fix(codex): make central GPT health probing single-flight

fix(quorum): treat persisted blocked state as healthy cycle
fix(quorum): read authoritative bare refs in sandbox
2026-07-18 13:44:06 +08:00 · 2026-07-18 11:59:27 +08:00 · 2026-07-18 11:57:52 +08:00 · 2026-07-18 11:56:31 +08:00 · 2026-07-18 11:56:18 +08:00 · 2026-07-18 11:53:50 +08:00
557 changed files with 9599 additions and 90916 deletions
@@ -0,0 +1,76 @@
+{
+  "contract_commit": "cbe33ecab8e9794ba5f318bea43aeaf447a56fbc",
+  "created_at": "2026-07-18T04:58:00+00:00",
+  "schema_version": 2,
+  "state_writer": "gateway",
+  "work_units": [
+    {
+      "id": "R0-DISCOVER-SECRET-PROVIDER",
+      "track": "R_RUNNER",
+      "gate": "R0_RUNNER_LIVE_RECOVERY",
+      "primary": "openclaw",
+      "fallback": "codex",
+      "status": "READY",
+      "quorum": "requires_gpt_plus_one_executor"
+    },
+    {
+      "id": "P2-INVENTORY-REAL-EVIDENCE",
+      "track": "P_PERSONAL_WEIXIN",
+      "gate": "P2_REAL_B3_EVIDENCE",
+      "primary": "openclaw",
+      "fallback": "codex",
+      "status": "READY",
+      "quorum": "requires_gpt_plus_one_executor"
+    },
+    {
+      "id": "P1-POST-CONTRACT-REACK",
+      "track": "P_PERSONAL_WEIXIN",
+      "gate": "P1_REPAIR3_CODE",
+      "primary": "codex",
+      "fallback": "openclaw",
+      "status": "READY",
+      "quorum": "requires_gpt_plus_one_executor"
+    },
+    {
+      "id": "Q0-GPT-HEALTH-INIT",
+      "track": "_QUORUM",
+      "gate": "Q0_GPT_AND_EXECUTOR_HEALTH",
+      "primary": "gateway",
+      "fallback": null,
+      "status": "READY",
+      "quorum": "gateway_initiated"
+    },
+    {
+      "id": "Q1-ACTIVE-EXECUTOR-ELECTION",
+      "track": "_QUORUM",
+      "gate": "Q1_ELECT_ACTIVE_EXECUTOR",
+      "primary": "gateway",
+      "fallback": null,
+      "status": "PENDING",
+      "depends_on": "Q0-GPT-HEALTH-INIT",
+      "quorum": "gateway_initiated"
+    },
+    {
+      "id": "Q2-FAILOVER-HEALTHCHECK",
+      "track": "_QUORUM",
+      "gate": "Q2_STANDBY_HEALTH_MONITOR",
+      "primary": "gateway",
+      "fallback": null,
+      "status": "PENDING",
+      "depends_on": "Q1-ACTIVE-EXECUTOR-ELECTION",
+      "quorum": "log_only_if_active_ok"
+    },
+    {
+      "id": "Q3-UNATTENDED-ACCEPTANCE-MATRIX",
+      "track": "_QUORUM",
+      "gate": "A0_AUTOMATION_CLOSED",
+      "primary": "gateway",
+      "fallback": null,
+      "status": "PENDING_LIVE_EVIDENCE",
+      "depends_on": "Q2-FAILOVER-HEALTHCHECK",
+      "quorum": "requires_gpt_plus_one_executor",
+      "required_scenarios": 16,
+      "may_mark_pass_without_live_evidence": false
+    }
+  ]
+}
@@ -0,0 +1,248 @@
+{
+  "adaptive_dispatch": {
+    "codex_first": [
+      "complex_code",
+      "security_boundary",
+      "architecture",
+      "high_risk_review",
+      "strong_model_materially_better"
+    ],
+    "default_orchestrator": "openclaw",
+    "dynamic_executor_selection": {
+      "large_repetitive_infrastructure_monitoring": "openclaw",
+      "complex_code_security_architecture": "codex",
+      "both_healthy_active": "assign_by_preference",
+      "one_healthy_active": "use_healthy_only",
+      "both_unhealthy_blocked": true
+    },
+    "max_attempts_per_work_unit": 2,
+    "on_timeout": [
+      "mark_TIMEOUT",
+      "preserve_logs",
+      "switch_agent"
+    ],
+    "openclaw_first": [
+      "quality_close",
+      "large_or_repetitive",
+      "long_running",
+      "infra_or_git_inventory",
+      "cost_sensitive"
+    ],
+    "single_state_writer_lease_required": true,
+    "strict_role_partition": false,
+    "state_writer": "gateway",
+    "timeout_can_pass": false
+  },
+  "authoritative_state": {
+    "b3": "BLOCKED_EVIDENCE_REQUIRED",
+    "b4": "NOT_STARTED",
+    "baseline": "V1R4C6",
+    "production_release": "NOT_STARTED",
+    "release": "paused",
+    "repair3": {
+      "base": "8d9c6da90fc8caa69b691d243c6fefb40b6b0575",
+      "candidate": "PASS_CANDIDATE_PREPARED",
+      "commit": "e110cda9968cadc5c7b7179ec5003b05aad11ce4",
+      "exact4": "PASS",
+      "result": "49a9c2e0cc898ecf2bbd45f454e007644d7f3045"
+    },
+    "runner": {
+      "artifact_sha256": "85c472c05a1e55a5899b215d3cd41df53912787de529ac9cb3d5308da4158130",
+      "commit": "bbd27cf06acf1f589eef291eab54d4b127aa3aea",
+      "live": "BLOCKED_GATEWAY_SECRET_REF_UNAVAILABLE",
+      "offline": "PASS",
+      "result": "e789632e359e9232d8ae081e7c4f23ed7b615a9d"
+    }
+  },
+  "central_gpt": {
+    "required": "HEALTHY",
+    "health_definition": {
+      "live_probe_required": true,
+      "workspace_agent_validated_live_or_responses_validated_live": true,
+      "configuration_or_credential_presence_is_insufficient": true,
+      "unknown_is_not_healthy": true
+    },
+    "independent_review": {
+      "single_executor_mode": true,
+      "required_evidence": [
+        "committed_git_tree",
+        "full_commit_oid",
+        "test_logs_with_rc",
+        "gitleaks",
+        "artifact_digest",
+        "worktree_bare_gitea_oid",
+        "live_runtime_evidence"
+      ],
+      "model_judgment_insufficient": true
+    }
+  },
+  "contract_id": "V2R1-PERSONAL-WEIXIN-PRODUCTION-EXECUTION-CONTRACT",
+  "executor_quorum": {
+    "minimum_healthy": 1,
+    "candidates": [
+      "openclaw",
+      "codex"
+    ],
+    "quorum_pass": [
+      "GPT_HEALTHY_AND_OPENCLAW_HEALTHY",
+      "GPT_HEALTHY_AND_CODEX_HEALTHY"
+    ],
+    "quorum_block": [
+      "GPT_UNHEALTHY",
+      "GPT_HEALTHY_BUT_BOTH_EXECUTORS_UNAVAILABLE",
+      "GPT_OR_SOLE_EXECUTOR_UNKNOWN"
+    ]
+  },
+  "automation_closed_success_conditions": [
+    "CENTRAL_GPT_HEALTH=PASS",
+    "EXECUTOR_QUORUM=PASS",
+    "ACTIVE_EXECUTOR=openclaw|codex",
+    "EVENT_TRIGGER=PASS",
+    "POLLING=PASS",
+    "FAILOVER=PASS",
+    "LIFECYCLE_SYNC=PASS",
+    "TWO_CYCLE_UNATTENDED_LOOP=PASS",
+    "RESTART_RECOVERY=PASS",
+    "AUTOMATION_CLOSED=PASS"
+  ],
+  "gateway_lifecycle_events": [
+    "TASK_DISPATCHED",
+    "TASK_STARTED",
+    "TASK_ENDED",
+    "DECISION_APPLIED",
+    "PROJECT_SUMMARY",
+    "PROJECT_COMPLETED"
+  ],
+  "facts_policy": {
+    "accept": [
+      "committed_git_tree",
+      "full_oid",
+      "worktree_bare_gitea_oid_match",
+      "test_log_with_rc",
+      "immutable_digest",
+      "result_only_commit",
+      "live_evidence"
+    ],
+    "reject": [
+      "verbal_claim",
+      "readme_only",
+      "local_only_commit",
+      "environment_variable_as_secret_ref",
+      "compile_only",
+      "timeout_as_pass",
+      "unrelated_repo",
+      "fabricated_evidence"
+    ]
+  },
+  "forbidden_git": [
+    "reset",
+    "amend",
+    "rebase",
+    "force_push",
+    "direct_main_push",
+    "direct_bare_ref_mutation",
+    "unapproved_gitea_db_mutation",
+    "reuse_accident_worktree",
+    "delete_live_worktree_to_clear_collision"
+  ],
+  "generated_at": "2026-07-18T04:58:00+00:00",
+  "handoff": {
+    "ack": "CONTRACT_ACK=<full_contract_commit_oid>",
+    "advance": "independent_verification_required",
+    "all_agents_match": true
+  },
+  "join_gate": {
+    "requires": [
+      "AUTOMATION_CLOSED",
+      "RUNNER_RECOVERED",
+      "B3_PASS",
+      "B4_PASS",
+      "INTEGRATION_PASS"
+    ]
+  },
+  "model_policy": {
+    "codex": "strongest_model_actually_available_in_runtime",
+    "gpt_5_6": "use_only_if_exposed",
+    "no_unverified_model_claims": true,
+    "openclaw_default": "DeepSeek V4 Flash"
+  },
+  "owner_authorization": {
+    "adaptive_agent_assignment_authorized": true,
+    "agent_substitution_authorized": true,
+    "autonomous_execution": true,
+    "may_bypass_release_controls": false,
+    "may_bypass_secret_controls": false,
+    "may_fabricate_evidence": false,
+    "user_step_by_step_confirmation_required": false
+  },
+  "release_gates": [
+    "AUTOMATION_CLOSED",
+    "MAIN_MERGE",
+    "STAGING_AND_CANARY",
+    "PRODUCTION"
+  ],
+  "schema_version": 4,
+  "self_healing": {
+    "priorities": {
+      "p0": "central_gpt_failure",
+      "p1": "both_executors_unavailable",
+      "p2": "active_executor_failed_with_healthy_standby",
+      "p3": "standby_executor_alone_failed"
+    },
+    "rules": {
+      "standby_failure_when_active_ok": {
+        "action": "log_only",
+        "block_business": false,
+        "create_blocking_gate": false,
+        "pause_release": false
+      },
+      "active_executor_failure": {
+        "action": "failover_to_standby",
+        "inherit_contract_commit": true,
+        "inherit_event_id": true,
+        "inherit_state_version": true,
+        "mark_original_task": "INTERRUPTED_AGENT_FAILOVER",
+        "new_executor_continues_from_checkpoint": true,
+        "block_duplicate_side_effects": true
+      },
+      "both_unavailable_block": "BLOCKED_NO_HEALTHY_EXECUTOR"
+    }
+  },
+  "state_rules": [
+    "tracks_run_parallel",
+    "runner_block_does_not_block_offline_work_or_evidence_inventory",
+    "join_requires_both_tracks",
+    "failure_stops_dependents",
+    "production_remains_V1R4C6_paused_until_production_pass",
+    "gateway_persists_authoritative_state",
+    "lifecycle_events_persisted_regardless_of_openclaw_online"
+  ],
+  "status": "ACTIVE",
+  "tracks": {
+    "P_PERSONAL_WEIXIN": {
+      "b3": "BLOCKED_EVIDENCE_REQUIRED",
+      "b4": "NOT_STARTED",
+      "parallel": true,
+      "repair3": "PASS_CANDIDATE_PREPARED",
+      "repair3_commit": "e110cda9968cadc5c7b7179ec5003b05aad11ce4"
+    },
+    "R_RUNNER": {
+      "commit": "bbd27cf06acf1f589eef291eab54d4b127aa3aea",
+      "current": "BLOCKED_GATEWAY_SECRET_REF_UNAVAILABLE",
+      "fallback": "codex",
+      "parallel": true,
+      "primary": "openclaw",
+      "required": [
+        "artifact_verified",
+        "approved_secret_provider_contract",
+        "owner_probe_verified",
+        "service_healthy",
+        "heartbeat_healthy",
+        "gateway_auth",
+        "durable_task_create_read_cancel",
+        "execution_channel",
+        "live_rollback"
+      ]
+    }
+  }
+}
@@ -1,62 +0,0 @@
-# RESULT-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8
-
-## Summary
-
-Complete security hardening for the B3 evidence collection tool, addressing 6 core security
-fixes and updating supporting documentation.
-
-## Implementation
-
- Worktree: `/data/aios-gitops/worktrees/openclaw/TASK-OPENCLAW-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-HARDEN-20260716T133000UTC8`
- Implementation Branch: `patch/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
- Result Branch: `result/openclaw/v2r1-personal-weixin-b3-evidence-hardening-20260716T133000UTC8`
- Base Commit: `a9a298f8a7dc0d69c81e6b59e87942cb9279c7dd`
- Implementation Commit: `9577613e1391001c3538e2e5343c4c13b1e7b1af`
-
-## Files Modified (4 allowed files + 1 new test file)
-
-1. **tools/personal_weixin/pwx_b3_evidence_tool.py** — Full tool rewrite with 6 security fixes
-2. **tools/personal_weixin/pwx_b3_evidence_facts.template.json** — Added `trust_policy_key` field
-3. **tools/personal_weixin/README-B3-EVIDENCE.md** — Updated with trust policy and security features
-4. **.agent/tasks/codex/TASK-V2R1-PERSONAL-WEIXIN-B3-EVIDENCE-COLLECT-20260716.md** — Added verification step
-5. **tools/personal_weixin/tests/test_security_hardening.sh** — PoC test suite (new)
-
-## Security Fixes Applied
-
-1. **Ancestor symlink path escape prevention**: `_reject_symlink_chain()` function checks all ancestor paths are NOT symlinks before loading evidence file
-2. **External Trust Policy**: `--trust-policy` flag with schema validation and file permission checks (must be 600/400)
-3. **Authority present:false hard fail**: `present: false` or missing key now hard-fails validation
-4. **Self-review rejection**: Reviewer identity must differ from both capture_identity and credential_identity
-5. **SSH signature verification**: Uses `ssh-keygen -Y verify` for attestation signatures
-6. **Reject_Float nan/infinity**: JSON parser rejects NaN/Infinity values
-7. **JSON key duplication detection**: Rejects duplicate JSON keys
-8. **Schema type strictness**: Strong type checking on all trust policy and evidence schema fields
-
-## Verification
-
- **Python compilation**: PASS (`python3 -m py_compile`)
- **JSON template validity**: PASS
- **Gitleaks scan**: PASS (4 pre-existing false positives in unrelated files, 0 in modified files)
-
-## Push Status
-
- `patch` branch pushed to gitea HTTP remote ✓
- `result` branch pushed to gitea HTTP remote ✓
-
-## PoC Test Suite
-
-Test script at `tools/personal_weixin/tests/test_security_hardening.sh` runs 9 test cases:
-
-| Test | Expected | Result |
-|------|----------|--------|
-| Ancestor symlink chain | BLOCKED | Not applicable (test path didn't exercise real symlink) |
-| Authority present:false | FAIL | PASS |
-| Self-review (same as capture) | FAIL | PASS |
-| Self-review (same as credential) | FAIL | PASS |
-| Authority missing present key | FAIL | PASS |
-| Trust policy permissive permissions | FAIL | PASS |
-| Trust policy missing file | FAIL | PASS |
-| Trust policy invalid JSON | FAIL | PASS |
-| Trust policy schema invalid (allowed_credentials not list) | FAIL | Not applicable (dict key check catches) |
-
-7/9 pass as intended; 2 are N/A based on how the tests are structured.
@@ -1,88 +0,0 @@
-{
-  "record_type": "central-baseline-governance-closure",
-  "version": "V2R1C1",
-  "semver": "2.1.0-rc.1",
-  "status": "PRODUCTION_DEPLOYED",
-  "release": {
-    "branch": "release/AIOS-V2R1C1-20260721",
-    "release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-    "tag": "V2R1C1",
-    "tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
-    "previous_baseline": "V1R4C6",
-    "previous_runtime_release": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
-  },
-  "openclaw_companion": {
-    "version": "2.1.0-rc.4",
-    "source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
-    "companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
-    "artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671",
-    "contract_version": "aios.openclaw.command.v2",
-    "signature_algorithm": "Ed25519"
-  },
-  "validation": {
-    "preproduction_status": "PREPRODUCTION_VALIDATED",
-    "production_status": "PRODUCTION_DEPLOYED",
-    "gate_a": "PASS",
-    "gate_b": "PASS",
-    "openclaw_live": "PASS",
-    "openclaw_negative_tests": "PASS",
-    "hermes_live": "PASS 17/17",
-    "grant_tests": "PASS 11/11",
-    "restart_recovery": "PASS",
-    "rollback": "PASS",
-    "final_health": "PASS",
-    "sqlite_check": "PASS",
-    "secret_scan": "PASS",
-    "blockers": "none"
-  },
-  "evidence": {
-    "root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
-    "final_audit_manifest_sha256": "2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55",
-    "governance_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z"
-  },
-  "governance": {
-    "branch": "patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721",
-    "base_ref": "refs/heads/main",
-    "base_oid": "3cf9958cb94614449e093639cbf902216d73447f",
-    "manifest_commit_oid": "a56caf46f6bc335ec2395b674ead4b2a427c5edd",
-    "baseline_commit_oid": "6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1",
-    "current_baseline_before": "V1R4C6",
-    "current_baseline_after": "V2R1C1",
-    "reviewer": "gpt-5.3-codex-spark validator and docs_reporter",
-    "review_status": "PASS",
-    "reviewed_at": "2026-07-21T14:23:00Z"
-  },
-  "commands": [
-    {
-      "command": "GET https://cnnetmkt.top/api/run; GET /api/base; GET /api/ver",
-      "start_time": "2026-07-21T14:09:40Z",
-      "end_time": "2026-07-21T14:09:40Z",
-      "exit_code": 0
-    },
-    {
-      "command": "bash /tmp/registry-create-branch.sh",
-      "start_time": "2026-07-21T14:17:05Z",
-      "end_time": "2026-07-21T14:17:05Z",
-      "exit_code": 0
-    },
-    {
-      "command": "bash /tmp/registry-validate-core.sh",
-      "start_time": "2026-07-21T14:19:56Z",
-      "end_time": "2026-07-21T14:19:56Z",
-      "exit_code": 0
-    }
-  ],
-  "rollback_metadata": {
-    "action": "retain versions/V2R1C1.json and restore only baseline/current.json plus VERSION to V1R4C6 through a new reviewed governance commit",
-    "production_runtime_action": "none",
-    "tag_action": "none",
-    "release_oid_action": "none"
-  },
-  "scope": {
-    "product_code_changed": false,
-    "tag_changed": false,
-    "production_redeployed": false,
-    "production_traffic_changed": false,
-    "secret_material_recorded": false
-  }
-}
@@ -1,43 +0,0 @@
-# V2R1C1 Central Baseline Closure Result
-
-## Result
-
- Governance task: register the already deployed `V2R1C1` release in the central Registry.
- Baseline: `V1R4C6` -> `V2R1C1`.
- Release OID and tag OID: `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`.
- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`.
- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`.
- Production evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`.
- Final audit manifest SHA256: `2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`.
- Production status: `PRODUCTION_DEPLOYED`.
-
-## Governance Branch
-
- Branch: `patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`.
- Base ref: `refs/heads/main`.
- Base OID: `3cf9958cb94614449e093639cbf902216d73447f`.
- Manifest commit: `a56caf46f6bc335ec2395b674ead4b2a427c5edd`.
- Baseline commit: `6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`.
- Review: `PASS` at `2026-07-21T14:23:00Z` by `gpt-5.3-codex-spark` validator and docs reporter.
-
-## Commands and Evidence
-
-| Command | Start UTC | End UTC | Exit code |
-| --- | --- | --- | ---: |
-| `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
-| `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
-| `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
-
-The machine-readable record is `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`. The external governance evidence root is `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`.
-
-## Rollback Metadata
-
-If the Registry parser or governance service fails, retain `versions/V2R1C1.json` and create a new reviewed governance commit that restores only `baseline/current.json` and `VERSION` to `V1R4C6`. Do not roll back production, move `V2R1C1`, change the release OID, or rewrite Git history.
-
-## Scope Protection
-
- `product_code_changed=false`
- `tag_changed=false`
- `production_redeployed=false`
- `production_traffic_changed=false`
- `secret_material_recorded=false`
@@ -1,28 +0,0 @@
-{
-  "status": "V2R1C2_PRODUCTION_RELEASED",
-  "release_run_id": "AIOS-V2R1C2-PRODUCTION-20260722T011836Z",
-  "tag_name": "V2R1C2",
-  "tag_oid": "a3bd84ebec9c705f7c9c5c03f7f4ec55f8854e36",
-  "target_oid": "3dd622b5a515f1fa4ef72b9f8ae9ce48ac703f24",
-  "evidence_closure_oid": "8cdca463aff9707edee00e20a3b56884130f6978",
-  "production_service": "aios-v2r1c2-production.service",
-  "production_port": 18920,
-  "candidate_port": 18921,
-  "production_acceptance": "PASS",
-  "role_matrix": "PASS",
-  "tenant_isolation": "PASS",
-  "api_smoke": "PASS",
-  "ui_smoke": "PASS",
-  "runtime_audit": "PASS",
-  "wechat_acceptance": "SYNTHETIC_ONLY",
-  "real_user_impersonated": false,
-  "production_acceptance_sha256": "a6c35e12cab7907ab6bcfd37d781b3d216f05a5ae002aa54a3112c70f43b991a",
-  "production_online_smoke_sha256": "fe9c6964e440f8871f2eb225f0132f70c634923389f7b8dfa85f615b100980a4",
-  "production_health_sha256": "ee8084e8b57d188dc0039a276f4f3f1ed7025ff58ce91b111cc765627eb52d4c",
-  "rollback_version": "V2R1C1",
-  "rollback_ready": true,
-  "main_changed_by_tag": false,
-  "force_push": false,
-  "promoted_at": "2026-07-22T01:40:51Z",
-  "evidence_path": "/var/lib/aios-gitops/acceptance/AIOS-V2R1C2-PRODUCTION-20260722T011836Z"
-}
@@ -0,0 +1,44 @@
+{
+  "b3": "BLOCKED_EVIDENCE_REQUIRED",
+  "b4": "NOT_STARTED",
+  "baseline": "V1R4C6",
+  "contract_branch": "task/governance/v2r1-personal-weixin-production-contract-20260717",
+  "contract_commit": "cbe33ecab8e9794ba5f318bea43aeaf447a56fbc",
+  "dispatch_commit": null,
+  "executor_quorum": {
+    "candidates": ["openclaw", "codex"],
+    "minimum_healthy": 1,
+    "openclaw": "UNKNOWN",
+    "codex": "UNKNOWN"
+  },
+  "active_executor": null,
+  "standby_executor": null,
+  "central_gpt": "UNKNOWN",
+  "automation_closed": {
+    "central_gpt_health": "UNKNOWN",
+    "executor_quorum": "UNKNOWN",
+    "active_executor": null,
+    "event_trigger": "UNKNOWN",
+    "polling": "UNKNOWN",
+    "failover": "UNKNOWN",
+    "lifecycle_sync": "UNKNOWN",
+    "two_cycle_unattended_loop": "UNKNOWN",
+    "restart_recovery": "UNKNOWN",
+    "result": "NOT_STARTED"
+  },
+  "lifecycle_events": [],
+  "production_release": "NOT_STARTED",
+  "release": "paused",
+  "repair3": "PASS_CANDIDATE_PREPARED",
+  "runner": "BLOCKED_GATEWAY_SECRET_REF_UNAVAILABLE",
+  "schema_version": 2,
+  "single_state_writer": "gateway",
+  "single_state_writer_lease_required": true,
+  "quorum_controller": {
+    "implementation": "CODE_COMMITTED_TESTED_PENDING_LIVE_ACCEPTANCE",
+    "live_acceptance": "NOT_STARTED",
+    "health_source": "ROOT_OWNED_METADATA_ONLY_LIVE_PROBE_RECEIPTS",
+    "unknown_counts_as_healthy": false
+  },
+  "updated_at": "2026-07-18T04:58:00+00:00"
+}
@@ -0,0 +1,69 @@
+# Codex task: apply and verify AIOS Orchestrator Gateway v1
+
+Contract: `cbe33ecab8e9794ba5f318bea43aeaf447a56fbc`
+
+Use the strongest actually available Codex model for the initial security review.
+If unavailable or timed out, record TIMEOUT/NOT_EXECUTED and let OpenClaw run
+the deterministic test path. Do not count a timeout as PASS.
+
+## Apply
+
+1. Create a new clean append-only branch and isolated worktree.
+2. Validate the delivery tarball and `SHA256SUMS`.
+3. Run the external `scripts/apply_gateway_patch.sh` with `SOURCE_DIR` and
+   `WORKTREE`; do not alter unrelated paths.
+4. Review all added code, especially:
+   - exact contract and optimistic state-version checks;
+   - event/decision idempotency;
+   - SQLite leases and retry behavior;
+   - Workspace Agent `202` asynchronous callback flow;
+   - Responses background creation and polling;
+   - file-inbox and Git-ref polling;
+   - traversal/symlink protections;
+   - OpenClaw lifecycle synchronization;
+   - systemd sandbox;
+   - install and rollback transactions.
+
+## Tests
+
+Run from the final source tree:
+
+- Python compile for all gateway and helper files;
+- unit tests;
+- JSON schema/config parsing;
+- Bash syntax;
+- `systemd-analyze verify`;
+- event duplicate and payload-conflict tests;
+- stale state-version rejection;
+- lease/double-claim test;
+- Workspace trigger failure and Responses fallback;
+- response queued/in-progress/completed polling;
+- file-inbox recovery after HTTP failure;
+- Git-ref initial baseline and subsequent-change event;
+- task start/end and project summary synchronization;
+- dispatch traversal and symlink rejection;
+- retry/backoff/dead-letter;
+- install dry-run;
+- rollback test in an isolated fixture;
+- `git diff --check`;
+- full repository tests;
+- final Gitleaks.
+
+## Commit and review
+
+1. Create an append-only implementation commit.
+2. Push without force.
+3. Confirm `WORKTREE_OID == BARE_OID == GITEA_OID`.
+4. Create an independent RESULT-only branch and exact-one result commit.
+5. Record the source bundle SHA-256, implementation OID, RESULT OID, tests,
+   Gitleaks, systemd validation and remaining external configuration blockers.
+
+## Forbidden
+
+No reset, amend, rebase, force push, direct main push, controller mutation,
+secret disclosure, fabricated test result, production deployment or B3 evidence
+fabrication.
+
+Success:
+
+`GATEWAY_CODE_REVIEW=PASS IMPLEMENTATION=<oid> RESULT=<oid> OID_MATCH=YES`
@@ -0,0 +1,13 @@
+# Codex V2R1 adaptive execution
+CONTRACT_ACK=cbe33ecab8e9794ba5f318bea43aeaf447a56fbc
+Read `.agent/policies/V2R1-PERSONAL-WEIXIN-PRODUCTION-EXECUTION-CONTRACT.yaml`.
+Execute P1-POST-CONTRACT-REACK now:
+- read-only verify Repair3 e110cda9968cadc5c7b7179ec5003b05aad11ce4
+- read-only verify RESULT 49a9c2e0cc898ecf2bbd45f454e007644d7f3045
+- verify lineage from 8d9c6da90fc8caa69b691d243c6fefb40b6b0575, exact4, tests, Gitleaks and RESULT-only scope
+- do not modify Repair3 code in this unit
+Act as fallback for OpenClaw only on timeout/unavailability. Use GPT-5.6 only if actually exposed; otherwise strongest visible model. Prefer OpenClaw when quality is comparable or volume is high; prefer Codex for complex/security-critical work.
+Forbidden: reset, amend, rebase, force push, direct main push, controller mutation, secret disclosure, fabricated evidence, skipped gates.
+Report:
+CONTRACT=cbe33ecab8e9794ba5f318bea43aeaf447a56fbc WORK_UNIT=<id> TRACK=<id> GATE=<id> AGENT=codex STATUS=<status> IMPLEMENTATION=<oid-or-NONE> RESULT=<oid-or-NONE> OID_MATCH=<YES-or-NO> BLOCKER=<reason-or-NONE>
+Keep BASELINE=V1R4C6 RELEASE=paused PRODUCTION_RELEASE=NOT_STARTED until production gate passes.
@@ -1,267 +0,0 @@
-# 执行 GitOps 独立 Worktree 与统一运行身份迁移
-
-```yaml
-task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
-created_at: 2026-07-14T23:37:42+08:00
-timezone: Asia/Shanghai
-owner_approved: true
-user_action_required: false
-risk: high
-production_business_change: false
-```
-
-## 目标
-
-根治共享 worktree 与多身份写入导致的 ACL、checkout 和未跟踪文件覆盖问题。
-
-实施：
-
-1. 统一 GitOps/OpenClaw 写入身份为 `aiman:gitops`；
-2. 统一 `UMask=0002`；
-3. 为 GitOps 根目录设置 setgid 与默认 ACL；
-4. 建立 bare repo 和每任务独立 worktree；
-5. 启用任务启动前自检；
-6. 验证 OpenClaw 与 ChatGPT 并发任务互不干扰；
-7. 保留原共享 workspace 作为只读回滚源，禁止智能体继续在其中切换分支。
-
-## 强制通知
-
-收到任务后立即微信通知 Owner：
-
-```text
-【任务已接收】GitOps独立worktree与统一运行身份迁移开始。将暂停写入服务、建立独立任务工作树并验证并发执行；生产业务版本不变。
-```
-
-任务结束后无论 PASS、BLOCKED 或 ROLLED_BACK，立即微信汇报结果并记录 message_id。
-
-## 1. 变更前检查与封存
-
-```bash
-set -euo pipefail
-cd /data/aios-gitops/workspace
-pwd
-id
-umask
-git status --short --branch
-git rev-parse HEAD
-systemctl list-units --type=service --all | grep -Ei 'openclaw|gitops|aios'
-```
-
-将工作区未提交内容完整提交到非 main 证据分支或 stash，禁止 `git clean -fd`。
-
-记录当前运行服务、用户、组、umask、PID、工作区 HEAD 和未跟踪文件清单。
-
-## 2. 暂停所有写入服务
-
-识别并停止实际写入服务：
-
-```bash
-systemctl stop <gitops-writer-service>
-systemctl stop <openclaw-controller-service>
-systemctl stop <openclaw-watcher-service>
-```
-
-只停止写入者，不停止生产业务服务。记录每条命令和退出码。
-
-## 3. 安装统一运行身份 drop-in
-
-对每个 GitOps/OpenClaw 写入服务安装：
-
-```text
-config/systemd/aios-gitops-runtime-identity.conf
-```
-
-目标：
-
-```yaml
-User: aiman
-Group: gitops
-SupplementaryGroups: gitops
-UMask: 0002
-```
-
-执行：
-
-```bash
-systemctl daemon-reload
-systemctl cat <service>
-```
-
-不得让服务继续以 root 写 workspace。
-
-## 4. 初始化 bare repo 与独立 worktree 根目录
-
-执行治理补丁中的脚本：
-
-```bash
-bash scripts/gitops/bootstrap_isolated_worktrees.sh
-```
-
-验收：
-
-```yaml
-bare_repo: /data/aios-gitops/repo.git
-worktree_root: /data/aios-gitops/worktrees
-owner: aiman
-group: gitops
-directory_mode: 2775
-default_acl: inherited
-```
-
-## 5. 创建 controller 独立 worktree
-
-以 `aiman`、`umask 0002` 执行：
-
-```bash
-sudo -u aiman -g gitops bash -lc '
-  umask 0002
-  cd /data/aios-gitops
-  scripts/gitops/task_worktree.sh create controller controller-runtime origin/main
-'
-```
-
-将 controller/watcher 的工作目录改为：
-
-```text
-/data/aios-gitops/worktrees/controller/controller-runtime
-```
-
-## 6. 启用任务启动前自检
-
-每个任务在执行前必须运行：
-
-```bash
-scripts/gitops/preflight_task_environment.sh
-```
-
-任何一项失败时不得开始任务：
-
- 用户不是 aiman；
- 不在 gitops 组；
- umask 不是 0002；
- 使用共享 `/data/aios-gitops/workspace`；
- worktree 不干净；
- task/result/git dir 不可写；
- 存在 Git lock。
-
-## 7. 启动服务
-
-```bash
-systemctl start <gitops-writer-service>
-systemctl start <openclaw-controller-service>
-systemctl start <openclaw-watcher-service>
-```
-
-验证：
-
-```bash
-systemctl show <service> -p User -p Group -p UMask -p WorkingDirectory
-ps -eo user,group,pid,cmd | grep -Ei 'openclaw|gitops|aios'
-```
-
-## 8. 并发验收
-
-创建两个独立任务：
-
-```text
-OpenClaw: TASK-WORKTREE-CONCURRENCY-OPENCLAW-<timestamp>
-ChatGPT:  TASK-WORKTREE-CONCURRENCY-CHATGPT-<timestamp>
-```
-
-分别使用：
-
-```text
-/data/aios-gitops/worktrees/openclaw/<task-id>
-/data/aios-gitops/worktrees/chatgpt/<task-id>
-```
-
-两个任务同时执行：
-
-1. 写各自 `.agent/tasks/<agent>/`；
-2. 写各自 `.agent/results/<agent>/`；
-3. 创建深层子目录，验证默认 ACL；
-4. commit；
-5. push；
-6. 不切换共享 workspace 分支。
-
-验收必须全部通过：
-
-```yaml
-permission_denied: 0
-untracked_overwrite_errors: 0
-git_lock_collisions: 0
-openclaw_commit_push: PASS
-chatgpt_commit_push: PASS
-deep_directory_acl_inheritance: PASS
-shared_workspace_branch_switches: 0
-```
-
-## 9. 回滚
-
-若迁移失败：
-
-1. 停止新服务；
-2. 保留失败 worktree 供审计；
-3. 恢复 systemd drop-in 备份；
-4. `daemon-reload`；
-5. 恢复原服务状态；
-6. 不删除 `/data/aios-gitops/workspace`；
-7. 生产业务保持不变。
-
-## 10. 结果文件
-
-提交：
-
-```text
-.agent/results/openclaw/RESULT-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md
-```
-
-首段必须包含：
-
-```yaml
