artifact or body.get("artifact_sha256") == expected_artifact)
        and body.get("deployment_state") == "ACTIVE"
        and body.get("production_deployed") is True
    )
    return {"status": "ACTIVE_VERIFIED" if exact else "CONFLICT", "http_status": status, **body}
 def build_executor_config(config: Any) -> GovernedProductionReleaseExecutor:
    return GovernedProductionReleaseExecutor(config)
 def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("operation", choices=("build-artifact", "status"))
    parser.add_argument("--git-dir", type=Path, default=Path("/data/aios-gitops/repo.git"))
    parser.add_argument("--output-root", type=Path, default=Path("/var/lib/aios-gitops/approved-artifacts/V2R2C1"))
    args = parser.parse_args()
    binding = ReleaseBinding()
    if args.operation == "build-artifact":
        print(json.dumps(build_production_artifact(args.git_dir, binding, args.output_root), sort_keys=True))
    else:
        print(json.dumps({"binding": binding.as_dict(), "status": "READY"}, sort_keys=True))
    return 0
 if __name__ == "__main__":
    raise SystemExit(main())
@@ -1,293 +0,0 @@
 #!/usr/bin/env python3
 """Thin production tag adapter over AIOS's existing mature TagPublisher.
 This adapter deliberately does not call TagPublisher.publish(), because that
 legacy method also mutates Registry/Baseline. The production executor requires:
 Tag -> runtime ACTIVE -> Registry -> Baseline.
 `apply` reuses TagPublisher._verify_publication() under the publisher's durable
 per-version lock. That method performs the existing fail-closed annotated-tag,
 network remote, Gitea API, peeled-target and listing verification, but stops
 before Registry/Baseline mutation.
 `probe` is read-only.
 """
 from __future__ import annotations
 import argparse
 import json
 import os
 import re
 import sys
 from pathlib import Path
 from typing import Any, Mapping
 from gitea_tag_publication import (
    GiteaTagClient,
    GitTagBackend,
    PublicationConflict,
    PublicationManualOwnerReviewRequired,
    PublicationPending,
    PublicationReconciliationRequired,
    PublicationRequest,
    PublicationState,
    TagPublisher,
 )
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
 def load_request() -> dict[str, Any]:
    value = json.load(sys.stdin)
    if not isinstance(value, dict):
        raise ValueError("request_object_required")
    if value.get("schema") != "aios.production-executor-request.v1":
        raise ValueError("request_schema_invalid")
    if not re.fullmatch(r"V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?", str(value.get("version", ""))):
        raise ValueError("version_invalid")
    for name in ("target_oid", "evidence_closure_oid"):
        if not OID_RE.fullmatch(str(value.get(name, ""))):
            raise ValueError(f"{name}_invalid")
    if not PLAN_RE.fullmatch(str(value.get("approval_plan_id", ""))):
        raise ValueError("approval_plan_id_invalid")
    if value.get("repository_identity") != "aios/aios":
        raise ValueError("repository_identity_invalid")
    return value
 def publication_request(value: Mapping[str, Any]) -> PublicationRequest:
    return PublicationRequest(
        str(value["version"]),
        str(value["target_oid"]),
        str(value["evidence_closure_oid"]),
        str(value["approval_plan_id"]),
    )
 def response(value: Mapping[str, Any], status: str, **extra: Any) -> dict[str, Any]:
    return {
        "status": status,
        "version": value["version"],
        "target_oid": value["target_oid"],
        "evidence_closure_oid": value["evidence_closure_oid"],
        "artifact_sha256": value["artifact_sha256"],
        "approval_plan_id": value["approval_plan_id"],
        **extra,
    }
 def build(args: argparse.Namespace) -> tuple[TagPublisher, GitTagBackend, GiteaTagClient]:
    git = GitTagBackend(args.workspace, authoritative_repo=args.repository)
    gitea = GiteaTagClient(
        args.gitea_api,
        args.gitea_repo,
        args.gitea_token_file,
        token_line=args.gitea_token_line,
    )
    publisher = TagPublisher(
        args.workspace,
        git,
        gitea,
        args.remote,
        state_root=args.state_root,
    )
    return publisher, git, gitea
 def _gitea_lookup(gitea: GiteaTagClient, version: str) -> tuple[str, str] | None:
    try:
        return gitea.lookup_tag(version)
    except RuntimeError as exc:
        if "HTTP 404" in str(exc):
            return None
        raise
 def probe(
    args: argparse.Namespace,
    value: Mapping[str, Any],
    publisher: TagPublisher,
    git: GitTagBackend,
    gitea: GiteaTagClient,
 ) -> dict[str, Any]:
    request = publication_request(value)
    request.validate()
    git.validate_evidence_lineage(request)
    local_oid = git._rev(f"refs/tags/{request.version}")
    local_target = git._rev(f"refs/tags/{request.version}^{{commit}}")
    remote = git.remote_tag(args.remote, request.version)
    api = _gitea_lookup(gitea, request.version)
    listing = False
    if api is not None:
        listing = gitea.tag_visible_in_listing(request.version, request.target_oid)
    if local_oid is None and remote is None and api is None:
        return response(value, "NOT_APPLIED")
    if local_oid is not None:
        if local_target is None or local_oid == local_target:
            return response(value, "CONFLICT", reason="local_tag_not_annotated")
        if local_target != request.target_oid:
            return response(
                value,
                "CONFLICT",
                reason="local_peeled_target_mismatch",
                tag_oid=local_oid,
                peeled_target_oid=local_target,
            )
    # A remote/Gitea tag without the Authority tag object is not safe to
    # recreate, because a new annotated tag would have a different object OID.
    if local_oid is None and (remote is not None or api is not None):
        return response(
            value,
            "INDETERMINATE",
            reason="remote_or_gitea_tag_exists_without_authority_tag_object",
        )
    if remote is not None:
        if remote[0] != local_oid or remote[1] != request.target_oid:
            return response(
                value,
                "CONFLICT",
                reason="network_remote_tag_mismatch",
                tag_oid=local_oid,
                peeled_target_oid=local_target,
                remote_tag_oid=remote[0],
                remote_peeled_target_oid=remote[1],
            )
    if api is not None:
        if api[0] != local_oid or api[1] != request.target_oid:
            return response(
                value,
                "CONFLICT",
                reason="gitea_api_tag_mismatch",
                tag_oid=local_oid,
                peeled_target_oid=local_target,
                gitea_tag_oid=api[0],
                gitea_peeled_target_oid=api[1],
            )
    if (
        local_oid is not None
        and remote is not None
        and api is not None
        and listing
    ):
        return response(
            value,
            "APPLIED_VERIFIED",
            tag_oid=local_oid,
            peeled_target_oid=local_target,
            remote_tag_oid=remote[0],
            remote_peeled_target_oid=remote[1],
            gitea_tag_oid=api[0],
            gitea_peeled_target_oid=api[1],
            gitea_listing_visible=True,
        )
    if local_oid is not None and remote is None and api is None:
        return response(
            value,
            "PARTIAL_LOCAL",
            tag_oid=local_oid,
            peeled_target_oid=local_target,
        )
    return response(
        value,
        "INDETERMINATE",
        reason="tag_visibility_partial",
        tag_oid=local_oid,
        peeled_target_oid=local_target,
    )
 def apply(
    args: argparse.Namespace,
    value: Mapping[str, Any],
    publisher: TagPublisher,
    git: GitTagBackend,
    gitea: GiteaTagClient,
 ) -> dict[str, Any]:
    before = probe(args, value, publisher, git, gitea)
    if before["status"] in {"APPLIED_VERIFIED", "CONFLICT", "INDETERMINATE"}:
        return before
    request = publication_request(value)
    with publisher.store.lock(request.version):
        request.validate()
        publisher._assert_fingerprint(request)
        publisher.store.record(request, PublicationState.PENDING)
        publisher._verify_publication(
            request,
            allow_push=True,
            previously_deployed=False,
        )
    return probe(args, value, publisher, git, gitea)
 def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--workspace", type=Path, default=Path(os.environ["AIOS_GITOPS_CONTROLLER_WORKSPACE"]))
    parser.add_argument("--repository", type=Path, default=Path(os.environ["AIOS_GITOPS_AUTHORITATIVE_GIT_DIR"]))
    parser.add_argument("--remote", default=os.getenv("AIOS_GITOPS_GITEA_REMOTE", "gitea"))
    parser.add_argument("--gitea-api", default=os.getenv("AIOS_GITOPS_GITEA_API_URL", ""))
    parser.add_argument("--gitea-repo", default=os.getenv("AIOS_GITOPS_GITEA_REPOSITORY", ""))
    parser.add_argument(
        "--gitea-token-file",
        type=Path,
        default=Path(os.getenv("AIOS_GITOPS_GITEA_TOKEN_FILE", "")),
    )
    parser.add_argument(
        "--gitea-token-line",
        type=int,
        default=int(os.getenv("AIOS_GITOPS_GITEA_TOKEN_LINE", "1")),
    )
    parser.add_argument(
        "--state-root",
        type=Path,
        default=Path(
            os.getenv(
                "AIOS_GITOPS_PUBLICATION_STATE_DIR",
                "/var/lib/aios-gitops/tag-publications",
            )
        ),
    )
    args = parser.parse_args()
    value = load_request()
    publisher, git, gitea = build(args)
    operation = value.get("operation")
    if operation == "probe":
        result = probe(args, value, publisher, git, gitea)
    elif operation == "apply":
        result = apply(args, value, publisher, git, gitea)
    else:
        raise ValueError("unsupported_operation")
    print(json.dumps(result, sort_keys=True))
    return 0
 if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except PublicationManualOwnerReviewRequired as exc:
        print(json.dumps({"status": "CONFLICT", "reason": str(exc)}, sort_keys=True))
        raise SystemExit(20)
    except PublicationConflict as exc:
        print(json.dumps({"status": "CONFLICT", "reason": str(exc)}, sort_keys=True))
        raise SystemExit(20)
    except (PublicationPending, PublicationReconciliationRequired) as exc:
        print(json.dumps({"status": "INDETERMINATE", "reason": str(exc)}, sort_keys=True))
        raise SystemExit(21)
    except Exception as exc:
        print(
            json.dumps(
                {"status": "INDETERMINATE", "error": type(exc).__name__, "reason": str(exc)},
                sort_keys=True,
            )
        )
        raise SystemExit(22)
@@ -1,456 +0,0 @@
 from __future__ import annotations
 import dataclasses
 import datetime as dt
 import hashlib
 import json
 import sqlite3
 import re
 from pathlib import Path
 from typing import Any, Iterable, Mapping
 UTC = dt.timezone.utc
 _ALLOWED_CONFIDENTIALITY = frozenset({"public", "tenant", "project", "private", "run"})
 _PRIVILEGED = frozenset({"*", "admin", "system.admin", "message.admin", "task.admin"})
 class HandoffError(RuntimeError):
    code = "HANDOFF_ERROR"
 class MessageScopeMismatch(HandoffError):
    code = "MESSAGE_SCOPE_MISMATCH_DENY"
 class ConfidentialityScopeDenied(HandoffError):
    code = "MESSAGE_CONFIDENTIALITY_SCOPE_ENFORCE"
 class MessageExpired(HandoffError):
    code = "MESSAGE_EXPIRED"
 class SequenceGap(HandoffError):
    code = "MESSAGE_SEQUENCE_GAP_DETECT"
 class SequenceConflict(HandoffError):
    code = "MESSAGE_SEQUENCE_CONFLICT"
 class IdempotencyConflict(HandoffError):
    code = "MESSAGE_IDEMPOTENCY_CONFLICT"
 def _utcnow() -> dt.datetime:
    return dt.datetime.now(UTC)
 def _iso(value: dt.datetime | str | None) -> str | None:
    if value is None:
        return None
    parsed = dt.datetime.fromisoformat(value.replace("Z", "+00:00")) if isinstance(value, str) else value
    if parsed.tzinfo is None:
        parsed = parsed.replace(tzinfo=UTC)
    return parsed.astimezone(UTC).isoformat()
 def _canonical(value: Any) -> str:
    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str)
 def _sha(value: Any) -> str:
    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
 def _clean(value: Any) -> str | None:
    if value is None:
        return None
    text = str(value).strip()
    return text or None
 def _tuple_scope(value: Iterable[str] | str | None) -> tuple[str, ...]:
    if value is None:
        return ()
    if isinstance(value, str):
        value = value.split(",")
    return tuple(sorted({str(item).strip() for item in value if str(item).strip()}))
 _SECRET_KEY = re.compile(r"(?i)(?:token|secret|password|private[_-]?key|api[_-]?key)")
 _SECRET_VALUE = re.compile(r"(?i)bearer\s+[A-Za-z0-9._~+/-]{8,}|(?:token|secret|password|api[_-]?key)\s*[:=]\s*\S+")
 _SAFE_REFERENCE = re.compile(r"^(?:systemd-credential|vault|secret-manager):[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$")
 def assert_payload_secret_safe(value: Any, *, key: str = "") -> None:
    if isinstance(value, Mapping):
        for child_key, child in value.items():
            assert_payload_secret_safe(child, key=str(child_key))
        return
    if isinstance(value, (list, tuple)):
        for child in value:
            assert_payload_secret_safe(child, key=key)
        return
    if isinstance(value, (bytes, bytearray)):
        raise ValueError("CREDENTIAL_SECRET_EXPOSURE_DENY")
    if isinstance(value, str):
        if _SECRET_VALUE.search(value):
            raise ValueError("CREDENTIAL_SECRET_EXPOSURE_DENY")
        if _SECRET_KEY.search(key) and value and _SAFE_REFERENCE.fullmatch(value) is None:
            raise ValueError("CREDENTIAL_SECRET_EXPOSURE_DENY")
@dataclasses.dataclass(frozen=True)
 class DeliveryContext:
    tenant_id: str | None = None
    user_id: str | None = None
    project_id: str | None = None
    conversation_id: str | None = None
    run_id: str | None = None
    capabilities: tuple[str, ...] = ()
    @classmethod
    def from_actor(cls, actor: Any) -> "DeliveryContext":
        def get(name: str) -> Any:
            if isinstance(actor, Mapping):
                return actor.get(name)
            return getattr(actor, name, None)
        return cls(
            tenant_id=_clean(get("tenant_id")),
            user_id=_clean(get("user_id")),
            project_id=_clean(get("project_id")),
            conversation_id=_clean(get("conversation_id")),
            run_id=_clean(get("run_id")),
            capabilities=_tuple_scope(get("capabilities") or get("capability_scope")),
        )
    @property
    def privileged(self) -> bool:
        return bool(set(self.capabilities) & _PRIVILEGED)
@dataclasses.dataclass(frozen=True)
 class MessageEnvelope:
    source: str
    target: str
    message_type: str
    payload: Mapping[str, Any]
    sequence: int
    idempotency_key: str
    tenant_id: str | None = None
    user_id: str | None = None
    project_id: str | None = None
    conversation_id: str | None = None
    task_id: str | None = None
    run_id: str | None = None
    correlation_id: str | None = None
    causation_id: str | None = None
    capability_scope: tuple[str, ...] = ()
    confidentiality_scope: str = "private"
    expires_at: str | None = None
    created_at: str = dataclasses.field(default_factory=lambda: _iso(_utcnow()) or "")
    envelope_id: str = ""
    def __post_init__(self) -> None:
        assert_payload_secret_safe(self.payload)
        for field in ("source", "target", "message_type", "idempotency_key", "tenant_id", "user_id",
                      "project_id", "conversation_id", "task_id", "run_id", "correlation_id", "causation_id"):
            object.__setattr__(self, field, _clean(getattr(self, field)) if field not in {
                "source", "target", "message_type", "idempotency_key"
            } else (_clean(getattr(self, field)) or ""))
        object.__setattr__(self, "capability_scope", _tuple_scope(self.capability_scope))
        object.__setattr__(self, "confidentiality_scope", (_clean(self.confidentiality_scope) or "private").lower())
        object.__setattr__(self, "expires_at", _iso(self.expires_at))
        object.__setattr__(self, "created_at", _iso(self.created_at) or "")
        if not self.source or not self.target or not self.message_type or not self.idempotency_key:
            raise ValueError("MESSAGE_ENVELOPE_IDENTITY_REQUIRED")
        if not isinstance(self.sequence, int) or self.sequence < 1:
            raise ValueError("MESSAGE_SEQUENCE_MUST_BE_POSITIVE")
        if self.confidentiality_scope not in _ALLOWED_CONFIDENTIALITY:
            raise ValueError("MESSAGE_CONFIDENTIALITY_SCOPE_INVALID")
        if self.confidentiality_scope != "public" and self.tenant_id is None:
            raise ValueError("MESSAGE_TENANT_REQUIRED")
        if self.confidentiality_scope in {"project", "private", "run"} and self.project_id is None:
            raise ValueError("MESSAGE_PROJECT_REQUIRED")
        if self.confidentiality_scope in {"private", "run"} and self.user_id is None:
            raise ValueError("MESSAGE_USER_REQUIRED")
        if self.confidentiality_scope == "run" and self.run_id is None:
            raise ValueError("MESSAGE_RUN_REQUIRED")
        expected = stable_event_id(
            source=self.source, target=self.target, message_type=self.message_type, payload=self.payload,
            tenant_id=self.tenant_id, user_id=self.user_id, project_id=self.project_id,
            conversation_id=self.conversation_id, task_id=self.task_id, run_id=self.run_id,
            correlation_id=self.correlation_id, causation_id=self.causation_id,
            sequence=self.sequence, idempotency_key=self.idempotency_key,
        )
        if self.envelope_id and self.envelope_id != expected:
            raise ValueError("MESSAGE_ENVELOPE_ID_MISMATCH")
        object.__setattr__(self, "envelope_id", expected)
    @property
    def payload_sha256(self) -> str:
        return _sha(self.payload)
    @property
    def stream_key(self) -> str:
        return _sha({
            "tenant_id": self.tenant_id, "source": self.source, "target": self.target,
            "conversation_id": self.conversation_id, "task_id": self.task_id, "run_id": self.run_id,
        })
    def is_expired(self, *, now: dt.datetime | None = None) -> bool:
        if self.expires_at is None:
            return False
        return dt.datetime.fromisoformat(self.expires_at) <= (now or _utcnow()).astimezone(UTC)
    def as_record(self) -> dict[str, Any]:
        return {
            "envelope_id": self.envelope_id, "stream_key": self.stream_key, "source": self.source,
            "target": self.target, "message_type": self.message_type, "payload_json": _canonical(self.payload),
            "payload_sha256": self.payload_sha256, "tenant_id": self.tenant_id, "user_id": self.user_id,
            "project_id": self.project_id, "conversation_id": self.conversation_id, "task_id": self.task_id,
            "run_id": self.run_id, "correlation_id": self.correlation_id,
            "causation_id": self.causation_id, "sequence": self.sequence,
            "capability_scope_json": _canonical(self.capability_scope),
            "confidentiality_scope": self.confidentiality_scope, "idempotency_key": self.idempotency_key,
            "expires_at": self.expires_at, "created_at": self.created_at,
        }
 def stable_event_id(*, source: Any, target: Any, message_type: Any, payload: Any,
                    tenant_id: Any = None, user_id: Any = None, project_id: Any = None,
                    conversation_id: Any = None, task_id: Any = None, run_id: Any = None,
                    correlation_id: Any = None, causation_id: Any = None,
                    sequence: Any = None, idempotency_key: Any = None) -> str:
    assert_payload_secret_safe(payload)
    material = {
        "source": _clean(source), "target": _clean(target), "message_type": _clean(message_type),
        "payload_sha256": _sha(payload), "tenant_id": _clean(tenant_id), "user_id": _clean(user_id),
        "project_id": _clean(project_id), "conversation_id": _clean(conversation_id),
        "task_id": _clean(task_id), "run_id": _clean(run_id), "causation_id": _clean(causation_id),
        "sequence": sequence, "idempotency_key": _clean(idempotency_key),
    }
    # Preserve historical envelope IDs for legacy rows that predate correlation_id.
    if _clean(correlation_id) is not None:
        material["correlation_id"] = _clean(correlation_id)
    return _sha(material)
 def bind_envelope_scope(envelope: MessageEnvelope, actor: Any) -> MessageEnvelope:
    ctx = DeliveryContext.from_actor(actor)
    if ctx.privileged:
        return envelope
    if ctx.tenant_id is None:
        if envelope.tenant_id is not None:
            raise MessageScopeMismatch(MessageScopeMismatch.code)
        return envelope
    updates: dict[str, Any] = {}
    for field in ("tenant_id", "user_id", "project_id", "conversation_id", "run_id"):
        trusted = getattr(ctx, field)
        requested = getattr(envelope, field)
        if requested is not None and requested != trusted:
            raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:{field}")
        if requested is None and trusted is not None:
            updates[field] = trusted
    if not updates:
        return envelope
    data = dataclasses.asdict(envelope)
    data.update(updates)
    data["envelope_id"] = ""
    return MessageEnvelope(**data)
 def authorize_delivery(actor: Any, envelope: MessageEnvelope) -> None:
    ctx = DeliveryContext.from_actor(actor)
    if ctx.privileged:
        return
    if not set(envelope.capability_scope).issubset(set(ctx.capabilities)):
        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:capability")
    if envelope.confidentiality_scope == "public":
        return
    if ctx.tenant_id != envelope.tenant_id:
        raise MessageScopeMismatch(f"{MessageScopeMismatch.code}:tenant_id")
    if envelope.confidentiality_scope in {"project", "private", "run"} and ctx.project_id != envelope.project_id:
        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:project_id")
    if envelope.confidentiality_scope in {"private", "run"} and ctx.user_id != envelope.user_id:
        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:user_id")
    if envelope.confidentiality_scope == "run" and ctx.run_id != envelope.run_id:
        raise ConfidentialityScopeDenied(f"{ConfidentialityScopeDenied.code}:run_id")
 _SCHEMA = """
 CREATE TABLE IF NOT EXISTS message_handoff (
  envelope_id TEXT PRIMARY KEY,
  stream_key TEXT NOT NULL,
  source TEXT NOT NULL,
  target TEXT NOT NULL,
  message_type TEXT NOT NULL,
  payload_json TEXT NOT NULL,
  payload_sha256 TEXT NOT NULL,
  tenant_id TEXT,
  user_id TEXT,
  project_id TEXT,
  conversation_id TEXT,
  task_id TEXT,
  run_id TEXT,
  correlation_id TEXT,
  causation_id TEXT,
  sequence INTEGER NOT NULL CHECK(sequence >= 1),
  capability_scope_json TEXT NOT NULL,
  confidentiality_scope TEXT NOT NULL,
  idempotency_key TEXT NOT NULL,
  expires_at TEXT,
  created_at TEXT NOT NULL,
  status TEXT NOT NULL DEFAULT 'PENDING',
  delivered_at TEXT,
  acked_at TEXT,
  UNIQUE(stream_key, idempotency_key),
  UNIQUE(stream_key, sequence)
 );
 CREATE INDEX IF NOT EXISTS idx_message_handoff_target_status
  ON message_handoff(target, status, created_at);
 CREATE INDEX IF NOT EXISTS idx_message_handoff_scope
  ON message_handoff(tenant_id, project_id, user_id, conversation_id, run_id);
 """
 class DurableHandoffStore:
    def __init__(self, path: str | Path) -> None:
        self.path = Path(path)
        self.path.parent.mkdir(parents=True, exist_ok=True)
        with self._connect() as conn:
            conn.executescript(_SCHEMA)
            columns = {str(row[1]) for row in conn.execute("PRAGMA table_info(message_handoff)")}
            if "correlation_id" not in columns:
                conn.execute("ALTER TABLE message_handoff ADD COLUMN correlation_id TEXT")
            conn.execute(
                "CREATE INDEX IF NOT EXISTS idx_message_handoff_lineage "
                "ON message_handoff(correlation_id, causation_id)"
            )
    def _connect(self) -> sqlite3.Connection:
        conn = sqlite3.connect(self.path, timeout=30.0)
        conn.row_factory = sqlite3.Row
        conn.execute("PRAGMA foreign_keys=ON")
        conn.execute("PRAGMA busy_timeout=30000")
        return conn
    @staticmethod
    def _from_row(row: sqlite3.Row) -> MessageEnvelope:
        return MessageEnvelope(
            source=row["source"], target=row["target"], message_type=row["message_type"],
            payload=json.loads(row["payload_json"]), tenant_id=row["tenant_id"], user_id=row["user_id"],
            project_id=row["project_id"], conversation_id=row["conversation_id"], task_id=row["task_id"],
            run_id=row["run_id"], correlation_id=row["correlation_id"],
            causation_id=row["causation_id"], sequence=int(row["sequence"]),
            capability_scope=tuple(json.loads(row["capability_scope_json"])),
            confidentiality_scope=row["confidentiality_scope"], idempotency_key=row["idempotency_key"],
            expires_at=row["expires_at"], created_at=row["created_at"], envelope_id=row["envelope_id"],
        )
    def put(self, envelope: MessageEnvelope) -> tuple[str, MessageEnvelope]:
        if envelope.is_expired():
            raise MessageExpired(MessageExpired.code)
        record = envelope.as_record()
        with self._connect() as conn:
            conn.execute("BEGIN IMMEDIATE")
            replay = conn.execute(
                "SELECT * FROM message_handoff WHERE stream_key=? AND idempotency_key=?",
                (envelope.stream_key, envelope.idempotency_key),
            ).fetchone()
            if replay is not None:
                existing = self._from_row(replay)
                if existing.envelope_id != envelope.envelope_id or existing.payload_sha256 != envelope.payload_sha256:
                    raise IdempotencyConflict(IdempotencyConflict.code)
                conn.commit()
                return "REPLAY", existing
            seq = conn.execute(
                "SELECT * FROM message_handoff WHERE stream_key=? AND sequence=?",
                (envelope.stream_key, envelope.sequence),
            ).fetchone()
            if seq is not None:
                existing = self._from_row(seq)
                if existing.envelope_id == envelope.envelope_id:
                    conn.commit()
                    return "REPLAY", existing
                raise SequenceConflict(SequenceConflict.code)
            maximum = int(conn.execute(
                "SELECT COALESCE(MAX(sequence),0) FROM message_handoff WHERE stream_key=?",
                (envelope.stream_key,),
            ).fetchone()[0])
            expected = maximum + 1
            if envelope.sequence != expected:
                raise SequenceGap(f"{SequenceGap.code}:expected={expected}:actual={envelope.sequence}")
            columns = tuple(record)
            placeholders = ",".join("?" for _ in columns)
            conn.execute(
                f"INSERT INTO message_handoff ({','.join(columns)}) VALUES ({placeholders})",
                tuple(record[column] for column in columns),
            )
            conn.commit()
            return "CREATED", envelope
    def get(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
        with self._connect() as conn:
            row = conn.execute("SELECT * FROM message_handoff WHERE envelope_id=?", (envelope_id,)).fetchone()
            if row is None:
                raise KeyError(envelope_id)
            envelope = self._from_row(row)
            if envelope.is_expired():
                conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope_id,))
                conn.commit()
                raise MessageExpired(MessageExpired.code)
            authorize_delivery(actor, envelope)
            return envelope
    def pending(self, *, target: str, actor: Any, limit: int = 100) -> list[MessageEnvelope]:
        if not 1 <= limit <= 1000:
            raise ValueError("MESSAGE_PENDING_LIMIT_INVALID")
        visible: list[MessageEnvelope] = []
        with self._connect() as conn:
            rows = conn.execute(
                "SELECT * FROM message_handoff WHERE target=? AND status='PENDING' ORDER BY created_at, sequence LIMIT ?",
                (target, limit),
            ).fetchall()
            for row in rows:
                envelope = self._from_row(row)
                if envelope.is_expired():
                    conn.execute("UPDATE message_handoff SET status='EXPIRED' WHERE envelope_id=?", (envelope.envelope_id,))
                    continue
                try:
                    authorize_delivery(actor, envelope)
                except HandoffError:
                    continue
                visible.append(envelope)
            conn.commit()
        return visible
    def mark_delivered(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
        envelope = self.get(envelope_id, actor=actor)
        with self._connect() as conn:
            conn.execute(
                "UPDATE message_handoff SET status='DELIVERED', delivered_at=? "
                "WHERE envelope_id=? AND status='PENDING'",
                (_iso(_utcnow()), envelope_id),
            )
            conn.commit()
        return envelope
    def acknowledge(self, envelope_id: str, *, actor: Any) -> MessageEnvelope:
        envelope = self.get(envelope_id, actor=actor)
        with self._connect() as conn:
            conn.execute(
                "UPDATE message_handoff SET status='ACKED', acked_at=? WHERE envelope_id=?",
                (_iso(_utcnow()), envelope_id),
            )
            conn.commit()
        return envelope
 class HandoffFabric:
    def __init__(self, store: DurableHandoffStore) -> None:
        self.store = store
    def publish(self, envelope: MessageEnvelope, *, actor: Any | None = None) -> tuple[str, MessageEnvelope]:
        return self.store.put(bind_envelope_scope(envelope, actor) if actor is not None else envelope)
@@ -1,68 +0,0 @@
 from __future__ import annotations
 from typing import Any, Mapping
 from message_handoff import MessageEnvelope
 def _get(value: Any, *names: str, default: Any = None) -> Any:
    for name in names:
        if isinstance(value, Mapping) and name in value:
            return value[name]
        if hasattr(value, name):
            return getattr(value, name)
    return default
 def agent_event_to_envelope(event: Any, *, target: str | None = None, sequence: int = 1,
                            idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
    payload = _get(event, "payload", "data", default={}) or {}
    target = target or _get(event, "target", "recipient")
    if not target:
        raise ValueError("MESSAGE_TARGET_REQUIRED")
    return MessageEnvelope(
        source=str(_get(event, "source", "producer", "agent_id", default="agent-event")),
        target=str(target),
        message_type=str(_get(event, "event_type", "type", "message_type", default="agent.event")),
        payload=dict(payload),
        sequence=sequence,
        idempotency_key=idempotency_key or str(_get(event, "id", "event_id", default="")) or f"agent-event:{sequence}",
        causation_id=_get(event, "causation_id"),
        **scope,
    )
 def taskplane_event_to_envelope(event: Any, *, target: str, sequence: int = 1,
                                idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
    data = _get(event, "data", "payload", default={}) or {}
    event_id = str(_get(event, "id", "event_id", default=""))
    return MessageEnvelope(
        source=str(_get(event, "source", default="task-plane")),
        target=target,
        message_type=str(_get(event, "type", "event_type", default="task.event")),
        payload=dict(data),
        sequence=sequence,
        idempotency_key=idempotency_key or event_id or f"task-event:{sequence}",
        causation_id=event_id or None,
        **scope,
    )
 def legacy_message_to_envelope(message: Any, *, target: str | None = None, sequence: int = 1,
                               idempotency_key: str | None = None, **scope: Any) -> MessageEnvelope:
    payload = _get(message, "payload", "data", "body", "content", default={})
    if not isinstance(payload, Mapping):
        payload = {"value": payload}
    target = target or _get(message, "target", "recipient", "receiver")
    if not target:
        raise ValueError("MESSAGE_TARGET_REQUIRED")
    source = _get(message, "source", "sender", "agent_id", default="legacy-message-bus")
    kind = _get(message, "message_type", "type", "kind", default="legacy.message")
    identifier = _get(message, "id", "message_id", "event_id")
    return MessageEnvelope(
        source=str(source), target=str(target), message_type=str(kind), payload=dict(payload),
        sequence=sequence,
        idempotency_key=idempotency_key or (str(identifier) if identifier else f"legacy:{sequence}"),
        causation_id=str(identifier) if identifier else None,
        **scope,
    )
@@ -1,611 +0,0 @@
 """Audited Owner authorization broker for task-scoped writer provisioning.
 The broker closes the bootstrap gap without minting a new general-purpose
 Owner token and without modifying the bearer-token registry. It accepts an
 already-authenticated, explicitly allow-listed Owner principal, records a
 tamper-evident authorization event, and invokes the existing
 AuthorizedTaskWriterProvisioner with a generated authorization reference.
 The broker never writes Git refs itself. The governed signer, validator and
 one-shot provisioner remain the only components allowed to create the task
 branch/worktree/writer.
 """
 from __future__ import annotations
 import fcntl
 import hashlib
 import json
 import os
 import re
 import tempfile
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Mapping, Protocol
 from authorized_task_writer_provisioning import (
    AuthorizedTaskWriterProvisioner,
    BRANCH_RE,
    OID_RE,
    OwnerContext,
    ProvisioningError,
    REQUIRED_ALLOWED_OPERATIONS,
    REQUIRED_DENIED_OPERATIONS,
    TASK_RE,
 )
 ACTION = "AUTHORIZE_TASK_WRITER_PROVISIONING"
 SCHEMA = "aios.owner-authorization-event.v1"
 BROKER_REQUEST_FIELDS = frozenset(
    {
        "action",
        "task_id",
        "repository",
        "base_ref",
        "base_oid",
        "target_branch",
        "one_time_use",
        "expires_in_seconds",
        "production_change_authorized",
        "tag_change_authorized",
        "baseline_change_authorized",
        "main_write_authorized",
        "allowed_operations",
        "denied_operations",
    }
 )
 IDENTITY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._@:+/-]{1,254}$")
 SCOPE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$")
 CREDENTIAL_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:@+-]{1,255}$")
 WILDCARD_SCOPE_RE = re.compile(r"(^\*$)|(^.+:\*$)")
 class OwnerAuthorizationError(RuntimeError):
    """Stable fail-closed broker error."""
    def __init__(
        self,
        code: str,
        status: int = 400,
        *,
        details: Mapping[str, Any] | None = None,
    ) -> None:
        super().__init__(code)
        self.code = code
        self.status = status
        self.details = dict(details or {})
@dataclass(frozen=True)
 class OwnerPrincipal:
    """Non-secret authentication evidence returned by the existing API."""
    identity: str
    role: str
    authenticated_scope: str
    token_scopes: frozenset[str]
    credential_id: str = ""
@dataclass(frozen=True)
 class OwnerAuthorizationBrokerConfig:
    repository_identity: str
    state_root: Path
    allowed_owner_identities: frozenset[str]
    allowed_intake_scopes: frozenset[str]
    allowed_credential_ids: frozenset[str] = frozenset()
    max_expiry_seconds: int = 900
    @classmethod
    def from_environment(cls) -> "OwnerAuthorizationBrokerConfig":
        identities = _csv_set(
            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES", "")
        )
        scopes = _csv_set(
            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES", "")
        )
        credential_ids = _csv_set(
            os.getenv("AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS", "")
        )
        if not identities:
            raise OwnerAuthorizationError(
                "OWNER_IDENTITY_ALLOWLIST_REQUIRED", 503
            )
        if not scopes:
            raise OwnerAuthorizationError(
                "OWNER_INTAKE_SCOPE_ALLOWLIST_REQUIRED", 503
            )
        if any(_is_wildcard_scope(item) for item in scopes):
            raise OwnerAuthorizationError(
                "WILDCARD_INTAKE_SCOPE_REJECTED", 503
            )
        if "writer:provision" in scopes:
            raise OwnerAuthorizationError(
                "WRITER_PROVISION_SCOPE_BOOTSTRAP_REJECTED", 503
            )
        try:
            maximum = int(
                os.getenv(
                    "AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS", "900"
                )
            )
        except ValueError:
            raise OwnerAuthorizationError(
                "BROKER_MAX_EXPIRY_INVALID", 503
            ) from None
        if maximum < 60 or maximum > 1800:
            raise OwnerAuthorizationError("BROKER_MAX_EXPIRY_INVALID", 503)
        return cls(
            repository_identity=os.getenv(
                "AIOS_GITOPS_REPOSITORY_IDENTITY", "aios/aios"
            ).strip(),
            state_root=Path(
                os.getenv(
                    "AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT",
                    "/var/lib/aios-gitops/owner-authorization-broker",
                )
            ),
            allowed_owner_identities=identities,
            allowed_intake_scopes=scopes,
            allowed_credential_ids=credential_ids,
            max_expiry_seconds=maximum,
        )
 class TaskWriterProvisioner(Protocol):
    def provision(
        self, raw: Mapping[str, Any], owner: OwnerContext
    ) -> dict[str, Any]:
        ...
 def utc_now() -> datetime:
    return datetime.now(timezone.utc)
 def iso_utc(value: datetime) -> str:
    return value.astimezone(timezone.utc).isoformat().replace("+00:00", "Z")
 def canonical_json_bytes(value: Any) -> bytes:
    return (
        json.dumps(
            value,
            ensure_ascii=False,
            sort_keys=True,
            separators=(",", ":"),
        )
        + "\n"
    ).encode("utf-8")
 def sha256_json(value: Any) -> str:
    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
 def _csv_set(value: str) -> frozenset[str]:
    return frozenset(
        item.strip() for item in value.split(",") if item.strip()
    )
 def _is_wildcard_scope(scope: str) -> bool:
    return bool(WILDCARD_SCOPE_RE.fullmatch(scope.strip()))
 def _atomic_write_json(path: Path, value: Any, mode: int = 0o600) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    if path.parent.is_symlink() or path.is_symlink():
        raise OwnerAuthorizationError("BROKER_STATE_SYMLINK_REJECTED", 500)
    fd, temporary = tempfile.mkstemp(prefix=".tmp-", dir=path.parent)
    try:
        os.fchmod(fd, mode)
        with os.fdopen(fd, "wb", closefd=True) as stream:
            stream.write(canonical_json_bytes(value))
            stream.flush()
            os.fsync(stream.fileno())
        os.replace(temporary, path)
        os.chmod(path, mode)
        parent_fd = os.open(
            path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
        )
        try:
            os.fsync(parent_fd)
        finally:
            os.close(parent_fd)
    finally:
        if os.path.exists(temporary):
            os.unlink(temporary)
 def _read_json(path: Path) -> dict[str, Any]:
    if path.is_symlink() or not path.is_file():
        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
    if path.stat().st_size <= 0 or path.stat().st_size > 1_048_576:
        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (UnicodeDecodeError, json.JSONDecodeError):
        raise OwnerAuthorizationError(
            "BROKER_RECEIPT_JSON_INVALID", 500
        ) from None
    if not isinstance(value, dict):
        raise OwnerAuthorizationError("BROKER_RECEIPT_INVALID", 500)
    return value
 def _prepare_state_root(root: Path) -> None:
    if root.is_symlink():
        raise OwnerAuthorizationError("BROKER_STATE_SYMLINK_REJECTED", 500)
    root.mkdir(parents=True, exist_ok=True, mode=0o700)
    os.chmod(root, 0o700)
    if root.stat().st_mode & 0o077:
        raise OwnerAuthorizationError(
            "BROKER_STATE_PERMISSIONS_REJECTED", 500
        )
 def _event_id(
    principal: OwnerPrincipal, request_digest: str
 ) -> str:
    material = (
        f"{principal.identity}\0{principal.authenticated_scope}\0"
        f"{request_digest}"
    ).encode("utf-8")
    return "owner-auth-" + hashlib.sha256(material).hexdigest()[:32]
 def _authorization_reference(event_id: str, request_digest: str) -> str:
    return f"owner-auth:{event_id}:{request_digest[:16]}"
 def _validate_principal(
    principal: OwnerPrincipal,
    config: OwnerAuthorizationBrokerConfig,
 ) -> None:
    if principal.role != "owner":
        raise OwnerAuthorizationError("OWNER_ROLE_REQUIRED", 403)
    if (
        not principal.identity
        or not IDENTITY_RE.fullmatch(principal.identity)
        or principal.identity not in config.allowed_owner_identities
    ):
        raise OwnerAuthorizationError("OWNER_IDENTITY_NOT_ALLOWED", 403)
    if (
        not principal.authenticated_scope
        or not SCOPE_RE.fullmatch(principal.authenticated_scope)
        or principal.authenticated_scope
        not in config.allowed_intake_scopes
    ):
        raise OwnerAuthorizationError("OWNER_INTAKE_SCOPE_REJECTED", 403)
    if principal.authenticated_scope == "writer:provision":
        raise OwnerAuthorizationError(
            "WRITER_PROVISION_SCOPE_BOOTSTRAP_REJECTED", 403
        )
    scopes = principal.token_scopes
    if any(_is_wildcard_scope(scope) for scope in scopes):
        raise OwnerAuthorizationError(
            "WILDCARD_OWNER_CREDENTIAL_REJECTED", 403
        )
    if scopes:
        if principal.authenticated_scope not in scopes:
            raise OwnerAuthorizationError(
                "OWNER_SCOPE_EVIDENCE_MISMATCH", 403
            )
    elif (
        not principal.credential_id
        or principal.credential_id not in config.allowed_credential_ids
    ):
        # handler.need(scope) proves authorization but may hide whether the
        # credential was wildcard. When scope metadata is absent, require an
        # exact non-secret credential ID allowlist as the alternative proof.
        raise OwnerAuthorizationError(
            "OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE", 403
        )
    if principal.credential_id:
        if not CREDENTIAL_ID_RE.fullmatch(principal.credential_id):
            raise OwnerAuthorizationError("OWNER_CREDENTIAL_ID_INVALID", 403)
        if (
            config.allowed_credential_ids
            and principal.credential_id not in config.allowed_credential_ids
        ):
            raise OwnerAuthorizationError(
                "OWNER_CREDENTIAL_ID_NOT_ALLOWED", 403
            )
 def _validate_request(
    raw: Mapping[str, Any],
    config: OwnerAuthorizationBrokerConfig,
 ) -> dict[str, Any]:
    if set(raw) != BROKER_REQUEST_FIELDS:
        raise OwnerAuthorizationError("BROKER_REQUEST_FIELDS_REJECTED")
    if raw["action"] != ACTION:
        raise OwnerAuthorizationError("BROKER_ACTION_REJECTED")
    if raw["repository"] != config.repository_identity:
        raise OwnerAuthorizationError(
            "REPOSITORY_IDENTITY_MISMATCH", 409
        )
    if raw["base_ref"] != "refs/heads/main":
        raise OwnerAuthorizationError("BASE_REF_REJECTED", 409)
    if (
        not isinstance(raw["base_oid"], str)
        or not OID_RE.fullmatch(raw["base_oid"])
    ):
        raise OwnerAuthorizationError("BASE_OID_REJECTED")
    if (
        not isinstance(raw["target_branch"], str)
        or not BRANCH_RE.fullmatch(raw["target_branch"])
        or raw["target_branch"] in {"main", "master"}
    ):
        raise OwnerAuthorizationError("TARGET_BRANCH_REJECTED")
    if (
        not isinstance(raw["task_id"], str)
        or not TASK_RE.fullmatch(raw["task_id"])
    ):
        raise OwnerAuthorizationError("TASK_ID_REJECTED")
    if raw["one_time_use"] is not True:
        raise OwnerAuthorizationError("ONE_TIME_USE_REQUIRED")
    expiry = raw["expires_in_seconds"]
    if (
        not isinstance(expiry, int)
        or isinstance(expiry, bool)
        or not 60 <= expiry <= config.max_expiry_seconds
    ):
        raise OwnerAuthorizationError("GRANT_LIFETIME_REJECTED")
    for field in (
        "production_change_authorized",
        "tag_change_authorized",
        "baseline_change_authorized",
        "main_write_authorized",
    ):
        if raw[field] is not False:
            raise OwnerAuthorizationError(
                "PRODUCTION_CAPABILITY_REJECTED", 403
            )
    allowed = raw["allowed_operations"]
    denied = raw["denied_operations"]
    if (
        not isinstance(allowed, list)
        or frozenset(allowed) != REQUIRED_ALLOWED_OPERATIONS
    ):
        raise OwnerAuthorizationError("ALLOWED_OPERATIONS_MISMATCH", 403)
    if (
        not isinstance(denied, list)
        or frozenset(denied) != REQUIRED_DENIED_OPERATIONS
    ):
        raise OwnerAuthorizationError("DENIED_OPERATIONS_MISMATCH", 403)
    return dict(raw)
 def _response_is_safe(value: Any) -> bool:
    """Reject accidental credential material before writing a receipt."""
    sensitive_markers = (
        "access_token",
        "bearer",
        "client_secret",
        "private_key",
        "raw_token",
        "secret_value",
    )
    if isinstance(value, Mapping):
        for key, inner in value.items():
            lowered = str(key).lower()
            if any(marker in lowered for marker in sensitive_markers):
                return False
            if not _response_is_safe(inner):
                return False
    elif isinstance(value, list):
        return all(_response_is_safe(item) for item in value)
    return True
 class OwnerAuthorizationBroker:
    """Create an audited Owner event and invoke the governed bridge."""