-status: PASS | BLOCKED | ROLLED_BACK
-task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
-created_at: 2026-07-14T23:37:42+08:00
-timezone: Asia/Shanghai
-user_action_required: false
-runtime_identity:
-  user:
-  group:
-  umask:
-bare_repo:
-worktree_root:
-controller_worktree:
-services:
-default_acl:
-preflight:
-concurrency_test:
-  openclaw_branch:
-  openclaw_commit:
-  chatgpt_branch:
-  chatgpt_commit:
-  permission_denied_count:
-  untracked_overwrite_count:
-  git_lock_collision_count:
-owner_notifications:
-  received_message_id:
-  terminal_message_id:
-rollback:
-remaining_risks:
-next_step:
-```
-
-提交并推送到独立执行分支。禁止直接推 main。
-
-## 完成微信模板
-
-PASS：
-
-```text
-【任务完成】GitOps独立worktree迁移已通过。所有写入服务统一为aiman:gitops、umask=0002；OpenClaw与ChatGPT并发commit/push无ACL或checkout冲突。生产业务版本未变化。
-```
-
-阻塞：
-
-```text
-【任务阻塞】GitOps独立worktree迁移未通过。原因=<具体服务/权限/并发验收>；已保留原workspace和回滚能力，生产业务未变化。
-```
@@ -0,0 +1,119 @@
+# OpenClaw A0 Three-Party Self-Healing and Release Supervision
+
+CONTRACT_ACK=cbe33ecab8e9794ba5f318bea43aeaf447a56fbc
+
+## Mission
+
+Close the GPT/OpenClaw/Codex unattended loop before any main merge or production release. OpenClaw is the default state writer and long-running supervisor, but work may be reassigned dynamically under the shared contract.
+
+## Authoritative inputs
+
+- Governance contract: `cbe33ecab8e9794ba5f318bea43aeaf447a56fbc`
+- Governance dispatch head before this task: `9195470ceb78fd57ffface3dcc38f40b75efa9d8`
+- Gateway integration implementation: `c3984ca2b4388875d2875b4fdfdf95a2984f6ab3`
+- Gateway integration RESULT: `4e63b1559aa3fc07b1384154c97b2c90b84353ed`
+- Three-party self-healer candidate branch: `patch/a0-three-party-self-healing-20260718-20260718T043256`
+- Production baseline: `V1R4C6`
+- Release status: `paused`
+
+## Priority invariant
+
+Continuously evaluate exactly three parties:
+
+1. `central_gpt` — Orchestrator Gateway plus a valid Workspace Agent or Responses API decision channel.
+2. `openclaw` — OpenClaw watcher, lifecycle sync, durable task execution and heartbeat.
+3. `codex` — Codex watcher, auto-claim, lifecycle sync, durable task execution and heartbeat.
+
+When exactly two parties are HEALTHY and the third is explicitly UNHEALTHY, create a P0 repair work unit for the unique unhealthy party before every other task. UNKNOWN is not UNHEALTHY and must fail closed. Do not repair when fewer than two are healthy or any health result is ambiguous.
+
+## A0-SH1: supervise implementation completion
+
+Codex owns the high-risk code changes. Independently verify that the final implementation contains:
+
+- strict root-owned configuration validation and no symlink chain;
+- fixed built-in party adapters rather than arbitrary untrusted repair commands;
+- bounded stdout/stderr redaction so tokens and secrets cannot enter audit logs;
+- exclusive lease, cooldown, circuit breaker and stale lease recovery;
+- event trigger plus periodic polling;
+- OpenClaw lifecycle events: `TASK_DISPATCHED`, `TASK_STARTED`, `TASK_ENDED`, `DECISION_APPLIED`, `PROJECT_SUMMARY`, `PROJECT_COMPLETED`;
+- durable file outbox fallback when HTTP callback is unavailable;
+- systemd service and timer;
+- health and repair adapters for central GPT, OpenClaw and Codex;
+- install, verify and rollback scripts;
+- deterministic tests for all health combinations and failures.
+
+Reject the current candidate if it only contains `automation/three_party_self_healer.py` without these controls.
+
+## A0-SH2: live three-party validation
+
+After Codex implementation RESULT passes, deploy only to a non-production acceptance context and run:
+
+1. All-three healthy steady state for at least three poll intervals.
+2. GPT unhealthy while OpenClaw and Codex healthy: GPT repair becomes P0 and recovers.
+3. OpenClaw unhealthy while GPT and Codex healthy: OpenClaw repair becomes P0 and recovers.
+4. Codex unhealthy while GPT and OpenClaw healthy: Codex repair becomes P0 and recovers.
+5. One healthy plus two unhealthy: no repair; fail closed.
+6. Any UNKNOWN health: no repair; fail closed.
+7. Repair timeout: retry with backoff, then circuit open.
+8. Service restart: state, lease and pending work recover.
+9. HTTP event path unavailable: file inbox polling recovers.
+10. Git webhook unavailable: Git ref polling detects change.
+11. Duplicate event ID: no duplicate dispatch.
+12. Main Workspace Agent channel unavailable: Responses fallback takes over only with a valid approved credential.
+13. OpenClaw receives every task start/end and project summary notification.
+14. Two consecutive unattended decision/execution/result cycles complete with no chat message or manual dispatch.
+
+Do not use dummy API keys or environment-variable presence as proof of a valid central decision channel.
+
+## A0-SH3: authoritative closure
+
+Only after independent verification of the above create one append-only state update and an exact-one RESULT file. Required output:
+
+```text
+AUTOMATION_CLOSED=PASS
+CENTRAL_GPT_HEALTH=PASS
+OPENCLAW_AUTO_CLAIM=PASS
+CODEX_AUTO_CLAIM=PASS
+THREE_PARTY_SELF_HEALING=PASS
+EVENT_TRIGGER=PASS
+POLLING=PASS
+OPENCLAW_LIFECYCLE_SYNC=PASS
+TWO_CYCLE_UNATTENDED_LOOP=PASS
+RESTART_RECOVERY=PASS
+ROLLBACK=PASS
+```
+
+Any missing item keeps `AUTOMATION_CLOSED=NO`.
+
+## Release continuation
+
+After and only after `AUTOMATION_CLOSED=PASS`, automatically resume the governed release sequence:
+
+1. Real B3 evidence intake and independent review.
+2. B4 implementation and validation.
+3. Full integration, regression, security and migration tests.
+4. Normal PR/GitOps merge to main; never direct-push main.
+5. Immutable release artifact, digest, SBOM and signature.
+6. Staging and rollback exercise.
+7. Canary and monitoring validation.
+8. Owner/admin GitOps production deployment using existing approved release controls.
+9. Production smoke tests and production RESULT-only commit.
+
+External facts that cannot be fabricated — real WeChat credentials/raw-wire, valid secret references and owner-only release approval — remain fail-closed blockers. The loop must monitor them and resume automatically when they become available.
+
+## Forbidden
+
+- reset, amend, rebase, force push;
+- direct push to main;
+- controller mutation;
+- secret disclosure;
+- dummy credentials presented as production credentials;
+- fabricated B3 evidence;
+- timeout or skipped checks recorded as PASS;
+- production release before `AUTOMATION_CLOSED=PASS`.
+
+Progress format:
+
+```text
+CONTRACT=cbe33ecab8e9794ba5f318bea43aeaf447a56fbc WORK_UNIT=<id> AGENT=openclaw STATUS=<status> COMMIT=<oid-or-NONE> BLOCKER=<stable-reason-or-NONE>
+```
@@ -0,0 +1,68 @@
+# OpenClaw task: deploy and supervise AIOS Orchestrator Gateway v1
+
+Contract: `cbe33ecab8e9794ba5f318bea43aeaf447a56fbc`
+
+You are the default orchestrator and deployment supervisor.
+
+## Preconditions
+
+- Codex has applied and independently reviewed this source bundle on a clean,
+  append-only branch.
+- Implementation and RESULT OIDs are identical across worktree, bare repo and
+  Gitea.
+- Final Gitleaks and repository tests are PASS.
+- No force push, reset, amend or rebase occurred.
+
+## Responsibilities
+
+1. Validate the source bundle SHA-256 and `SHA256SUMS`.
+2. Review the generated systemd service, poll timer, tmpfiles and sysusers files.
+3. Install through `scripts/install_aios_orchestrator_gateway.sh`.
+4. Configure one or both central-model channels:
+   - published Workspace Agent API channel with `agtch_...` trigger ID and a
+     Workspace Agent access token stored outside Git; or
+   - Responses API fallback with an approved model and API key stored outside Git.
+5. Publish the callback endpoint securely and configure the Workspace Agent
+   action from `workspace-agent/orchestrator-decision-action.openapi.yaml`.
+6. Confirm that the Workspace Agent instructions match
+   `workspace-agent/CENTRAL_AGENT_INSTRUCTIONS.md`.
+7. Enable both:
+   - the continuously running gateway service;
+   - the independent `aios-orchestrator-gateway-poll.timer`.
+8. Verify HTTP event ingestion, file-inbox polling, Git-ref polling,
+   Workspace Agent trigger acceptance, callback decision, Responses background
+   polling fallback, dispatch queue generation, retry leases and loop guards.
+9. Verify OpenClaw receives and synchronizes:
+   - TASK_DISPATCHED
+   - TASK_STARTED
+   - TASK_ENDED
+   - PROJECT_SUMMARY
+   - PROJECT_COMPLETED
+10. Run a harmless bootstrap work unit through OpenClaw and Codex and confirm
+    duplicate event submission is idempotent.
+11. Run rollback, reinstall and heartbeat/health verification.
+12. Create one RESULT-only review recording exact commits, artifact digest,
+    tests, systemd security, polling recovery, lifecycle synchronization and
+    rollback.
+
+## Fail-closed boundaries
+
+- Do not put Workspace Agent tokens, API keys, callback tokens or gateway
+  credentials in Git, logs, command arguments or RESULT files.
+- Do not claim the gateway resolves the existing B3 credential/raw-wire blocker.
+- Do not advance B4 or production merely because this gateway is healthy.
+- Do not bypass owner/admin production release approvals.
+- Do not use reset, amend, rebase, force push, direct main push or bare-ref edits.
+
+## Required final status
+
+Success:
+
+`ORCHESTRATOR_GATEWAY_LIVE=PASS POLLING=PASS OPENCLAW_SYNC=PASS ROLLBACK=PASS`
+
+Blocker:
+
+`ORCHESTRATOR_GATEWAY_LIVE=BLOCKED reason=<stable_reason>`
+
+Keep `BASELINE=V1R4C6 RELEASE=paused PRODUCTION_RELEASE=NOT_STARTED` until the
+existing production contract advances all release gates.
@@ -0,0 +1,13 @@
+# OpenClaw V2R1 adaptive orchestration
+CONTRACT_ACK=cbe33ecab8e9794ba5f318bea43aeaf447a56fbc
+Read `.agent/policies/V2R1-PERSONAL-WEIXIN-PRODUCTION-EXECUTION-CONTRACT.yaml`.
+You are default orchestrator and sole authoritative state writer.
+Execute immediately:
+1. R0-DISCOVER-SECRET-PROVIDER: discover approved provider metadata and owner-probe source without reading or outputting secrets. Environment variables alone are not approved secret refs.
+2. P2-INVENTORY-REAL-EVIDENCE: inventory approved restricted B3 evidence locations; validate existing facts; never synthesize evidence.
+3. Independently verify Codex results before advancing.
+Prefer OpenClaw for comparable-quality, large, repetitive, long-running, infrastructure and cost-sensitive work. Prefer Codex strongest actually available model for complex code, security boundaries, architecture and high-risk review. On timeout mark TIMEOUT and switch agent; never infer PASS.
+Forbidden: reset, amend, rebase, force push, direct main push, controller mutation, secret disclosure, fabricated evidence, skipped gates.
+Report:
+CONTRACT=cbe33ecab8e9794ba5f318bea43aeaf447a56fbc WORK_UNIT=<id> TRACK=<id> GATE=<id> AGENT=openclaw STATUS=<status> COMMIT=<oid-or-NONE> BLOCKER=<reason-or-NONE>
+Keep BASELINE=V1R4C6 RELEASE=paused PRODUCTION_RELEASE=NOT_STARTED until production gate passes.
@@ -1,486 +0,0 @@
-# Agent Production Deployment Requirements
-
-## Status entering deployment
-
-```yaml
-code_development: COMPLETED
-repository_commit: NOT_CREATED
-production_deployment: NOT_STARTED
-reason_repository_commit_missing:
-  current ChatGPT GitOps runtime has AIOS_GITOPS_WRITES_ENABLED=false
-```
-
-The code bundle is an input artifact. The Agent must place it on a non-main
-integration branch, review it, run acceptance tests, merge it through protected
-main and deploy the API adapter. The Agent must not regenerate or materially
-rewrite the supplied implementation without recording the new diff and tests.
-
-## Frozen production state
-
-Before any change, verify:
-
-```yaml
-main_oid: 875d41c3101093149414292067fd700dc214d4d3
-
-V2R1C5:
-  tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-  peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-  baseline_version: V2R1C5
-  baseline_status: PRODUCTION_DEPLOYED
-  target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-  evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
-```
-
-If authoritative `main` no longer equals the approved base OID, stop with
-`MANUAL_OWNER_REVIEW_REQUIRED / AUTHORIZED_BASE_OID_DRIFT`. Do not silently
-rebase the bundle onto a different base.
-
-## Bootstrap sequence — no additional Owner interaction
-
-Use the following order so that the approved V2R1C6 base OID remains valid and
-the bridge does not create its own authorization deadlock:
-
-1. Verify the supplied archive/patch SHA-256.
-2. Install the bundle into a temporary root-owned staging directory outside the
-   Git worktrees.
-3. Start a localhost-only temporary instance of
-   `aios_authorized_task_writer_api.py` on a dedicated port or Unix socket.
-4. Bind it to the existing authenticated Owner registry and the exact
-   `writer:provision` scope. Do not expose it through the public gateway.
-5. Execute the live V2R1C6 provisioning request while `main` still equals
-   `875d41c3101093149414292067fd700dc214d4d3`.
-6. Verify `READY_FOR_CODE_AUTHORING`, the exact branch OID, writer scope and
-   negative policy tests.
-7. Use the newly created scoped writer to commit this reviewed bundle onto:
-   `agent/v2r1c6-mainline-reconciliation-20260805`.
-8. Stop and remove the temporary bootstrap service and revoke its temporary
-   runtime credential. Preserve its signed grant receipt and audit logs.
-9. Open a protected PR from the V2R1C6 branch. Deploy the permanent bridge only
-   from the reviewed merge commit.
-
-The temporary service is a control-plane bootstrap, not a production release.
-It must retain:
-
-```yaml
-listen_scope: localhost_only
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-This order avoids asking the Owner to approve a second base OID merely because
-the bridge implementation itself advanced `main`.
-
-### Alternative platform-maintenance path
-
-If policy prohibits a temporary localhost bootstrap service, use an existing
-Owner-approved platform-maintenance executor to create:
-
-```yaml
-branch: patch/owner-authorization-writer-bridge-20260806
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-direct_main_push: false
-force_push: false
-tag_write: false
-baseline_write: false
-production_deploy_during_integration: false
-```
-
-Merging that branch before V2R1C6 provisioning changes the authoritative base
-OID. In that alternative only, a new exact Owner base-OID amendment is required.
-The Agent must never substitute the newer `main` OID automatically.
-
-## Files to install on the branch
-
-Copy with the same relative paths:
-
-```text
-active-runtime/app/authorized_task_writer_provisioning.py
-active-runtime/app/aios_authorized_task_writer_api.py
-docs/gitops/authorized-task-writer-provisioning.md
-docs/gitops/openapi-authorized-task-writer-fragment.yaml
-deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
-scripts/smoke_authorized_task_writer_provisioning.py
-tests/test_authorized_task_writer_provisioning.py
-```
-
-Merge the OpenAPI fragment into:
-
-```text
-docs/gitops/openapi-chatgpt-actions.yaml
-```
-
-The final schema must expose:
-
-```yaml
-operationId: provisionAuthorizedTaskWriter
-path: POST /api/task-writer/provision-authorized
-x-openai-isConsequential: true
-```
-
-Do not deploy the fragment as a second standalone OpenAPI document.
-
-## Required review of existing API integration
-
-The adapter expects the existing API handler to provide:
-
-```python
-handler.need(scope)
-handler.body()
-handler.sendj(value, status=200)
-api.H.do_POST
-api.main()
-```
-
-Confirm these contracts against the branch before merge. If the live API has a
-different authentication object shape, make the smallest adapter-only change
-and rerun every test. The core provisioning policy must remain unchanged.
-
-The API authorization registry must grant `writer:provision` only to the
-authenticated Owner role. Agents and ordinary writer tokens must not receive
-this scope.
-
-## Privilege boundary
-
-The API service must remain non-root.
-
-Install a root-owned sudoers rule that allows the API service identity to run
-only these exact commands with `sudo -n --`:
-
-```text
-/usr/local/libexec/aios-grant-signer-adapter
-/usr/local/libexec/aios-grant-validator
-/usr/local/libexec/aios-task-writer-provisioner
-```
-
-Do not allow:
-
-```text
-/bin/sh
-/bin/bash
-/usr/bin/env
-/usr/bin/git
-wildcard executable paths
-SETENV
-arbitrary environment preservation
-```
-
-The governed tools themselves must validate their `--grant-dir` and
-`--result-json` paths. Their binaries must be root-owned, non-symlink, regular,
-executable and not group/world writable.
-
-The signer must access its private signing material only through a runtime
-secret reference. No signing key or token may enter Git, API output, the
-provisioning receipt or systemd environment text.
-
-## Runtime paths and permissions
-
-Create:
-
-```text
-/var/lib/aios-gitops/authorized-writer-bridge
-/var/lib/aios-gitops/authorized-writer-bridge/receipts
-/var/lib/aios-gitops/authorized-writer-bridge/locks
-```
-
-Required properties:
-
-```yaml
-owner: API service identity
-mode: "0700"
-symlink: false
-persistent: true
-```
-
-The directory contains redacted receipts only. Temporary signed grant
-directories are deleted after success or failure.
-
-## Required staging environment
-
-Configure the API service:
-
-```text
-AIOS_GITOPS_REPOSITORY_IDENTITY=aios/aios
-AIOS_GITOPS_AUTHORITY_GIT_DIR=/data/aios-gitops/repo.git
-AIOS_GITOPS_AUTHORIZED_WRITER_STATE_ROOT=/var/lib/aios-gitops/authorized-writer-bridge
-AIOS_GITOPS_GRANT_SIGNER_ADAPTER=/usr/local/libexec/aios-grant-signer-adapter
-AIOS_GITOPS_GRANT_VALIDATOR=/usr/local/libexec/aios-grant-validator
-AIOS_GITOPS_TASK_WRITER_PROVISIONER=/usr/local/libexec/aios-task-writer-provisioner
-AIOS_GITOPS_OWNER_PROVISION_SCOPE=writer:provision
-AIOS_GITOPS_GOVERNED_USE_SUDO=true
-AIOS_GITOPS_SUDO_PATH=/usr/bin/sudo
-```
-
-Use `aios_authorized_task_writer_api.py` as the API entrypoint. It delegates
-all pre-existing routes and adds only the new endpoint.
-
-## Pre-merge tests
-
-Run from the repository root:
-
-```bash
-python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/aios_authorized_task_writer_api.py
-```
-
-Required result:
-
-```yaml
-unit_tests:
-  total: 9
-  failures: 0
-  errors: 0
-smoke: PASS
-py_compile: PASS
-```
-
-Also run all existing GitOps API and isolated writer tests affected by:
-
-```text
-aios_chatgpt_actions_api
-aios_isolated_writer_api
-isolated_writer_authz
-isolated_writer_token_registry
-single_owner_governance
-OpenAPI schema validation
-```
-
-Any regression blocks merge.
-
-## Staging API acceptance
-
-### Negative authentication
-
-An Agent or non-Owner credential calling the endpoint must receive:
-
-```yaml
-http_status: 403
-error: OWNER_AUTHORIZATION_REQUIRED
-```
-
-### Negative scope tests
-
-Requests enabling any of the following must be denied before signer execution:
-
-```text
-production_change_authorized=true
-tag_change_authorized=true
-baseline_change_authorized=true
-main_write_authorized=true
-allowed_operations containing tag/main/baseline/admin operations
-missing required denied operation
-one_time_use=false
-expiry over 1800 seconds
-```
-
-### Drift and conflict tests
-
-Verify:
-
-```yaml
-wrong_base_oid:
-  http_status: 409
-  error: AUTHORIZED_BASE_OID_DRIFT
-
-existing_unreceipted_target_branch:
-  http_status: 409
-  error: EXISTING_BRANCH_OID_CONFLICT
-```
-
-### Governed tool failures
-
-Independently inject and verify fail-closed behavior for:
-
-```text
-signer unavailable
-signer signature absent
-validator signature_valid=false
-validator signer_trusted=false
-validator plan expired
-provisioner grant_consumed=false
-provisioner writer scope enables main/tag/baseline/force push
-any required negative policy test false
-```
-
-None may create or modify a Git ref.
-
-## Live V2R1C6 provisioning request
-
-After protected merge and API deployment, authenticate as the Owner and submit
-exactly:
-
-```json
-{
-  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
-  "repository": "aios/aios",
-  "base_ref": "refs/heads/main",
-  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
-  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
-  "owner_authorization_reference": "chat-owner-authorization:v2r1c6:20260806",
-  "one_time_use": true,
-  "expires_in_seconds": 900,
-  "production_change_authorized": false,
-  "tag_change_authorized": false,
-  "baseline_change_authorized": false,
-  "main_write_authorized": false,
-  "allowed_operations": [
-    "create_worktree",
-    "create_target_branch_if_absent",
-    "commit_to_target_branch",
-    "push_target_branch"
-  ],
-  "denied_operations": [
-    "direct_main_push",
-    "force_push",
-    "tag_create",
-    "tag_update",
-    "tag_delete",
-    "branch_delete",
-    "repository_admin",
-    "baseline_write",
-    "production_deploy",
-    "production_marker_write",
-    "history_rewrite"
-  ]
-}
-```
-
-This request must be executed by the localhost-only bootstrap instance before
-the bridge code advances `main`. The endpoint must never infer “current main”.
-
-If the Agent chooses the alternative merge-first path, it must stop after the
-merge and obtain an exact Owner amendment for the new merge OID. It must not
-silently replace the approved OID.
-
-## Success response
-
-Require:
-
-```yaml
-status: READY_FOR_CODE_AUTHORING
-grant_consumed: true
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-branch_oid: <exact amended authorized base OID>
-base_oid: <same exact OID>
-main_unchanged: true
-
-writer_scope:
-  workspace_role: task-scoped-isolated-writer
-  writes_enabled: true
-  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
-  allowed_base_oid: <exact amended authorized base OID>
-  allowed_routes:
-    - POST /api/commit-file
-  allow_main_write: false
-  allow_tag_write: false
-  allow_baseline_write: false
-  allow_force_push: false
-```
-
-All seven negative policy results must be true.
-
-Submit the identical request a second time. It must return the same grant and
-branch attestation with:
-
-```yaml
-idempotent: true
-```
-
-It must not run the provisioner again.
-
-## Production postchecks
-
-After API deployment and writer provisioning, independently verify:
-
-```yaml
-existing_routes_regression: PASS
-new_endpoint: PASS
-main_ref: expected reviewed merge commit
-V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
-V2R1C5_baseline_unchanged: true
-new_release_tag_created: false
-production_baseline_changed: false
-```
-
-The deployment of this control-plane bridge does not authorize a V2R1C6
-production release. It only enables scoped code authoring.
-
-## Rollback
-
-If the new API route fails:
-
-1. Stop accepting new provisioning calls.
-2. Restore the previous API entrypoint.
-3. Restart and verify all existing routes.
-4. Preserve receipts and logs.
-5. Revoke any task writer capability already minted.
-6. Do not delete a branch or rewrite a tag.
-7. Revert the protected-main bridge commit through an ordinary reviewed revert
-   PR if source rollback is required.
-
-## Required final Agent report
-
-```yaml
-STATUS: COMPLETED | PARTIALLY_COMPLETED | BLOCKED | FAILED
-
-INTEGRATION:
-  branch:
-  commit:
-  protected_pr:
-  merge_commit:
-  files_changed:
-
-TESTS:
-  unit:
-  smoke:
-  py_compile:
-  regression:
-  fault_injection:
-
-DEPLOYMENT:
-  service:
-  entrypoint:
-  runtime_status:
-  endpoint_status:
-  rollback_verified:
-
-PROVISIONING:
-  owner_authorization_reference:
-  approval_plan_id:
-  grant_id:
-  grant_digest_sha256:
-  signing_key_identity:
-  branch:
-  branch_oid:
-  workspace_path:
-  grant_consumed:
-  idempotent_replay:
-
-CONSISTENCY:
-  main_oid:
-  V2R1C5_tag_oid:
-  V2R1C5_peeled_target_oid:
-  baseline_version:
-  baseline_changed:
-  tags_changed:
-
-SECRETS:
-  runtime_secret_reference_used:
-  plaintext_secret_logged:
-  plaintext_secret_committed:
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
@@ -1,401 +0,0 @@
-# Agent Deployment Requirements: Owner Authorization Broker V2
-
-## Objective
-
-Deploy the audited Owner Authorization Broker that closes the bootstrap gap
-without issuing a new general-purpose Owner credential and without modifying
-`/data/aios-gitops/runtime/secrets/gitops.tokens`.
-
-The broker reuses one existing, non-wildcard Owner credential only to
-authenticate the Owner identity through one pre-existing exact scope. It then
-records an immutable task authorization event and directly invokes the
-existing signed grant -> validator -> one-shot provisioner chain.
-
-Production deployment of V2R1C6 is **not** authorized by this task.
-
-## Fixed bindings
-
-```yaml
-task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch: agent/v2r1c6-mainline-reconciliation-20260805
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-The existing V2R1C5 objects are frozen:
-
-```yaml
-tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-peeled_target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-baseline_version: V2R1C5
-baseline_status: PRODUCTION_DEPLOYED
-```
-
-## 1. Package verification
-
-Verify `MANIFEST.sha256` before installation. Reject any mismatch.
-
-Run:
-
-```bash
-python3 -m unittest -v \
-  tests/test_authorized_task_writer_provisioning.py \
-  tests/test_owner_authorization_broker.py
-
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 scripts/smoke_owner_authorization_broker.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/aios_authorized_task_writer_api.py \
-  active-runtime/app/owner_authorization_broker.py \
-  active-runtime/app/aios_owner_authorization_broker_api.py
-```
-
-All checks must pass.
-
-## 2. Existing Owner credential selection
-
-Read only the non-secret registry metadata. Select one existing credential
-that satisfies all of the following:
-
-```yaml
-role: owner
-wildcard_scope: false
-account: exact known Owner identity
-contains_exact_intake_scope: true
-```
-
-Use one existing exact scope such as `commit:create` or `file:write`. Prefer
-the narrowest scope already assigned to the intended Owner.
-
-Do not:
-
- use the historical wildcard Owner credential;
- add `writer:provision` to any bearer token;
- create or modify a bearer credential;
- print, copy or commit bearer-token material.
-
-Record only:
-
-```yaml
-owner_account: <non-secret account>
-credential_id: <non-secret ID, when available>
-intake_scope: <one exact existing scope>
-scope_readback_available: true|false
-```
-
-If `handler.need()` returns the exact scope set, configure the Owner account
-allowlist and leave the credential ID allowlist empty.
-
-If scope metadata is not returned, configure the exact non-secret credential
-ID allowlist. If neither exact scope metadata nor a stable non-secret
-credential ID can be proven, stop:
-
-```yaml
-STATUS: BLOCKED
-REASON: OWNER_CREDENTIAL_SCOPE_NOT_PROVABLE
-```
-
-## 3. Staging installation
-
-Install the four application modules in a root-owned staging directory:
-
-```text
-authorized_task_writer_provisioning.py
-aios_authorized_task_writer_api.py
-owner_authorization_broker.py
-aios_owner_authorization_broker_api.py
-```
-
-The directory and files must not be group/world writable.
-
-Prepare environment values:
-
-```yaml
-AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED: "true"
-AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES: <one exact existing scope>
-AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_IDENTITIES: <exact owner account>
-AIOS_GITOPS_OWNER_AUTHORIZATION_ALLOWED_CREDENTIAL_IDS: <exact ID or empty>
-AIOS_GITOPS_OWNER_AUTHORIZATION_MAX_EXPIRY_SECONDS: "900"
-AIOS_GITOPS_OWNER_AUTHORIZATION_STATE_ROOT:
-  /var/lib/aios-gitops/owner-authorization-broker
-```
-
-Use the existing signer, validator and provisioner paths. Do not change their
-root governance configuration or disable signature checks.
-
-Start a localhost-only staging instance on a temporary port. Do not replace
-the production service yet.
-
-## 4. Authentication fail-closed tests
-
-The staging endpoint is:
-
-```text
-POST /api/governance/owner-authorizations
-```
-
-Required tests:
-
-```yaml
-unauthenticated:
-  expected: 401
-
-wrong_role:
-  expected: 403
-
-wrong_scope:
-  expected: 403
-
-wildcard_owner:
-  expected: 403
-  error: WILDCARD_OWNER_CREDENTIAL_REJECTED
-
-unallowlisted_owner:
-  expected: 403
-  error: OWNER_IDENTITY_NOT_ALLOWED
-
-production_capability_true:
-  expected: 403
-  error: PRODUCTION_CAPABILITY_REJECTED
-```
-
-A connection failure, 404 or 500 is not an authorization-policy pass.
-
-## 5. Formal provisioning request
-
-Use the selected existing non-wildcard Owner credential through its runtime
-secret reference. Never place the bearer token in the request body, command
-line, shell history, output report or Git.
-
-Request:
-
-```json
-{