    def __init__(
        self,
        config: OwnerAuthorizationBrokerConfig | None = None,
        provisioner: TaskWriterProvisioner | None = None,
    ) -> None:
        self.config = (
            config or OwnerAuthorizationBrokerConfig.from_environment()
        )
        self.provisioner = provisioner or AuthorizedTaskWriterProvisioner()
    def authorize_and_provision(
        self,
        raw: Mapping[str, Any],
        principal: OwnerPrincipal,
    ) -> dict[str, Any]:
        config = self.config
        _validate_principal(principal, config)
        request = _validate_request(raw, config)
        _prepare_state_root(config.state_root)
        request_digest = sha256_json(request)
        event_id = _event_id(principal, request_digest)
        reference = _authorization_reference(event_id, request_digest)
        event_dir = config.state_root / "events" / event_id
        event_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
        os.chmod(event_dir, 0o700)
        lock_path = event_dir / "event.lock"
        lock_path.touch(mode=0o600, exist_ok=True)
        os.chmod(lock_path, 0o600)
        with lock_path.open("r+b") as lock:
            fcntl.flock(lock.fileno(), fcntl.LOCK_EX)
            response_path = event_dir / "response.json"
            event_path = event_dir / "event.json"
            if response_path.exists():
                response = _read_json(response_path)
                response["owner_authorization_idempotent"] = True
                return response
            issued_at = utc_now()
            expires_at = issued_at + timedelta(
                seconds=int(request["expires_in_seconds"])
            )
            event: dict[str, Any] = {
                "schema": SCHEMA,
                "event_id": event_id,
                "authorization_reference": reference,
                "status": "AUTHORIZED",
                "owner": {
                    "identity": principal.identity,
                    "role": principal.role,
                    "authenticated_scope": principal.authenticated_scope,
                    "credential_id": principal.credential_id or None,
                    "token_scope_digest_sha256": sha256_json(
                        sorted(principal.token_scopes)
                    ),
                    "wildcard_scope_used": False,
                },
                "request": {
                    "task_id": request["task_id"],
                    "repository": request["repository"],
                    "base_ref": request["base_ref"],
                    "base_oid": request["base_oid"],
                    "target_branch": request["target_branch"],
                    "one_time_use": True,
                    "production_change_authorized": False,
                    "tag_change_authorized": False,
                    "baseline_change_authorized": False,
                    "main_write_authorized": False,
                    "allowed_operations": sorted(
                        REQUIRED_ALLOWED_OPERATIONS
                    ),
                    "denied_operations": sorted(
                        REQUIRED_DENIED_OPERATIONS
                    ),
                },
                "request_digest_sha256": request_digest,
                "issued_at": iso_utc(issued_at),
                "expires_at": iso_utc(expires_at),
            }
            event["event_digest_sha256"] = sha256_json(event)
            _atomic_write_json(event_path, event)
            bridge_request = dict(request)
            bridge_request.pop("action")
            bridge_request["owner_authorization_reference"] = reference
            try:
                result = self.provisioner.provision(
                    bridge_request,
                    OwnerContext(
                        identity=principal.identity,
                        role=principal.role,
                        authorization_reference=reference,
                    ),
                )
                if not isinstance(result, dict):
                    raise OwnerAuthorizationError(
                        "PROVISIONER_RESPONSE_INVALID", 502
                    )
                if result.get("status") != "READY_FOR_CODE_AUTHORING":
                    raise OwnerAuthorizationError(
                        "PROVISIONER_NOT_READY",
                        409,
                        details={"status": result.get("status")},
                    )
                if not _response_is_safe(result):
                    raise OwnerAuthorizationError(
                        "PROVISIONER_RESPONSE_CONTAINS_SENSITIVE_DATA", 500
                    )
            except ProvisioningError as exc:
                event.update(
                    {
                        "status": "PROVISIONING_BLOCKED",
                        "failed_at": iso_utc(utc_now()),
                        "error": exc.code,
                        "error_status": exc.status,
                    }
                )
                event["event_digest_sha256"] = sha256_json(
                    {
                        key: value
                        for key, value in event.items()
                        if key != "event_digest_sha256"
                    }
                )
                _atomic_write_json(event_path, event)
                raise
            except OwnerAuthorizationError as exc:
                event.update(
                    {
                        "status": "PROVISIONING_BLOCKED",
                        "failed_at": iso_utc(utc_now()),
                        "error": exc.code,
                        "error_status": exc.status,
                    }
                )
                event["event_digest_sha256"] = sha256_json(
                    {
                        key: value
                        for key, value in event.items()
                        if key != "event_digest_sha256"
                    }
                )
                _atomic_write_json(event_path, event)
                raise
            except Exception as exc:
                event.update(
                    {
                        "status": "PROVISIONING_FAILED",
                        "failed_at": iso_utc(utc_now()),
                        "error": "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR",
                    }
                )
                event["event_digest_sha256"] = sha256_json(
                    {
                        key: value
                        for key, value in event.items()
                        if key != "event_digest_sha256"
                    }
                )
                _atomic_write_json(event_path, event)
                raise OwnerAuthorizationError(
                    "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR", 500
                ) from exc
            completed_at = utc_now()
            event.update(
                {
                    "status": "CONSUMED",
                    "consumed_at": iso_utc(completed_at),
                    "approval_plan_id": result.get("approval_plan_id"),
                    "grant_id": result.get("grant_id"),
                    "grant_digest_sha256": result.get(
                        "grant_digest_sha256"
                    ),
                    "branch_oid": result.get("branch_oid"),
                    "grant_consumed": result.get("grant_consumed") is True,
                }
            )
            event["event_digest_sha256"] = sha256_json(
                {
                    key: value
                    for key, value in event.items()
                    if key != "event_digest_sha256"
                }
            )
            _atomic_write_json(event_path, event)
            response = dict(result)
            response.update(
                {
                    "owner_authorization_event_id": event_id,
                    "owner_authorization_reference": reference,
                    "owner_authorization_digest_sha256": event[
                        "event_digest_sha256"
                    ],
                    "owner_authorization_consumed": True,
                    "owner_authorization_idempotent": False,
                }
            )
            _atomic_write_json(response_path, response)
            return response
@@ -1,642 +0,0 @@
 #!/usr/bin/env python3
 """One-shot local Owner authentication ingress for AIOS.
 This module deliberately does not mint a reusable Owner token.
 Authentication is based on a real local login session:
 - a root-run one-shot server owns a Unix socket;
 - the client must run as the configured Owner OS account;
 - the server validates SO_PEERCRED, Linux audit loginuid and the controlling TTY;
 - the Owner must interactively confirm the exact task/branch/base request;
 - the server constructs a narrow OwnerPrincipal and invokes the existing
  OwnerAuthorizationBroker;
 - one successful authorization consumes the service lifetime.
 The resulting principal is fixed to one non-wildcard intake scope
 (`commit:create` for the current deployment) and cannot carry production,
 tag, baseline, main or history-rewrite capability.
 This is a trust-root ingress, not a Git writer and not a production executor.
 """
 from __future__ import annotations
 import argparse
 import fcntl
 import hashlib
 import json
 import os
 from pathlib import Path
 import pwd
 import re
 import secrets
 import socket
 import stat
 import struct
 import sys
 import tempfile
 import time
 from typing import Any, Mapping
 BINDING_SCHEMA = "aios.local-owner-auth-ingress.v1"
 CLIENT_BEGIN_SCHEMA = "aios.local-owner-auth-client-begin.v1"
 CHALLENGE_SCHEMA = "aios.local-owner-auth-challenge.v1"
 CLIENT_CONFIRM_SCHEMA = "aios.local-owner-auth-client-confirm.v1"
 RESULT_SCHEMA = "aios.local-owner-auth-result.v1"
 ACTION = "AUTHORIZE_TASK_WRITER_PROVISIONING"
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 IDENTITY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._@:+/-]{1,254}$")
 SCOPE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,127}$")
 TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{1,255}$")
 BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9._/-]{1,220}$")
 MAX_FRAME = 64 * 1024
 CHALLENGE_TTL_SECONDS = 120
 EXPECTED_ALLOWED_OPERATIONS = frozenset(
    {
        "create_worktree",
        "create_target_branch_if_absent",
        "commit_to_target_branch",
        "push_target_branch",
    }
 )
 EXPECTED_DENIED_OPERATIONS = frozenset(
    {
        "direct_main_push",
        "force_push",
        "tag_create",
        "tag_update",
        "tag_delete",
        "branch_delete",
        "repository_admin",
        "baseline_write",
        "production_deploy",
        "production_marker_write",
        "history_rewrite",
    }
 )
 SENSITIVE_FRAGMENTS = (
    "authorization_header",
    "bearer",
    "client_secret",
    "password",
    "private_key",
    "raw_secret",
    "raw_token",
    "secret_value",
 )
 class BootstrapError(RuntimeError):
    def __init__(self, code: str, status: int = 1) -> None:
        super().__init__(code)
        self.code = code
        self.status = status
 def canonical_json(value: Any) -> bytes:
    return (
        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
        + "\n"
    ).encode("utf-8")
 def sha256_json(value: Any) -> str:
    return hashlib.sha256(canonical_json(value)).hexdigest()
 def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o600) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    if path.parent.is_symlink() or path.is_symlink():
        raise BootstrapError("STATE_SYMLINK_REJECTED")
    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
    try:
        os.fchmod(fd, mode)
        with os.fdopen(fd, "wb", closefd=True) as stream:
            stream.write(canonical_json(dict(value)))
            stream.flush()
            os.fsync(stream.fileno())
        os.replace(name, path)
        os.chmod(path, mode)
        dfd = os.open(path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
        try:
            os.fsync(dfd)
        finally:
            os.close(dfd)
    finally:
        try:
            os.unlink(name)
        except FileNotFoundError:
            pass
 def secure_root_file(path: Path) -> dict[str, Any]:
    if path.is_symlink() or not path.is_file():
        raise BootstrapError("BINDING_FILE_INVALID")
    st = path.lstat()
    if st.st_uid != 0:
        raise BootstrapError("BINDING_FILE_ROOT_OWNER_REQUIRED")
    if stat.S_IMODE(st.st_mode) & 0o077:
        raise BootstrapError("BINDING_FILE_PERMISSIONS_INVALID")
    if st.st_size <= 0 or st.st_size > 1_048_576:
        raise BootstrapError("BINDING_FILE_SIZE_INVALID")
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
        raise BootstrapError("BINDING_JSON_INVALID") from exc
    if not isinstance(value, dict):
        raise BootstrapError("BINDING_JSON_INVALID")
    return value
 def validate_binding(value: Mapping[str, Any]) -> dict[str, Any]:
    if set(value) != {
        "schema",
        "owner_identity",
        "owner_role",
        "authenticated_scope",
        "request",
    }:
        raise BootstrapError("BINDING_FIELDS_REJECTED")
    if value["schema"] != BINDING_SCHEMA:
        raise BootstrapError("BINDING_SCHEMA_REJECTED")
    identity = value["owner_identity"]
    if not isinstance(identity, str) or not IDENTITY_RE.fullmatch(identity):
        raise BootstrapError("OWNER_IDENTITY_INVALID")
    if value["owner_role"] != "owner":
        raise BootstrapError("OWNER_ROLE_INVALID")
    scope = value["authenticated_scope"]
    if (
        not isinstance(scope, str)
        or not SCOPE_RE.fullmatch(scope)
        or scope == "writer:provision"
        or scope == "*"
        or scope.endswith(":*")
    ):
        raise BootstrapError("OWNER_SCOPE_INVALID")
    request = value["request"]
    if not isinstance(request, dict):
        raise BootstrapError("REQUEST_INVALID")
    expected_fields = {
        "action",
        "task_id",
        "repository",
        "base_ref",
        "base_oid",
        "target_branch",
        "one_time_use",
        "expires_in_seconds",
        "production_change_authorized",
        "tag_change_authorized",
        "baseline_change_authorized",
        "main_write_authorized",
        "allowed_operations",
        "denied_operations",
    }
    if set(request) != expected_fields:
        raise BootstrapError("REQUEST_FIELDS_REJECTED")
    if request["action"] != ACTION:
        raise BootstrapError("REQUEST_ACTION_REJECTED")
    if request["repository"] != "aios/aios":
        raise BootstrapError("REPOSITORY_REJECTED")
    if request["base_ref"] != "refs/heads/main":
        raise BootstrapError("BASE_REF_REJECTED")
    if not isinstance(request["base_oid"], str) or not OID_RE.fullmatch(request["base_oid"]):
        raise BootstrapError("BASE_OID_REJECTED")
    if (
        not isinstance(request["target_branch"], str)
        or not BRANCH_RE.fullmatch(request["target_branch"])
    ):
        raise BootstrapError("TARGET_BRANCH_REJECTED")
    if (
        not isinstance(request["task_id"], str)
        or not TASK_RE.fullmatch(request["task_id"])
    ):
        raise BootstrapError("TASK_ID_REJECTED")
    if request["one_time_use"] is not True:
        raise BootstrapError("ONE_TIME_USE_REQUIRED")
    expiry = request["expires_in_seconds"]
    if (
        not isinstance(expiry, int)
        or isinstance(expiry, bool)
        or not 60 <= expiry <= 900
    ):
        raise BootstrapError("EXPIRY_REJECTED")
    for field in (
        "production_change_authorized",
        "tag_change_authorized",
        "baseline_change_authorized",
        "main_write_authorized",
    ):
        if request[field] is not False:
            raise BootstrapError("CONSEQUENTIAL_CAPABILITY_REJECTED")
    if (
        not isinstance(request["allowed_operations"], list)
        or frozenset(request["allowed_operations"]) != EXPECTED_ALLOWED_OPERATIONS
    ):
        raise BootstrapError("ALLOWED_OPERATIONS_MISMATCH")
    if (
        not isinstance(request["denied_operations"], list)
        or frozenset(request["denied_operations"]) != EXPECTED_DENIED_OPERATIONS
    ):
        raise BootstrapError("DENIED_OPERATIONS_MISMATCH")
    return {
        "schema": BINDING_SCHEMA,
        "owner_identity": identity,
        "owner_role": "owner",
        "authenticated_scope": scope,
        "request": dict(request),
    }
 def _status_uids(pid: int) -> tuple[int, int, int, int]:
    try:
        lines = Path(f"/proc/{pid}/status").read_text(encoding="utf-8").splitlines()
    except OSError as exc:
        raise BootstrapError("PEER_STATUS_UNAVAILABLE") from exc
    for line in lines:
        if line.startswith("Uid:"):
            fields = line.split()[1:]
            if len(fields) != 4:
                break
            return tuple(int(item) for item in fields)  # type: ignore[return-value]
    raise BootstrapError("PEER_UID_STATUS_INVALID")
 def _loginuid(pid: int) -> int:
    try:
        raw = Path(f"/proc/{pid}/loginuid").read_text(encoding="ascii").strip()
        value = int(raw)
    except (OSError, ValueError) as exc:
        raise BootstrapError("PEER_LOGINUID_UNAVAILABLE") from exc
    if value == 4294967295:
        raise BootstrapError("PEER_LOGIN_SESSION_REQUIRED")
    return value
 def _tty_path(pid: int) -> Path:
    try:
        value = os.readlink(f"/proc/{pid}/fd/0")
    except OSError as exc:
        raise BootstrapError("PEER_INTERACTIVE_TTY_REQUIRED") from exc
    if not (value.startswith("/dev/pts/") or value.startswith("/dev/tty")):
        raise BootstrapError("PEER_INTERACTIVE_TTY_REQUIRED")
    path = Path(value)
    try:
        if not stat.S_ISCHR(path.stat().st_mode):
            raise BootstrapError("PEER_INTERACTIVE_TTY_REQUIRED")
    except OSError as exc:
        raise BootstrapError("PEER_INTERACTIVE_TTY_REQUIRED") from exc
    return path
 def verify_peer_session(pid: int, uid: int, gid: int, owner_identity: str) -> dict[str, Any]:
    try:
        owner = pwd.getpwnam(owner_identity)
    except KeyError as exc:
        raise BootstrapError("OWNER_OS_ACCOUNT_MISSING") from exc
    if uid != owner.pw_uid:
        raise BootstrapError("PEER_OWNER_UID_MISMATCH")
    uids = _status_uids(pid)
    if any(item != owner.pw_uid for item in uids):
        raise BootstrapError("PEER_UID_TRANSITION_REJECTED")
    loginuid = _loginuid(pid)
    if loginuid != owner.pw_uid:
        # This deliberately rejects sudo/runuser from another authenticated
        # account; the session itself must have logged in as the Owner.
        raise BootstrapError("PEER_LOGINUID_OWNER_MISMATCH")
    tty = _tty_path(pid)
    if tty.stat().st_uid != owner.pw_uid:
        raise BootstrapError("PEER_TTY_OWNER_MISMATCH")
    return {
        "pid": pid,
        "uid": uid,
        "gid": gid,
        "loginuid": loginuid,
        "tty": str(tty),
        "owner_identity": owner_identity,
    }
 def read_frame(connection: socket.socket) -> dict[str, Any]:
    data = bytearray()
    while len(data) <= MAX_FRAME:
        block = connection.recv(4096)
        if not block:
            break
        data.extend(block)
        if b"\n" in block:
            break
    if not data or len(data) > MAX_FRAME:
        raise BootstrapError("PROTOCOL_FRAME_INVALID")
    raw = bytes(data).split(b"\n", 1)[0]
    try:
        value = json.loads(raw)
    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
        raise BootstrapError("PROTOCOL_JSON_INVALID") from exc
    if not isinstance(value, dict):
        raise BootstrapError("PROTOCOL_JSON_INVALID")
    return value
 def write_frame(connection: socket.socket, value: Mapping[str, Any]) -> None:
    connection.sendall(canonical_json(dict(value)))
 def safe_result(value: Mapping[str, Any]) -> dict[str, Any]:
    for key in value:
        lowered = str(key).lower()
        if any(fragment in lowered for fragment in SENSITIVE_FRAGMENTS):
            raise BootstrapError("BROKER_RESPONSE_SENSITIVE_DATA_REJECTED")
    allowed = {
        "status",
        "approval_plan_id",
        "grant_id",
        "grant_digest_sha256",
        "branch_oid",
        "branch_ref_created",
        "grant_consumed",
        "owner_authorization_event_id",
        "owner_authorization_reference",
        "owner_authorization_digest_sha256",
        "owner_authorization_consumed",
        "owner_authorization_idempotent",
    }
    return {key: value.get(key) for key in sorted(allowed) if key in value}
 def request_summary(binding: Mapping[str, Any]) -> dict[str, Any]:
    request = binding["request"]
    return {
        "owner_identity": binding["owner_identity"],
        "authenticated_scope": binding["authenticated_scope"],
        "task_id": request["task_id"],
        "repository": request["repository"],
        "base_ref": request["base_ref"],
        "base_oid": request["base_oid"],
        "target_branch": request["target_branch"],
        "expires_in_seconds": request["expires_in_seconds"],
        "allowed_operations": sorted(request["allowed_operations"]),
        "denied_operations": sorted(request["denied_operations"]),
        "production_change_authorized": False,
        "tag_change_authorized": False,
        "baseline_change_authorized": False,
        "main_write_authorized": False,
    }
 def _ensure_runtime_paths(socket_path: Path, state_root: Path, owner_identity: str) -> None:
    if os.geteuid() != 0:
        raise BootstrapError("SERVER_ROOT_REQUIRED")
    owner = pwd.getpwnam(owner_identity)
    for directory, mode, uid, gid in (
        (socket_path.parent, 0o750, 0, owner.pw_gid),
        (state_root, 0o700, 0, 0),
    ):
        if directory.is_symlink():
            raise BootstrapError("RUNTIME_DIRECTORY_SYMLINK_REJECTED")
        directory.mkdir(parents=True, exist_ok=True)
        os.chown(directory, uid, gid)
        os.chmod(directory, mode)
    if socket_path.exists() or socket_path.is_symlink():
        raise BootstrapError("SOCKET_ALREADY_EXISTS")
 def _lock(path: Path):
    path.parent.mkdir(parents=True, exist_ok=True)
    fd = os.open(path, os.O_RDWR | os.O_CREAT | getattr(os, "O_NOFOLLOW", 0), 0o600)
    os.fchmod(fd, 0o600)
    fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
    return fd
 def invoke_broker(binding: Mapping[str, Any]) -> dict[str, Any]:
    # Import only on the root server side. The bootstrap package does not carry
    # a second broker/provisioner implementation; it reuses current main.
    from owner_authorization_broker import (  # type: ignore
        OwnerAuthorizationBroker,
        OwnerAuthorizationBrokerConfig,
        OwnerPrincipal,
    )
    config = OwnerAuthorizationBrokerConfig.from_environment()
    identity = str(binding["owner_identity"])
    scope = str(binding["authenticated_scope"])
    if identity not in config.allowed_owner_identities:
        raise BootstrapError("OWNER_IDENTITY_NOT_ALLOWED_BY_LIVE_BROKER")
    if scope not in config.allowed_intake_scopes:
        raise BootstrapError("OWNER_SCOPE_NOT_ALLOWED_BY_LIVE_BROKER")
    if config.max_expiry_seconds < int(binding["request"]["expires_in_seconds"]):
        raise BootstrapError("LIVE_BROKER_EXPIRY_TOO_SMALL")
    principal = OwnerPrincipal(
        identity=identity,
        role="owner",
        authenticated_scope=scope,
        token_scopes=frozenset({scope}),
        credential_id="",
    )
    return OwnerAuthorizationBroker(config=config).authorize_and_provision(
        binding["request"], principal
    )
 def serve(binding_path: Path, socket_path: Path, state_root: Path, timeout: int) -> int:
    binding = validate_binding(secure_root_file(binding_path))
    identity = str(binding["owner_identity"])
    _ensure_runtime_paths(socket_path, state_root, identity)
    lock_fd = _lock(state_root / "bootstrap.lock")
    listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    try:
        listener.bind(str(socket_path))
        owner = pwd.getpwnam(identity)
        os.chown(socket_path, 0, owner.pw_gid)
        os.chmod(socket_path, 0o660)
        listener.listen(1)
        listener.settimeout(timeout)
        connection, _ = listener.accept()
        with connection:
            raw_peer = connection.getsockopt(
                socket.SOL_SOCKET, socket.SO_PEERCRED, struct.calcsize("3i")
            )
            pid, uid, gid = struct.unpack("3i", raw_peer)
            session = verify_peer_session(pid, uid, gid, identity)
            begin = read_frame(connection)
            if begin != {"schema": CLIENT_BEGIN_SCHEMA, "action": "BEGIN"}:
                raise BootstrapError("CLIENT_BEGIN_REJECTED")
            challenge = secrets.token_hex(12)
            challenge_issued = time.monotonic()
            summary = request_summary(binding)
            write_frame(
                connection,
                {
                    "schema": CHALLENGE_SCHEMA,
                    "challenge": challenge,
                    "expires_in_seconds": CHALLENGE_TTL_SECONDS,
                    "request_digest_sha256": sha256_json(binding["request"]),
                    "summary": summary,
                },
            )
            confirm = read_frame(connection)
            expected_confirmation = f"AUTHORIZE {challenge}"
            if (
                confirm.get("schema") != CLIENT_CONFIRM_SCHEMA
                or confirm.get("challenge") != challenge
                or confirm.get("confirmation") != expected_confirmation
            ):
                raise BootstrapError("OWNER_INTERACTIVE_CONFIRMATION_REJECTED")
            if time.monotonic() - challenge_issued > CHALLENGE_TTL_SECONDS:
                raise BootstrapError("OWNER_CONFIRMATION_EXPIRED")
            result = safe_result(invoke_broker(binding))
            receipt = {
                "schema": "aios.local-owner-auth-ingress-receipt.v1",
                "status": "CONSUMED",
                "owner_identity": identity,
                "owner_role": "owner",
                "authenticated_scope": binding["authenticated_scope"],
                "peer": session,
                "request_digest_sha256": sha256_json(binding["request"]),
                "binding_digest_sha256": sha256_json(binding),
                "challenge_digest_sha256": hashlib.sha256(
                    challenge.encode("ascii")
                ).hexdigest(),
                "broker": result,
                "completed_at_unix": int(time.time()),
            }
            event_id = str(
                result.get("owner_authorization_event_id")
                or hashlib.sha256(
                    canonical_json(
                        {
                            "peer": session,
                            "request": sha256_json(binding["request"]),
                        }
                    )
                ).hexdigest()[:32]
            )
            atomic_json(state_root / "events" / f"{event_id}.json", receipt)
            write_frame(
                connection,
                {
                    "schema": RESULT_SCHEMA,
                    "ok": True,
                    "result": result,
                },
            )
            return 0
    except (BootstrapError, TimeoutError, socket.timeout) as exc:
        code = exc.code if isinstance(exc, BootstrapError) else "OWNER_BOOTSTRAP_TIMEOUT"
        try:
            if "connection" in locals():
                write_frame(
                    connection,
                    {
                        "schema": RESULT_SCHEMA,
                        "ok": False,
                        "error": code,
                    },
                )
        except Exception:
            pass
        atomic_json(
            state_root / "last-failure.json",
            {
                "schema": "aios.local-owner-auth-ingress-failure.v1",
                "status": "FAILED",
                "error": code,
                "binding_digest_sha256": sha256_json(binding),
                "failed_at_unix": int(time.time()),
            },
        )
        return 2
    finally:
        listener.close()
        try:
            socket_path.unlink()
        except FileNotFoundError:
            pass
        try:
            fcntl.flock(lock_fd, fcntl.LOCK_UN)
        finally:
            os.close(lock_fd)
 def client(socket_path: Path) -> int:
    # The server performs the authoritative peer/session checks. The client
    # also refuses non-interactive execution to make accidental automation hard.
    if not sys.stdin.isatty() or not sys.stdout.isatty():
        raise BootstrapError("CLIENT_INTERACTIVE_TTY_REQUIRED")
    connection = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    connection.connect(str(socket_path))
    with connection:
        write_frame(connection, {"schema": CLIENT_BEGIN_SCHEMA, "action": "BEGIN"})
        challenge = read_frame(connection)
        if challenge.get("schema") != CHALLENGE_SCHEMA:
            raise BootstrapError("CHALLENGE_INVALID")
        summary = challenge.get("summary")
        if not isinstance(summary, dict):
            raise BootstrapError("CHALLENGE_INVALID")
        print("\nAIOS one-shot Owner authorization request:")
        print(json.dumps(summary, indent=2, sort_keys=True))
        print("\nThis authorizes only the task writer shown above.")
        phrase = f"AUTHORIZE {challenge['challenge']}"
        typed = input(f"Type exactly:\n{phrase}\n> ").strip()
        if typed != phrase:
            raise BootstrapError("OWNER_CONFIRMATION_MISMATCH")
        write_frame(
            connection,
            {
                "schema": CLIENT_CONFIRM_SCHEMA,
                "challenge": challenge["challenge"],
                "confirmation": typed,
            },
        )
        result = read_frame(connection)
        print(json.dumps(result, indent=2, sort_keys=True))
        return 0 if result.get("ok") is True else 3
 def parser() -> argparse.ArgumentParser:
    value = argparse.ArgumentParser()
    mode = value.add_mutually_exclusive_group(required=True)
    mode.add_argument("--serve", action="store_true")
    mode.add_argument("--client", action="store_true")
    value.add_argument("--binding", type=Path)
    value.add_argument(
        "--socket",
        type=Path,
        default=Path("/run/aios-owner-bootstrap/owner.sock"),
    )
    value.add_argument(
        "--state-root",
        type=Path,
        default=Path("/var/lib/aios-gitops/owner-local-auth-ingress"),
    )
    value.add_argument("--timeout", type=int, default=300)
    return value
 def main(argv: list[str] | None = None) -> int:
    args = parser().parse_args(argv)
    if args.serve:
        if args.binding is None:
            raise SystemExit("--binding is required with --serve")
        return serve(args.binding, args.socket, args.state_root, args.timeout)
    return client(args.socket)
 if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except BootstrapError as exc:
        print(json.dumps({"status": "BLOCKED", "error": exc.code}), file=sys.stderr)
        raise SystemExit(exc.status)
@@ -1,32 +0,0 @@
 """Read-only release reconciliation and durable follow-up intent."""
 from __future__ import annotations
 from dataclasses import dataclass
 from typing import Any, Mapping
@dataclass(frozen=True)
 class ReconciliationReport:
    healthy: bool
    drift: tuple[str, ...]
    actions: tuple[str, ...]
 class ReconciliationController:
    CHECKS = (
        ("authority_main", "gitea_main", "main_drift"),
        ("local_tag_oid", "remote_tag_oid", "tag_drift"),
        ("remote_peeled_target", "approved_target_oid", "peeled_target_drift"),
        ("registry_version", "baseline_version", "registry_baseline_drift"),
        ("approved_artifact_digest", "deployed_artifact_digest", "artifact_drift"),
        ("declared_production_state", "service_healthy", "service_health_drift"),
    )
    def reconcile(self, actual: Mapping[str, Any]) -> ReconciliationReport:
        drift: list[str] = []
        for left, right, label in self.CHECKS:
            if actual.get(left) != actual.get(right):
                drift.append(label)
        actions = () if not drift else ("open_reconciliation_task", "open_reconciliation_pr", "attach_evidence", "notify_owner")
        return ReconciliationReport(not drift, tuple(drift), actions)
@@ -1,65 +0,0 @@
 """Durable-friendly recurring task scheduling primitives."""
 from __future__ import annotations
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from typing import Any
 class RecurringTaskError(ValueError):
    pass
@dataclass
 class RecurringTask:
    task_id: str
    interval_seconds: int
    next_run_at: datetime
    run_count: int = 0
    max_runs: int | None = None
    cancelled: bool = False
    def due(self, now: datetime) -> bool:
        return not self.cancelled and (self.max_runs is None or self.run_count < self.max_runs) and now >= self.next_run_at
 class RecurringTaskScheduler:
    def __init__(self) -> None:
        self.tasks: dict[str, RecurringTask] = {}
        self.successors: set[str] = set()
    def schedule(self, task_id: str, interval_seconds: int, *, now: datetime | None = None, max_runs: int | None = None) -> RecurringTask:
        if task_id in self.tasks:
            raise RecurringTaskError("task already exists")
        if interval_seconds <= 0 or (max_runs is not None and max_runs <= 0):
            raise RecurringTaskError("invalid recurring task bounds")
        now = now or datetime.now(timezone.utc)
        task = RecurringTask(task_id, interval_seconds, now, 0, max_runs, False)
        self.tasks[task_id] = task
        return task
    def due(self, *, now: datetime | None = None) -> list[RecurringTask]:
        now = now or datetime.now(timezone.utc)
        return [task for task in self.tasks.values() if task.due(now)]
    def mark_run(self, task_id: str, *, now: datetime | None = None) -> RecurringTask:
        task = self.tasks[task_id]
        now = now or datetime.now(timezone.utc)
        if not task.due(now):
            raise RecurringTaskError("task is not due")
        task.run_count += 1
        task.next_run_at = now + timedelta(seconds=task.interval_seconds)
        return task
    def cancel(self, task_id: str) -> None:
        self.tasks[task_id].cancelled = True
    def create_successor_once(self, predecessor: str, successor: str, *, interval_seconds: int, now: datetime | None = None) -> RecurringTask:
        key = f"{predecessor}->{successor}"
        if key in self.successors:
            return self.tasks[successor]
        self.successors.add(key)
        if successor not in self.tasks:
            return self.schedule(successor, interval_seconds, now=now)
        return self.tasks[successor]
@@ -1,225 +0,0 @@
 #!/usr/bin/env python3
 """AIOS durable autonomous release-campaign authorization.
 The campaign receipt represents one explicit Owner policy delegation. It is not
 a reusable Owner credential and it is not an unrestricted Git/production token.
 Normal release operations are allowed only when all machine gates in the
 campaign policy succeed. Formal tag conflicts, non-fast-forward main divergence,
 history rewrite, private-signing-material exposure, repository identity conflict
 or campaign revocation remain fail-closed/manual-review conditions.
 """
 from __future__ import annotations
 from dataclasses import dataclass
 import hashlib
 import json
 import os
 from pathlib import Path
 import re
 import stat
 from typing import Any, Mapping
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 CAMPAIGN_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{3,127}$")
 SCHEMA = "aios.release-campaign-authorization.v1"
 ALLOWED_ENGINEERING = frozenset({
    "create_task_branch",
    "create_worktree",
    "append_commit",
    "push_task_branch",
    "repair_task_branch",
    "create_pr",
    "update_pr",
    "run_required_checks",
    "publish_truthful_status",
    "protected_merge",
 })
 ALLOWED_RECONCILIATION = frozenset({
    "fetch_gitea_main",
    "verify_ancestor",
    "authority_main_ff_cas",
    "refresh_runtime_context",
 })
 ALLOWED_RELEASE = frozenset({
    "deterministic_build",
    "retain_artifact",
    "materialize_approved_artifact",
    "staging_install",
    "health_check",
    "restart_test",
    "rollback_readiness_test",
    "create_evidence_commit",
    "generate_exact_binding",
    "derive_campaign_acceptance",
 })
 ALLOWED_PRODUCTION = frozenset({
    "create_annotated_tag",
    "publish_tag",
    "verify_tag",
    "deploy_exact_artifact",
    "verify_production_health",
    "update_runtime_registry",
    "update_production_baseline",
    "update_baseline_sidecar",
 })
 DENIED = frozenset({
    "force_push",
    "non_fast_forward_main_write",
    "direct_main_push",
    "published_history_rewrite",
    "formal_tag_rewrite",
    "formal_tag_delete",
    "overwrite_conflicting_same_name_tag",
    "expose_private_signing_material",
    "commit_plaintext_secret",
    "repository_identity_change",
    "weaken_branch_protection",
 })
 class CampaignError(RuntimeError):
    pass
 def canonical_json(value: Any) -> bytes:
    return (
        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
        + "\n"
    ).encode("utf-8")
 def sha256_bytes(value: bytes) -> str:
    return hashlib.sha256(value).hexdigest()
 def secure_json(path: Path) -> dict[str, Any]:
    if path.is_symlink() or not path.is_file():
        raise CampaignError(f"invalid_file:{path}")
    st = path.lstat()
    if st.st_uid != 0:
        raise CampaignError(f"root_owner_required:{path}")
    if stat.S_IMODE(st.st_mode) & 0o022:
        raise CampaignError(f"group_world_writable_rejected:{path}")
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
        raise CampaignError(f"invalid_json:{path}") from exc
    if not isinstance(value, dict):
        raise CampaignError(f"json_object_required:{path}")
    return value
 def _exact_set(value: Any, expected: frozenset[str], name: str) -> None:
    if not isinstance(value, list) or frozenset(value) != expected:
        raise CampaignError(f"{name}_mismatch")
 def validate_policy(value: Mapping[str, Any]) -> dict[str, Any]:
    required = {
        "schema",
        "campaign_id",
        "generation",
        "owner_identity",
        "owner_role",
        "repository",
        "lineage_anchor_oid",
        "control_plane_branch",
        "activation_state",
        "active",
        "revoked",
        "valid_until_revoked",
        "allowed_engineering",
        "allowed_reconciliation",
        "allowed_release",
        "allowed_production",
        "denied",
        "normal_owner_interaction_required",
    }
    if set(value) != required:
        raise CampaignError("campaign_fields_invalid")
    if value["schema"] != SCHEMA:
        raise CampaignError("campaign_schema_invalid")
    if not isinstance(value["campaign_id"], str) or not CAMPAIGN_RE.fullmatch(value["campaign_id"]):
        raise CampaignError("campaign_id_invalid")
    if value["generation"] != 1:
        raise CampaignError("campaign_generation_invalid")
    if value["owner_identity"] != "aiman" or value["owner_role"] != "owner":
        raise CampaignError("campaign_owner_invalid")
    if value["repository"] != "aios/aios":
        raise CampaignError("campaign_repository_invalid")
    if not isinstance(value["lineage_anchor_oid"], str) or not OID_RE.fullmatch(value["lineage_anchor_oid"]):
        raise CampaignError("campaign_anchor_invalid")
    branch = value["control_plane_branch"]
    if branch != "agent/autonomous-release-campaign-v1-20260807":
        raise CampaignError("campaign_branch_invalid")
    if value["activation_state"] not in {"PENDING_CONTROL_PLANE_MERGE", "ACTIVE"}:
        raise CampaignError("campaign_activation_state_invalid")
    if value["revoked"] is not False or value["valid_until_revoked"] is not True:
        raise CampaignError("campaign_lifecycle_invalid")
    if value["normal_owner_interaction_required"] is not False:
        raise CampaignError("campaign_owner_interaction_policy_invalid")
    if value["activation_state"] == "ACTIVE" and value["active"] is not True:
        raise CampaignError("campaign_active_state_invalid")
    if value["activation_state"] == "PENDING_CONTROL_PLANE_MERGE" and value["active"] is not False:
        raise CampaignError("campaign_pending_state_invalid")
    _exact_set(value["allowed_engineering"], ALLOWED_ENGINEERING, "allowed_engineering")
    _exact_set(value["allowed_reconciliation"], ALLOWED_RECONCILIATION, "allowed_reconciliation")
    _exact_set(value["allowed_release"], ALLOWED_RELEASE, "allowed_release")
    _exact_set(value["allowed_production"], ALLOWED_PRODUCTION, "allowed_production")
    _exact_set(value["denied"], DENIED, "denied")
    return dict(value)
@dataclass(frozen=True)
 class CampaignAuthorization:
    path: Path
    data: dict[str, Any]
    digest: str
    @classmethod
    def load(
        cls,
        path: Path,
        *,
        sidecar: Path | None = None,
        revocation: Path | None = None,
        require_active: bool = True,
    ) -> "CampaignAuthorization":
        data = validate_policy(secure_json(path))
        raw = path.read_bytes()
        digest = sha256_bytes(raw)
        sidecar = sidecar or path.with_suffix(path.suffix + ".sha256")
        if not sidecar.is_file() or sidecar.is_symlink():
            raise CampaignError("campaign_digest_sidecar_missing")
        token = sidecar.read_text(encoding="ascii").strip().split()[0]
        if token != digest:
            raise CampaignError("campaign_digest_sidecar_mismatch")
        if revocation and revocation.exists():
            revoked = secure_json(revocation)
            if revoked.get("campaign_id") == data["campaign_id"] and revoked.get("revoked") is True:
                raise CampaignError("campaign_revoked")
        if require_active and (data["activation_state"] != "ACTIVE" or data["active"] is not True):
            raise CampaignError("campaign_not_active")
        return cls(path=path, data=data, digest=digest)
    @property
    def campaign_id(self) -> str:
        return str(self.data["campaign_id"])
    @property
    def anchor_oid(self) -> str:
        return str(self.data["lineage_anchor_oid"])
    def assert_operation(self, operation: str) -> None:
        if operation in DENIED:
            raise CampaignError(f"campaign_operation_denied:{operation}")
        universe = (
            ALLOWED_ENGINEERING
            | ALLOWED_RECONCILIATION
            | ALLOWED_RELEASE
            | ALLOWED_PRODUCTION
        )
        if operation not in universe:
            raise CampaignError(f"campaign_operation_out_of_scope:{operation}")
@@ -1,427 +0,0 @@
 #!/usr/bin/env python3
 """One-interaction bootstrap for the AIOS autonomous release campaign.
 A single real local `aiman` login confirmation does two things atomically at the
 policy layer:
 1. Writes a root-owned, digest-sidecar protected campaign authorization receipt
   in PENDING_CONTROL_PLANE_MERGE state. It grants no immediate production side
   effect; the campaign becomes ACTIVE only after the campaign control-plane PR
   is merged and machine activation verifies lineage and implementation.
 2. Invokes the existing OwnerAuthorizationBroker to issue only the narrow
   engineering writer needed to implement that control-plane PR.
 No reusable Owner token is minted.