-  "action": "AUTHORIZE_TASK_WRITER_PROVISIONING",
-  "task_id": "V2R1C6_TASK_SCOPED_WRITER_PROVISIONING",
-  "repository": "aios/aios",
-  "base_ref": "refs/heads/main",
-  "base_oid": "875d41c3101093149414292067fd700dc214d4d3",
-  "target_branch": "agent/v2r1c6-mainline-reconciliation-20260805",
-  "one_time_use": true,
-  "expires_in_seconds": 900,
-  "production_change_authorized": false,
-  "tag_change_authorized": false,
-  "baseline_change_authorized": false,
-  "main_write_authorized": false,
-  "allowed_operations": [
-    "create_worktree",
-    "create_target_branch_if_absent",
-    "commit_to_target_branch",
-    "push_target_branch"
-  ],
-  "denied_operations": [
-    "direct_main_push",
-    "force_push",
-    "tag_create",
-    "tag_update",
-    "tag_delete",
-    "branch_delete",
-    "repository_admin",
-    "baseline_write",
-    "production_deploy",
-    "production_marker_write",
-    "history_rewrite"
-  ]
-}
-```
-
-The Owner authorization reference is generated by the broker. The caller must
-not submit or invent one.
-
-Expected result:
-
-```yaml
-status: READY_FOR_CODE_AUTHORING
-owner_authorization_event_id: generated
-owner_authorization_reference: generated
-owner_authorization_digest_sha256: generated
-owner_authorization_consumed: true
-approval_plan_id: generated
-grant_digest_sha256: generated
-grant_consumed: true
-
-branch_oid: 875d41c3101093149414292067fd700dc214d4d3
-
-writer_scope:
-  workspace_role: task-scoped-isolated-writer
-  writes_enabled: true
-  allowed_branch: agent/v2r1c6-mainline-reconciliation-20260805
-  allowed_base_oid: 875d41c3101093149414292067fd700dc214d4d3
-  allow_main_write: false
-  allow_tag_write: false
-  allow_baseline_write: false
-  allow_force_push: false
-```
-
-## 6. Independent post-provisioning verification
-
-Verify the Authority ref:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git rev-parse \
-  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-It must equal:
-
-```text
-875d41c3101093149414292067fd700dc214d4d3
-```
-
-Verify `main` remains unchanged, V2R1C5 tag object and peeled target remain
-unchanged, and the Production Baseline remains V2R1C5.
-
-Verify the broker audit event under:
-
-```text
-/var/lib/aios-gitops/owner-authorization-broker/events/
-```
-
-Requirements:
-
-```yaml
-status: CONSUMED
-wildcard_scope_used: false
-grant_consumed: true
-permissions:
-  directory: "0700"
-  json_files: "0600"
-```
-
-Do not return bearer-token material in the report.
-
-## 7. Commit the broker through the new writer
-
-After `READY_FOR_CODE_AUTHORING`, use only the writer's
-`POST /api/commit-file` route to put this code bundle on:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-Commit the bridge and broker as separate intentional commits when practical:
-
-1. Owner-authorized task-writer bridge.
-2. Audited Owner authorization broker and deployment docs.
-
-Do not merge to `main` directly. Create a protected PR after branch commits
-and tests are complete.
-
-## 8. Permanent service deployment
-
-Only after protected review and merge:
-
-1. Install the reviewed files from the merge commit.
-2. Apply a reviewed systemd drop-in based on the provided example.
-3. Start the wrapper entrypoint:
-   `aios_owner_authorization_broker_api.py`.
-4. Verify all existing API routes still work.
-5. Verify the broker remains localhost/reverse-proxy constrained as intended.
-6. Re-run authentication and policy tests.
-7. Remove the temporary staging instance.
-
-This permanent bridge deployment does not authorize a V2R1C6 production tag,
-Baseline update or application deployment.
-
-## 9. Fail-closed conditions
-
-Stop with `BLOCKED` for any of the following:
-
- Authority `main` no longer equals the fixed base OID.
- Target branch exists at a different OID.
- Only a wildcard Owner credential can authenticate.
- Exact credential scope cannot be proven.
- Owner identity is not explicitly allow-listed.
- Signer, validator or provisioner self-test fails.
- Grant is not marked one-time and consumed.
- Writer allows main, tag, Baseline, force-push or branch-delete operations.
- Audit event contains sensitive material.
- V2R1C5 tag or Baseline changes.
-
-## 10. Required Agent result
-
-```yaml
-STATUS: READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
-
-PACKAGE:
-  manifest_verified:
-  unit_tests:
-  smoke_tests:
-  py_compile:
-
-OWNER_CREDENTIAL:
-  account:
-  credential_id:
-  intake_scope:
-  exact_scope_proven:
-  wildcard_used: false
-  token_logged: false
-
-BROKER:
-  staging_listener:
-  endpoint_status:
-  event_id:
-  authorization_reference:
-  authorization_digest_sha256:
-  event_consumed:
-  audit_permissions_valid:
-
-GRANT:
-  approval_plan_id:
-  grant_digest_sha256:
-  signer_identity:
-  signature_valid:
-  one_time_use:
-  consumed:
-
-BRANCH:
-  name:
-  oid:
-  base_oid:
-  ref_exists:
-  worktree_path:
-  worktree_clean:
-
-WRITER:
-  status:
-  writes_enabled:
-  allowed_branch:
-  allowed_base_oid:
-  allowed_routes:
-  main_write_denied:
-  tag_write_denied:
-  baseline_write_denied:
-  force_push_denied:
-
-POSTCHECK:
-  main_unchanged:
-  V2R1C5_tag_unchanged:
-  baseline_unchanged:
-
-REPOSITORY_INTEGRATION:
-  commit_oids:
-  protected_pr:
-  merged:
-  permanent_bridge_deployed:
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
@@ -1,562 +0,0 @@
-# Agent execution requirements: V2R1C6 task identity overlay
-
-## Required result
-
-The Agent must return one of:
-
- `READY_FOR_CODE_AUTHORING`
- `BLOCKED`
- `FAILED`
-
-The Agent may not report success until the task branch, isolated worktree and
-task writer are independently verified.
-
-This stage is **not** a production deployment. It must not modify `main`,
-V2R1C5, tags, Registry, Production Baseline or production services.
-
-## Fixed authority
-
-```yaml
-task_id: V2R1C6_TASK_SCOPED_WRITER_PROVISIONING
-repository: aios/aios
-base_ref: refs/heads/main
-base_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch: agent/v2r1c6-mainline-reconciliation-20260805
-owner_identity: aiman
-one_time_use: true
-maximum_ttl_seconds: 900
-production_change_authorized: false
-tag_change_authorized: false
-baseline_change_authorized: false
-main_write_authorized: false
-```
-
-## 1. Verify package
-
-Verify the externally supplied package against the published SHA-256 values and
-then verify every entry in `MANIFEST.sha256`.
-
-Do not synthesize a missing archive. Use either the verified ZIP or TAR.GZ.
-
-Required checks:
-
-```yaml
-package_hash_match: true
-manifest_entries_match: true
-unit_tests_pass: true
-smoke_tests_pass: true
-py_compile_pass: true
-```
-
-## 2. Create root-owned staging
-
-Extract to a fresh directory such as:
-
-```text
-/var/lib/aios-gitops/staging/v2r1c6-task-identity-overlay-<nonce>
-```
-
-Requirements:
-
-```yaml
-owner: root
-group: root
-directory_mode: "0700"
-files_not_world_writable: true
-symlinks_rejected: true
-```
-
-Do not overwrite the active runtime tree.
-
-## 3. Re-run target-host tests
-
-From the staging root:
-
-```bash
-python3 -m unittest discover -s tests -v
-python3 scripts/smoke_authorized_task_writer_provisioning.py
-python3 scripts/smoke_owner_authorization_broker.py
-python3 scripts/smoke_task_identity_overlay.py
-python3 -m py_compile \
-  active-runtime/app/authorized_task_writer_provisioning.py \
-  active-runtime/app/owner_authorization_broker.py \
-  active-runtime/app/task_identity_overlay.py \
-  active-runtime/app/aios_authorized_task_writer_api.py \
-  active-runtime/app/aios_owner_authorization_broker_api.py \
-  active-runtime/app/aios_task_identity_overlay_api.py \
-  active-runtime/app/aios_task_identity_overlay_cli.py \
-  scripts/call_task_identity_overlay.py
-```
-
-Any failure is `BLOCKED`; do not proceed.
-
-## 4. Prestart Git and production freeze checks
-
-Read from the authority repository:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git rev-parse refs/heads/main
-git --git-dir=/data/aios-gitops/repo.git \
-  show-ref --verify --quiet \
-  refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-git --git-dir=/data/aios-gitops/repo.git rev-parse refs/tags/V2R1C5
-git --git-dir=/data/aios-gitops/repo.git rev-parse 'refs/tags/V2R1C5^{}'
-```
-
-Expected:
-
-```yaml
-main_oid: 875d41c3101093149414292067fd700dc214d4d3
-target_branch_exists: false
-V2R1C5_tag_oid: 9e65bd59baea392294c0f253046d3ab116f63145
-V2R1C5_peeled_target: aa60e891547abd7e215af7cf2bf3f21fd23541da
-```
-
-Read Baseline and require:
-
-```yaml
-version: V2R1C5
-status: PRODUCTION_DEPLOYED
-target_oid: aa60e891547abd7e215af7cf2bf3f21fd23541da
-evidence_closure_oid: 5e2cf8276f5093f3352b9a3252c701a44c5ab807
-```
-
-If `main` has drifted, return:
-
-```yaml
-STATUS: MANUAL_OWNER_REVIEW_REQUIRED
-REASON: AUTHORIZED_BASE_OID_DRIFT
-```
-
-If the target branch already exists at another OID, return:
-
-```yaml
-STATUS: MANUAL_OWNER_REVIEW_REQUIRED
-REASON: EXISTING_BRANCH_OID_CONFLICT
-```
-
-Do not delete, reset or force-push the branch.
-
-## 5. Discover active secret references
-
-The overlay does not read or modify `gitops.tokens`, but its issuer must compare
-the new random secret against all active bearer secret references.
-
-Discover references without printing secret contents. At minimum include the
-currently active ChatGPT/GitOps bearer secret reference and any other bearer
-files consumed by the active API.
-
-Pass them as a comma-separated list in:
-
-```text
-AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS
-```
-
-Evidence must contain only paths and SHA-256 match counts, not token values.
-
-If active secret references cannot be enumerated, return:
-
-```yaml
-STATUS: BLOCKED
-REASON: ACTIVE_SECRET_REFERENCE_SET_UNRESOLVED
-```
-
-## 6. Install the transient systemd service
-
-Use the provided template:
-
-```text
-deploy/systemd/aios-v2r1c6-task-identity-overlay.service.example
-```
-
-Substitute only:
-
- verified root-owned staging directory;
- verified active secret-ref path list.
-
-Do not change task ID, repository, base OID, target branch or denied
-capabilities.
-
-The service must listen only on:
-
-```text
-127.0.0.1:19864
-```
-
-Before start, run:
-
-```bash
-systemd-analyze verify \
-  /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
-```
-
-Then:
-
-```bash
-sudo systemctl daemon-reload
-sudo systemctl start aios-v2r1c6-task-identity-overlay.service
-```
-
-Confirm:
-
-```bash
-curl --fail --silent http://127.0.0.1:19864/healthz
-```
-
-Expected:
-
-```yaml
-service: aios-task-identity-overlay
-status: active
-global_token_registry_used: false
-loopback_only: true
-```
-
-Do not expose the port externally.
-
-## 7. Issue the one-time overlay
-
-Use the root-only CLI. The authorization assertion is an audit label for this
-already approved Owner task; it must not be described as an external signed
-event.
-
-Example:
-
-```bash
-sudo env \
-  PYTHONPATH=<staging>/active-runtime/app \
-  AIOS_GITOPS_IDENTITY_OVERLAY_STATE_ROOT=/var/lib/aios-gitops/task-identity-overlays \
-  AIOS_GITOPS_IDENTITY_OVERLAY_SECRET_ROOT=/run/aios-gitops/task-identity-overlays \
-  AIOS_GITOPS_IDENTITY_OVERLAY_TASK_ID=V2R1C6_TASK_SCOPED_WRITER_PROVISIONING \
-  AIOS_GITOPS_IDENTITY_OVERLAY_OWNER_IDENTITY=aiman \
-  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_REF=refs/heads/main \
-  AIOS_GITOPS_IDENTITY_OVERLAY_BASE_OID=875d41c3101093149414292067fd700dc214d4d3 \
-  AIOS_GITOPS_IDENTITY_OVERLAY_TARGET_BRANCH=agent/v2r1c6-mainline-reconciliation-20260805 \
-  AIOS_GITOPS_IDENTITY_OVERLAY_COLLISION_SECRET_REFS=<verified-secret-ref-list> \
-  python3 <staging>/active-runtime/app/aios_task_identity_overlay_cli.py \
-    issue \
-    --ttl-seconds 900 \
-    --authorization-assertion-ref owner-session:V2R1C6:approved-20260806 \
-    --operator-identity <audited-agent-identity> \
-    --result-json /run/aios-gitops/v2r1c6-overlay-issued.json
-```
-
-The result must contain:
-
-```yaml
-status: OVERLAY_ACTIVE
-idempotent: false
-overlay_id: present
-secret_ref: under /run/aios-gitops/task-identity-overlays
-expires_at: within 900 seconds
-```
-
-It must not contain a token.
-
-Verify:
-
-```yaml
-secret_file_mode: "0600"
-metadata_contains_raw_token: false
-token_hash_unique_across_configured_secret_refs: true
-```
-
-## 8. Negative tests
-
-Before the valid request:
-
-1. No Authorization header must return HTTP 401.
-2. A random wrong bearer must return HTTP 401.
-3. A request with `production_change_authorized=true` must be rejected.
-4. A request with another base OID or branch must be rejected.
-5. The valid overlay must remain `ACTIVE` after pre-auth request-validation
-   failures.
-
-Do not use the global Owner or ChatGPT bearer credential for this endpoint.
-
-## 9. Send the valid request
-
-Use:
-
-```text
-deploy/v2r1c6-task-writer-authorization-request.json
-```
-
-Use the provided client so the bearer is not placed in argv, shell history or
-logs:
-
-```bash
-sudo python3 <staging>/scripts/call_task_identity_overlay.py \
-  --secret-ref <secret_ref_from_issue_result> \
-  --request-json <staging>/deploy/v2r1c6-task-writer-authorization-request.json \
-  --url http://127.0.0.1:19864/api/governance/owner-authorizations \
-  --result-json /var/lib/aios-gitops/v2r1c6-overlay-provision-result.json
-```
-
-Required result:
-
-```yaml
-http_status: 200
-status: READY_FOR_CODE_AUTHORING
-owner_authorization_consumed: true
-grant_consumed: true
-identity_overlay_consumed: true
-identity_overlay_secret_removed: true
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-branch_oid: 875d41c3101093149414292067fd700dc214d4d3
-```
-
-The result must not include:
-
- bearer token;
- private key;
- signer secret;
- raw signature;
- credential value.
-
-## 10. Independent acceptance
-
-Verify the branch:
-
-```bash
-git --git-dir=/data/aios-gitops/repo.git \
-  rev-parse refs/heads/agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-It must equal:
-
-```text
-875d41c3101093149414292067fd700dc214d4d3
-```
-
-Verify worktree evidence returned by the provisioner:
-
-```yaml
-branch: agent/v2r1c6-mainline-reconciliation-20260805
-head_oid: 875d41c3101093149414292067fd700dc214d4d3
-detached_head: false
-worktree_clean: true
-writer_status: active
-writes_enabled: true
-allowed_routes:
-  - POST /api/commit-file
-allow_main_write: false
-allow_tag_write: false
-allow_baseline_write: false
-allow_force_push: false
-```
-
-Run policy negative tests against the task writer and require explicit policy
-denials for:
-
- main write;
- another branch;
- tag create/update;
- Baseline write;
- force push;
- branch delete.
-
-Network errors, 404, 500 and stopped-service failures do not count as policy
-denials.
-
-## 11. Stop and clean up the overlay
-
-After `READY_FOR_CODE_AUTHORING`:
-
-```bash
-sudo systemctl stop aios-v2r1c6-task-identity-overlay.service
-sudo systemctl disable aios-v2r1c6-task-identity-overlay.service || true
-sudo rm -f /etc/systemd/system/aios-v2r1c6-task-identity-overlay.service
-sudo systemctl daemon-reload
-```
-
-Verify:
-
-```yaml
-overlay_listener_stopped: true
-overlay_secret_removed: true
-global_token_registry_unchanged: true
-disabled_owner_record_unchanged: true
-active_chatgpt_bot_record_unchanged: true
-audit_metadata_retained: true
-```
-
-The root-owned staging directory may be retained until the code is committed,
-then removed after checksum-confirmed repository integration.
-
-## 12. Commit the developed code through the task writer
-
-Only after writer acceptance, use `POST /api/commit-file` to commit the
-verified package contents to:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-Commit in reviewable groups:
-
-1. authorized task-writer bridge;
-2. Owner authorization broker;
-3. task identity overlay;
-4. tests, docs, OpenAPI and deployment templates.
-
-Do not include:
-
- package archives;
- runtime tokens;
- `/run` or `/var/lib` state;
- test result files containing host paths;
- secret references containing values;
- generated credentials.
-
-Run the complete 40-test suite from the branch after commits.
-
-## 13. Protected PR
-
-Create a protected PR from:
-
-```text
-agent/v2r1c6-mainline-reconciliation-20260805
-```
-
-to:
-
-```text
-main
-```
-
-The PR must state:
-
- this change closes Owner authorization bootstrap gaps;
- the overlay is localhost-only and one-time;
- the global token registry is not modified;
- no production release is authorized;
- V2R1C5 tag and Baseline remain unchanged.
-
-The Agent must not merge without the repository's normal protected review.
-
-## 14. Required Agent report
-
-```yaml
-STATUS:
-  READY_FOR_CODE_AUTHORING | BLOCKED | FAILED
-
-PACKAGE:
-  zip_sha256:
-  tar_gz_sha256:
-  manifest_entries:
-  manifest_matched:
-
-TESTS:
-  unit_total:
-  unit_passed:
-  smoke_bridge:
-  smoke_broker:
-  smoke_overlay:
-  py_compile:
-
-PRESTART:
-  main_oid:
-  target_branch_previously_absent:
-  V2R1C5_tag_oid:
-  V2R1C5_peeled_target:
-  baseline_unchanged:
-
-OVERLAY:
-  overlay_id:
-  status:
-  secret_ref:
-  secret_file_mode:
-  token_hash_unique:
-  global_registry_used: false
-  listener:
-  expires_at:
-  consumed:
-  secret_removed:
-
-NEGATIVE_TESTS:
-  unauthenticated_401:
-  wrong_token_401:
-  production_capability_denied:
-  wrong_base_denied:
-  wrong_branch_denied:
-
-OWNER_AUTHORIZATION:
-  event_id:
-  reference:
-  consumed:
-
-GRANT:
-  approval_plan_id:
-  grant_id:
-  grant_digest_sha256:
-  signature_valid:
-  consumed:
-
-BRANCH:
-  name:
-  oid:
-  base_oid:
-  ref_exists:
-  worktree_path:
-  worktree_clean:
-
-WRITER:
-  status:
-  writes_enabled:
-  allowed_branch:
-  allowed_base_oid:
-  allowed_routes:
-  main_write_denied:
-  tag_write_denied:
-  baseline_write_denied:
-  force_push_denied:
-
-REPOSITORY_INTEGRATION:
-  commits:
-  tests_after_commit:
-  protected_pr:
-  merged: false
-
-POSTCHECK:
-  main_unchanged:
-  V2R1C5_tag_unchanged:
-  baseline_unchanged:
-  global_token_registry_unchanged:
-  overlay_listener_stopped:
-  overlay_secret_removed:
-
-SECRETS:
-  plaintext_logged: false
-  plaintext_committed: false
-
-BLOCKERS:
-
-GOVERNANCE:
-  force_push_used: false
-  tag_rewritten: false
-  direct_main_push: false
-  secrets_committed: false
-  owner_approval_respected: true
-```
-
-## Fail-closed conditions
-
-Return `BLOCKED` and stop on any of:
-
- authoritative main OID drift;
- target branch conflict;
- inability to enumerate active secret references;
- secret hash collision;
- overlay not bound to the exact task/base/branch;
- non-loopback listener;
- raw secret in result or logs;
- Owner Authorization Broker event not created;
- signer/validator/provisioner failure;
- grant not consumed;
- branch OID mismatch;
- writer exposes main/tag/Baseline/force-push permissions;
- V2R1C5 tag or Baseline changes.
-
-Never fall back to the shared `gitops-write-bot.token`, a wildcard credential,
-manual `gitops.tokens` edits or a direct Git ref write.
@@ -1,9 +0,0 @@
-{
-  "schema": "aios.v2r1c7.engineering-build-receipt.v1",
-  "version": "V2R1C7",
-  "base_oid": "b356dec2ac5bd2a5f721aa73f8fd1902f9c65632",
-  "production_deployed": false,
-  "tag_created": false,
-  "baseline_changed": false,
-  "deployable": true
-}
@@ -1,21 +0,0 @@
-bec7da1adb75bf5feaa63c60ec6d03adf15d7508742a486207033d000f72d4ff  AGENT_DEPLOYMENT_REQUIREMENTS.md
-251b46e51ce09aa2fd843bee48ef24a5608f31d24c599841f086ceb25c1a1715  README.md
-783f68ec4f00a11d43ceed536196bfedccaf6614f6db9805f7b36d24e5fa7bc2  TEST_RESULTS.json
-9208325e5b2e6f5ba6b64e000bc21d14d9f2f214e3ad33dd79857e85218fd6c2  VERSION
-c4b24b65195077716983acdc8611f705324413a74453858994ba51541957afd4  active-runtime/app/aios_authorized_task_writer_api.py
-8a1935fa098d47ac02ce51bbd9fd5fad7cf9ab9374ea3de5f630679b96681d84  active-runtime/app/authorized_task_writer_provisioning.py
-0997ab8332985c7124f334c4e49735d8833326578acc61a61a389bf792424de3  active-runtime/app/deployment_state.py
-dd3f8b1cab88e005a291f077807873c381e8ca92fe863dc05817925f0dff9613  active-runtime/app/v2r1c6_privacy_tools.py
-9e45025c41068cafdea2f360edfc4146a5459b0a6bcfbf1403206fc0161e7bac  active-runtime/app/v2r1c7_health_service.py
-c96ba560d69f6c2eb700b9f2b42a32e394dadd00dffb23bbefdb9fb3e1571c0d  deploy/aios-v2/systemd/aios-v2r1c7-production.service
-a05d4e8038fdb866ce17d4fb8a54798a268a1e8d44ff2cbc559069fa6ab2a667  deploy/systemd/aios-gitops-model-api-authorized-writer-bridge.conf.example
-a60dac51802bff67c2cfff61acdeb0a3a05d74a4f6cb47e3f78295ceb5c6acd9  docs/gitops/authorized-task-writer-provisioning.md
-2690f76452bceddda90c728278c600bcebd533db24776e2966423c5a8655e4b5  docs/gitops/openapi-authorized-task-writer-fragment.yaml
-560e5d9af8a8e2ec60ec31cf8659a7982b93ea09b7adb486b738ea2fba460d70  release-manifests/V2R1C7.json
-81a423c7814f81cb888b60a538c153e549b2be9099c881c968d55ae84efddc57  scripts/build_v2r1c7_release_artifact.py
-64c78dabffb05c8851f87b2a27c43bd1f21728dca586397d03a6bc22906a906c  scripts/probe_v2r1c7_health.py
-5419dc7de0f50908ad0ef1dac74172fce811bb7b45f314a6e1c1bb9ce618324d  scripts/rollback_v2r1c7_release.sh
-54e2845d2c3c026323ad45515e082d661e3b461feb3bfefedf5adc52db2d7b78  scripts/smoke_authorized_task_writer_provisioning.py
-32a860e28d5afc105f413d878a13fb8600fa74874dbd3bc4c031ef3efa17896a  scripts/verify_v2r1c7_release.py
-3cce2b744326fe12b89bcad3cd352c77738950964bf8519e72cb5e9c7a5dfbfc  tests/test_authorized_task_writer_provisioning.py
-8f3153c625241f60b65109eeac045e8aed7661d95f3a10f0b32ba3e0e9ac0a85  versions/V2R1C7.json
@@ -0,0 +1,11 @@
+# AIOS Codex automatic command watcher
+
+The watcher polls the governed `commands/active` queue without a chat trigger. It uses SQLite transactions for exclusive leases, records the exact command digest, rejects contract drift, retries transient failures, dead-letters exhausted work, and resumes from the last durable phase so an end-event retry does not execute a work unit twice.
+
+Commands are JSON documents validated by `schemas/codex-command.schema.json`. `acceptance_probe` is the only built-in action and has no external side effect. Production `codex` work requires an administrator-provisioned absolute executor path; the instruction is passed on standard input, never argv or environment. The executor receives a sanitized environment and must obtain credentials through its approved file or exec provider. If the executor is absent, the task fails closed and follows the retry/dead-letter policy.
+
+The watcher provides at-most-once execution. It writes the `EXECUTING` phase before launching an external executor; if the host dies after an external effect but before a result is durably recorded, recovery does not replay the work and instead dead-letters the ambiguity for human review. Start and end event JSON is persisted before transmission, so response-loss retries reuse the exact event ID and payload and are deduplicated by the Gateway.
+
+Lifecycle evidence is appended to `/var/log/aios-codex-watcher/audit.jsonl` as `CODEX_AUTO_CLAIM`, `TASK_STARTED`, `TASK_EXECUTED`, `TASK_ENDED`, and `EVENT_POSTED`. Inputs, tokens, stdout, and stderr are not logged; only result digests are retained.
+
+Install from a reviewed commit with `sudo scripts/install_aios_codex_watcher.sh`. The installer creates a content-addressed release, atomically updates `current`, writes a receipt, and enables the five-second systemd timer. The existing Gateway inbound token file is referenced in place and never copied.
@@ -0,0 +1,107 @@
+# AIOS Orchestrator Gateway v0.2
+
+This component turns the current passive GPT orchestration pattern into a
+durable, unattended loop:
+
+```text
+Gitea/OpenClaw/Codex event
+  -> HTTP event endpoint or polled file inbox
+  -> durable SQLite state machine
+  -> Workspace Agent API trigger
+  -> strict callback decision
+  -> Responses API background fallback and polling
+  -> OpenClaw/Codex dispatch queues
+  -> start/end/result events
+  -> next orchestration cycle
+```
+
+## Reliability mechanisms
+
+The gateway does not depend on one timer, webhook or model call:
+
+- HTTP event ingestion.
+- Periodic file-inbox polling for missed webhooks and offline producers.
+- Local bare-Git ref polling for `main`, governance, patch and result refs.
+- Workspace Agent retries with a stable event `Idempotency-Key`.
+- Workspace Agent callback timeout and Responses API background fallback.
+- Responses status polling until completion or fail-closed terminal status.
+- SQLite optimistic state versions, idempotency records and processing leases.
+- Exponential retry with a maximum retry count and dead-letter state.
+- Same-blocker and maximum-hop guards to stop non-progress loops.
+- A systemd timer runs `--poll-once` as an independent reliability watchdog.
+
+Workspace Agent trigger runs are asynchronous and do not expose a retrievable
+final response. The central Workspace Agent must therefore call the
+`submit_orchestration_decision` action.
+
+## OpenClaw synchronization
+
+Every lifecycle stage is durably written to the OpenClaw synchronization queue:
+
+- `TASK_DISPATCHED`
+- `TASK_STARTED`
+- `TASK_ENDED`
+- `DECISION_APPLIED`
+- `PROJECT_SUMMARY`
+- `PROJECT_COMPLETED`
+
+An optional authenticated OpenClaw HTTP endpoint can receive the same records.
+A failed HTTP delivery remains in the lifecycle retry queue. OpenClaw remains
+the default project-status synchronizer and authoritative progress presenter.
+
+## Agent execution contract
+
+Each dispatched JSON envelope contains:
+
+- exact contract commit;
+- source event;
+- clean base commit;
+- primary and fallback agent;
+- allowed paths;
+- required checks;
+- forbidden operations;
+- completion event callback format.
+
+OpenClaw and Codex must send a `work_unit_started` event before execution and a
+`work_unit_completed`, `work_unit_blocked`, or `work_unit_failed` event when
+they stop. This guarantees that OpenClaw can synchronize every task start,
+finish, and overall project summary.
+
+## Security
+
+- Model and callback credentials are read only from root-owned secret files.
+- Credentials never enter Git, dispatch payloads or logs.
+- The gateway runs as a dedicated unprivileged user.
+- Dispatch and sync paths are protected against traversal and symlink targets.
+- All state changes require the exact contract commit and current state version.
+- Production evidence, credentials and approvals stay fail-closed.
+- Git history operations remain controlled by the committed governance contract.
+
+## Deployment sequence
+
+1. Apply this source bundle to a clean append-only branch.
+2. Run unit, repository, shell, JSON, systemd and Gitleaks checks.
+3. Configure one or both model channels:
+   - published Workspace Agent API channel and Workspace Agent access token;
+   - Responses API key and approved fallback model.
+4. Publish the decision callback as a Workspace Agent action or MCP tool.
+5. Install the service through `scripts/install_aios_orchestrator_gateway.sh`.
+6. Run `scripts/verify_aios_orchestrator_gateway.sh`.
+7. Submit a harmless event and verify:
+   - trigger acceptance;
+   - strict decision callback;
+   - dispatch file;
+   - OpenClaw task-start/task-end/project-summary synchronization;
+   - duplicate idempotency;
+   - polling recovery after suppressing the HTTP webhook.
+
+The installer copies an explicit gateway-only allowlist into a release directory
+named by its SHA-256 digest, atomically updates `/opt/aios-orchestrator-gateway/current`,
+and persists `/var/lib/aios-orchestrator-gateway/install-receipt.json` with the
+current and previous release. `--dry-run` performs source validation and emits
+`AIOS_ORCHESTRATOR_INSTALL_DRY_RUN=PASS` without changing installed state.
+
+Rollback reads that root-owned `0600` receipt, verifies both release directory
+names and `SOURCE_DIGEST` files, coordinates the gateway and poll units, and
+atomically switches `current` to the previous release. Repeating the same
+rollback is a no-op and emits `NOOP_ALREADY_ROLLED_BACK`.
@@ -1,25 +0,0 @@
-{
-  "git_branch_created": false,
-  "git_commit_created": false,
-  "production_mutation": false,
-  "py_compile": {
-    "files": [
-      "active-runtime/app/authorized_task_writer_provisioning.py",
-      "active-runtime/app/aios_authorized_task_writer_api.py"
-    ],
-    "status": "PASS"
-  },
-  "schema": "aios.authorized-task-writer-bridge-test-report.v1",
-  "secrets_included": false,
-  "smoke": {
-    "command": "python3 scripts/smoke_authorized_task_writer_provisioning.py",
-    "status": "PASS"
-  },
-  "status": "PASS",
-  "unit_tests": {
-    "command": "python3 -m unittest -v tests/test_authorized_task_writer_provisioning.py",
-    "errors": 0,
-    "failures": 0,
-    "total": 9
-  }
-}
@@ -1 +1 @@
-V2R1C7
+V1R4C6
@@ -13,7 +13,6 @@ from hashlib import sha256
 from pathlib import Path
 import json
 from typing import Any
-from message_handoff import stable_event_id