 """
 from __future__ import annotations
 import argparse
 import fcntl
 import hashlib
 import json
 import os
 from pathlib import Path
 import secrets
 import socket
 import struct
 import tempfile
 import time
 from typing import Any, Mapping
 from owner_local_auth_ingress import (
    BootstrapError,
    canonical_json,
    read_frame,
    verify_peer_session,
    write_frame,
 )
 from release_campaign_authorization import (
    ALLOWED_ENGINEERING,
    ALLOWED_PRODUCTION,
    ALLOWED_RECONCILIATION,
    ALLOWED_RELEASE,
    DENIED,
    SCHEMA,
    validate_policy,
 )
 BEGIN = "aios.release-campaign-bootstrap.begin.v1"
 CHALLENGE = "aios.release-campaign-bootstrap.challenge.v1"
 CONFIRM = "aios.release-campaign-bootstrap.confirm.v1"
 RESULT = "aios.release-campaign-bootstrap.result.v1"
 TASK_ID = "AIOS_AUTONOMOUS_RELEASE_CAMPAIGN_V1"
 TARGET_BRANCH = "agent/autonomous-release-campaign-v1-20260807"
 REPOSITORY = "aios/aios"
 class CampaignBootstrapError(RuntimeError):
    pass
 def sha256_file(path: Path) -> str:
    h = hashlib.sha256()
    with path.open("rb") as stream:
        for block in iter(lambda: stream.read(1024 * 1024), b""):
            h.update(block)
    return h.hexdigest()
 def atomic_json_new(path: Path, value: Mapping[str, Any]) -> None:
    if path.exists() or path.is_symlink():
        raise CampaignBootstrapError(f"target_exists:{path}")
    path.parent.mkdir(parents=True, exist_ok=True)
    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
    try:
        os.fchmod(fd, 0o600)
        if os.geteuid() == 0:
            os.fchown(fd, 0, 0)
        with os.fdopen(fd, "wb", closefd=True) as stream:
            stream.write(canonical_json(dict(value)))
            stream.flush()
            os.fsync(stream.fileno())
        os.replace(name, path)
        os.chmod(path, 0o600)
        dfd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
        try:
            os.fsync(dfd)
        finally:
            os.close(dfd)
    finally:
        try:
            os.unlink(name)
        except FileNotFoundError:
            pass
 def atomic_sidecar(path: Path, digest: str, target_name: str) -> None:
    if path.exists() or path.is_symlink():
        raise CampaignBootstrapError(f"sidecar_exists:{path}")
    path.parent.mkdir(parents=True, exist_ok=True)
    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
    try:
        os.fchmod(fd, 0o600)
        if os.geteuid() == 0:
            os.fchown(fd, 0, 0)
        with os.fdopen(fd, "w", encoding="ascii", closefd=True) as stream:
            stream.write(f"{digest}  {target_name}\n")
            stream.flush()
            os.fsync(stream.fileno())
        os.replace(name, path)
        os.chmod(path, 0o600)
        dfd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
        try:
            os.fsync(dfd)
        finally:
            os.close(dfd)
    finally:
        try:
            os.unlink(name)
        except FileNotFoundError:
            pass
 def writer_request(base_oid: str) -> dict[str, Any]:
    return {
        "action": "AUTHORIZE_TASK_WRITER_PROVISIONING",
        "task_id": TASK_ID,
        "repository": REPOSITORY,
        "base_ref": "refs/heads/main",
        "base_oid": base_oid,
        "target_branch": TARGET_BRANCH,
        "one_time_use": True,
        "expires_in_seconds": 300,
        "production_change_authorized": False,
        "tag_change_authorized": False,
        "baseline_change_authorized": False,
        "main_write_authorized": False,
        "allowed_operations": [
            "create_worktree",
            "create_target_branch_if_absent",
            "commit_to_target_branch",
            "push_target_branch",
        ],
        "denied_operations": [
            "direct_main_push",
            "force_push",
            "tag_create",
            "tag_update",
            "tag_delete",
            "branch_delete",
            "repository_admin",
            "baseline_write",
            "production_deploy",
            "production_marker_write",
            "history_rewrite",
        ],
    }
 def campaign_policy(campaign_id: str, base_oid: str) -> dict[str, Any]:
    value = {
        "schema": SCHEMA,
        "campaign_id": campaign_id,
        "generation": 1,
        "owner_identity": "aiman",
        "owner_role": "owner",
        "repository": REPOSITORY,
        "lineage_anchor_oid": base_oid,
        "control_plane_branch": TARGET_BRANCH,
        "activation_state": "PENDING_CONTROL_PLANE_MERGE",
        "active": False,
        "revoked": False,
        "valid_until_revoked": True,
        "allowed_engineering": sorted(ALLOWED_ENGINEERING),
        "allowed_reconciliation": sorted(ALLOWED_RECONCILIATION),
        "allowed_release": sorted(ALLOWED_RELEASE),
        "allowed_production": sorted(ALLOWED_PRODUCTION),
        "denied": sorted(DENIED),
        "normal_owner_interaction_required": False,
    }
    return validate_policy(value)
 def invoke_writer_broker(base_oid: str) -> dict[str, Any]:
    from owner_authorization_broker import (
        OwnerAuthorizationBroker,
        OwnerAuthorizationBrokerConfig,
        OwnerPrincipal,
    )
    config = OwnerAuthorizationBrokerConfig.from_environment()
    if "aiman" not in config.allowed_owner_identities:
        raise CampaignBootstrapError("aiman_not_allowed_by_live_broker")
    if "commit:create" not in config.allowed_intake_scopes:
        raise CampaignBootstrapError("commit_create_not_allowed_by_live_broker")
    principal = OwnerPrincipal(
        identity="aiman",
        role="owner",
        authenticated_scope="commit:create",
        token_scopes=frozenset({"commit:create"}),
        credential_id="",
    )
    return OwnerAuthorizationBroker(config=config).authorize_and_provision(
        writer_request(base_oid),
        principal,
    )
 def safe_broker_result(value: Mapping[str, Any]) -> dict[str, Any]:
    allowed = {
        "status",
        "approval_plan_id",
        "grant_id",
        "grant_digest_sha256",
        "branch_oid",
        "branch_ref_created",
        "grant_consumed",
        "owner_authorization_event_id",
        "owner_authorization_reference",
        "owner_authorization_digest_sha256",
        "owner_authorization_consumed",
        "owner_authorization_idempotent",
    }
    lowered = " ".join(str(k).lower() for k in value)
    for secret_word in ("token", "password", "private_key", "secret_value", "bearer"):
        if secret_word in lowered:
            raise CampaignBootstrapError("broker_response_sensitive_field_rejected")
    return {k: value[k] for k in sorted(allowed) if k in value}
 def serve(
    *,
    socket_path: Path,
    state_root: Path,
    base_oid: str,
    campaign_id: str,
    timeout: int,
 ) -> int:
    if os.geteuid() != 0:
        raise CampaignBootstrapError("server_root_required")
    if len(base_oid) != 40 or any(c not in "0123456789abcdef" for c in base_oid):
        raise CampaignBootstrapError("base_oid_invalid")
    policy = campaign_policy(campaign_id, base_oid)
    campaign_dir = state_root / campaign_id
    campaign_path = campaign_dir / "authorization.json"
    sidecar_path = campaign_dir / "authorization.json.sha256"
    socket_path.parent.mkdir(parents=True, exist_ok=True)
    if socket_path.exists() or socket_path.is_symlink():
        raise CampaignBootstrapError("socket_already_exists")
    import pwd
    owner = pwd.getpwnam("aiman")
    os.chown(socket_path.parent, 0, owner.pw_gid)
    os.chmod(socket_path.parent, 0o750)
    listener = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    try:
        listener.bind(str(socket_path))
        os.chown(socket_path, 0, owner.pw_gid)
        os.chmod(socket_path, 0o660)
        listener.listen(1)
        listener.settimeout(timeout)
        conn, _ = listener.accept()
        with conn:
            raw = conn.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, struct.calcsize("3i"))
            pid, uid, gid = struct.unpack("3i", raw)
            peer = verify_peer_session(pid, uid, gid, "aiman")
            if read_frame(conn) != {"schema": BEGIN, "action": "BEGIN"}:
                raise CampaignBootstrapError("client_begin_invalid")
            challenge = secrets.token_hex(12)
            issued = time.monotonic()
            summary = {
                "campaign_id": campaign_id,
                "repository": REPOSITORY,
                "lineage_anchor_oid": base_oid,
                "control_plane_branch": TARGET_BRANCH,
                "normal_owner_interaction_after_activation": False,
                "allowed_engineering": sorted(ALLOWED_ENGINEERING),
                "allowed_reconciliation": sorted(ALLOWED_RECONCILIATION),
                "allowed_release": sorted(ALLOWED_RELEASE),
                "allowed_production": sorted(ALLOWED_PRODUCTION),
                "denied": sorted(DENIED),
                "writer_request": writer_request(base_oid),
            }
            write_frame(
                conn,
                {
                    "schema": CHALLENGE,
                    "challenge": challenge,
                    "expires_in_seconds": 120,
                    "summary": summary,
                },
            )
            confirm = read_frame(conn)
            phrase = f"AUTHORIZE CAMPAIGN {campaign_id} {challenge}"
            if (
                confirm.get("schema") != CONFIRM
                or confirm.get("challenge") != challenge
                or confirm.get("confirmation") != phrase
            ):
                raise CampaignBootstrapError("campaign_confirmation_invalid")
            if time.monotonic() - issued > 120:
                raise CampaignBootstrapError("campaign_confirmation_expired")
            # First issue the narrow engineering writer. If this fails, do not
            # persist a campaign authorization that cannot be implemented.
            broker = safe_broker_result(invoke_writer_broker(base_oid))
            if broker.get("status") != "READY_FOR_CODE_AUTHORING":
                raise CampaignBootstrapError("writer_not_ready")
            atomic_json_new(campaign_path, policy)
            digest = sha256_file(campaign_path)
            atomic_sidecar(sidecar_path, digest, campaign_path.name)
            receipt = {
                "schema": "aios.release-campaign-bootstrap-receipt.v1",
                "status": "CAMPAIGN_PENDING_CONTROL_PLANE_MERGE",
                "campaign_id": campaign_id,
                "campaign_authorization_path": str(campaign_path),
                "campaign_authorization_sha256": digest,
                "owner_identity": "aiman",
                "owner_role": "owner",
                "authentication": {
                    "method": "local_so_peercred_loginuid_tty",
                    "uid": peer["uid"],
                    "loginuid": peer["loginuid"],
                    "tty": peer["tty"],
                },
                "writer": broker,
                "reusable_owner_token_created": False,
                "production_side_effect_executed": False,
                "completed_at_unix": int(time.time()),
            }
            receipt_path = campaign_dir / "bootstrap-receipt.json"
            atomic_json_new(receipt_path, receipt)
            write_frame(
                conn,
                {
                    "schema": RESULT,
                    "ok": True,
                    "campaign_id": campaign_id,
                    "campaign_authorization_path": str(campaign_path),
                    "campaign_authorization_sha256": digest,
                    "writer": broker,
                },
            )
            return 0
    finally:
        listener.close()
        try:
            socket_path.unlink()
        except FileNotFoundError:
            pass
 def client(socket_path: Path) -> int:
    import sys
    if not sys.stdin.isatty() or not sys.stdout.isatty():
        raise CampaignBootstrapError("interactive_tty_required")
    conn = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
    conn.connect(str(socket_path))
    with conn:
        write_frame(conn, {"schema": BEGIN, "action": "BEGIN"})
        challenge = read_frame(conn)
        if challenge.get("schema") != CHALLENGE:
            raise CampaignBootstrapError("challenge_invalid")
        print("\nAIOS Autonomous Release Campaign authorization")
        print(json.dumps(challenge["summary"], indent=2, sort_keys=True))
        phrase = (
            f"AUTHORIZE CAMPAIGN "
            f"{challenge['summary']['campaign_id']} "
            f"{challenge['challenge']}"
        )
        typed = input(f"\nType exactly:\n{phrase}\n> ").strip()
        if typed != phrase:
            raise CampaignBootstrapError("confirmation_mismatch")
        write_frame(
            conn,
            {
                "schema": CONFIRM,
                "challenge": challenge["challenge"],
                "confirmation": typed,
            },
        )
        result = read_frame(conn)
        print(json.dumps(result, indent=2, sort_keys=True))
        return 0 if result.get("ok") is True else 3
 def main() -> int:
    p = argparse.ArgumentParser()
    mode = p.add_mutually_exclusive_group(required=True)
    mode.add_argument("--serve", action="store_true")
    mode.add_argument("--client", action="store_true")
    p.add_argument("--socket", type=Path, default=Path("/run/aios-release-campaign/owner.sock"))
    p.add_argument(
        "--state-root",
        type=Path,
        default=Path("/var/lib/aios-gitops/release-campaigns"),
    )
    p.add_argument("--base-oid")
    p.add_argument("--campaign-id")
    p.add_argument("--timeout", type=int, default=300)
    a = p.parse_args()
    if a.serve:
        if not a.base_oid or not a.campaign_id:
            raise CampaignBootstrapError("server_binding_required")
        return serve(
            socket_path=a.socket,
            state_root=a.state_root,
            base_oid=a.base_oid,
            campaign_id=a.campaign_id,
            timeout=a.timeout,
        )
    return client(a.socket)
 if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except (CampaignBootstrapError, BootstrapError) as exc:
        print(json.dumps({"status": "BLOCKED", "reason": str(exc)}, sort_keys=True))
        raise SystemExit(2)
@@ -1,113 +0,0 @@
 #!/usr/bin/env python3
 """Durable state model for the AIOS autonomous release campaign."""
 from __future__ import annotations
 from dataclasses import dataclass
 import json
 import os
 from pathlib import Path
 import tempfile
 from typing import Any
 STATES = (
    "DEVELOPMENT",
    "VALIDATING",
    "PR_READY",
    "MERGING",
    "MAIN_RECONCILING",
    "POSTMERGE_BUILDING",
    "STAGING",
    "EVIDENCE_CLOSING",
    "BINDING_ACCEPTING",
    "TAGGING",
    "DEPLOYING",
    "VERIFYING",
    "REGISTRY_FINALIZING",
    "BASELINE_FINALIZING",
    "PRODUCTION_DEPLOYED",
 )
 RECOVERABLE = "RECOVERABLE_FAILURE"
 RECONCILIATION = "RECONCILIATION_REQUIRED"
 MANUAL = "MANUAL_OWNER_REVIEW_REQUIRED"
 NEXT = {STATES[i]: STATES[i + 1] for i in range(len(STATES) - 1)}
 MANUAL_REASONS = frozenset({
    "formal_same_name_tag_conflict",
    "force_push_required",
    "published_history_rewrite_required",
    "non_fast_forward_main_divergence",
    "private_signing_material_exposure_required",
    "repository_identity_conflict",
    "campaign_revoked",
    "operation_outside_campaign_scope",
 })
 class OrchestratorError(RuntimeError):
    pass
@dataclass
 class ReleaseState:
    version: str
    state: str = "DEVELOPMENT"
    last_stable_state: str = "DEVELOPMENT"
    recoverable_reason: str | None = None
    def advance(self) -> None:
        if self.state not in NEXT:
            raise OrchestratorError(f"cannot_advance:{self.state}")
        self.last_stable_state = self.state
        self.state = NEXT[self.state]
        self.recoverable_reason = None
    def recoverable_failure(self, reason: str) -> None:
        self.last_stable_state = self.state
        self.state = RECOVERABLE
        self.recoverable_reason = reason
    def reconciliation_required(self, reason: str) -> None:
        self.last_stable_state = self.state
        self.state = RECONCILIATION
        self.recoverable_reason = reason
    def manual_review(self, reason: str) -> None:
        if reason not in MANUAL_REASONS:
            raise OrchestratorError("reason_not_manual_red_line")
        self.last_stable_state = self.state
        self.state = MANUAL
        self.recoverable_reason = reason
    def resume(self) -> None:
        if self.state not in {RECOVERABLE, RECONCILIATION}:
            raise OrchestratorError("state_not_resumable")
        self.state = self.last_stable_state
    def as_dict(self) -> dict[str, Any]:
        return {
            "schema": "aios.autonomous-release-state.v1",
            "version": self.version,
            "state": self.state,
            "last_stable_state": self.last_stable_state,
            "recoverable_reason": self.recoverable_reason,
            "owner_interaction_required": self.state == MANUAL,
        }
 def atomic_state(path: Path, state: ReleaseState) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
    try:
        os.fchmod(fd, 0o600)
        with os.fdopen(fd, "w", encoding="utf-8", closefd=True) as stream:
            json.dump(state.as_dict(), stream, sort_keys=True, indent=2)
            stream.write("\n")
            stream.flush()
            os.fsync(stream.fileno())
        os.replace(name, path)
    finally:
        try:
            os.unlink(name)
        except FileNotFoundError:
            pass
@@ -1,410 +0,0 @@
 #!/usr/bin/env python3
 """Atomic Registry/Baseline finalizer for an already ACTIVE exact release.
 This adapter never writes Git refs. It is intended for the AIOS runtime
 Registry and authoritative runtime-anchor Baseline only.
 Registry is finalized before Baseline. Baseline apply independently verifies:
 - exact Authority annotated tag and peeled target
 - exact ACTIVE production health
 - exact V2R1C7 Registry record
 - exact previous Baseline file SHA-256 (CAS)
 """
 from __future__ import annotations
 import argparse
 import hashlib
 import json
 import os
 import re
 import stat
 import subprocess
 import sys
 import tempfile
 import time
 import urllib.error
 import urllib.request
 from pathlib import Path
 from typing import Any, Mapping
 OID_RE = re.compile(r"^[0-9a-f]{40}$")
 SHA_RE = re.compile(r"^[0-9a-f]{64}$")
 PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
 def sha256_file(path: Path) -> str:
    digest = hashlib.sha256()
    with path.open("rb") as source:
        for block in iter(lambda: source.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()
 def atomic_json(path: Path, value: Mapping[str, Any], mode: int = 0o640) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    # Existing runtime-authority files may be root:gitops and read-only to
    # non-root readers. Preserve their owner/group/mode across os.replace().
    if path.exists():
        metadata = path.lstat()
        if not stat.S_ISREG(metadata.st_mode) or path.is_symlink():
            raise RuntimeError("ATOMIC_TARGET_NOT_REGULAR")
        target_mode = stat.S_IMODE(metadata.st_mode)
        target_uid = metadata.st_uid
        target_gid = metadata.st_gid
    else:
        parent = path.parent.stat()
        target_mode = mode
        target_uid = 0 if os.geteuid() == 0 else os.geteuid()
        target_gid = parent.st_gid
    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
    try:
        with os.fdopen(fd, "w", encoding="utf-8") as output:
            json.dump(dict(value), output, sort_keys=True, indent=2)
            output.write("\n")
            output.flush()
            os.fsync(output.fileno())
        os.chmod(name, target_mode)
        if os.geteuid() == 0:
            os.chown(name, target_uid, target_gid)
        os.replace(name, path)
        dfd = os.open(path.parent, os.O_RDONLY | os.O_DIRECTORY)
        try:
            os.fsync(dfd)
        finally:
            os.close(dfd)
    finally:
        try:
            os.unlink(name)
        except FileNotFoundError:
            pass
 def load_request() -> dict[str, Any]:
    value = json.load(sys.stdin)
    if not isinstance(value, dict) or value.get("schema") != "aios.production-executor-request.v1":
        raise ValueError("request_schema_invalid")
    if value.get("repository_identity") != "aios/aios":
        raise ValueError("repository_identity_invalid")
    if not re.fullmatch(r"V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?", str(value.get("version", ""))):
        raise ValueError("version_invalid")
    for name in ("target_oid", "evidence_closure_oid"):
        if not OID_RE.fullmatch(str(value.get(name, ""))):
            raise ValueError(f"{name}_invalid")
    if not SHA_RE.fullmatch(str(value.get("artifact_sha256", ""))):
        raise ValueError("artifact_sha256_invalid")
    if not PLAN_RE.fullmatch(str(value.get("approval_plan_id", ""))):
        raise ValueError("approval_plan_id_invalid")
    if "tag_oid" in value and not OID_RE.fullmatch(str(value["tag_oid"])):
        raise ValueError("tag_oid_invalid")
    return value
 def exact_response(value: Mapping[str, Any], status: str, **extra: Any) -> dict[str, Any]:
    return {
        "status": status,
        "version": value["version"],
        "target_oid": value["target_oid"],
        "evidence_closure_oid": value["evidence_closure_oid"],
        "artifact_sha256": value["artifact_sha256"],
        "approval_plan_id": value["approval_plan_id"],
        **extra,
    }
 def git(repository: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        ["git", f"--git-dir={repository}", *args],
        check=check,
        capture_output=True,
        text=True,
        timeout=30,
        env={"PATH": os.environ.get("PATH", "")},
    )
 def verify_local_tag(repository: Path, value: Mapping[str, Any]) -> tuple[str, str]:
    tag_oid = git(repository, "rev-parse", "--verify", f"refs/tags/{value['version']}").stdout.strip()
    peeled = git(repository, "rev-parse", "--verify", f"refs/tags/{value['version']}^{{commit}}").stdout.strip()
    if tag_oid == peeled or peeled != value["target_oid"]:
        raise RuntimeError("FORMAL_TAG_BINDING_MISMATCH")
    requested = value.get("tag_oid")
    if requested and requested != tag_oid:
        raise RuntimeError("FORMAL_TAG_OBJECT_MISMATCH")
    return tag_oid, peeled
 def health(url: str, value: Mapping[str, Any]) -> dict[str, Any]:
    try:
        with urllib.request.urlopen(url, timeout=5) as response:
            body = json.loads(response.read().decode("utf-8"))
            status = response.status
    except (urllib.error.URLError, TimeoutError, ValueError) as exc:
        raise RuntimeError("PRODUCTION_HEALTH_UNAVAILABLE") from exc
    if not (
        status == 200
        and body.get("version") == value["version"]
        and body.get("commit_oid") == value["target_oid"]
        and body.get("artifact_sha256") == value["artifact_sha256"]
        and body.get("deployment_state") == "ACTIVE"
        and body.get("production_deployed") is True
    ):
        raise RuntimeError("PRODUCTION_HEALTH_BINDING_MISMATCH")
    return body
 def registry_record(value: Mapping[str, Any], tag_oid: str, production_health: Mapping[str, Any]) -> dict[str, Any]:
    return {
        "schema": "aios.production-registry.v2",
        "version": value["version"],
        "repository": "aios/aios",
        "target_oid": value["target_oid"],
        "tag": value["version"],
        "tag_oid": tag_oid,
        "tag_object": tag_oid,
        "peeled_target_oid": value["target_oid"],
        "evidence_closure_oid": value["evidence_closure_oid"],
        "artifact_sha256": value["artifact_sha256"],
        "approval_plan_id": value["approval_plan_id"],
        "production_service": value["production_service"],
        "production_port": value["production_port"],
        "registered": True,
        "enabled": True,
        "production_deployed": True,
        "status": "PRODUCTION_DEPLOYED",
        "deployment_state": production_health["deployment_state"],
        "updated_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
    }
 def registry_matches(record: Mapping[str, Any], value: Mapping[str, Any], tag_oid: str) -> bool:
    return all(
        record.get(key) == expected
        for key, expected in {
            "version": value["version"],
            "target_oid": value["target_oid"],
            "tag_oid": tag_oid,
            "evidence_closure_oid": value["evidence_closure_oid"],
            "artifact_sha256": value["artifact_sha256"],
            "approval_plan_id": value["approval_plan_id"],
            "production_service": value["production_service"],
            "production_port": value["production_port"],
            "production_deployed": True,
        }.items()
    ) and record.get("registered") is True and record.get("enabled") is True
 def baseline_matches(record: Mapping[str, Any], value: Mapping[str, Any], tag_oid: str) -> bool:
    current = record.get("current_baseline") or record.get("version")
    return current == value["version"] and all(
        record.get(key) == expected
        for key, expected in {
            "target_oid": value["target_oid"],
            "tag_oid": tag_oid,
            "evidence_closure_oid": value["evidence_closure_oid"],
            "artifact_sha256": value["artifact_sha256"],
            "approval_plan_id": value["approval_plan_id"],
            "production_service": value["production_service"],
            "production_port": value["production_port"],
            "status": "PRODUCTION_DEPLOYED",
        }.items()
    )
 def registry_probe(args: argparse.Namespace, value: Mapping[str, Any]) -> dict[str, Any]:
    tag_oid, _ = verify_local_tag(args.repository, value)
    path = args.registry_root / f"{value['version']}.json"
    if not path.exists():
        return exact_response(value, "NOT_APPLIED", tag_oid=tag_oid)
    record = json.loads(path.read_text(encoding="utf-8"))
    if registry_matches(record, value, tag_oid):
        return exact_response(
            value,
            "VERIFIED",
            tag_oid=tag_oid,
            registry_path=str(path),
            registry_sha256=sha256_file(path),
        )
    return exact_response(value, "CONFLICT", tag_oid=tag_oid, reason="registry_binding_mismatch")
 def registry_apply(args: argparse.Namespace, value: Mapping[str, Any]) -> dict[str, Any]:
    existing = registry_probe(args, value)
    if existing["status"] in {"VERIFIED", "CONFLICT"}:
        return existing
    tag_oid, _ = verify_local_tag(args.repository, value)
    production_health = health(args.health_url, value)
    path = args.registry_root / f"{value['version']}.json"
    atomic_json(path, registry_record(value, tag_oid, production_health))
    return registry_probe(args, value)
 def secure_baseline_authority_file(path: Path) -> None:
    if not path.is_file() or path.is_symlink():
        raise RuntimeError("BASELINE_AUTHORITY_FILE_INVALID")
    baseline_stat = path.lstat()
    if baseline_stat.st_uid != 0 or baseline_stat.st_mode & 0o022:
        raise RuntimeError("BASELINE_AUTHORITY_PERMISSIONS_INVALID")
 def baseline_probe(args: argparse.Namespace, value: Mapping[str, Any]) -> dict[str, Any]:
    tag_oid, _ = verify_local_tag(args.repository, value)
    secure_baseline_authority_file(args.baseline_path)
    record = json.loads(args.baseline_path.read_text(encoding="utf-8"))
    if baseline_matches(record, value, tag_oid):
        return exact_response(
            value,
            "VERIFIED",
            tag_oid=tag_oid,
            baseline_path=str(args.baseline_path),
            baseline_sha256=sha256_file(args.baseline_path),
        )
    current = record.get("current_baseline") or record.get("version")
    current_sha = sha256_file(args.baseline_path)
    if (
        current == args.expected_previous_baseline
        and current_sha == args.expected_previous_baseline_sha256
    ):
        return exact_response(
            value,
            "NOT_APPLIED",
            tag_oid=tag_oid,
            previous_baseline=current,
            previous_baseline_sha256=current_sha,
        )
    return exact_response(
        value,
        "CONFLICT",
        tag_oid=tag_oid,
        reason="baseline_precondition_or_binding_mismatch",
        observed_baseline=current,
        observed_sha256=current_sha,
    )
 def baseline_apply(args: argparse.Namespace, value: Mapping[str, Any]) -> dict[str, Any]:
    existing = baseline_probe(args, value)
    if existing["status"] in {"VERIFIED", "CONFLICT"}:
        return existing
    tag_oid, _ = verify_local_tag(args.repository, value)
    production_health = health(args.health_url, value)
    registry_path = args.registry_root / f"{value['version']}.json"
    if not registry_path.is_file():
        raise RuntimeError("REGISTRY_NOT_FINALIZED")
    registry = json.loads(registry_path.read_text(encoding="utf-8"))
    if not registry_matches(registry, value, tag_oid):
        raise RuntimeError("REGISTRY_BINDING_NOT_VERIFIED")
    previous = json.loads(args.baseline_path.read_text(encoding="utf-8"))
    if sha256_file(args.baseline_path) != args.expected_previous_baseline_sha256:
        raise RuntimeError("BASELINE_CAS_MISMATCH")
    generation = max(
        int(previous.get("generation", 0) or 0),
        int(previous.get("authority_generation", 0) or 0),
    ) + 1
    record = {
        "schema": "aios.production-baseline.v2",
        "source_identity": "aios-gitops-runtime-anchor-baseline-authority-v1",
        "current_baseline": value["version"],
        "version": value["version"],
        "previous_baseline": args.expected_previous_baseline,
        "previous_version": args.expected_previous_baseline,
        "status": "PRODUCTION_DEPLOYED",
        "target_oid": value["target_oid"],
        "peeled_target_oid": value["target_oid"],
        "tag_oid": tag_oid,
        "evidence_closure_oid": value["evidence_closure_oid"],
        "approval_plan_id": value["approval_plan_id"],
        "artifact_sha256": value["artifact_sha256"],
        "production_artifact_sha256": value["artifact_sha256"],
        "production_service": value["production_service"],
        "production_port": value["production_port"],
        "production_deployed": True,
        "deployment_state": production_health["deployment_state"],
        "registry_digest": sha256_file(registry_path),
        "registry_source": str(registry_path),
        "generation": generation,
        "authority_generation": generation,
        # The actual previously deployed production baseline is the rollback
        # target. V2R1C6 has a formal tag but was never production-deployed.
        "rollback_version": args.expected_previous_baseline,
        "rollback_tag_oid": previous.get("tag_oid"),
        "rollback_target_oid": previous.get("target_oid"),
        "promoted_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
        "promoted_by": "aios-approved-production-release-executor",
    }
    atomic_json(args.baseline_path, record)
    return baseline_probe(args, value)
 def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument(
        "--mode",
        choices=("registry", "baseline"),
        default=os.environ.get("AIOS_RELEASE_METADATA_MODE"),
        required=os.environ.get("AIOS_RELEASE_METADATA_MODE") is None,
    )
    parser.add_argument(
        "--repository",
        type=Path,
        default=Path(os.environ["AIOS_GITOPS_AUTHORITATIVE_GIT_DIR"]),
    )
    parser.add_argument(
        "--registry-root",
        type=Path,
        default=Path(os.environ["AIOS_RUNTIME_REGISTRY_ROOT"]),
    )
    parser.add_argument(
        "--baseline-path",
        type=Path,
        default=Path(os.environ["AIOS_RUNTIME_BASELINE_PATH"]),
    )
    parser.add_argument(
        "--expected-previous-baseline",
        default=os.environ.get("AIOS_PREVIOUS_BASELINE", "V2R1C5"),
    )
    parser.add_argument(
        "--expected-previous-baseline-sha256",
        default=os.environ.get("AIOS_PREVIOUS_BASELINE_SHA256"),
        required=os.environ.get("AIOS_PREVIOUS_BASELINE_SHA256") is None,
    )
    parser.add_argument(
        "--health-url",
        default=os.environ.get("AIOS_RELEASE_HEALTH_URL", "http://127.0.0.1:18927/health"),
    )
    args = parser.parse_args()
    value = load_request()
    operation = value.get("operation")
    if args.mode == "registry":
        if operation == "probe":
            result = registry_probe(args, value)
        elif operation == "apply":
            result = registry_apply(args, value)
        else:
            raise ValueError("unsupported_operation")
    else:
        if operation == "probe":
            result = baseline_probe(args, value)
        elif operation == "apply":
            result = baseline_apply(args, value)
        else:
            raise ValueError("unsupported_operation")
    print(json.dumps(result, sort_keys=True))
    return 0
 if __name__ == "__main__":
    try:
        raise SystemExit(main())
    except Exception as exc:
        print(
            json.dumps(
                {"status": "FAIL_CLOSED", "error": type(exc).__name__, "reason": str(exc)},
                sort_keys=True,
            )
        )
        raise SystemExit(2)
@@ -1,53 +0,0 @@
 """Release state machine with explicit fail-closed production gates."""
 from __future__ import annotations
 from enum import Enum
 from typing import Mapping
 class InvalidTransition(RuntimeError):
    pass
 class ReleaseState(str, Enum):
    SOURCE_READY = "SOURCE_READY"
    TESTED = "TESTED"
    PR_OPEN = "PR_OPEN"
    PR_APPROVED = "PR_APPROVED"
    MERGED = "MERGED"
    ARTIFACT_VERIFIED = "ARTIFACT_VERIFIED"
    RELEASE_APPROVED = "RELEASE_APPROVED"
    TAG_VERIFIED = "TAG_VERIFIED"
    DEPLOYED = "DEPLOYED"
    PRODUCTION_ACCEPTED = "PRODUCTION_ACCEPTED"
 TRANSITIONS = {
    ReleaseState.SOURCE_READY: (ReleaseState.TESTED,),
    ReleaseState.TESTED: (ReleaseState.PR_OPEN,),
    ReleaseState.PR_OPEN: (ReleaseState.PR_APPROVED,),
    ReleaseState.PR_APPROVED: (ReleaseState.MERGED,),
    ReleaseState.MERGED: (ReleaseState.ARTIFACT_VERIFIED,),
    ReleaseState.ARTIFACT_VERIFIED: (ReleaseState.RELEASE_APPROVED,),
    ReleaseState.RELEASE_APPROVED: (ReleaseState.TAG_VERIFIED,),
    ReleaseState.TAG_VERIFIED: (ReleaseState.DEPLOYED,),
    ReleaseState.DEPLOYED: (ReleaseState.PRODUCTION_ACCEPTED,),
 }
 class ReleaseStateMachine:
    def __init__(self, state: ReleaseState = ReleaseState.SOURCE_READY) -> None:
        self.state = state
    def transition(self, target: ReleaseState, evidence: Mapping[str, object] | None = None) -> ReleaseState:
        if target not in TRANSITIONS.get(self.state, ()):
            raise InvalidTransition(f"{self.state.value}_to_{target.value}_denied")
        evidence = evidence or {}
        if target is ReleaseState.PRODUCTION_ACCEPTED:
            if evidence.get("tag_verified") is not True or evidence.get("remote_tag_readback") is not True or evidence.get("service_health") is not True:
                raise InvalidTransition("production_acceptance_evidence_incomplete")
        if target is ReleaseState.DEPLOYED and evidence.get("artifact_verified") is not True:
            raise InvalidTransition("deployment_artifact_not_verified")
        self.state = target
        return self.state
@@ -11,7 +11,6 @@ from dataclasses import asdict, dataclass, field
 from typing import Any
 from .search_gateway_orchestrator import SearchGatewayOrchestrator
 from .trace_tool_credential_governance import GovernanceActor, TraceContext
@dataclass(frozen=True)
@@ -44,9 +43,6 @@ class SearchGatewayAgentAdapter:
        domain_profiles: list[str] | None = None,
        user_scope: str = "public",
        correlation_id: str | None = None,
        *,
        actor: GovernanceActor | dict[str, Any] | None = None,
        trace: TraceContext | None = None,
    ) -> dict[str, Any]:
        payload = {
            "query": query,
@@ -63,11 +59,7 @@ class SearchGatewayAgentAdapter:
            "session_profile": context.session_profile,
            "correlation_id": correlation_id,
        }
        if actor is None and trace is None:
            # Preserve adapter compatibility; the governed orchestrator itself
            # still fails closed when trusted context is absent.
        return self.orchestrator.execute(payload)
        return self.orchestrator.execute(payload, actor=actor, trace=trace)
 class OpenClawSearchClient(SearchGatewayAgentAdapter):
@@ -13,18 +13,10 @@ from __future__ import annotations
 from dataclasses import asdict, dataclass, field
 from datetime import datetime, timezone
 import hashlib
 import json
 from typing import Any, Protocol
 from uuid import uuid4
 from .search_profile_resolver import DomainQueryProfileRegistry, SearchProfile, SearchProfileResolver
 from .trace_tool_credential_governance import (
    GovernanceActor,
    GovernanceError,
    GovernanceStore,
    TraceContext,
 )
 def utc_now() -> str:
@@ -164,25 +156,13 @@ class SearchPolicyGuard:
 class SearchGateway:
-    def __init__(self, providers: list[SearchProvider] | None = None, *, governance_store: GovernanceStore | None = None):
+    def __init__(self, providers: list[SearchProvider] | None = None):
        self.providers = providers or []
        self.governance_store = governance_store
        self.profile_resolver = SearchProfileResolver()
        self.planner = QueryPlanner()
        self.guard = SearchPolicyGuard()
-    def search(self, request: SearchRequest, *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None) -> SearchResponse:
+    def search(self, request: SearchRequest) -> SearchResponse:
        trusted_actor: GovernanceActor | None = None
        if self.governance_store is not None:
            if actor is None or trace is None:
                raise GovernanceError("TOOL_MCP_AUTHZ_DENY")
            trusted_actor = GovernanceActor.from_value(actor)
            if request.requester != trusted_actor.identity:
                raise GovernanceError("TOOL_MCP_AUTHZ_DENY", field="requester")
            if request.correlation_id is not None and request.correlation_id not in {
                trace.trace_id, trace.correlation_id
            }:
                raise GovernanceError("TOOL_SCOPE_PROPAGATION", field="correlation_id")
        request_id = request.correlation_id or f"search_{uuid4().hex[:12]}"
        profile = self.profile_resolver.resolve(request.group_profile, request.user_profile, request.session_profile)
        expanded_queries = self.planner.expand(request, profile)
@@ -204,60 +184,14 @@ class SearchGateway:
        attempts: list[SearchProviderAttempt] = []
        providers = self._ordered_providers(profile)
        for provider in providers:
            if request.authorized_sources and provider.name not in request.authorized_sources:
                attempts.append(SearchProviderAttempt(provider=provider.name, status="denied", reason="SOURCE_AUTHZ_DENY"))
                continue
            if request.user_scope != "public" and provider.name not in request.authorized_sources:
                attempts.append(SearchProviderAttempt(provider=provider.name, status="denied", reason="SOURCE_AUTHZ_REQUIRED"))
                continue
            try:
                if self.governance_store is not None:
                    assert trusted_actor is not None and trace is not None
                    input_digest = hashlib.sha256(
                        json.dumps(
                            {"query": request.query, "intent": request.intent, "provider": provider.name},
                            sort_keys=True, separators=(",", ":"), ensure_ascii=False,
                        ).encode("utf-8")
                    ).hexdigest()
                    invocation_key = hashlib.sha256(
                        f"{trace.trace_id}:{trace.span_id}:{provider.name}:{input_digest}".encode("utf-8")
                    ).hexdigest()
                    authorization = self.governance_store.authorize_tool(
                        actor=trusted_actor,
                        tool_name=f"search.{provider.name}",
                        trace=trace,
                        requested_scope=trace.scope,
                        input_digest=input_digest,
                        invocation_key=invocation_key,
                    )
                    if authorization.get("idempotent"):
                        raise GovernanceError("TOOL_INVOCATION_REPLAY")
                provider_evidence, attempt = provider.search(request, expanded_queries)
                if self.governance_store is not None:
                    result_digest = hashlib.sha256(
                        json.dumps(
                            {
                                "evidence": [item.to_dict() for item in provider_evidence],
                                "attempt": attempt.to_dict(),
                            },
                            sort_keys=True, separators=(",", ":"), ensure_ascii=False,
                        ).encode("utf-8")
                    ).hexdigest()
                    self.governance_store.record_tool_receipt(
                        invocation_key=invocation_key,
                        result_digest=result_digest,
                        actor=trusted_actor,
                        trace=trace,
                    )
                evidence.extend(provider_evidence)
                attempts.append(attempt)
                if provider_evidence:
                    break
-            except GovernanceError:
+            except Exception as exc:
-                raise
+                attempts.append(SearchProviderAttempt(provider=getattr(provider, "name", "unknown"), status="failed", reason=str(exc)))
            except Exception:
                # Provider exceptions may contain URLs, tokens, or local paths.
                attempts.append(SearchProviderAttempt(provider=getattr(provider, "name", "unknown"), status="failed", reason="PROVIDER_FAILURE"))
        if evidence:
            return SearchResponse(
@@ -7,29 +7,27 @@ try:
 except Exception:
    APIRouter = None
-from .search_gateway import SearchRequest
+from .search_gateway import SearchGateway, SearchRequest
 from .search_gateway_orchestrator import SearchGatewayOrchestrator
 from .trace_tool_credential_governance import GovernanceActor, TraceContext
 from .search_gateway_dashboard import SearchGatewayDashboard
-orchestrator = SearchGatewayOrchestrator()
+gateway = SearchGateway()
 dashboard = SearchGatewayDashboard()
-def search_gateway_request(payload: dict[str, Any], *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None) -> dict[str, Any]:
+def search_gateway_request(payload: dict[str, Any]) -> dict[str, Any]:
-    return orchestrator.execute(payload, actor=actor, trace=trace)
+    request = SearchRequest(**payload)
    return gateway.search(request).to_dict()
 def get_search_gateway_status() -> dict[str, Any]:
    return {
        "module": "search-gateway",
        "status": "ready",
-        "providers_configured": len(orchestrator.gateway.providers),
+        "providers_configured": len(gateway.providers),
        "policy_guard": "enabled",
        "profile_customization": "enabled",
        "fallback_required_when_provider_unavailable": True,
        "governance": "required",
    }
@@ -3,49 +3,24 @@
 from __future__ import annotations
 from typing import Any
 import os
 from .search_audit_store import SearchAuditStore
 from .search_event_bridge import SearchEventBridge
 from .search_gateway import SearchGateway, SearchRequest
 from .search_provider_registry import SearchProviderRegistry
 from .trace_tool_credential_governance import (
    GovernanceActor,
    GovernanceScope,
    GovernanceStore,
    ToolDescriptor,
    TraceContext,
 )
 class SearchGatewayOrchestrator:
-    def __init__(self, *, governance_store: GovernanceStore | None = None):
+    def __init__(self):
        self.registry = SearchProviderRegistry()
        self.audit = SearchAuditStore()
        self.events = SearchEventBridge()
-        self.governance = governance_store or GovernanceStore(
+        self.gateway = SearchGateway(self.registry.ordered())
            os.environ.get("AIOS_SEARCH_GOVERNANCE_DB", "runtime/search-governance.sqlite3")
        )
        registrar = GovernanceActor(
            "search-runtime-bootstrap", GovernanceScope("system"), ("system.admin",)
        )
        for provider in self.registry.ordered():
            self.governance.register_tool(
                ToolDescriptor(
                    f"search.{provider.name}", "tool", GovernanceScope("global"), ("tool.search",)
                ),
                registrar,
            )
        self.gateway = SearchGateway(self.registry.ordered(), governance_store=self.governance)
-    def execute(self, payload: dict[str, Any], *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None) -> dict[str, Any]:
+    def execute(self, payload: dict[str, Any]) -> dict[str, Any]:
        if actor is None or trace is None:
            from .trace_tool_credential_governance import GovernanceError
            raise GovernanceError("TOOL_MCP_AUTHZ_DENY")
        self.governance.record_trace(trace, actor)
        request = SearchRequest(**payload)
        self.events.search_started(request.to_dict())
-        response = self.gateway.search(request, actor=actor, trace=trace)
+        response = self.gateway.search(request)
        result = response.to_dict()
        for attempt in result.get("attempts", []):
            self.events.provider_attempted(result["request_id"], attempt)
@@ -60,7 +35,6 @@ class SearchGatewayOrchestrator:
            "registry": self.registry.status(),
            "audit": "enabled",
            "events": "enabled",
            "governance": "required",
        }
@@ -1,520 +0,0 @@
 """Compatibility adapter for the deployed signer and validator contracts.
 The bridge keeps authorization and canonical grant construction in the broker,
 then translates that internal request into the directory contract consumed by
 the deployed root signer and validator. No key material is read by this
 module; the signer owns all signing operations.
 """
 from __future__ import annotations
 import hashlib
 import json
 import os
 import re
 import subprocess
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 _SIGNER_FLAGS = (
    "--namespace",
    "--input",
    "--signature-out",
    "--key-id-out",
 )
 class SignerContractError(RuntimeError):
    """Raised when the deployed contract cannot be normalized safely."""
 def canonical_json_bytes(value: Any) -> bytes:
    return (
        json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
        + "\n"
    ).encode("utf-8")
 def sha256_json(value: Any) -> str:
    return hashlib.sha256(canonical_json_bytes(value)).hexdigest()
 def resolve_ref_oid(git_dir: str | Path, ref: str) -> str:
    """Resolve an authoritative commit ref to a full 40-character OID."""