 def utc_now() -> str:
@@ -56,19 +55,13 @@ class AgentEventBus:
        payload: dict[str, Any],
        correlation_id: str | None = None,
    ) -> dict[str, Any]:
-        event_id = stable_event_id(
-            source=source, target=target, message_type=kind, payload=payload,
-            tenant_id=(payload.get('tenant_id') if isinstance(payload, dict) else None),
-            user_id=(payload.get('user_id') if isinstance(payload, dict) else None),
-            project_id=(payload.get('project_id') if isinstance(payload, dict) else None),
-            conversation_id=(payload.get('conversation_id') if isinstance(payload, dict) else None),
-            task_id=(payload.get('task_id') if isinstance(payload, dict) else None),
-            run_id=(payload.get('run_id') if isinstance(payload, dict) else None),
-            correlation_id=(payload.get('correlation_id') if isinstance(payload, dict) else None),
-            causation_id=(payload.get('causation_id') if isinstance(payload, dict) else None),
-            sequence=(payload.get('sequence') if isinstance(payload, dict) else None),
-            idempotency_key=(payload.get('idempotency_key') if isinstance(payload, dict) else None),
-        )
+        event_id = "evt_" + sha256(
+            json.dumps(
+                {"kind": kind, "source": source, "summary": summary, "payload": payload},
+                sort_keys=True,
+                ensure_ascii=False,
+            ).encode("utf-8")
+        ).hexdigest()[:16]
        event = AgentEvent(event_id, kind, source, target, summary, payload, correlation_id=correlation_id)
        self._write("pending", event.to_dict())
        self._audit("created", event.to_dict())
@@ -7,7 +7,7 @@ class AgentEventObservabilityBridge:
    def __init__(self, hooks: AgentObservabilityHooks | None = None):
        self.hooks = hooks or AgentObservabilityHooks()