    if not isinstance(ref, str) or not re.fullmatch(r"refs/[A-Za-z0-9._/-]+", ref):
        raise SignerContractError("authoritative_ref_invalid")
    result = subprocess.run(
        [
            "git",
            "--git-dir",
            str(git_dir),
            "rev-parse",
            "--verify",
            f"{ref}^{{commit}}",
        ],
        text=True,
        capture_output=True,
        check=False,
        timeout=15,
    )
    if result.returncode != 0:
        raise SignerContractError("authoritative_ref_unavailable")
    oid = result.stdout.strip().lower()
    if not re.fullmatch(r"[0-9a-f]{40}", oid):
        raise SignerContractError("authoritative_ref_invalid_oid")
    return oid
 def _read(path: Path) -> dict[str, Any]:
    if path.is_symlink() or not path.is_file():
        raise SignerContractError("contract_input_missing")
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
        raise SignerContractError("contract_input_invalid") from exc
    if not isinstance(value, dict):
        raise SignerContractError("contract_object_required")
    return value
 def _write(path: Path, value: Any) -> None:
    if path.is_symlink():
        raise SignerContractError("contract_output_symlink")
    path.parent.mkdir(parents=True, exist_ok=True)
    temporary = path.with_name(path.name + ".tmp")
    temporary.write_bytes(canonical_json_bytes(value))
    os.chmod(temporary, 0o600)
    os.replace(temporary, path)
    os.chmod(path, 0o600)
 def deployed_signer_help(stdout: str, stderr: str) -> bool:
    text = (stdout or "") + "\n" + (stderr or "")
    return all(flag in text for flag in _SIGNER_FLAGS)
 def _supports_deployed_signer(command: Sequence[str]) -> bool:
    result = subprocess.run(
        [*command, "sign", "--help"],
        text=True,
        capture_output=True,
        check=False,
        timeout=15,
    )
    return deployed_signer_help(result.stdout, result.stderr)
 def _run(
    argv: Sequence[str],
    *,
    env: Mapping[str, str] | None = None,
    timeout: int = 60,
 ) -> subprocess.CompletedProcess[str]:
    result = subprocess.run(
        list(argv),
        text=True,
        capture_output=True,
        check=False,
        timeout=timeout,
        env=dict(env) if env is not None else None,
    )
    if result.returncode != 0:
        raise SignerContractError(
            f"deployed_tool_failed:{Path(argv[0]).name}:{result.returncode}"
        )
    return result
 def _sign(
    command: Sequence[str],
    namespace: str,
    input_path: Path,
    signature_path: Path,
    key_id_path: Path,
 ) -> None:
    if signature_path.exists() or key_id_path.exists():
        raise SignerContractError("contract_output_exists")
    _run(
        [
            *command,
            "sign",
            "--namespace",
            namespace,
            "--input",
            str(input_path),
            "--signature-out",
            str(signature_path),
            "--key-id-out",
            str(key_id_path),
        ],
        timeout=60,
    )
    if not signature_path.is_file() or not key_id_path.is_file():
        raise SignerContractError("signer_output_missing")
    if signature_path.stat().st_size <= 0 or key_id_path.stat().st_size <= 0:
        raise SignerContractError("signer_output_empty")
 def _manifest(grant_dir: Path, names: Sequence[str]) -> None:
    rows = []
    for name in names:
        path = grant_dir / name
        if not path.is_file() or path.is_symlink():
            raise SignerContractError("manifest_input_missing")
        rows.append(
            f"{hashlib.sha256(path.read_bytes()).hexdigest()}  {name}"
        )
    (grant_dir / "MANIFEST.sha256").write_text(
        "\n".join(rows) + "\n",
        encoding="utf-8",
    )
    os.chmod(grant_dir / "MANIFEST.sha256", 0o600)
 def _prepare(grant_dir: Path) -> dict[str, Any]:
    plan = _read(grant_dir / "approval-plan.json")
    request = _read(grant_dir / "grant-request.json")
    base = request.get("base")
    target = request.get("target")
    owner = request.get("owner_authorization")
    authorization = request.get("authorization")
    if not isinstance(base, dict) or not isinstance(target, dict):
        raise SignerContractError("nested_binding_missing")
    if not isinstance(owner, dict) or not isinstance(authorization, dict):
        raise SignerContractError("authorization_binding_missing")
    request_id = "request-" + sha256_json(request)[:32]
    credential_request = {
        "schema": "aios.credential-request.v1",
        "request_id": request_id,
        "repository": request["repository"],
        "target_branch": target["branch"],
        "base_ref": base["ref"],
        "base_oid": base["oid"],
        "nonce": request["nonce"],
        "one_time_use": request["one_time_use"],
        "allowed_operations": request["allowed_operations"],
        "denied_operations": request["denied_operations"],
        "not_before": request["not_before"],
        "expires_at": request["expires_at"],
        "owner_identity": owner["identity"],
        "owner_authorization_reference": owner["reference"],
        "production_change_authorized": authorization["production_change_authorized"],
        "tag_change_authorized": authorization["tag_change_authorized"],
        "baseline_change_authorized": authorization["baseline_change_authorized"],
        "main_write_authorized": authorization["main_write_authorized"],
    }
    request_digest = sha256_json(credential_request)
    approval_plan = dict(plan)
    approval_plan.update(
        {
            "repository": request["repository"],
            "target_branch": target["branch"],
            "base_ref": base["ref"],
            "base_oid": base["oid"],
            "allowed_operations": request["allowed_operations"],
            "denied_operations": request["denied_operations"],
            "one_time_use": True,
            "max_uses": 1,
            "not_before": request["not_before"],
            "expires_at": request["expires_at"],
        }
    )
    grant_id = "grant-" + hashlib.sha256(
        (request_id + "\0" + request["nonce"]).encode("utf-8")
    ).hexdigest()[:32]
    grant_payload = {
        "schema": "aios.grant-payload.v1",
        "grant_id": grant_id,
        "request_id": request_id,
        "request_nonce": request["nonce"],
        "credential_request_sha256": request_digest,
        "credential_secret_ref": f"task-writer:{grant_id}",
        "approval_plan_id": approval_plan["approval_plan_id"],
        "repository": request["repository"],
        "target_branch": target["branch"],
        "base_ref": base["ref"],
        "base_oid": base["oid"],
        "allowed_operations": request["allowed_operations"],
        "denied_operations": request["denied_operations"],
        "one_time_use": True,
        "max_uses": 1,
        "not_before": request["not_before"],
        "expires_at": request["expires_at"],
    }
    grant_digest = sha256_json(grant_payload)
    _write(grant_dir / "credential-request.json", credential_request)
    (grant_dir / "credential-request.canonical.json").write_bytes(
        canonical_json_bytes(credential_request)
    )
    os.chmod(grant_dir / "credential-request.canonical.json", 0o600)
    _write(grant_dir / "approval-plan.json", approval_plan)
    (grant_dir / "approval-plan.canonical.json").write_bytes(
        canonical_json_bytes(approval_plan)
    )
    os.chmod(grant_dir / "approval-plan.canonical.json", 0o600)
    _write(grant_dir / "grant-payload.json", grant_payload)
    (grant_dir / "grant-payload.canonical.json").write_bytes(
        canonical_json_bytes(grant_payload)
    )
    os.chmod(grant_dir / "grant-payload.canonical.json", 0o600)
    _write(
        grant_dir / "signed-grant.json",
        {
            "schema": "aios.signed-grant.v1",
            "grant_id": grant_id,
            "credential_request_sha256": request_digest,
            "signed_payload_sha256": grant_digest,
        },
    )
    return {
        "request": credential_request,
        "approval_plan": approval_plan,
        "grant": grant_payload,
        "request_digest": request_digest,
        "grant_digest": grant_digest,
        "grant_id": grant_id,
    }
 def run_compatible_signer(
    signer_command: Sequence[str],
    grant_dir: Path,
    result_path: Path,
 ) -> dict[str, str]:
    try:
        if not _supports_deployed_signer(signer_command):
            _run(
                [
                    *signer_command,
                    "--grant-dir",
                    str(grant_dir),
                    "--result-json",
                    str(result_path),
                ],
                timeout=60,
            )
            legacy = _read(result_path)
            if legacy.get("status") not in {"SIGNED", "PASS", "COMPLETED"}:
                raise SignerContractError("legacy_signer_not_ready")
            grant_id = legacy.get("grant_id")
            digest = legacy.get("grant_digest_sha256")
            signer = legacy.get("signing_key_identity") or legacy.get(
                "signer_identity"
            )
            if not all(
                isinstance(value, str) and value.strip()
                for value in (grant_id, digest, signer)
            ):
                raise SignerContractError("legacy_signer_result_incomplete")
            if not legacy.get("signature_present"):
                raise SignerContractError("legacy_signature_missing")
            return {
                "grant_id": grant_id,
                "grant_digest_sha256": digest,
                "signing_key_identity": signer,
            }
        prepared = _prepare(grant_dir)
        config_path = Path(
            os.environ.get("AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json")
        )
        config = _read(config_path)
        grant_namespace = str(config["grant_namespace"])
        approval_namespace = str(config["approval_namespace"])
        _sign(
            signer_command,
            approval_namespace,
            grant_dir / "approval-plan.canonical.json",
            grant_dir / "approval-plan.sig",
            grant_dir / "approval-plan.key-id",
        )
        _sign(
            signer_command,
            grant_namespace,
            grant_dir / "grant-payload.canonical.json",
            grant_dir / "signed-grant.sig",
            grant_dir / "signed-grant.key-id",
        )
        key_identity = (
            grant_dir / "signed-grant.key-id"
        ).read_text(encoding="utf-8").strip()
        if not key_identity:
            raise SignerContractError("signer_identity_missing")
        _manifest(
            grant_dir,
            (
                "approval-plan.json",
                "approval-plan.canonical.json",
                "approval-plan.sig",
                "approval-plan.key-id",
                "credential-request.json",
                "credential-request.canonical.json",
                "grant-payload.json",
                "grant-payload.canonical.json",
                "signed-grant.json",
                "signed-grant.sig",
                "signed-grant.key-id",
            ),
        )
        result = {
            "schema": "aios.compatible-signer-result.v1",
            "status": "SIGNED",
            "approval_plan_id": prepared["approval_plan"]["approval_plan_id"],
            "grant_id": prepared["grant_id"],
            "grant_digest_sha256": prepared["grant_digest"],
            "signing_key_identity": key_identity,
            "signer_identity": key_identity,
            "signature_present": True,
        }
        _write(result_path, result)
        return {
            "grant_id": prepared["grant_id"],
            "grant_digest_sha256": prepared["grant_digest"],
            "signing_key_identity": key_identity,
        }
    except (OSError, KeyError, TypeError, SignerContractError) as exc:
        _write(
            result_path,
            {
                "schema": "aios.compatible-signer-result.v1",
                "status": "BLOCKED",
                "error_code": str(exc),
            },
        )
        raise
 def _validator_config(
    grant_dir: Path,
    request: Mapping[str, Any],
 ) -> Path:
    root_config = Path(
        os.environ.get("AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json")
    )
    config = _read(root_config)
    repo_path = (
        os.environ.get("AIOS_GITOPS_VALIDATOR_REPO_PATH")
        or os.environ.get("AIOS_GITOPS_WORKSPACE")
        or config.get("repo_path")
    )
    config.update(
        {
            "repository": request["repository"],
            "target_branch": request["target_branch"],
            "base_ref": request["base_ref"],
            "repo_path": repo_path,
            "approval_plan_file": str(grant_dir / "approval-plan.json"),
            "approval_plan_canonical_file": str(
                grant_dir / "approval-plan.canonical.json"
            ),
            "approval_plan_signature_file": str(grant_dir / "approval-plan.sig"),
            "consumed_grants_ledger": str(
                grant_dir / "consumed-grants.jsonl"
            ),
        }
    )
    path = grant_dir.parent / "compat-validator-config.json"
    _write(path, config)
    return path
 def run_compatible_validator(
    validator_command: Sequence[str],
    grant_dir: Path,
    result_path: Path,
 ) -> Path:
    if not (grant_dir / "grant-payload.json").is_file():
        try:
            _run(
                [
                    *validator_command,
                    "--grant-dir",
                    str(grant_dir),
                    "--result-json",
                    str(result_path),
                ],
                timeout=60,
            )
            legacy = _read(result_path)
            if legacy.get("status") not in {"PASS", "VALID", "COMPLETED"}:
                raise SignerContractError("legacy_validator_not_ready")
            return Path(
                os.environ.get(
                    "AIOS_GRANT_ROOT_CONFIG", "/etc/aios/grant-root/config.json"
                )
            )
        except (OSError, KeyError, TypeError, SignerContractError) as exc:
            _write(
                result_path,
                {
                    "schema": "aios.compatible-validator-result.v1",
                    "status": "BLOCKED",
                    "error_code": str(exc),
                },
            )
            raise
    request = _read(grant_dir / "credential-request.json")
    config_path = _validator_config(grant_dir, request)
    env = os.environ.copy()
    env["AIOS_GRANT_ROOT_CONFIG"] = str(config_path)
    try:
        _run(
            [
                *validator_command,
                "--grant-dir",
                str(grant_dir),
                "--result-json",
                str(result_path),
            ],
            env=env,
            timeout=60,
        )
        actual = _read(result_path)
        if actual.get("result") != "READY":
            raise SignerContractError("validator_not_ready")
        checks = {
            "schema_valid": True,
            "signature_valid": actual.get("signature_verified") is True,
            "signer_trusted": actual.get("signature_verified") is True,
            "approval_plan_active": actual.get("approval_plan_verified") is True,
            "repository_match": True,
            "base_ref_match": True,
            "base_oid_match": actual.get("remote_base_verified") is True,
            "target_branch_match": actual.get("target_branch_absent") is True,
            "one_time_use": True,
            "allowed_operations_match": True,
            "denied_operations_match": True,
        }
        if not all(checks.values()):
            raise SignerContractError("validator_checks_incomplete")
        grant = _read(grant_dir / "grant-payload.json")
        result = {
            "schema": "aios.compatible-validator-result.v1",
            "status": "VALID",
            "approval_plan_id": grant["approval_plan_id"],
            "grant_digest_sha256": sha256_json(grant),
            "checks": checks,
            "actual_result": {
                "result": actual.get("result"),
                "signature_verified": actual.get("signature_verified"),
                "approval_plan_verified": actual.get("approval_plan_verified"),
                "remote_base_verified": actual.get("remote_base_verified"),
                "target_branch_absent": actual.get("target_branch_absent"),
                "grant_unused": actual.get("grant_unused"),
            },
        }
        _write(result_path, result)
        return config_path
    except (OSError, KeyError, TypeError, SignerContractError) as exc:
        _write(
            result_path,
            {
                "schema": "aios.compatible-validator-result.v1",
                "status": "BLOCKED",
                "error_code": str(exc),
            },
        )
        raise
@@ -1,760 +0,0 @@
 """Task-scoped identity overlay for bootstrap writer provisioning.
 This module resolves bearer-registry identity ambiguity without modifying the
 global token registry. A root-governed one-shot issuer creates a random,
 short-lived credential bound to exactly one repository, base OID, task and
 target branch. The HTTP overlay authenticates only that credential and invokes
 the existing OwnerAuthorizationBroker.
 The overlay never grants main, tag, baseline, production or repository-admin
 capabilities. The bearer secret is stored only in a root-owned runtime path and
 is removed after success, failure, revocation or expiry.
 """
 from __future__ import annotations
 import fcntl
 import hashlib
 import json
 import os
 import re
 import secrets
 import tempfile
 from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any, Mapping, Sequence
 from authorized_task_writer_provisioning import (
    BRANCH_RE,
    ProvisioningError,
    OID_RE,
    REQUIRED_ALLOWED_OPERATIONS,
    REQUIRED_DENIED_OPERATIONS,
    TASK_RE,
 )
 from owner_authorization_broker import (
    ACTION,
    BROKER_REQUEST_FIELDS,
    OwnerAuthorizationBroker,
    OwnerAuthorizationBrokerConfig,
    OwnerAuthorizationError,
    OwnerPrincipal,
    TaskWriterProvisioner,
    canonical_json_bytes,
    iso_utc,
    sha256_json,
    utc_now,
 )
 OVERLAY_SCHEMA = "aios.task-identity-overlay.v1"
 OVERLAY_SCOPE = "owner:task-authorize"
 OVERLAY_ID_RE = re.compile(r"^overlay-[0-9a-f]{32}$")
 OWNER_IDENTITY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._@:+/-]{1,254}$")
 AUTH_ASSERTION_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:/@+-]{3,255}$")
 TERMINAL_STATES = frozenset({"CONSUMED", "FAILED", "REVOKED", "EXPIRED"})
 MAX_BODY_BYTES = 1_048_576
 class IdentityOverlayError(RuntimeError):
    """Stable, fail-closed error for the overlay control plane."""
    def __init__(
        self,
        code: str,
        status: int = 400,
        *,
        details: Mapping[str, Any] | None = None,
    ) -> None:
        super().__init__(code)
        self.code = code
        self.status = status
        self.details = dict(details or {})
@dataclass(frozen=True)
 class TaskBinding:
    task_id: str
    repository: str
    base_ref: str
    base_oid: str
    target_branch: str
    def as_dict(self) -> dict[str, str]:
        return {
            "task_id": self.task_id,
            "repository": self.repository,
            "base_ref": self.base_ref,
            "base_oid": self.base_oid,
            "target_branch": self.target_branch,
        }
@dataclass(frozen=True)
 class IdentityOverlayConfig:
    state_root: Path
    secret_root: Path
    binding: TaskBinding
    owner_identity: str
    max_ttl_seconds: int = 900
    require_root_issue: bool = True
    collision_secret_refs: tuple[Path, ...] = ()
    broker_state_root: Path | None = None
    @classmethod
    def from_environment(cls) -> "IdentityOverlayConfig":
        try:
            maximum = int(
                os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_MAX_TTL_SECONDS", "900")
            )
        except ValueError:
            raise IdentityOverlayError("OVERLAY_MAX_TTL_INVALID", 503) from None
        if not 60 <= maximum <= 900:
            raise IdentityOverlayError("OVERLAY_MAX_TTL_INVALID", 503)
        refs = tuple(
            Path(item.strip())
            for item in os.getenv(
                "AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS", ""
            ).split(",")
            if item.strip()
        )
        owner = os.getenv(
            "AIOS_GITOPS_IDENTITY_OVERLAY_OWNER_IDENTITY", ""
        ).strip()
        config = cls(
            state_root=Path(
                os.getenv(
                    "AIOS_GITOPS_IDENTITY_OVERLAY_STATE_ROOT",
                    "/var/lib/aios-gitops/task-identity-overlays",
                )
            ),
            secret_root=Path(
                os.getenv(
                    "AIOS_GITOPS_IDENTITY_OVERLAY_SECRET_ROOT",
                    "/run/aios-gitops/task-identity-overlays",
                )
            ),
            broker_state_root=Path(
                os.getenv(
                    "AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT",
                    "/var/lib/aios-gitops/owner-authorization-broker",
                )
            ),
            binding=TaskBinding(
                task_id=os.getenv(
                    "AIOS_GITOPS_IDENTITY_OVERLAY_TASK_ID", ""
                ).strip(),
                repository=os.getenv(
                    "AIOS_GITOPS_REPOSITORY_IDENTITY", "aios/aios"
                ).strip(),
                base_ref=os.getenv(
                    "AIOS_GITOPS_IDENTITY_OVERLAY_BASE_REF",
                    "refs/heads/main",
                ).strip(),
                base_oid=os.getenv(
                    "AIOS_GITOPS_IDENTITY_OVERLAY_BASE_OID", ""
                ).strip(),
                target_branch=os.getenv(
                    "AIOS_GITOPS_IDENTITY_OVERLAY_TARGET_BRANCH", ""
                ).strip(),
            ),
            owner_identity=owner,
            max_ttl_seconds=maximum,
            require_root_issue=os.getenv(
                "AIOS_GITOPS_IDENTITY_OVERLAY_REQUIRE_ROOT", "true"
            ).strip().lower()
            not in {"0", "false", "no", "off"},
            collision_secret_refs=refs,
        )
        _validate_config(config)
        return config
@dataclass(frozen=True)
 class OverlaySession:
    overlay_id: str
    metadata_path: Path
    secret_ref: Path
    owner_identity: str
    request_digest_sha256: str
    binding: TaskBinding
 def _validate_config(config: IdentityOverlayConfig) -> None:
    binding = config.binding
    if not TASK_RE.fullmatch(binding.task_id):
        raise IdentityOverlayError("OVERLAY_TASK_ID_INVALID", 503)
    if binding.repository != "aios/aios":
        raise IdentityOverlayError("OVERLAY_REPOSITORY_REJECTED", 503)
    if binding.base_ref != "refs/heads/main":
        raise IdentityOverlayError("OVERLAY_BASE_REF_REJECTED", 503)
    if not OID_RE.fullmatch(binding.base_oid):
        raise IdentityOverlayError("OVERLAY_BASE_OID_INVALID", 503)
    if (
        not BRANCH_RE.fullmatch(binding.target_branch)
        or binding.target_branch in {"main", "master"}
    ):
        raise IdentityOverlayError("OVERLAY_TARGET_BRANCH_INVALID", 503)
    if not OWNER_IDENTITY_RE.fullmatch(config.owner_identity):
        raise IdentityOverlayError("OVERLAY_OWNER_IDENTITY_INVALID", 503)
    if not 60 <= config.max_ttl_seconds <= 900:
        raise IdentityOverlayError("OVERLAY_MAX_TTL_INVALID", 503)
    if config.state_root == config.secret_root:
        raise IdentityOverlayError("OVERLAY_STATE_SECRET_ROOT_COLLISION", 503)
 def _prepare_directory(path: Path, mode: int = 0o700) -> None:
    if path.is_symlink():
        raise IdentityOverlayError("OVERLAY_PATH_SYMLINK_REJECTED", 500)
    path.mkdir(parents=True, exist_ok=True, mode=mode)
    os.chmod(path, mode)
    if path.stat().st_mode & 0o077:
        raise IdentityOverlayError("OVERLAY_DIRECTORY_PERMISSIONS_REJECTED", 500)
 def _atomic_write(path: Path, data: bytes, mode: int) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    if path.parent.is_symlink() or path.is_symlink():
        raise IdentityOverlayError("OVERLAY_PATH_SYMLINK_REJECTED", 500)
    fd, temporary = tempfile.mkstemp(prefix=".tmp-", dir=path.parent)
    try:
        os.fchmod(fd, mode)
        with os.fdopen(fd, "wb", closefd=True) as stream:
            stream.write(data)
            stream.flush()
            os.fsync(stream.fileno())
        os.replace(temporary, path)
        os.chmod(path, mode)
        parent_fd = os.open(
            path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0)
        )
        try:
            os.fsync(parent_fd)
        finally:
            os.close(parent_fd)
    finally:
        if os.path.exists(temporary):
            os.unlink(temporary)
 def _atomic_write_json(path: Path, value: Any, mode: int = 0o600) -> None:
    _atomic_write(path, canonical_json_bytes(value), mode)
 def _read_json(path: Path) -> dict[str, Any]:
    if path.is_symlink() or not path.is_file():
        raise IdentityOverlayError("OVERLAY_METADATA_INVALID", 500)
    if path.stat().st_size <= 0 or path.stat().st_size > MAX_BODY_BYTES:
        raise IdentityOverlayError("OVERLAY_METADATA_INVALID", 500)
    try:
        value = json.loads(path.read_text(encoding="utf-8"))
    except (UnicodeDecodeError, json.JSONDecodeError):
        raise IdentityOverlayError("OVERLAY_METADATA_INVALID", 500) from None
    if not isinstance(value, dict):
        raise IdentityOverlayError("OVERLAY_METADATA_INVALID", 500)
    return value
 def _parse_utc(value: str) -> datetime:
    try:
        parsed = datetime.fromisoformat(value.replace("Z", "+00:00"))
    except (TypeError, ValueError):
        raise IdentityOverlayError("OVERLAY_TIMESTAMP_INVALID", 500) from None
    if parsed.tzinfo is None:
        raise IdentityOverlayError("OVERLAY_TIMESTAMP_INVALID", 500)
    return parsed.astimezone(timezone.utc)
 def _token_hash(token: bytes) -> str:
    return hashlib.sha256(token.strip()).hexdigest()
 def _safe_unlink(path: Path) -> None:
    try:
        if path.is_symlink():
            raise IdentityOverlayError("OVERLAY_SECRET_SYMLINK_REJECTED", 500)
        path.unlink(missing_ok=True)
    except OSError as exc:
        raise IdentityOverlayError("OVERLAY_SECRET_REMOVAL_FAILED", 500) from exc
 def _validate_request_binding(
    request: Mapping[str, Any], binding: TaskBinding, max_ttl: int
 ) -> dict[str, Any]:
    if set(request) != BROKER_REQUEST_FIELDS:
        raise IdentityOverlayError("OVERLAY_REQUEST_FIELDS_REJECTED")
    if request.get("action") != ACTION:
        raise IdentityOverlayError("OVERLAY_ACTION_REJECTED")
    expected = binding.as_dict()
    for key, value in expected.items():
        if request.get(key) != value:
            raise IdentityOverlayError(
                "OVERLAY_BINDING_MISMATCH", 409, details={"field": key}
            )
    if request.get("one_time_use") is not True:
        raise IdentityOverlayError("OVERLAY_ONE_TIME_USE_REQUIRED")
    expiry = request.get("expires_in_seconds")
    if (
        not isinstance(expiry, int)
        or isinstance(expiry, bool)
        or not 60 <= expiry <= max_ttl
    ):
        raise IdentityOverlayError("OVERLAY_TTL_REJECTED")
    for field in (
        "production_change_authorized",
        "tag_change_authorized",
        "baseline_change_authorized",
        "main_write_authorized",
    ):
        if request.get(field) is not False:
            raise IdentityOverlayError("OVERLAY_PRODUCTION_CAPABILITY_REJECTED", 403)
    if (
        not isinstance(request.get("allowed_operations"), list)
        or frozenset(request["allowed_operations"])
        != REQUIRED_ALLOWED_OPERATIONS
    ):
        raise IdentityOverlayError("OVERLAY_ALLOWED_OPERATIONS_MISMATCH", 403)
    if (
        not isinstance(request.get("denied_operations"), list)
        or frozenset(request["denied_operations"])
        != REQUIRED_DENIED_OPERATIONS
    ):
        raise IdentityOverlayError("OVERLAY_DENIED_OPERATIONS_MISMATCH", 403)
    return dict(request)
 def _metadata_digest(metadata: Mapping[str, Any]) -> str:
    unsigned = {
        key: value
        for key, value in metadata.items()
        if key != "metadata_digest_sha256"
    }
    return sha256_json(unsigned)
 def _verify_metadata(metadata: Mapping[str, Any]) -> None:
    if metadata.get("schema") != OVERLAY_SCHEMA:
        raise IdentityOverlayError("OVERLAY_METADATA_SCHEMA_INVALID", 500)
    overlay_id = str(metadata.get("overlay_id") or "")
    if not OVERLAY_ID_RE.fullmatch(overlay_id):
        raise IdentityOverlayError("OVERLAY_METADATA_ID_INVALID", 500)
    expected = _metadata_digest(metadata)
    if metadata.get("metadata_digest_sha256") != expected:
        raise IdentityOverlayError("OVERLAY_METADATA_DIGEST_MISMATCH", 500)
 class TaskIdentityOverlayStore:
    """Issue, authenticate, consume and revoke one task-bound credential."""