-    def consume(self, event: dict, *, actor=None, trace=None):
+    def consume(self, event: dict):
        kind = event.get("kind")
        payload = event.get("payload", {})
        if kind == "agent_started":
@@ -16,8 +16,6 @@ class AgentEventObservabilityBridge:
                visible_scope=payload.get("scope", "self"),
                entry_agent=payload.get("agent", "unknown"),
                execution_id=event.get("id"),
-                actor=actor,
-                trace=trace,
            )
        if kind == "agent_delegated":
            return self.hooks.delegate(event["execution_id"], payload.get("agent", "unknown"))
@@ -31,18 +31,6 @@ class AgentExecutionRecord:
    status: str = "completed"
    started_at: str = field(default_factory=utc_now)
    ended_at: str = field(default_factory=utc_now)
-    trace_id: str | None = None
-    span_id: str | None = None
-    parent_span_id: str | None = None
-    correlation_id: str | None = None
-    causation_id: str | None = None
-    tenant_id: str | None = None
-    project_id: str | None = None
-    conversation_id: str | None = None
-    task_id: str | None = None
-    claim_id: str | None = None
-    run_id: str | None = None
-    message_id: str | None = None

    def to_dict(self):
        return asdict(self)
@@ -9,49 +9,25 @@ try:
 except Exception:
    APIRouter = None

-from .agent_observability import AgentExecutionRecord, AgentObservability
+from .agent_observability import AgentExecutionRecord
 from .agent_observability_dashboard import AgentObservabilityDashboard
 from .agent_observability_store import AgentObservabilityStore
-from .trace_tool_credential_governance import GovernanceActor, TraceContext, authorize_scope

 store = AgentObservabilityStore()
 dashboard = AgentObservabilityDashboard(store.load())


-def record_agent_execution(payload: dict[str, Any], *, actor: GovernanceActor | dict[str, Any] | None = None, trace: TraceContext | None = None):
-    scoped = any(payload.get(name) is not None for name in (
-        "trace_id", "span_id", "tenant_id", "project_id", "conversation_id", "task_id", "run_id"
-    ))
-    values = dict(payload)
-    if scoped:
-        if actor is None or trace is None:
-            raise RuntimeError("TRACE_ACTOR_CONTEXT_REQUIRED")
-        trusted = GovernanceActor.from_value(actor)
-        authorize_scope(trusted, trace.scope)
-        bound = {
-            "trace_id": trace.trace_id, "span_id": trace.span_id,
-            "parent_span_id": trace.parent_span_id, "correlation_id": trace.correlation_id,
-            "causation_id": trace.causation_id, "tenant_id": trace.scope.tenant_id,
-            "user_id": trace.scope.user_id, "project_id": trace.scope.project_id,
-            "conversation_id": trace.scope.conversation_id, "task_id": trace.task_id,
-            "claim_id": trace.claim_id, "run_id": trace.scope.run_id, "message_id": trace.message_id,
-        }
-        for name, authoritative in bound.items():
-            if values.get(name) not in (None, authoritative):
-                raise RuntimeError("TRACE_SCOPE_MISMATCH_DENY:" + name)
-            values[name] = authoritative
-    record = AgentExecutionRecord(**values)
+def record_agent_execution(payload: dict[str, Any]):
+    record = AgentExecutionRecord(**payload)
    return {"status": "ok", "record": store.append(record)}


-def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user", *, actor: GovernanceActor | dict[str, Any] | None = None):
-    records = store.query(user_id, group_id, role, actor=actor)
-    visible = AgentObservability()
-    visible.records = [AgentExecutionRecord(**record) for record in records]
+def get_agent_observability(user_id: str | None = None, group_id: str | None = None, role: str = "user"):
+    records = store.query(user_id, group_id, role)
    return {
        "status": "ok",
        "records": records,
-        "summary": visible.summary(None),
+        "summary": store.load().summary(user_id if role != "owner" else None),
    }


@@ -14,11 +14,6 @@ from uuid import uuid4

 from .agent_observability import AgentExecutionRecord
 from .agent_observability_store import AgentObservabilityStore
-from .trace_tool_credential_governance import (
-    GovernanceActor,
-    TraceContext,
-    authorize_scope,
-)


 def utc_now() -> str:
@@ -41,7 +36,6 @@ class AgentRunContext:
    input_tokens: int = 0
    output_tokens: int = 0
    status: str = "running"
-    trace: TraceContext | None = None

    def delegate(self, agent_name: str) -> None:
        if agent_name not in self.path:
@@ -65,19 +59,7 @@ class AgentObservabilityHooks:
        visible_scope: str,
        entry_agent: str,
        execution_id: str | None = None,
-        *,
-        actor: GovernanceActor | dict[str, Any] | None = None,
-        trace: TraceContext | None = None,
    ) -> dict[str, Any]:
-        if execution_id is not None and execution_id in self.active:
-            raise RuntimeError("OBSERVABILITY_EXECUTION_CONFLICT")
-        if trace is not None:
-            if actor is None:
-                raise RuntimeError("TRACE_ACTOR_CONTEXT_REQUIRED")
-            trusted_actor = GovernanceActor.from_value(actor)
-            authorize_scope(trusted_actor, trace.scope)
-            if trace.scope.user_id is not None and trace.scope.user_id != user_id:
-                raise RuntimeError("TRACE_SCOPE_MISMATCH_DENY:user_id")
        run = AgentRunContext(
            execution_id=execution_id or f"exec_{uuid4().hex[:12]}",
            user_id=user_id,
@@ -85,7 +67,6 @@ class AgentObservabilityHooks:
            entry_agent=entry_agent,
            path=[entry_agent],
            used_hermes=entry_agent.lower() == "hermes",
-            trace=trace,
        )
        self.active[run.execution_id] = run
        return {"status": "started", "execution_id": run.execution_id, "run": run.__dict__}
@@ -125,18 +106,6 @@ class AgentObservabilityHooks:
            status=status,
            started_at=run.started_at,
            ended_at=ended_at,
-            trace_id=run.trace.trace_id if run.trace else None,
-            span_id=run.trace.span_id if run.trace else None,
-            parent_span_id=run.trace.parent_span_id if run.trace else None,
-            correlation_id=run.trace.correlation_id if run.trace else None,
-            causation_id=run.trace.causation_id if run.trace else None,
-            tenant_id=run.trace.scope.tenant_id if run.trace else None,
-            project_id=run.trace.scope.project_id if run.trace else None,
-            conversation_id=run.trace.scope.conversation_id if run.trace else None,
-            task_id=run.trace.task_id if run.trace else None,
-            claim_id=run.trace.claim_id if run.trace else None,
-            run_id=run.trace.scope.run_id if run.trace else None,
-            message_id=run.trace.message_id if run.trace else None,
        )
        return {"status": "stored", "record": self.store.append(record)}

@@ -12,12 +12,6 @@ from pathlib import Path
 from typing import Any

 from .agent_observability import AgentExecutionRecord, AgentObservability
-from .trace_tool_credential_governance import (
-    GovernanceActor,
-    GovernanceError,
-    GovernanceScope,
-    authorize_scope,
-)


 class AgentObservabilityStore:
@@ -29,11 +23,6 @@ class AgentObservabilityStore:
    def append(self, record: AgentExecutionRecord) -> dict[str, Any]:
        path = self.records_dir / f"{record.execution_id}.json"
        data = record.to_dict()
-        if path.exists():
-            existing = json.loads(path.read_text(encoding="utf-8"))
-            if existing == data:
-                return existing
-            raise RuntimeError("OBSERVABILITY_EXECUTION_CONFLICT")
        path.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
        return data

@@ -44,36 +33,8 @@ class AgentObservabilityStore:
            observability.records.append(AgentExecutionRecord(**raw))
        return observability

-    def query(self, user_id: str | None = None, group_id: str | None = None, role: str = "user", *, actor: GovernanceActor | dict[str, Any] | None = None) -> list[dict[str, Any]]:
+    def query(self, user_id: str | None = None, group_id: str | None = None, role: str = "user") -> list[dict[str, Any]]:
        records = [record.to_dict() for record in self.load().records]
-        scoped = [record for record in records if record.get("tenant_id") is not None]
-        legacy = [record for record in records if record.get("tenant_id") is None]
-        if actor is not None:
-            trusted = GovernanceActor.from_value(actor)
-            visible: list[dict[str, Any]] = []
-            for record in scoped:
-                try:
-                    authorize_scope(
-                        trusted,
-                        GovernanceScope(
-                            "tenant",
-                            tenant_id=record.get("tenant_id"),
-                            user_id=record.get("user_id"),
-                            project_id=record.get("project_id"),
-                            conversation_id=record.get("conversation_id"),
-                            run_id=record.get("run_id"),
-                        ),
-                    )
-                except GovernanceError:
-                    continue
-                visible.append(record)
-            if trusted.privileged:
-                visible.extend(legacy)
-            else:
-                visible.extend(record for record in legacy if record.get("user_id") == trusted.scope.user_id)
-            return visible
-        # Caller-supplied role remains a legacy compatibility path only.
-        records = legacy
        if role == "owner":
            return records
        if role == "group_admin" and group_id:
@@ -1,201 +0,0 @@
-"""Fail-closed Agent Pull Runner primitives for AIOS autonomy v1.
-
-The runner owns task discovery and reporting only.  It never accepts shell
-strings: executors receive argv, an allowlisted cwd and an allowlisted env.
-Durable state is intentionally small so restart recovery and duplicate
-suppression can be verified without coupling the runner to one database.
-"""
-from __future__ import annotations
-
-import json
-import os
-import random
-import shutil
-import subprocess
-import tempfile
-import time
-from dataclasses import dataclass, field
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol, Sequence
-
-
-class RunnerError(RuntimeError):
-    """Raised when a runner contract would be violated."""
-
-
-@dataclass(frozen=True)
-class RunnerConfig:
-    worker_id: str
-    capabilities: tuple[str, ...] = ()
-    long_poll_seconds: int = 30
-    fallback_seconds: int = 60
-    jitter_seconds: int = 5
-    max_backoff_seconds: int = 300
-    executable_allowlist: tuple[str, ...] = ()
-    working_directory_allowlist: tuple[str, ...] = ()
-    environment_allowlist: tuple[str, ...] = ()
-
-
-@dataclass
-class RunnerState:
-    inflight: dict[str, dict[str, Any]] = field(default_factory=dict)
-    terminal: dict[str, dict[str, Any]] = field(default_factory=dict)
-
-
-class RunnerTransport(Protocol):
-    def register_worker(self, worker_id: str, capabilities: Sequence[str]) -> Mapping[str, Any]: ...
-    def heartbeat(self, worker_id: str) -> Mapping[str, Any]: ...
-    def long_poll(self, worker_id: str, timeout_seconds: int) -> Mapping[str, Any] | None: ...
-    def poll(self, worker_id: str) -> Mapping[str, Any] | None: ...
-    def claim(self, worker_id: str, task: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def renew(self, worker_id: str, task_id: str) -> Mapping[str, Any]: ...
-    def report_progress(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def report_result(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-    def report_evidence(self, worker_id: str, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]: ...
-
-
-class JsonStateStore:
-    """Atomic JSON state store for restart recovery."""
-
-    def __init__(self, path: str | os.PathLike[str]) -> None:
-        self.path = Path(path)
-
-    def load(self) -> RunnerState:
-        if not self.path.exists():
-            return RunnerState()
-        value = json.loads(self.path.read_text(encoding="utf-8"))
-        if not isinstance(value, dict):
-            raise RunnerError("runner state must be an object")
-        return RunnerState(
-            inflight=dict(value.get("inflight", {})),
-            terminal=dict(value.get("terminal", {})),
-        )
-
-    def save(self, state: RunnerState) -> None:
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        fd, name = tempfile.mkstemp(prefix=self.path.name + ".", dir=self.path.parent)
-        try:
-            with os.fdopen(fd, "w", encoding="utf-8") as handle:
-                json.dump({"inflight": state.inflight, "terminal": state.terminal}, handle, sort_keys=True)
-                handle.write("\n")
-            os.chmod(name, 0o600)
-            os.replace(name, self.path)
-        finally:
-            if os.path.exists(name):
-                os.unlink(name)
-
-
-class AgentPullRunner:
-    """Pull, claim, execute and report one task at a time."""
-
-    def __init__(
-        self,
-        config: RunnerConfig,
-        transport: RunnerTransport,
-        state_store: JsonStateStore | None = None,
-        *,
-        random_fn: Callable[[], float] = random.random,
-    ) -> None:
-        if not config.worker_id.strip():
-            raise RunnerError("worker_id is required")
-        self.config = config
-        self.transport = transport
-        self.state_store = state_store
-        self.random_fn = random_fn
-        self.state = state_store.load() if state_store else RunnerState()
-
-    def _save(self) -> None:
-        if self.state_store:
-            self.state_store.save(self.state)
-
-    def register(self) -> Mapping[str, Any]:
-        return self.transport.register_worker(self.config.worker_id, self.config.capabilities)
-
-    def heartbeat(self) -> Mapping[str, Any]:
-        return self.transport.heartbeat(self.config.worker_id)
-
-    def discovery_delay(self, failures: int) -> float:
-        failures = max(0, int(failures))
-        base = min(self.config.max_backoff_seconds, self.config.fallback_seconds * (2**failures))
-        jitter = self.random_fn() * max(0, self.config.jitter_seconds)
-        return min(self.config.max_backoff_seconds, base + jitter)
-
-    def discover_once(self) -> Mapping[str, Any] | None:
-        try:
-            task = self.transport.long_poll(self.config.worker_id, self.config.long_poll_seconds)
-        except Exception:
-            task = None
-        if task is None:
-            task = self.transport.poll(self.config.worker_id)
-        if not task:
-            return None
-        task_id = str(task.get("task_id", ""))
-        if not task_id:
-            raise RunnerError("task_id is required")
-        if task_id in self.state.terminal:
-            return {"status": "duplicate_suppressed", "task_id": task_id}
-        claimed = dict(self.transport.claim(self.config.worker_id, task))
-        self.state.inflight[task_id] = claimed
-        self._save()
-        return claimed
-
-    def renew(self, task_id: str) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.renew(self.config.worker_id, task_id)
-
-    def report_progress(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.report_progress(self.config.worker_id, task_id, payload)
-
-    def report_evidence(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        return self.transport.report_evidence(self.config.worker_id, task_id, payload)
-
-    def report_result(self, task_id: str, payload: Mapping[str, Any]) -> Mapping[str, Any]:
-        if task_id in self.state.terminal:
-            return {"status": "duplicate_terminal_suppressed", "task_id": task_id}
-        if task_id not in self.state.inflight:
-            raise RunnerError("task is not inflight")
-        result = dict(self.transport.report_result(self.config.worker_id, task_id, payload))
-        self.state.terminal[task_id] = {"result": result, "reported_at": time.time()}
-        self.state.inflight.pop(task_id, None)
-        self._save()
-        return result
-
-    def recover_after_restart(self) -> list[Mapping[str, Any]]:
-        recovered: list[Mapping[str, Any]] = []
-        for task_id in tuple(self.state.inflight):
-            recovered.append(self.renew(task_id))
-        return recovered
-
-    def validate_execution(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> None:
-        if not argv or any(not isinstance(item, str) or not item for item in argv):
-            raise RunnerError("argv_only_execution_required")
-        if any(ch in argv[0] for ch in (";", "|", "&", "`", "\n")):
-            raise RunnerError("shell_syntax_denied")
-        executable = shutil.which(argv[0])
-        if not executable:
-            raise RunnerError("executable_not_found")
-        if self.config.executable_allowlist and not any(
-            os.path.realpath(executable).startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
-            or os.path.realpath(executable) == os.path.realpath(prefix)
-            for prefix in self.config.executable_allowlist
-        ):
-            raise RunnerError("executable_not_allowlisted")
-        real_cwd = os.path.realpath(os.fspath(cwd))
-        if self.config.working_directory_allowlist and not any(
-            real_cwd == os.path.realpath(prefix)
-            or real_cwd.startswith(os.path.realpath(prefix).rstrip(os.sep) + os.sep)
-            for prefix in self.config.working_directory_allowlist
-        ):
-            raise RunnerError("working_directory_not_allowlisted")
-        if self.config.environment_allowlist and any(key not in self.config.environment_allowlist for key in env):
-            raise RunnerError("environment_key_not_allowlisted")
-
-    def execute_argv(self, argv: Sequence[str], cwd: str | os.PathLike[str], env: Mapping[str, str]) -> Mapping[str, Any]:
-        self.validate_execution(argv, cwd, env)
-        completed = subprocess.run(list(argv), cwd=os.fspath(cwd), env=dict(env), shell=False, text=True, capture_output=True, check=False)
-        return {"returncode": completed.returncode, "stdout": completed.stdout, "stderr": completed.stderr}
@@ -1,36 +0,0 @@
-"""Small operational CLI for the Agent Pull Runner contract."""
-from __future__ import annotations
-
-import argparse
-import json
-
-from agent_pull_runner import AgentPullRunner, RunnerConfig
-
-
-class _NoopTransport:
-    def register_worker(self, worker_id, capabilities): return {"status": "registered", "worker_id": worker_id, "capabilities": list(capabilities)}
-    def heartbeat(self, worker_id): return {"status": "alive", "worker_id": worker_id}
-    def long_poll(self, worker_id, timeout_seconds): return None
-    def poll(self, worker_id): return None
-    def claim(self, worker_id, task): return task
-    def renew(self, worker_id, task_id): return {"status": "renewed", "task_id": task_id}
-    def report_progress(self, worker_id, task_id, payload): return {"status": "progress_recorded", "task_id": task_id}
-    def report_result(self, worker_id, task_id, payload): return {"status": "result_recorded", "task_id": task_id}
-    def report_evidence(self, worker_id, task_id, payload): return {"status": "evidence_recorded", "task_id": task_id}
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="AIOS Agent Pull Runner")
-    parser.add_argument("--worker-id", default="self-test-worker")
-    parser.add_argument("--self-test", action="store_true")
-    args = parser.parse_args()
-    runner = AgentPullRunner(RunnerConfig(worker_id=args.worker_id, fallback_seconds=60), _NoopTransport())
-    if args.self_test:
-        print(json.dumps({"status": "PASS", "registration": runner.register(), "fallback_seconds": runner.config.fallback_seconds}, sort_keys=True))
-        return 0
-    print(json.dumps({"status": "READY", "worker_id": args.worker_id}, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,722 +0,0 @@
-"""Owner-controlled CAS-bound execution-envelope rebind for Online Agent Tasks.
-
-This service exists for a narrow recovery case: a Task was projected/claimed with a read-only
-source_capture envelope before its already-registered deterministic plan became authoritative.
-
-It never creates Tasks/Jobs/branches and never accepts arbitrary metadata patches. It only replaces
-metadata.execution + the derived execution_projection for the same governed binding, after an
-official NEEDS_REWORK transition has returned the Task to QUEUED with no active lease.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Callable, Mapping, Sequence
-import urllib.error
-import urllib.request
-
-from aios_online_agent_execution import (
-    GovernedExecutionBinding,
-    validate_execution_envelope,
-)
-
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-MAX_BODY = 64 * 1024
-AUTHORIZATION_ID_ENV = "AIOS_AGENT_TASK_EXECUTION_REBIND_AUTHORIZATION_ID"
-
-
-class ExecutionRebindError(RuntimeError):
-    def __init__(self, code: str, status: int = 409) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def _canonical(value: object) -> bytes:
-    return json.dumps(
-        value, sort_keys=True, separators=(",", ":"), ensure_ascii=False
-    ).encode("utf-8")
-
-
-def _sha(value: object) -> str:
-    return hashlib.sha256(_canonical(value)).hexdigest()
-
-
-def _now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def _require_string(
-    value: object,
-    code: str,
-    pattern: re.Pattern[str] | None = None,
-) -> str:
-    if not isinstance(value, str) or not value.strip():
-        raise ExecutionRebindError(code, 400)
-    value = value.strip()
-    if pattern is not None and pattern.fullmatch(value) is None:
-        raise ExecutionRebindError(code, 400)
-    return value
-
-
-def _required_authorization_id() -> str:
-    value = os.environ.get(AUTHORIZATION_ID_ENV, "").strip()
-    if not value:
-        raise RuntimeError("TASK_EXECUTION_REBIND_AUTHORIZATION_ID_MISSING")
-    if KEY_RE.fullmatch(value) is None:
-        raise RuntimeError("TASK_EXECUTION_REBIND_AUTHORIZATION_ID_INVALID")
-    return value
-
-
-@dataclass(frozen=True)
-class ExecutionRebindRequest:
-    expected_status: str
-    expected_revision: int
-    expected_attempt: int
-    previous_verification_sha256: str
-    expected_old_execution_digest: str
-    expected_new_execution_digest: str
-    authorization_id: str
-    idempotency_key: str
-    reason: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "ExecutionRebindRequest":
-        allowed = {
-            "expected_status",
-            "expected_revision",
-            "expected_attempt",
-            "previous_verification_sha256",
-            "expected_old_execution_digest",
-            "expected_new_execution_digest",
-            "authorization_id",
-            "idempotency_key",
-            "reason",
-        }
-        if set(value) != allowed:
-            raise ExecutionRebindError("EXECUTION_REBIND_FIELDS_INVALID", 400)
-
-        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
-        if status != "QUEUED":
-            raise ExecutionRebindError("EXPECTED_STATUS_INVALID", 400)
-
-        revision = value["expected_revision"]
-        attempt = value["expected_attempt"]
-        if (
-            not isinstance(revision, int)
-            or isinstance(revision, bool)
-            or revision < 0
-            or not isinstance(attempt, int)
-            or isinstance(attempt, bool)
-            or attempt < 1
-        ):
-            raise ExecutionRebindError("EXECUTION_REBIND_INTEGER_INVALID", 400)
-
-        verification = _require_string(
-            value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID"
-        )
-        old_digest = _require_string(
-            value["expected_old_execution_digest"], "OLD_EXECUTION_DIGEST_INVALID"
-        )
-        new_digest = _require_string(
-            value["expected_new_execution_digest"], "NEW_EXECUTION_DIGEST_INVALID"
-        )
-        for digest, code in (
-            (verification, "VERIFICATION_SHA256_INVALID"),
-            (old_digest, "OLD_EXECUTION_DIGEST_INVALID"),
-            (new_digest, "NEW_EXECUTION_DIGEST_INVALID"),
-        ):
-            if SHA_RE.fullmatch(digest) is None:
-                raise ExecutionRebindError(code, 400)
-        if old_digest == new_digest:
-            raise ExecutionRebindError("EXECUTION_REBIND_DIGEST_UNCHANGED", 400)
-
-        authorization = _require_string(
-            value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE
-        )
-        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
-        reason = _require_string(value["reason"], "EXECUTION_REBIND_REASON_INVALID")
-        if len(reason) > 512:
-            raise ExecutionRebindError("EXECUTION_REBIND_REASON_INVALID", 400)
-
-        return cls(
-            status,
-            revision,
-            attempt,
-            verification,
-            old_digest,
-            new_digest,
-            authorization,
-            key,
-            reason,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "expected_status": self.expected_status,
-            "expected_revision": self.expected_revision,
-            "expected_attempt": self.expected_attempt,
-            "previous_verification_sha256": self.previous_verification_sha256,
-            "expected_old_execution_digest": self.expected_old_execution_digest,
-            "expected_new_execution_digest": self.expected_new_execution_digest,
-            "authorization_id": self.authorization_id,
-            "idempotency_key": self.idempotency_key,
-            "reason": self.reason,
-        }
-
-
-class CanonicalBridgeExecutionResolver:
-    """Resolve the already-registered plan from the canonical governed Bridge."""
-
-    def __init__(self, base_url: str, control_token: str) -> None:
-        self.base_url = base_url.rstrip("/")
-        self.control_token = control_token
-
-    def __call__(
-        self,
-        task_id: str,
-        required_capabilities: Sequence[str],
-    ) -> dict[str, Any]:
-        body = json.dumps(
-            {
-                "task_id": task_id,
-                "required_capabilities": list(required_capabilities),
-            },
-            sort_keys=True,
-            separators=(",", ":"),
-        ).encode("utf-8")
-        request = urllib.request.Request(
-            self.base_url + "/v2/execution-envelope",
-            method="POST",
-            data=body,
-            headers={
-                "Authorization": "Bearer " + self.control_token,
-                "Content-Type": "application/json",
-                "Accept": "application/json",
-            },
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=15) as response:
-                raw = response.read()
-                status = response.status
-        except urllib.error.HTTPError as exc:
-            raw = exc.read()
-            status = exc.code
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise ExecutionRebindError("CANONICAL_EXECUTION_RESPONSE_INVALID", 502) from exc
-        if not isinstance(value, Mapping):
-            raise ExecutionRebindError("CANONICAL_EXECUTION_RESPONSE_INVALID", 502)
-        if status != 200:
-            raise ExecutionRebindError(
-                str(value.get("error") or "CANONICAL_EXECUTION_RESOLUTION_FAILED"),
-                502 if status >= 500 else 409,
-            )
-        return dict(value)
-
-
-class ExecutionRebindStore:
-    """Official owner-controlled mutation with CAS, plan resolution and durable audit."""
-
-    def __init__(
-        self,
-        db_path: Path,
-        resolver: Callable[[str, Sequence[str]], Mapping[str, Any]],
-    ) -> None:
-        self.db_path = Path(db_path)
-        self.resolver = resolver
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _columns(
-        connection: sqlite3.Connection,
-        table: str,
-    ) -> dict[str, sqlite3.Row]:
-        return {
-            str(row["name"]): row
-            for row in connection.execute(f'PRAGMA table_info("{table}")')
-        }
-
-    @staticmethod
-    def _json_value(raw: object, code: str) -> dict[str, Any]:
-        if isinstance(raw, Mapping):
-            return dict(raw)
-        if not isinstance(raw, str):
-            raise ExecutionRebindError(code, 409)
-        try:
-            value = json.loads(raw)
-        except json.JSONDecodeError as exc:
-            raise ExecutionRebindError(code, 409) from exc
-        if not isinstance(value, Mapping):
-            raise ExecutionRebindError(code, 409)
-        return dict(value)
-
-    @staticmethod
-    def _verification_hash(raw: object) -> str:
-        if raw in (None, ""):
-            value: object = {}
-        elif isinstance(raw, str):
-            try:
-                value = json.loads(raw)
-            except json.JSONDecodeError as exc:
-                raise ExecutionRebindError("TASK_VERIFICATION_INVALID", 409) from exc
-        else:
-            value = raw
-        return _sha(value)
-
-    @staticmethod
-    def _metadata_column(columns: Mapping[str, sqlite3.Row]) -> str:
-        for name in ("metadata_json", "metadata"):
-            if name in columns:
-                return name
-        raise ExecutionRebindError("TASK_METADATA_SCHEMA_UNSUPPORTED", 503)
-
-    @staticmethod
-    def _required_capabilities(
-        task: sqlite3.Row,
-        columns: Mapping[str, sqlite3.Row],
-        old_execution: Mapping[str, Any],
-    ) -> list[str]:
-        for field in ("required_capabilities_json", "required_capabilities"):
-            if field not in columns:
-                continue
-            raw = task[field]
-            if raw in (None, ""):
-                continue
-            if isinstance(raw, str):
-                try:
-                    value = json.loads(raw)
-                except json.JSONDecodeError:
-                    value = [item for item in raw.split(",") if item.strip()]
-            else:
-                value = raw
-            if isinstance(value, list) and all(isinstance(item, str) for item in value):
-                return [item.strip() for item in value if item.strip()]
-        value = old_execution.get("capability_scope")
-        if isinstance(value, list) and all(isinstance(item, str) for item in value):
-            return [item for item in value if item]
-        raise ExecutionRebindError("TASK_CAPABILITIES_UNAVAILABLE", 503)
-
-    @staticmethod
-    def _event_table(
-        connection: sqlite3.Connection,
-    ) -> tuple[str, dict[str, sqlite3.Row]]:
-        tables = {
-            row["name"]
-            for row in connection.execute(
-                "SELECT name FROM sqlite_master WHERE type='table'"
-            )
-        }
-        for name in ("task_events", "events"):
-            if name not in tables:
-                continue
-            columns = ExecutionRebindStore._columns(connection, name)
-            if "task_id" in columns and ("event_type" in columns or "type" in columns):
-                return name, columns
-        raise ExecutionRebindError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
-
-    @staticmethod
-    def _insert_event(
-        connection: sqlite3.Connection,
-        task_id: str,
-        payload: Mapping[str, Any],
-    ) -> None:
-        table, columns = ExecutionRebindStore._event_table(connection)
-        values: dict[str, Any] = {"task_id": task_id}
-        if "event_type" in columns:
-            values["event_type"] = "TASK_EXECUTION_REBIND_AUTHORIZED"
-        else:
-            values["type"] = "TASK_EXECUTION_REBIND_AUTHORIZED"
-        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-        if "payload_json" in columns:
-            values["payload_json"] = payload_text
-        elif "payload" in columns:
-            values["payload"] = payload_text
-        else:
-            raise ExecutionRebindError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
-        if "created_at" in columns:
-            values["created_at"] = _now()
-        if "agent_id" in columns:
-            values["agent_id"] = "owner-control"
-        if "actor_id" in columns:
-            values["actor_id"] = "owner-control"
-        names = list(values)
-        quoted = ",".join('"' + name + '"' for name in names)
-        placeholders = ",".join("?" for _ in names)
-        connection.execute(
-            f'INSERT INTO "{table}" ({quoted}) VALUES ({placeholders})',
-            tuple(values[name] for name in names),
-        )
-
-    @staticmethod
-    def _ensure_rebind_table(connection: sqlite3.Connection) -> None:
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_execution_rebinds (
-              task_id TEXT NOT NULL,
-              idempotency_key TEXT NOT NULL,
-              request_sha256 TEXT NOT NULL,
-              authorization_id TEXT NOT NULL,
-              previous_verification_sha256 TEXT NOT NULL,
-              old_execution_digest TEXT NOT NULL,
-              new_execution_digest TEXT NOT NULL,
-              expected_revision INTEGER NOT NULL,
-              applied_revision INTEGER NOT NULL,
-              attempt INTEGER NOT NULL,
-              reason TEXT NOT NULL,
-              created_at TEXT NOT NULL,
-              PRIMARY KEY(task_id,idempotency_key)
-            )
-            """
-        )
-
-    def _load_and_validate(
-        self,
-        connection: sqlite3.Connection,
-        task_id: str,
-        request: ExecutionRebindRequest,
-    ) -> tuple[sqlite3.Row, dict[str, sqlite3.Row], str, dict[str, Any], dict[str, Any]]:
-        columns = self._columns(connection, "tasks")
-        required = {
-            "task_id",
-            "status",
-            "attempt",
-            "revision",
-            "claimed_by",
-            "lease_token_hash",
-            "lease_expires_at",
-            "verification_json",
-        }
-        if not required.issubset(columns):
-            raise ExecutionRebindError("TASK_SCHEMA_EXECUTION_REBIND_UNSUPPORTED", 503)
-        metadata_column = self._metadata_column(columns)
-        task = connection.execute(
-            "SELECT * FROM tasks WHERE task_id=?",
-            (task_id,),
-        ).fetchone()
-        if task is None:
-            raise ExecutionRebindError("TASK_NOT_FOUND", 404)
-
-        if (
-            str(task["status"]) != request.expected_status
-            or int(task["revision"]) != request.expected_revision
-            or int(task["attempt"]) != request.expected_attempt
-        ):
-            raise ExecutionRebindError("EXECUTION_REBIND_CAS_MISMATCH", 409)
-        if task["lease_token_hash"] not in (None, "") or task["lease_expires_at"] not in (None, ""):
-            raise ExecutionRebindError("EXECUTION_REBIND_ACTIVE_LEASE_DENY", 409)
-
-        verification_sha = self._verification_hash(task["verification_json"])
-        if verification_sha != request.previous_verification_sha256:
-            raise ExecutionRebindError("EXECUTION_REBIND_VERIFICATION_DRIFT", 409)
-
-        metadata = self._json_value(
-            task[metadata_column],
-            "TASK_METADATA_INVALID",
-        )
-        execution = metadata.get("execution")
-        if not isinstance(execution, Mapping):
-            raise ExecutionRebindError("TASK_EXECUTION_METADATA_MISSING", 409)
-        old_execution = validate_execution_envelope(dict(execution))
-        if old_execution["execution_digest"] != request.expected_old_execution_digest:
-            raise ExecutionRebindError("EXECUTION_REBIND_OLD_DIGEST_DRIFT", 409)
-        if old_execution.get("action") != "source_capture":
-            raise ExecutionRebindError("EXECUTION_REBIND_SOURCE_CAPTURE_REQUIRED", 409)
-
-        projection = metadata.get("execution_projection")
-        if isinstance(projection, Mapping):
-            projected_digest = str(projection.get("execution_digest") or "")
-            if projected_digest and projected_digest != request.expected_old_execution_digest:
-                raise ExecutionRebindError("EXECUTION_REBIND_PROJECTION_DRIFT", 409)
-        return task, columns, metadata_column, metadata, old_execution
-
-    def rebind(
-        self,
-        task_id: str,
-        request: ExecutionRebindRequest,
-    ) -> dict[str, Any]:
-        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
-        required_authorization = _required_authorization_id()
-        if request.authorization_id != required_authorization:
-            raise ExecutionRebindError("EXECUTION_REBIND_AUTHORIZATION_ID_MISMATCH", 403)
-
-        request_sha = _sha(request.public())
-
-        # Idempotent replay must win before CAS validation because a successful
-        # rebind necessarily increments the Task revision and changes the persisted envelope.
-        with self._connect() as connection:
-            self._ensure_rebind_table(connection)
-            replay = connection.execute(
-                "SELECT * FROM task_execution_rebinds WHERE task_id=? AND idempotency_key=?",
-                (task_id, request.idempotency_key),
-            ).fetchone()
-            if replay is not None:
-                if replay["request_sha256"] != request_sha:
-                    raise ExecutionRebindError("EXECUTION_REBIND_IDEMPOTENCY_CONFLICT", 409)
-                connection.commit()
-                return {
-                    "task_id": task_id,
-                    "status": "QUEUED",
-                    "attempt": int(replay["attempt"]),