    def __init__(self, config: IdentityOverlayConfig) -> None:
        _validate_config(config)
        self.config = config
    @property
    def lock_path(self) -> Path:
        return self.config.state_root / "overlay.lock"
    def _lock(self):
        _prepare_directory(self.config.state_root)
        _prepare_directory(self.config.secret_root)
        self.lock_path.touch(mode=0o600, exist_ok=True)
        os.chmod(self.lock_path, 0o600)
        stream = self.lock_path.open("r+b")
        fcntl.flock(stream.fileno(), fcntl.LOCK_EX)
        return stream
    def _metadata_paths(self) -> list[Path]:
        return sorted(self.config.state_root.glob("overlay-*/metadata.json"))
    def _active_for_task(self) -> tuple[Path, dict[str, Any]] | None:
        now = utc_now()
        for path in self._metadata_paths():
            metadata = _read_json(path)
            _verify_metadata(metadata)
            if metadata.get("task_id") != self.config.binding.task_id:
                continue
            state = metadata.get("status")
            if state in TERMINAL_STATES:
                continue
            if _parse_utc(str(metadata["expires_at"])) <= now:
                metadata["status"] = "EXPIRED"
                metadata["expired_at"] = iso_utc(now)
                metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
                _atomic_write_json(path, metadata)
                _safe_unlink(Path(str(metadata["secret_ref"])))
                continue
            return path, metadata
        return None
    def _assert_hash_unique(self, digest: str) -> None:
        matches = 0
        for path in self._metadata_paths():
            metadata = _read_json(path)
            _verify_metadata(metadata)
            if metadata.get("token_sha256") == digest:
                matches += 1
        for secret_ref in self.config.collision_secret_refs:
            if not secret_ref.exists():
                continue
            if secret_ref.is_symlink() or not secret_ref.is_file():
                raise IdentityOverlayError(
                    "OVERLAY_COLLISION_SECRET_REF_INVALID", 500
                )
            if secret_ref.stat().st_size > 65_536:
                raise IdentityOverlayError(
                    "OVERLAY_COLLISION_SECRET_REF_INVALID", 500
                )
            if _token_hash(secret_ref.read_bytes()) == digest:
                matches += 1
        if matches:
            raise IdentityOverlayError("OVERLAY_SECRET_IDENTITY_COLLISION", 409)
    def issue(
        self,
        *,
        ttl_seconds: int,
        authorization_assertion_ref: str,
        operator_identity: str,
    ) -> dict[str, Any]:
        if self.config.require_root_issue and os.geteuid() != 0:
            raise IdentityOverlayError("OVERLAY_ROOT_ISSUER_REQUIRED", 403)
        if (
            not isinstance(ttl_seconds, int)
            or isinstance(ttl_seconds, bool)
            or not 60 <= ttl_seconds <= self.config.max_ttl_seconds
        ):
            raise IdentityOverlayError("OVERLAY_TTL_REJECTED")
        if not AUTH_ASSERTION_RE.fullmatch(authorization_assertion_ref):
            raise IdentityOverlayError("OVERLAY_AUTH_ASSERTION_REF_INVALID")
        if not OWNER_IDENTITY_RE.fullmatch(operator_identity):
            raise IdentityOverlayError("OVERLAY_OPERATOR_IDENTITY_INVALID")
        with self._lock():
            active = self._active_for_task()
            if active:
                _, metadata = active
                expected = self.config.binding.as_dict()
                actual = {
                    key: metadata.get(key)
                    for key in expected
                }
                if actual != expected:
                    raise IdentityOverlayError(
                        "OVERLAY_ACTIVE_BINDING_CONFLICT", 409
                    )
                return {
                    "status": "OVERLAY_ACTIVE",
                    "idempotent": True,
                    "overlay_id": metadata["overlay_id"],
                    "secret_ref": metadata["secret_ref"],
                    "expires_at": metadata["expires_at"],
                    "binding": expected,
                }
            token_text = secrets.token_urlsafe(48)
            token_bytes = token_text.encode("ascii")
            digest = _token_hash(token_bytes)
            self._assert_hash_unique(digest)
            overlay_id = "overlay-" + hashlib.sha256(
                (
                    f"{self.config.binding.task_id}\0"
                    f"{self.config.binding.base_oid}\0"
                    f"{self.config.binding.target_branch}\0"
                    f"{digest}"
                ).encode("utf-8")
            ).hexdigest()[:32]
            issued_at = utc_now()
            expires_at = issued_at + timedelta(seconds=ttl_seconds)
            overlay_dir = self.config.state_root / overlay_id
            secret_dir = self.config.secret_root / overlay_id
            _prepare_directory(overlay_dir)
            _prepare_directory(secret_dir)
            secret_ref = secret_dir / "bearer.token"
            _atomic_write(secret_ref, token_bytes + b"\n", 0o600)
            metadata: dict[str, Any] = {
                "schema": OVERLAY_SCHEMA,
                "overlay_id": overlay_id,
                "status": "ACTIVE",
                **self.config.binding.as_dict(),
                "owner_identity": self.config.owner_identity,
                "role": "owner",
                "scope": OVERLAY_SCOPE,
                "wildcard_scope": False,
                "one_time_use": True,
                "token_sha256": digest,
                "secret_ref": str(secret_ref),
                "authorization_assertion_ref": authorization_assertion_ref,
                "operator_identity": operator_identity,
                "issued_at": iso_utc(issued_at),
                "expires_at": iso_utc(expires_at),
                "attempt_count": 0,
            }
            metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
            metadata_path = overlay_dir / "metadata.json"
            _atomic_write_json(metadata_path, metadata)
            _atomic_write_json(
                overlay_dir / "audit-issued.json",
                {
                    "event": "TASK_IDENTITY_OVERLAY_ISSUED",
                    "overlay_id": overlay_id,
                    "task_id": self.config.binding.task_id,
                    "binding_digest_sha256": sha256_json(
                        self.config.binding.as_dict()
                    ),
                    "authorization_assertion_ref": authorization_assertion_ref,
                    "operator_identity": operator_identity,
                    "issued_at": metadata["issued_at"],
                    "expires_at": metadata["expires_at"],
                    "token_sha256": digest,
                },
            )
            return {
                "status": "OVERLAY_ACTIVE",
                "idempotent": False,
                "overlay_id": overlay_id,
                "secret_ref": str(secret_ref),
                "expires_at": metadata["expires_at"],
                "binding": self.config.binding.as_dict(),
            }
    def authenticate_and_lock(
        self, token: str, request: Mapping[str, Any]
    ) -> OverlaySession:
        if not token or len(token) > 4096:
            raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
        digest = _token_hash(token.encode("utf-8"))
        with self._lock():
            matches: list[tuple[Path, dict[str, Any]]] = []
            for path in self._metadata_paths():
                metadata = _read_json(path)
                _verify_metadata(metadata)
                if metadata.get("token_sha256") == digest:
                    matches.append((path, metadata))
            if not matches:
                raise IdentityOverlayError("OVERLAY_CREDENTIAL_INVALID", 401)
            if len(matches) != 1:
                raise IdentityOverlayError("OVERLAY_SECRET_IDENTITY_COLLISION", 409)
            path, metadata = matches[0]
            if metadata.get("status") in TERMINAL_STATES:
                raise IdentityOverlayError("OVERLAY_CREDENTIAL_INACTIVE", 401)
            if _parse_utc(str(metadata["expires_at"])) <= utc_now():
                metadata["status"] = "EXPIRED"
                metadata["expired_at"] = iso_utc(utc_now())
                metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
                _atomic_write_json(path, metadata)
                _safe_unlink(Path(str(metadata["secret_ref"])))
                raise IdentityOverlayError("OVERLAY_CREDENTIAL_EXPIRED", 401)
            expected = self.config.binding.as_dict()
            for key, value in expected.items():
                if metadata.get(key) != value:
                    raise IdentityOverlayError(
                        "OVERLAY_METADATA_BINDING_MISMATCH", 409
                    )
            if metadata.get("owner_identity") != self.config.owner_identity:
                raise IdentityOverlayError("OVERLAY_OWNER_IDENTITY_MISMATCH", 409)
            if metadata.get("scope") != OVERLAY_SCOPE:
                raise IdentityOverlayError("OVERLAY_SCOPE_MISMATCH", 409)
            if metadata.get("wildcard_scope") is not False:
                raise IdentityOverlayError("OVERLAY_WILDCARD_SCOPE_REJECTED", 409)
            # Validate detailed request policy only after the bearer identity is
            # proven, so unauthenticated callers cannot probe task bindings.
            validated = _validate_request_binding(
                request, self.config.binding, self.config.max_ttl_seconds
            )
            request_digest = sha256_json(validated)
            previous = str(metadata.get("request_digest_sha256") or "")
            if metadata.get("status") == "LOCKED" and previous != request_digest:
                raise IdentityOverlayError("OVERLAY_REPLAY_REQUEST_MISMATCH", 409)
            metadata["status"] = "LOCKED"
            metadata["request_digest_sha256"] = request_digest
            metadata["locked_at"] = metadata.get("locked_at") or iso_utc(utc_now())
            metadata["attempt_count"] = int(metadata.get("attempt_count") or 0) + 1
            metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
            _atomic_write_json(path, metadata)
            return OverlaySession(
                overlay_id=str(metadata["overlay_id"]),
                metadata_path=path,
                secret_ref=Path(str(metadata["secret_ref"])),
                owner_identity=str(metadata["owner_identity"]),
                request_digest_sha256=request_digest,
                binding=self.config.binding,
            )
    def complete(
        self, session: OverlaySession, result: Mapping[str, Any]
    ) -> dict[str, Any]:
        with self._lock():
            metadata = _read_json(session.metadata_path)
            _verify_metadata(metadata)
            if metadata.get("status") == "CONSUMED":
                return metadata
            if metadata.get("status") != "LOCKED":
                raise IdentityOverlayError("OVERLAY_NOT_LOCKED", 409)
            if (
                metadata.get("request_digest_sha256")
                != session.request_digest_sha256
            ):
                raise IdentityOverlayError("OVERLAY_REQUEST_DIGEST_MISMATCH", 409)
            metadata["status"] = "CONSUMED"
            metadata["consumed_at"] = iso_utc(utc_now())
            metadata["result_digest_sha256"] = sha256_json(dict(result))
            metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
            _atomic_write_json(session.metadata_path, metadata)
            _safe_unlink(session.secret_ref)
            _atomic_write_json(
                session.metadata_path.parent / "audit-consumed.json",
                {
                    "event": "TASK_IDENTITY_OVERLAY_CONSUMED",
                    "overlay_id": session.overlay_id,
                    "task_id": session.binding.task_id,
                    "request_digest_sha256": session.request_digest_sha256,
                    "result_digest_sha256": metadata["result_digest_sha256"],
                    "consumed_at": metadata["consumed_at"],
                    "secret_removed": True,
                },
            )
            return metadata
    def fail(
        self,
        session: OverlaySession,
        *,
        error_code: str,
        error_status: int,
    ) -> dict[str, Any]:
        with self._lock():
            metadata = _read_json(session.metadata_path)
            _verify_metadata(metadata)
            if metadata.get("status") in TERMINAL_STATES:
                return metadata
            metadata["status"] = "FAILED"
            metadata["failed_at"] = iso_utc(utc_now())
            metadata["error_code"] = error_code
            metadata["error_status"] = int(error_status)
            metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
            _atomic_write_json(session.metadata_path, metadata)
            _safe_unlink(session.secret_ref)
            _atomic_write_json(
                session.metadata_path.parent / "audit-failed.json",
                {
                    "event": "TASK_IDENTITY_OVERLAY_FAILED",
                    "overlay_id": session.overlay_id,
                    "task_id": session.binding.task_id,
                    "request_digest_sha256": session.request_digest_sha256,
                    "error_code": error_code,
                    "error_status": int(error_status),
                    "failed_at": metadata["failed_at"],
                    "secret_removed": True,
                },
            )
            return metadata
    def revoke(self, overlay_id: str, *, reason: str) -> dict[str, Any]:
        if self.config.require_root_issue and os.geteuid() != 0:
            raise IdentityOverlayError("OVERLAY_ROOT_ISSUER_REQUIRED", 403)
        if not OVERLAY_ID_RE.fullmatch(overlay_id):
            raise IdentityOverlayError("OVERLAY_ID_INVALID")
        if not AUTH_ASSERTION_RE.fullmatch(reason):
            raise IdentityOverlayError("OVERLAY_REVOCATION_REASON_INVALID")
        with self._lock():
            path = self.config.state_root / overlay_id / "metadata.json"
            metadata = _read_json(path)
            _verify_metadata(metadata)
            if metadata.get("status") not in TERMINAL_STATES:
                metadata["status"] = "REVOKED"
                metadata["revoked_at"] = iso_utc(utc_now())
                metadata["revocation_reason"] = reason
                metadata["metadata_digest_sha256"] = _metadata_digest(metadata)
                _atomic_write_json(path, metadata)
                _safe_unlink(Path(str(metadata["secret_ref"])))
            return metadata
    def status(self, overlay_id: str) -> dict[str, Any]:
        if not OVERLAY_ID_RE.fullmatch(overlay_id):
            raise IdentityOverlayError("OVERLAY_ID_INVALID")
        metadata = _read_json(
            self.config.state_root / overlay_id / "metadata.json"
        )
        _verify_metadata(metadata)
        return {
            key: value
            for key, value in metadata.items()
            if key not in {"token_sha256"}
        }
 class TaskIdentityOverlayService:
    """Authenticate one overlay credential and invoke the existing broker."""
    def __init__(
        self,
        config: IdentityOverlayConfig,
        provisioner: TaskWriterProvisioner | None = None,
    ) -> None:
        self.config = config
        self.store = TaskIdentityOverlayStore(config)
        broker_state = config.broker_state_root or (
            config.state_root / "owner-authorization-events"
        )
        self.broker = OwnerAuthorizationBroker(
            OwnerAuthorizationBrokerConfig(
                repository_identity=config.binding.repository,
                state_root=broker_state,
                allowed_owner_identities=frozenset({config.owner_identity}),
                allowed_intake_scopes=frozenset({OVERLAY_SCOPE}),
                allowed_credential_ids=frozenset(),
                max_expiry_seconds=config.max_ttl_seconds,
            ),
            provisioner=provisioner,
        )
    def provision(
        self, request: Mapping[str, Any], bearer_token: str
    ) -> dict[str, Any]:
        session = self.store.authenticate_and_lock(bearer_token, request)
        principal = OwnerPrincipal(
            identity=session.owner_identity,
            role="owner",
            authenticated_scope=OVERLAY_SCOPE,
            token_scopes=frozenset({OVERLAY_SCOPE}),
            credential_id=session.overlay_id,
        )
        try:
            result = self.broker.authorize_and_provision(request, principal)
            if result.get("status") != "READY_FOR_CODE_AUTHORING":
                raise IdentityOverlayError("OVERLAY_PROVISIONER_NOT_READY", 409)
            self.store.complete(session, result)
            response = dict(result)
            response.update(
                {
                    "identity_overlay_id": session.overlay_id,
                    "identity_overlay_consumed": True,
                    "identity_overlay_secret_removed": True,
                    "identity_overlay_scope": OVERLAY_SCOPE,
                }
            )
            return response
        except (OwnerAuthorizationError, ProvisioningError) as exc:
            self.store.fail(
                session, error_code=exc.code, error_status=exc.status
            )
            raise
        except IdentityOverlayError as exc:
            self.store.fail(
                session, error_code=exc.code, error_status=exc.status
            )
            raise
        except Exception as exc:
            self.store.fail(
                session,
                error_code="IDENTITY_OVERLAY_INTERNAL_ERROR",
                error_status=500,
            )
            raise IdentityOverlayError(
                "IDENTITY_OVERLAY_INTERNAL_ERROR", 500
            ) from exc
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
chatgpt-final-release-writer	d070735480	evidence: close V2R1C4 v3 security validation	2026-07-29 20:32:26 +08:00
chatgpt-final-release-writer	56bb00cd13	security: prove failure scenarios and non-root execution	2026-07-29 20:27:20 +08:00
chatgpt-final-release-writer	44833d22fe	security: derive evidence gates from required raw results	2026-07-29 20:21:05 +08:00
chatgpt-final-release-writer	476acb258f	security: bind evidence conclusions to raw observations	2026-07-29 20:08:59 +08:00
chatgpt-final-release-writer	b044d7a427	security: preserve revoker recovery credential boundary	2026-07-29 19:58:42 +08:00
chatgpt-final-release-writer	2ab06fd5aa	evidence: add deterministic v3 closure generator	2026-07-29 19:50:05 +08:00
chatgpt-final-release-writer	0444d3e13f	test: add isolated V2R1C4 live candidate fixtures	2026-07-29 19:45:06 +08:00
chatgpt-final-release-writer	202eade75b	security: close writer and revoker identity invariants	2026-07-29 19:44:29 +08:00
chatgpt-final-release-writer	5e46d2bc7e	security: bind release approval and transactional recovery	2026-07-29 19:44:18 +08:00
chatgpt-final-release-writer	473b86a2f1	integrate:v2r1c4-autonomy-control-plane-v2	2026-07-29 17:11:42 +08:00
chatgpt-final-release-writer	e5dc9185dd	test:scope-single-owner-systemd-contract	2026-07-29 13:48:39 +08:00
chatgpt-final-release-writer	334354557a	integrate:v2r1c4-autonomy-handoff	2026-07-29 13:44:17 +08:00
chatgpt-final-release-writer	9917145a64	release:v2r1c4-version-contract	2026-07-29 13:33:36 +08:00
AIOS Governed Development Writer	357041bc3c	feat(control-plane): add unified seven-component bootstrap contracts	2026-07-29 13:24:00 +08:00
AIOS Governed Development Writer	ba403c0959	merge(v2r1c4): integrate single-owner governance hardening	2026-07-29 13:17:37 +08:00
AIOS Governed Development Writer	aa2ffdb5a8	merge(v2r1c4): integrate autonomous release and WeChat candidate	2026-07-29 13:17:37 +08:00
Codex Agent	310ab2af90	evidence: close live activation hardening candidate	2026-07-29 12:30:10 +08:00
Codex Agent	71def340e7	governance: harden single-owner live activation	2026-07-29 12:28:37 +08:00
Codex Agent	e1e438564c	feat(governance): add fail-closed live activation	2026-07-29 11:27:04 +08:00
AIOS Task-Bound Prerequisites Writer	fa038d17b2	governance: add dormant single-owner activation prerequisites	2026-07-29 04:00:00 +08:00
AIOS Task-Bound Writer	112d995545	feat(gitops): implement integration refresh provisioner	2026-07-28 17:23:52 +08:00
AIOS Task-Bound Writer	85426f4f57	chore(source-map): import canonical runtime sources	2026-07-28 17:06:58 +08:00
chatgpt-final-release-writer	c294b90fd7	docs(autonomous-release): add final V2R1C4 agent execution contract	2026-07-26 14:24:37 +08:00
chatgpt-final-release-writer	8806aabb52	test(autonomous-release): complete candidate and final acceptance coverage	2026-07-26 14:19:50 +08:00
chatgpt-final-release-writer	3a44188d39	fix(autonomous-release): bind owner approval to exact final release digest	2026-07-26 14:16:15 +08:00
chatgpt-final-release-writer	7a1d704054	test(autonomous-release): verify dormant acceptance contracts	2026-07-26 14:12:16 +08:00
chatgpt-final-release-writer	752691869f	feat(autonomous-release): make dormant acceptance runner machine executable	2026-07-26 14:12:09 +08:00
chatgpt-final-release-writer	27c3fe09fa	feat(autonomous-release): complete candidate and final dormant acceptance gates	2026-07-26 14:09:47 +08:00
chatgpt-final-release-writer	7484a3b442	feat(autonomous-release): add dormant acceptance contract	2026-07-26 14:05:55 +08:00
chatgpt-final-release-writer	432f88ea6f	docs(autonomous-release): add V2R1C4 dormant execution guide	2026-07-26 14:01:38 +08:00
chatgpt-final-release-writer	60af3e4105	feat(autonomous-release): add dormant candidate worker entrypoint	2026-07-26 13:55:20 +08:00
chatgpt-final-release-writer	83376fa777	feat(autonomous-release): add dormant candidate systemd template	2026-07-26 13:51:50 +08:00
chatgpt-final-release-writer	eb3f507b64	build(autonomous-release): add deterministic artifact builder script	2026-07-26 13:25:35 +08:00
chatgpt-final-release-writer	6eb5825db8	build(autonomous-release): add candidate package metadata	2026-07-26 13:25:28 +08:00
chatgpt-final-release-writer	0b7539095d	docs(autonomous-release): add final execution package	2026-07-26 13:22:24 +08:00
chatgpt-final-release-writer	678d7000b1	docs(autonomous-release): add dormant shadow-only release guide	2026-07-26 13:22:13 +08:00
chatgpt-final-release-writer	faadd35c76	test(autonomous-release): verify dormant shadow-only release gate	2026-07-26 12:31:20 +08:00
chatgpt-final-release-writer	28168d3ecd	feat(autonomous-release): codify dormant shadow-only release mode	2026-07-26 11:58:02 +08:00
		`@@ -1 +0,0 @@`
			`"""Permanent AIOS governance source components."""`