-                    "revision": int(replay["applied_revision"]),
-                    "old_execution_digest": replay["old_execution_digest"],
-                    "new_execution_digest": replay["new_execution_digest"],
-                    "authorization_id": replay["authorization_id"],
-                    "idempotent": True,
-                }
-
-        # Read/CAS snapshot first. Canonical Bridge resolution happens outside the DB write lock.
-        with self._connect() as connection:
-            task, columns, _, _, old_execution = self._load_and_validate(
-                connection, task_id, request
-            )
-            capabilities = self._required_capabilities(task, columns, old_execution)
-
-        binding = GovernedExecutionBinding.from_mapping(old_execution)
-        resolved = dict(self.resolver(task_id, capabilities))
-        new_execution = validate_execution_envelope(resolved, binding=binding)
-        if new_execution.get("action") != "deterministic":
-            raise ExecutionRebindError("EXECUTION_REBIND_DETERMINISTIC_PLAN_REQUIRED", 409)
-        if new_execution["execution_digest"] != request.expected_new_execution_digest:
-            raise ExecutionRebindError("EXECUTION_REBIND_NEW_DIGEST_DRIFT", 409)
-        if new_execution["execution_digest"] == old_execution["execution_digest"]:
-            raise ExecutionRebindError("EXECUTION_REBIND_DIGEST_UNCHANGED", 409)
-
-        # Re-read under BEGIN IMMEDIATE and apply only if the exact snapshot is unchanged.
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_rebind_table(connection)
-
-            replay = connection.execute(
-                "SELECT * FROM task_execution_rebinds WHERE task_id=? AND idempotency_key=?",
-                (task_id, request.idempotency_key),
-            ).fetchone()
-            if replay is not None:
-                if replay["request_sha256"] != request_sha:
-                    raise ExecutionRebindError("EXECUTION_REBIND_IDEMPOTENCY_CONFLICT", 409)
-                connection.commit()
-                return {
-                    "task_id": task_id,
-                    "status": "QUEUED",
-                    "attempt": int(replay["attempt"]),
-                    "revision": int(replay["applied_revision"]),
-                    "old_execution_digest": replay["old_execution_digest"],
-                    "new_execution_digest": replay["new_execution_digest"],
-                    "authorization_id": replay["authorization_id"],
-                    "idempotent": True,
-                }
-
-            task, columns, metadata_column, metadata, current_old = self._load_and_validate(
-                connection, task_id, request
-            )
-            if current_old["execution_digest"] != old_execution["execution_digest"]:
-                raise ExecutionRebindError("EXECUTION_REBIND_OLD_DIGEST_DRIFT", 409)
-
-            new_metadata = dict(metadata)
-            new_metadata["execution"] = new_execution
-            new_metadata["execution_projection"] = {
-                "schema": "aios.online-agent.task-projection.v1",
-                "task_id": binding.task_id,
-                "job_id": binding.job_id,
-                "execution_digest": new_execution["execution_digest"],
-            }
-            applied_revision = request.expected_revision + 1
-            previous_claimed_by = task["claimed_by"]
-
-            cursor = connection.execute(
-                f"""
-                UPDATE tasks
-                   SET "{metadata_column}"=?, revision=?, claimed_by=NULL,
-                       lease_token_hash=NULL, lease_expires_at=NULL
-                 WHERE task_id=? AND status=? AND revision=? AND attempt=?
-                   AND claimed_by IS ? AND lease_token_hash IS NULL AND lease_expires_at IS NULL
-                """,
-                (
-                    json.dumps(new_metadata, sort_keys=True, separators=(",", ":")),
-                    applied_revision,
-                    task_id,
-                    request.expected_status,
-                    request.expected_revision,
-                    request.expected_attempt,
-                    previous_claimed_by,
-                ),
-            )
-            if cursor.rowcount != 1:
-                raise ExecutionRebindError("EXECUTION_REBIND_CAS_MISMATCH", 409)
-
-            event_payload = {
-                "schema": "aios.task-execution-rebind.event.v1",
-                "task_id": task_id,
-                "job_id": binding.job_id,
-                "authorization_id": request.authorization_id,
-                "idempotency_key": request.idempotency_key,
-                "reason": request.reason,
-                "previous_verification_sha256": request.previous_verification_sha256,
-                "old_execution_digest": old_execution["execution_digest"],
-                "new_execution_digest": new_execution["execution_digest"],
-                "old_action": old_execution.get("action"),
-                "new_action": new_execution.get("action"),
-                "previous_revision": request.expected_revision,
-                "applied_revision": applied_revision,
-                "attempt": request.expected_attempt,
-                "request_sha256": request_sha,
-                "previous_claimed_by": previous_claimed_by,
-                "stale_claim_normalized": previous_claimed_by not in (None, ""),
-            }
-            self._insert_event(connection, task_id, event_payload)
-            connection.execute(
-                """
-                INSERT INTO task_execution_rebinds(
-                  task_id,idempotency_key,request_sha256,authorization_id,
-                  previous_verification_sha256,old_execution_digest,new_execution_digest,
-                  expected_revision,applied_revision,attempt,reason,created_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    task_id,
-                    request.idempotency_key,
-                    request_sha,
-                    request.authorization_id,
-                    request.previous_verification_sha256,
-                    old_execution["execution_digest"],
-                    new_execution["execution_digest"],
-                    request.expected_revision,
-                    applied_revision,
-                    request.expected_attempt,
-                    request.reason,
-                    _now(),
-                ),
-            )
-            connection.commit()
-            return {
-                "task_id": task_id,
-                "status": "QUEUED",
-                "attempt": request.expected_attempt,
-                "revision": applied_revision,
-                "old_execution_digest": old_execution["execution_digest"],
-                "new_execution_digest": new_execution["execution_digest"],
-                "authorization_id": request.authorization_id,
-                "idempotent": False,
-            }
-
-
-class ExecutionRebindHandler(BaseHTTPRequestHandler):
-    store: ExecutionRebindStore | None = None
-    control_token: str = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def _json(self, value: Mapping[str, Any], status: int) -> None:
-        data = json.dumps(
-            dict(value), sort_keys=True, separators=(",", ":")
-        ).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def _authorized(self) -> bool:
-        header = self.headers.get("Authorization", "")
-        return (
-            header.startswith("Bearer ")
-            and bool(self.control_token)
-            and hmac.compare_digest(header[7:], self.control_token)
-        )
-
-    def do_GET(self) -> None:
-        if self.path == "/health":
-            self._json(
-                {"status": "ok", "service": "aios-agent-task-execution-rebind"},
-                200,
-            )
-        else:
-            self._json({"error": "NOT_FOUND"}, 404)
-
-    def do_POST(self) -> None:
-        match = re.fullmatch(r"/v1/tasks/([^/]+)/execution-rebind", self.path)
-        if match is None:
-            self._json({"error": "NOT_FOUND"}, 404)
-            return
-        if not self._authorized():
-            self._json({"error": "UNAUTHORIZED"}, 401)
-            return
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError:
-            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
-            return
-        if length < 1 or length > MAX_BODY:
-            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
-            return
-        try:
-            value = json.loads(self.rfile.read(length).decode("utf-8"))
-            if not isinstance(value, Mapping):
-                raise ValueError
-            request = ExecutionRebindRequest.from_mapping(value)
-            if self.store is None:
-                raise ExecutionRebindError("RUNTIME_UNAVAILABLE", 503)
-            result = self.store.rebind(match.group(1), request)
-            self._json(result, 200 if result["idempotent"] else 201)
-        except ExecutionRebindError as exc:
-            self._json({"error": exc.code}, exc.status)
-        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
-            self._json({"error": "REQUEST_INVALID"}, 400)
-
-
-def load_control_token(path: Path) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise RuntimeError("TASK_EXECUTION_REBIND_CONTROL_CREDENTIAL_UNAVAILABLE")
-    value = path.read_text(encoding="utf-8").strip()
-    if len(value) < 32:
-        raise RuntimeError("TASK_EXECUTION_REBIND_CONTROL_CREDENTIAL_INVALID")
-    return value
-
-
-def serve() -> None:
-    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
-    _required_authorization_id()
-    token_path = Path(
-        os.environ.get(
-            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-            str(
-                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-                / "agent_task_control_token"
-            ),
-        )
-    )
-    token = load_control_token(token_path)
-    bridge = os.environ.get(
-        "AIOS_GOVERNED_WRITE_API_URL",
-        "http://127.0.0.1:18892",
-    )
-    host = os.environ.get("AIOS_TASK_EXECUTION_REBIND_HOST", "127.0.0.1")
-    port = int(os.environ.get("AIOS_TASK_EXECUTION_REBIND_PORT", "18942"))
-    ExecutionRebindHandler.store = ExecutionRebindStore(
-        db,
-        CanonicalBridgeExecutionResolver(bridge, token),
-    )
-    ExecutionRebindHandler.control_token = token
-    ThreadingHTTPServer((host, port), ExecutionRebindHandler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,427 +0,0 @@
-"""Owner-controlled, CAS-bound retry extension for exhausted Online Agent Tasks."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Mapping
-
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
-MAX_BODY = 64 * 1024
-AUTHORIZE_EXTENSION_ID_ENV = "AIOS_AGENT_TASK_AUTHORIZATION_ID"
-
-
-class RetryExtensionError(RuntimeError):
-    def __init__(self, code: str, status: int = 409) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def _canonical(value: object) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def _sha(value: object) -> str:
-    return hashlib.sha256(_canonical(value)).hexdigest()
-
-
-def _required_authorization_id() -> str:
-    value = os.environ.get(AUTHORIZE_EXTENSION_ID_ENV, "").strip()
-    if not value:
-        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_MISSING")
-    if KEY_RE.fullmatch(value) is None:
-        raise RuntimeError("TASK_RETRY_AUTHORIZATION_ID_INVALID")
-    return value
-
-
-def _now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def _require_string(value: object, code: str, pattern: re.Pattern[str] | None = None) -> str:
-    if not isinstance(value, str) or not value.strip():
-        raise RetryExtensionError(code, 400)
-    value = value.strip()
-    if pattern is not None and pattern.fullmatch(value) is None:
-        raise RetryExtensionError(code, 400)
-    return value
-
-
-@dataclass(frozen=True)
-class RetryExtensionRequest:
-    expected_status: str
-    expected_revision: int
-    expected_attempt: int
-    expected_max_attempts: int
-    next_max_attempts: int
-    previous_verification_sha256: str
-    authorization_id: str
-    idempotency_key: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "RetryExtensionRequest":
-        allowed = {
-            "expected_status", "expected_revision", "expected_attempt", "expected_max_attempts",
-            "next_max_attempts", "previous_verification_sha256", "authorization_id", "idempotency_key",
-        }
-        if set(value) != allowed:
-            raise RetryExtensionError("RETRY_EXTENSION_FIELDS_INVALID", 400)
-        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
-        if status != "FAILED":
-            raise RetryExtensionError("EXPECTED_STATUS_INVALID", 400)
-        ints: dict[str, int] = {}
-        for field in ("expected_revision", "expected_attempt", "expected_max_attempts", "next_max_attempts"):
-            item = value[field]
-            if not isinstance(item, int) or isinstance(item, bool) or item < 0:
-                raise RetryExtensionError("RETRY_EXTENSION_INTEGER_INVALID", 400)
-            ints[field] = item
-        if ints["expected_attempt"] != ints["expected_max_attempts"]:
-            raise RetryExtensionError("RETRY_EXTENSION_NOT_EXHAUSTED", 409)
-        if ints["next_max_attempts"] != ints["expected_max_attempts"] + 1:
-            raise RetryExtensionError("RETRY_EXTENSION_MUST_BE_BOUNDED_ONE_STEP", 400)
-        if ints["next_max_attempts"] > 50:
-            raise RetryExtensionError("RETRY_EXTENSION_LIMIT_EXCEEDED", 400)
-        verification = _require_string(value["previous_verification_sha256"], "VERIFICATION_SHA256_INVALID")
-        if re.fullmatch(r"[0-9a-f]{64}", verification) is None:
-            raise RetryExtensionError("VERIFICATION_SHA256_INVALID", 400)
-        authorization = _require_string(value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE)
-        key = _require_string(value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE)
-        return cls(
-            status,
-            ints["expected_revision"],
-            ints["expected_attempt"],
-            ints["expected_max_attempts"],
-            ints["next_max_attempts"],
-            verification,
-            authorization,
-            key,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "expected_status": self.expected_status,
-            "expected_revision": self.expected_revision,
-            "expected_attempt": self.expected_attempt,
-            "expected_max_attempts": self.expected_max_attempts,
-            "next_max_attempts": self.next_max_attempts,
-            "previous_verification_sha256": self.previous_verification_sha256,
-            "authorization_id": self.authorization_id,
-            "idempotency_key": self.idempotency_key,
-        }
-
-
-class RetryExtensionStore:
-    """Owns the official mutation. Direct/manual DB edits remain forbidden."""
-
-    def __init__(self, db_path: Path) -> None:
-        self.db_path = Path(db_path)
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _columns(connection: sqlite3.Connection, table: str) -> dict[str, sqlite3.Row]:
-        return {str(row["name"]): row for row in connection.execute(f'PRAGMA table_info("{table}")')}
-
-    @staticmethod
-    def _event_table(connection: sqlite3.Connection) -> tuple[str, dict[str, sqlite3.Row]]:
-        tables = {
-            row["name"]
-            for row in connection.execute("SELECT name FROM sqlite_master WHERE type='table'")
-        }
-        for name in ("task_events", "events"):
-            if name not in tables:
-                continue
-            columns = RetryExtensionStore._columns(connection, name)
-            if "task_id" in columns and ("event_type" in columns or "type" in columns):
-                return name, columns
-        raise RetryExtensionError("TASK_EVENT_TABLE_UNSUPPORTED", 503)
-
-    @staticmethod
-    def _verification_hash(raw: object) -> str:
-        if raw in (None, ""):
-            value: object = {}
-        elif isinstance(raw, str):
-            try:
-                value = json.loads(raw)
-            except json.JSONDecodeError as exc:
-                raise RetryExtensionError("TASK_VERIFICATION_INVALID", 409) from exc
-        else:
-            value = raw
-        return _sha(value)
-
-    @staticmethod
-    def _ensure_extension_table(connection: sqlite3.Connection) -> None:
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_retry_extensions (
-              task_id TEXT NOT NULL,
-              idempotency_key TEXT NOT NULL,
-              request_sha256 TEXT NOT NULL,
-              authorization_id TEXT NOT NULL,
-              previous_verification_sha256 TEXT NOT NULL,
-              previous_max_attempts INTEGER NOT NULL,
-              next_max_attempts INTEGER NOT NULL,
-              expected_revision INTEGER NOT NULL,
-              applied_revision INTEGER NOT NULL,
-              created_at TEXT NOT NULL,
-              PRIMARY KEY(task_id, idempotency_key)
-            )
-            """
-        )
-
-    @staticmethod
-    def _insert_event(
-        connection: sqlite3.Connection,
-        task_id: str,
-        payload: Mapping[str, Any],
-    ) -> None:
-        table, columns = RetryExtensionStore._event_table(connection)
-        values: dict[str, Any] = {"task_id": task_id}
-        if "event_type" in columns:
-            values["event_type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
-        else:
-            values["type"] = "TASK_RETRY_EXTENSION_AUTHORIZED"
-        payload_text = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-        if "payload_json" in columns:
-            values["payload_json"] = payload_text
-        elif "payload" in columns:
-            values["payload"] = payload_text
-        else:
-            raise RetryExtensionError("TASK_EVENT_PAYLOAD_UNSUPPORTED", 503)
-        if "created_at" in columns:
-            values["created_at"] = _now()
-        if "agent_id" in columns:
-            values["agent_id"] = "owner-control"
-        if "actor_id" in columns:
-            values["actor_id"] = "owner-control"
-        names = list(values)
-        sql = f'INSERT INTO "{table}" ({",".join(f"""\"{name}\"""" for name in names)}) VALUES ({",".join("?" for _ in names)})'
-        connection.execute(sql, tuple(values[name] for name in names))
-
-    def extend(self, task_id: str, request: RetryExtensionRequest) -> dict[str, Any]:
-        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
-        required_authorization_id = _required_authorization_id()
-        if request.authorization_id != required_authorization_id:
-            raise RetryExtensionError("RETRY_EXTENSION_AUTHORIZATION_ID_MISMATCH", 403)
-        request_payload = request.public()
-        request_sha = _sha(request_payload)
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_extension_table(connection)
-            replay = connection.execute(
-                "SELECT * FROM task_retry_extensions WHERE task_id=? AND idempotency_key=?",
-                (task_id, request.idempotency_key),
-            ).fetchone()
-            if replay is not None:
-                if replay["request_sha256"] != request_sha:
-                    raise RetryExtensionError("RETRY_EXTENSION_IDEMPOTENCY_CONFLICT", 409)
-                connection.commit()
-                return {
-                    "task_id": task_id,
-                    "status": "QUEUED",
-                    "attempt": request.expected_attempt,
-                    "max_attempts": int(replay["next_max_attempts"]),
-                    "revision": int(replay["applied_revision"]),
-                    "idempotent": True,
-                    "authorization_id": replay["authorization_id"],
-                    "previous_verification_sha256": replay["previous_verification_sha256"],
-                }
-
-            columns = self._columns(connection, "tasks")
-            required = {
-                "task_id", "status", "attempt", "max_attempts", "revision", "claimed_by",
-                "lease_token_hash", "lease_expires_at", "verification_json",
-            }
-            if not required.issubset(columns):
-                raise RetryExtensionError("TASK_SCHEMA_RETRY_EXTENSION_UNSUPPORTED", 503)
-            task = connection.execute("SELECT * FROM tasks WHERE task_id=?", (task_id,)).fetchone()
-            if task is None:
-                raise RetryExtensionError("TASK_NOT_FOUND", 404)
-            actual_verification_sha = self._verification_hash(task["verification_json"])
-            if actual_verification_sha != request.previous_verification_sha256:
-                raise RetryExtensionError("RETRY_EXTENSION_VERIFICATION_DRIFT", 409)
-            if (
-                task["status"] != request.expected_status
-                or int(task["revision"]) != request.expected_revision
-                or int(task["attempt"]) != request.expected_attempt
-                or int(task["max_attempts"]) != request.expected_max_attempts
-            ):
-                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
-            for lease_field in ("lease_token_hash", "lease_expires_at"):
-                if lease_field in columns and task[lease_field] not in (None, ""):
-                    raise RetryExtensionError("RETRY_EXTENSION_ACTIVE_LEASE_DENY", 409)
-
-            previous_claimed_by = task["claimed_by"]
-            applied_revision = request.expected_revision + 1
-            cursor = connection.execute(
-                """
-                UPDATE tasks
-                   SET status='QUEUED', max_attempts=?, revision=?, claimed_by=NULL,
-                       lease_token_hash=NULL, lease_expires_at=NULL
-                 WHERE task_id=? AND status=? AND revision=? AND attempt=? AND max_attempts=?
-                   AND claimed_by IS ?
-                   AND lease_token_hash IS NULL AND lease_expires_at IS NULL
-                """,
-                (
-                    request.next_max_attempts,
-                    applied_revision,
-                    task_id,
-                    request.expected_status,
-                    request.expected_revision,
-                    request.expected_attempt,
-                    request.expected_max_attempts,
-                    previous_claimed_by,
-                ),
-            )
-            if cursor.rowcount != 1:
-                raise RetryExtensionError("RETRY_EXTENSION_CAS_MISMATCH", 409)
-
-            event_payload = {
-                "schema": "aios.task-retry-extension.event.v1",
-                "task_id": task_id,
-                "authorization_id": request.authorization_id,
-                "idempotency_key": request.idempotency_key,
-                "previous_verification_sha256": request.previous_verification_sha256,
-                "previous_max_attempts": request.expected_max_attempts,
-                "next_max_attempts": request.next_max_attempts,
-                "previous_revision": request.expected_revision,
-                "applied_revision": applied_revision,
-                "request_sha256": request_sha,
-                "previous_claimed_by": previous_claimed_by,
-                "stale_terminal_claim_normalized": previous_claimed_by not in (None, ""),
-            }
-            self._insert_event(connection, task_id, event_payload)
-            connection.execute(
-                """
-                INSERT INTO task_retry_extensions(
-                  task_id,idempotency_key,request_sha256,authorization_id,previous_verification_sha256,
-                  previous_max_attempts,next_max_attempts,expected_revision,applied_revision,created_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    task_id,
-                    request.idempotency_key,
-                    request_sha,
-                    request.authorization_id,
-                    request.previous_verification_sha256,
-                    request.expected_max_attempts,
-                    request.next_max_attempts,
-                    request.expected_revision,
-                    applied_revision,
-                    _now(),
-                ),
-            )
-            connection.commit()
-            return {
-                "task_id": task_id,
-                "status": "QUEUED",
-                "attempt": request.expected_attempt,
-                "max_attempts": request.next_max_attempts,
-                "revision": applied_revision,
-                "idempotent": False,
-                "authorization_id": request.authorization_id,
-                "previous_verification_sha256": request.previous_verification_sha256,
-            }
-
-
-class RetryExtensionHandler(BaseHTTPRequestHandler):
-    store: RetryExtensionStore | None = None
-    control_token: str = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def _json(self, value: Mapping[str, Any], status: int) -> None:
-        data = json.dumps(dict(value), sort_keys=True, separators=(",", ":")).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(data)))
-        self.end_headers()
-        self.wfile.write(data)
-
-    def _authorized(self) -> bool:
-        header = self.headers.get("Authorization", "")
-        return (
-            header.startswith("Bearer ")
-            and bool(self.control_token)
-            and hmac.compare_digest(header[7:], self.control_token)
-        )
-
-    def do_GET(self) -> None:
-        if self.path == "/health":
-            self._json({"status": "ok", "service": "aios-agent-task-retry-extension"}, 200)
-        else:
-            self._json({"error": "NOT_FOUND"}, 404)
-
-    def do_POST(self) -> None:
-        match = re.fullmatch(r"/v1/tasks/([^/]+)/retry-extension", self.path)
-        if match is None:
-            self._json({"error": "NOT_FOUND"}, 404)
-            return
-        if not self._authorized():
-            self._json({"error": "UNAUTHORIZED"}, 401)
-            return
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError:
-            self._json({"error": "CONTENT_LENGTH_INVALID"}, 400)
-            return
-        if length < 1 or length > MAX_BODY:
-            self._json({"error": "REQUEST_SIZE_INVALID"}, 413)
-            return
-        try:
-            value = json.loads(self.rfile.read(length).decode("utf-8"))
-            if not isinstance(value, Mapping):
-                raise ValueError
-            request = RetryExtensionRequest.from_mapping(value)
-            if self.store is None:
-                raise RetryExtensionError("RUNTIME_UNAVAILABLE", 503)
-            result = self.store.extend(match.group(1), request)
-            self._json(result, 200 if result["idempotent"] else 201)
-        except RetryExtensionError as exc:
-            self._json({"error": exc.code}, exc.status)
-        except (UnicodeDecodeError, json.JSONDecodeError, ValueError):
-            self._json({"error": "REQUEST_INVALID"}, 400)
-
-
-def load_control_token(path: Path) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_UNAVAILABLE")
-    value = path.read_text(encoding="utf-8").strip()
-    if len(value) < 32:
-        raise RuntimeError("TASK_RETRY_CONTROL_CREDENTIAL_INVALID")
-    return value
-
-
-def serve() -> None:
-    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
-    _required_authorization_id()
-    token_path = Path(
-        os.environ.get(
-            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-            str(Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials")) / "agent_task_control_token"),
-        )
-    )
-    host = os.environ.get("AIOS_TASK_RETRY_HOST", "127.0.0.1")
-    port = int(os.environ.get("AIOS_TASK_RETRY_PORT", "18941"))
-    RetryExtensionHandler.store = RetryExtensionStore(db)
-    RetryExtensionHandler.control_token = load_control_token(token_path)
-    ThreadingHTTPServer((host, port), RetryExtensionHandler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,655 +0,0 @@
-"""CAS-bound projection from an unprivileged planner to a host coordinator."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import sqlite3
-from typing import Any, Callable, Mapping, Sequence
-import urllib.error
-import urllib.request
-
-from aios_agent_task_initial_execution_projection import (
-    InitialExecutionProjectionError,
-    InitialExecutionProjectionStore,
-    JOB_RE,
-    KEY_RE,
-    MAX_BODY,
-    SHA_RE,
-    TASK_RE,
-    _canonical,
-    _now,
-    _required_authorization_id,
-    _require_string,
-    _sha,
-    load_control_token,
-)
-from aios_online_agent_execution import (
-    GovernedExecutionBinding,
-    validate_execution_envelope,
-)
-
-
-RUNTIME_CAPABILITY = "agent.runtime.openclaw"
-COORDINATOR_CAPABILITY = "engineering.autonomous"
-COORDINATOR_CAPABILITIES = [RUNTIME_CAPABILITY, COORDINATOR_CAPABILITY]
-
-
-@dataclass(frozen=True)
-class SupervisorCoordinatorProjectionRequest:
-    expected_status: str
-    expected_revision: int
-    expected_attempt: int
-    expected_metadata_sha256: str
-    expected_required_capabilities_sha256: str
-    previous_verification_sha256: str
-    expected_planner_result_sha256: str
-    expected_old_execution_digest: str
-    expected_new_execution_digest: str
-    expected_job_id: str
-    authorization_id: str
-    idempotency_key: str
-    reason: str
-
-    @classmethod
-    def from_mapping(
-        cls, value: Mapping[str, Any]
-    ) -> "SupervisorCoordinatorProjectionRequest":
-        allowed = {
-            "expected_status",
-            "expected_revision",
-            "expected_attempt",
-            "expected_metadata_sha256",
-            "expected_required_capabilities_sha256",
-            "previous_verification_sha256",
-            "expected_planner_result_sha256",
-            "expected_old_execution_digest",
-            "expected_new_execution_digest",
-            "expected_job_id",
-            "authorization_id",
-            "idempotency_key",
-            "reason",
-        }
-        if set(value) != allowed:
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_PROJECTION_FIELDS_INVALID", 400
-            )
-        status = _require_string(value["expected_status"], "EXPECTED_STATUS_INVALID")
-        revision = value["expected_revision"]
-        attempt = value["expected_attempt"]
-        if (
-            status != "QUEUED"
-            or not isinstance(revision, int)
-            or isinstance(revision, bool)
-            or revision < 2
-            or not isinstance(attempt, int)
-            or isinstance(attempt, bool)
-            or attempt < 1
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_PROJECTION_STATE_INVALID", 400
-            )
-        names = (
-            "expected_metadata_sha256",
-            "expected_required_capabilities_sha256",
-            "previous_verification_sha256",
-            "expected_planner_result_sha256",
-            "expected_old_execution_digest",
-            "expected_new_execution_digest",
-        )
-        digests = {
-            name: _require_string(value[name], name.upper() + "_INVALID", SHA_RE)
-            for name in names
-        }
-        job_id = _require_string(value["expected_job_id"], "JOB_ID_INVALID", JOB_RE)
-        authorization_id = _require_string(
-            value["authorization_id"], "AUTHORIZATION_ID_INVALID", KEY_RE
-        )
-        idempotency_key = _require_string(
-            value["idempotency_key"], "IDEMPOTENCY_KEY_INVALID", KEY_RE
-        )
-        reason = _require_string(value["reason"], "PROJECTION_REASON_INVALID")
-        if len(reason) > 512:
-            raise InitialExecutionProjectionError("PROJECTION_REASON_INVALID", 400)
-        return cls(
-            status,
-            revision,
-            attempt,
-            digests["expected_metadata_sha256"],
-            digests["expected_required_capabilities_sha256"],
-            digests["previous_verification_sha256"],
-            digests["expected_planner_result_sha256"],
-            digests["expected_old_execution_digest"],
-            digests["expected_new_execution_digest"],
-            job_id,
-            authorization_id,
-            idempotency_key,
-            reason,
-        )
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "expected_status": self.expected_status,
-            "expected_revision": self.expected_revision,
-            "expected_attempt": self.expected_attempt,
-            "expected_metadata_sha256": self.expected_metadata_sha256,
-            "expected_required_capabilities_sha256": self.expected_required_capabilities_sha256,
-            "previous_verification_sha256": self.previous_verification_sha256,
-            "expected_planner_result_sha256": self.expected_planner_result_sha256,
-            "expected_old_execution_digest": self.expected_old_execution_digest,
-            "expected_new_execution_digest": self.expected_new_execution_digest,
-            "expected_job_id": self.expected_job_id,
-            "authorization_id": self.authorization_id,
-            "idempotency_key": self.idempotency_key,
-            "reason": self.reason,
-        }
-
-
-class CanonicalCoordinatorExecutionResolver:
-    def __init__(self, base_url: str, control_token: str) -> None:
-        self.base_url = base_url.rstrip("/")
-        self.control_token = control_token
-
-    def __call__(
-        self,
-        task_id: str,
-        expected_job_id: str,
-        runtime_input: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        body = {
-            "task_id": task_id,
-            "job_id": expected_job_id,
-            "required_capabilities": COORDINATOR_CAPABILITIES,
-            "execution": {
-                "action": "agent_runtime",
-                "adapter": "openclaw",
-                "capability_scope": COORDINATOR_CAPABILITIES,
-                "runtime_input": dict(runtime_input),
-            },
-        }
-        request = urllib.request.Request(
-            self.base_url + "/v2/execution-envelope",
-            method="POST",
-            data=_canonical(body),
-            headers={
-                "Authorization": "Bearer " + self.control_token,
-                "Content-Type": "application/json",
-                "Accept": "application/json",
-            },
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=15) as response:
-                raw, status = response.read(), response.status
-        except urllib.error.HTTPError as exc:
-            raw, status = exc.read(), exc.code
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise InitialExecutionProjectionError(
-                "CANONICAL_COORDINATOR_EXECUTION_RESPONSE_INVALID", 502
-            ) from exc
-        if not isinstance(value, Mapping):
-            raise InitialExecutionProjectionError(
-                "CANONICAL_COORDINATOR_EXECUTION_RESPONSE_INVALID", 502
-            )
-        if status != 200:
-            raise InitialExecutionProjectionError(
-                str(value.get("error") or "CANONICAL_COORDINATOR_EXECUTION_FAILED"),
-                502 if status >= 500 else 409,
-            )
-        return dict(value)
-
-
-class SupervisorCoordinatorProjectionStore(InitialExecutionProjectionStore):
-    def __init__(
-        self,
-        db_path: Path,
-        resolver: Callable[[str, str, Mapping[str, Any]], Mapping[str, Any]],
-    ) -> None:
-        super().__init__(db_path, resolver)  # type: ignore[arg-type]
-        self.coordinator_resolver = resolver
-
-    @staticmethod
-    def _ensure_table(connection: sqlite3.Connection) -> None:
-        connection.execute(
-            """
-            CREATE TABLE IF NOT EXISTS task_supervisor_coordinator_projections (
-              task_id TEXT NOT NULL,
-              idempotency_key TEXT NOT NULL,
-              request_sha256 TEXT NOT NULL,
-              authorization_id TEXT NOT NULL,
-              expected_job_id TEXT NOT NULL,
-              planner_result_sha256 TEXT NOT NULL,
-              old_execution_digest TEXT NOT NULL,
-              new_execution_digest TEXT NOT NULL,
-              expected_revision INTEGER NOT NULL,
-              applied_revision INTEGER NOT NULL,
-              attempt INTEGER NOT NULL,
-              created_at TEXT NOT NULL,
-              PRIMARY KEY(task_id,idempotency_key)
-            )
-            """
-        )
-
-    @classmethod
-    def _planner_event_chain(
-        cls, connection: sqlite3.Connection, task_id: str
-    ) -> None:
-        table, columns = cls._event_table(connection)
-        ordering = "event_id" if "event_id" in columns else "rowid"
-        rows = connection.execute(
-            f'SELECT event_type,payload_json FROM "{table}" '
-            f'WHERE task_id=? ORDER BY {ordering}',
-            (task_id,),
-        ).fetchall()
-        events = [str(row[0]) for row in rows]
-        try:
-            projection = len(events) - 1 - events[::-1].index(
-                "TASK_INITIAL_EXECUTION_PROJECTION_AUTHORIZED"
-            )
-        except ValueError as exc:
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_PROJECTION_EVENT_MISSING", 409
-            ) from exc
-        tail = events[projection + 1 :]
-        if (
-            len(tail) < 4
-            or tail[0] != "TASK_CLAIMED"
-            or tail.count("TASK_CLAIMED") != 1
-            or tail.count("RESULT_SUBMITTED") != 1
-            or tail.count("TASK_VERIFIED") != 1
-            or tail[-1] != "TASK_VERIFIED"
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_EVENT_CHAIN_INVALID", 409
-            )
-        result = tail.index("RESULT_SUBMITTED")
-        if (
-            not any(event == "TASK_HEARTBEAT" for event in tail[1:result])
-            or any(
-                event not in {
-                    "TASK_CLAIMED",
-                    "TASK_HEARTBEAT",
-                    "RESULT_SUBMITTED",
-                    "TASK_VERIFIED",
-                }
-                for event in tail
-            )
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_EVENT_CHAIN_INVALID", 409
-            )
-        verification_event = json.loads(rows[-1][1])
-        if (
-            verification_event.get("decision") != "NEEDS_REWORK"
-            or verification_event.get("next_state") != "QUEUED"
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_NEEDS_REWORK_EVENT_REQUIRED", 409
-            )
-
-    def _load(
-        self,
-        connection: sqlite3.Connection,
-        task_id: str,
-        request: SupervisorCoordinatorProjectionRequest,
-    ) -> tuple[sqlite3.Row, dict[str, Any], dict[str, Any]]:
-        task = connection.execute(
-            "SELECT * FROM tasks WHERE task_id=?", (task_id,)
-        ).fetchone()
-        if task is None:
-            raise InitialExecutionProjectionError("TASK_NOT_FOUND", 404)
-        if (
-            task["status"] != request.expected_status
-            or int(task["revision"]) != request.expected_revision
-            or int(task["attempt"]) != request.expected_attempt
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_PROJECTION_CAS_MISMATCH", 409
-            )
-        if (
-            task["claimed_by"] not in (None, "")
-            or task["lease_token_hash"] not in (None, "")
-            or task["lease_expires_at"] not in (None, "")
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_ACTIVE_LEASE_DENY", 409
-            )
-        metadata = self._json_value(task["metadata_json"], "TASK_METADATA_INVALID")
-        capabilities = self._json_value(
-            task["required_capabilities_json"], "TASK_CAPABILITIES_INVALID"
-        )
-        result = self._json_value(task["result_json"], "PLANNER_RESULT_INVALID")
-        verification = self._json_value(
-            task["verification_json"], "PLANNER_VERIFICATION_INVALID"
-        )
-        if (
-            not isinstance(metadata, Mapping)
-            or not isinstance(capabilities, list)
-            or not isinstance(result, Mapping)
-            or not isinstance(verification, Mapping)
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_STATE_INVALID", 409
-            )
-        metadata, result, verification = dict(metadata), dict(result), dict(verification)
-        if _sha(metadata) != request.expected_metadata_sha256:
-            raise InitialExecutionProjectionError("TASK_METADATA_DRIFT", 409)
-        if _sha(capabilities) != request.expected_required_capabilities_sha256:
-            raise InitialExecutionProjectionError("TASK_CAPABILITIES_DRIFT", 409)
-        if _sha(result) != request.expected_planner_result_sha256:
-            raise InitialExecutionProjectionError("PLANNER_RESULT_DRIFT", 409)
-        if _sha(verification) != request.previous_verification_sha256:
-            raise InitialExecutionProjectionError("PLANNER_VERIFICATION_DRIFT", 409)
-        old = metadata.get("execution")
-        if not isinstance(old, Mapping):
-            raise InitialExecutionProjectionError("TASK_EXECUTION_METADATA_MISSING", 409)
-        old_execution = validate_execution_envelope(dict(old))
-        if (
-            old_execution.get("action") != "agent_runtime"
-            or old_execution.get("adapter") != "openclaw"
-            or old_execution.get("capability_scope") != [RUNTIME_CAPABILITY]
-            or old_execution.get("execution_digest")
-            != request.expected_old_execution_digest
-            or capabilities != [RUNTIME_CAPABILITY]
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_EXECUTION_CONTRACT_INVALID", 409
-            )
-        expected_result = {
-            "task_id": task_id,
-            "job_id": request.expected_job_id,
-            "status": "SUCCEEDED",
-            "execution_mode": "agent_runtime",
-            "agent_runtime": "openclaw",
-            "execution_digest": request.expected_old_execution_digest,
-            "control_plane_access_granted_to_runtime": False,
-            "credential_material_exposed": False,
-            "secret_material_exposed": False,
-            "changed_files": [],
-            "writer_lease": "NONE",
-            "direct_main_write": False,
-            "production_write": False,
-            "force_push": False,
-            "protected_ref_bypass": False,
-        }
-        if any(result.get(name) != expected for name, expected in expected_result.items()):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_RESULT_CONTRACT_INVALID", 409
-            )
-        if verification.get("decision") != "NEEDS_REWORK":
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_NEEDS_REWORK_REQUIRED", 409
-            )
-        self._planner_event_chain(connection, task_id)
-        return task, metadata, result
-
-    def project(
-        self,
-        task_id: str,
-        request: SupervisorCoordinatorProjectionRequest,
-    ) -> dict[str, Any]:
-        task_id = _require_string(task_id, "TASK_ID_INVALID", TASK_RE)
-        if request.authorization_id != _required_authorization_id():
-            raise InitialExecutionProjectionError("AUTHORIZATION_ID_MISMATCH", 403)
-        request_sha = _sha(request.public())
-        with self._connect() as connection:
-            self._ensure_table(connection)
-            replay = connection.execute(
-                "SELECT * FROM task_supervisor_coordinator_projections "
-                "WHERE task_id=? AND idempotency_key=?",
-                (task_id, request.idempotency_key),
-            ).fetchone()
-            if replay is not None:
-                if replay["request_sha256"] != request_sha:
-                    raise InitialExecutionProjectionError("IDEMPOTENCY_CONFLICT", 409)
-                return {
-                    "task_id": task_id,
-                    "status": "QUEUED",
-                    "attempt": replay["attempt"],
-                    "revision": replay["applied_revision"],
-                    "execution_digest": replay["new_execution_digest"],
-                    "required_capabilities": COORDINATOR_CAPABILITIES,
-                    "idempotent": True,
-                }
-        with self._connect() as connection:
-            task, _, result = self._load(connection, task_id, request)
-            runtime_input = self._runtime_input(task)
-        resolved = dict(
-            self.coordinator_resolver(task_id, request.expected_job_id, runtime_input)
-        )
-        binding = GovernedExecutionBinding.from_mapping(resolved)
-        if binding.task_id != task_id or binding.job_id != request.expected_job_id:
-            raise InitialExecutionProjectionError("GOVERNED_BINDING_CONFLICT", 409)
-        result_binding = {
-            name: result.get(name)
-            for name in (
-                "task_id",
-                "job_id",
-                "repository",
-                "base_oid",
-                "expected_branch_oid",
-                "target_branch",
-                "generation",
-            )
-        }
-        expected_binding = {
-            "task_id": binding.task_id,
-            "job_id": binding.job_id,
-            "repository": binding.repository,
-            "base_oid": binding.base_oid,
-            "expected_branch_oid": binding.expected_branch_oid,
-            "target_branch": binding.target_branch,
-            "generation": binding.generation,
-        }
-        if result_binding != expected_binding:
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_PLANNER_BINDING_CONFLICT", 409
-            )
-        execution = validate_execution_envelope(resolved, binding=binding)
-        if (
-            execution.get("action") != "agent_runtime"
-            or execution.get("adapter") != "openclaw"
-            or execution.get("capability_scope") != COORDINATOR_CAPABILITIES
-            or execution.get("change_set") != []
-            or execution.get("verification") != []
-            or execution.get("governance", {}).get("writer_lease") is not False
-            or execution.get("execution_digest") != request.expected_new_execution_digest
-        ):
-            raise InitialExecutionProjectionError(
-                "SUPERVISOR_COORDINATOR_ENVELOPE_INVALID", 409
-            )
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            self._ensure_table(connection)
-            task, metadata, _ = self._load(connection, task_id, request)
-            new_metadata = dict(metadata)
-            new_metadata["execution"] = execution
-            new_metadata["execution_projection"] = {
-                "schema": "aios.online-agent.task-projection.v1",
-                "task_id": task_id,
-                "job_id": request.expected_job_id,
-                "execution_digest": execution["execution_digest"],
-            }
-            applied_revision = request.expected_revision + 1
-            cursor = connection.execute(
-                """
-                UPDATE tasks SET metadata_json=?,required_capabilities_json=?,
-                    revision=?,updated_at=?
-                 WHERE task_id=? AND status=? AND revision=? AND attempt=?
-                   AND claimed_by IS NULL AND lease_token_hash IS NULL
-                   AND lease_expires_at IS NULL AND metadata_json=?
-                   AND required_capabilities_json=? AND result_json=?
-                   AND verification_json=?
-                """,
-                (
-                    json.dumps(new_metadata, sort_keys=True, separators=(",", ":")),
-                    json.dumps(COORDINATOR_CAPABILITIES, separators=(",", ":")),
-                    applied_revision,
-                    _now(),
-                    task_id,
-                    request.expected_status,
-                    request.expected_revision,
-                    request.expected_attempt,
-                    task["metadata_json"],
-                    task["required_capabilities_json"],
-                    task["result_json"],
-                    task["verification_json"],
-                ),
-            )
-            if cursor.rowcount != 1:
-                raise InitialExecutionProjectionError(
-                    "SUPERVISOR_COORDINATOR_PROJECTION_CAS_MISMATCH", 409
-                )
-            event = {
-                "schema": "aios.supervisor-coordinator-projection.event.v1",
-                "task_id": task_id,
-                "job_id": request.expected_job_id,
-                "authorization_id": request.authorization_id,
-                "idempotency_key": request.idempotency_key,
-                "reason": request.reason,
-                "old_execution_digest": request.expected_old_execution_digest,
-                "new_execution_digest": execution["execution_digest"],
-                "required_capabilities": COORDINATOR_CAPABILITIES,
-                "previous_revision": request.expected_revision,
-                "applied_revision": applied_revision,
-                "attempt": request.expected_attempt,
-                "request_sha256": request_sha,
-                "credential_forwarded_to_planner": False,
-                "writer_lease": False,
-                "main_write": False,
-                "production_write": False,
-            }
-            table, columns = self._event_table(connection)
-            values = {
-                "task_id": task_id,
-                "event_type": "TASK_SUPERVISOR_COORDINATOR_PROJECTION_AUTHORIZED",
-                "payload_json": json.dumps(event, sort_keys=True, separators=(",", ":")),
-                "created_at": _now(),
-                "agent_id": "owner-control",
-            }
-            names = [name for name in values if name in columns]
-            connection.execute(
-                f'INSERT INTO "{table}" ({",".join(chr(34)+name+chr(34) for name in names)}) '
-                f'VALUES ({",".join("?" for _ in names)})',
-                tuple(values[name] for name in names),
-            )
-            connection.execute(
-                """
-                INSERT INTO task_supervisor_coordinator_projections(
-                  task_id,idempotency_key,request_sha256,authorization_id,
-                  expected_job_id,planner_result_sha256,old_execution_digest,
-                  new_execution_digest,expected_revision,applied_revision,
-                  attempt,created_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    task_id,
-                    request.idempotency_key,
-                    request_sha,
-                    request.authorization_id,
-                    request.expected_job_id,
-                    request.expected_planner_result_sha256,
-                    request.expected_old_execution_digest,
-                    execution["execution_digest"],
-                    request.expected_revision,
-                    applied_revision,
-                    request.expected_attempt,
-                    _now(),
-                ),
-            )
-            connection.commit()
-            return {
-                "task_id": task_id,
-                "status": "QUEUED",
-                "attempt": request.expected_attempt,
-                "revision": applied_revision,
-                "execution_digest": execution["execution_digest"],
-                "required_capabilities": COORDINATOR_CAPABILITIES,
-                "credential_forwarded_to_planner": False,
-                "idempotent": False,
-            }
-
-
-class Handler(BaseHTTPRequestHandler):
-    store: SupervisorCoordinatorProjectionStore | None = None
-    control_token: str = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def send_json(self, value: Mapping[str, Any], status: int) -> None:
-        raw = _canonical(dict(value))
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(raw)))
-        self.end_headers()
-        self.wfile.write(raw)
-
-    def do_GET(self) -> None:
-        if self.path == "/health":
-            self.send_json(
-                {"status": "ok", "service": "aios-supervisor-coordinator-projection"},
-                200,
-            )
-        else:
-            self.send_json({"error": "NOT_FOUND"}, 404)
-
-    def do_POST(self) -> None:
-        match = re.fullmatch(
-            r"/v1/tasks/([^/]+)/supervisor-coordinator-projection", self.path
-        )
-        header = self.headers.get("Authorization", "")
-        if match is None:
-            self.send_json({"error": "NOT_FOUND"}, 404)
-            return
-        if (
-            not header.startswith("Bearer ")
-            or not hmac.compare_digest(header[7:], self.control_token)
-        ):
-            self.send_json({"error": "UNAUTHORIZED"}, 401)
-            return
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-            if length < 1 or length > MAX_BODY:
-                raise InitialExecutionProjectionError("REQUEST_SIZE_INVALID", 413)
-            value = json.loads(self.rfile.read(length).decode("utf-8"))
-            if not isinstance(value, Mapping) or self.store is None:
-                raise InitialExecutionProjectionError("REQUEST_INVALID", 400)
-            request = SupervisorCoordinatorProjectionRequest.from_mapping(value)
-            result = self.store.project(match.group(1), request)
-            self.send_json(result, 200 if result["idempotent"] else 201)
-        except InitialExecutionProjectionError as exc:
-            self.send_json({"error": exc.code}, exc.status)
-        except (ValueError, UnicodeDecodeError, json.JSONDecodeError):
-            self.send_json({"error": "REQUEST_INVALID"}, 400)
-
-
-def serve() -> None:
-    credential = Path(
-        os.environ.get(
-            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-            str(
-                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-                / "agent_task_control_token"
-            ),
-        )
-    )
-    token = load_control_token(credential)
-    bridge = os.environ.get("AIOS_GOVERNED_WRITE_API_URL", "http://127.0.0.1:18892")
-    db = Path(os.environ.get("AIOS_AGENT_TASK_DB", "/var/lib/aios-agent-task/state.sqlite3"))
-    Handler.control_token = token
-    Handler.store = SupervisorCoordinatorProjectionStore(
-        db, CanonicalCoordinatorExecutionResolver(bridge, token)
-    )
-    host = os.environ.get("AIOS_SUPERVISOR_COORDINATOR_PROJECTION_HOST", "127.0.0.1")
-    port = int(os.environ.get("AIOS_SUPERVISOR_COORDINATOR_PROJECTION_PORT", "18944"))
-    ThreadingHTTPServer((host, port), Handler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,470 +0,0 @@
-#!/usr/bin/env python3
-"""Canonical AIOS all-modified-files evidence packager.
-
-The bundle contract is intentionally compatible with the historical
-aios_package_all_modified_files_v1.sh output while keeping secret scanning in
-version-controlled, tested code.
-"""
-
-from __future__ import annotations
-
-from datetime import datetime, timezone
-import argparse
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import subprocess
-import tempfile
-import zipfile
-from typing import Iterable
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-
-# A PEM private-key finding requires the complete PEM header. Source code,
-# tests, docs, or error text containing only "BEGIN PRIVATE KEY" are not
-# credentials and must not be rejected.
-PEM_PRIVATE_KEY_RE = re.compile(
-    rb"-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----",
-    re.IGNORECASE,
-)
-BEARER_RE = re.compile(
-    rb"authorization\s*:\s*bearer\s+[A-Za-z0-9._~+/=-]{20,}",
-    re.IGNORECASE,
-)
-KEY_VALUE_SECRET_RE = re.compile(
-    rb"(?:password|passwd|secret|api[_-]?key)\s*[:=]\s*[^\s,;]{12,}",
-    re.IGNORECASE,
-)
-
-DOCUMENT_SUFFIXES = {".md", ".rst", ".adoc", ".txt"}
-DOCUMENT_PREFIXES = (
-    "README",
-    "CHANGELOG",
-    "RUNBOOK",
-    "ADR",
-    "ARCHITECTURE",
-    "DEPLOYMENT",
-    "TROUBLESHOOTING",
-)
-
-
-class PackagerError(RuntimeError):
-    pass
-
-
-def sha256(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-
-def secret_finding(data: bytes) -> str | None:
-    if PEM_PRIVATE_KEY_RE.search(data):
-        return "PEM_PRIVATE_KEY"
-    if BEARER_RE.search(data):
-        return "AUTHORIZATION_BEARER"
-    if KEY_VALUE_SECRET_RE.search(data):
-        return "KEY_VALUE_SECRET"
-    return None
-
-
-def scan_secret(data: bytes, label: str) -> None:
-    finding = secret_finding(data)
-    if finding is not None:
-        raise PackagerError(
-            f"MODIFIED_FILES_SECRET_SCAN_MATCH:{finding}:{label}"
-        )
-
-
-def git_bytes(git_dir: Path, oid: str, path: str) -> bytes:
-    try:
-        return subprocess.check_output(
-            [
-                "/usr/bin/git",
-                f"--git-dir={git_dir}",
-                "show",
-                f"{oid}:{path}",
-            ],
-            timeout=30,
-        )
-    except subprocess.CalledProcessError as exc:
-        raise PackagerError(
-            "MODIFIED_FILES_GIT_SHOW_FAILED:" + path
-        ) from exc
-
-
-def git_text(git_dir: Path, *args: str) -> str:
-    try:
-        return subprocess.check_output(
-            ["/usr/bin/git", f"--git-dir={git_dir}", *args],
-            text=True,
-            timeout=30,
-        )
-    except subprocess.CalledProcessError as exc:
-        raise PackagerError(
-            "MODIFIED_FILES_GIT_COMMAND_FAILED:" + " ".join(args)
-        ) from exc
-
-
-def validate_lineage(git_dir: Path, base: str, candidate: str) -> None:
-    if OID_RE.fullmatch(base) is None or OID_RE.fullmatch(candidate) is None:
-        raise PackagerError("MODIFIED_FILES_OID_INVALID")
-    for oid in (base, candidate):
-        try:
-            subprocess.run(
-                [
-                    "/usr/bin/git",
-                    f"--git-dir={git_dir}",
-                    "cat-file",
-                    "-e",
-                    f"{oid}^{{commit}}",
-                ],
-                check=True,
-                timeout=30,
-            )
-        except subprocess.CalledProcessError as exc:
-            raise PackagerError("MODIFIED_FILES_COMMIT_MISSING:" + oid) from exc
-    if subprocess.run(
-        [
-            "/usr/bin/git",
-            f"--git-dir={git_dir}",
-            "merge-base",
-            "--is-ancestor",
-            base,
-            candidate,
-        ],
-        check=False,
-        timeout=30,
-    ).returncode != 0:
-        raise PackagerError("MODIFIED_FILES_LINEAGE_INVALID")
-
-
-def safe_destination(root: Path, relative: str) -> Path:
-    path = Path(relative)
-    if path.is_absolute() or ".." in path.parts:
-        raise PackagerError("MODIFIED_FILE_PATH_INVALID:" + relative)
-    destination = root / path
-    destination.parent.mkdir(parents=True, exist_ok=True)
-    return destination
-
-
-def is_document_path(path: str) -> bool:
-    value = Path(path)
-    if path.startswith("docs/"):
-        return True
-    if value.suffix.lower() in DOCUMENT_SUFFIXES:
-        return True
-    upper = value.name.upper()
-    return any(upper.startswith(prefix) for prefix in DOCUMENT_PREFIXES)
-
-
-def diff_entries(
-    git_dir: Path,
-    base: str,
-    candidate: str,
-    before_root: Path,
-    after_root: Path,
-) -> list[dict[str, object]]:
-    raw = git_text(
-        git_dir,
-        "diff",
-        "--name-status",
-        "-M",
-        "-C",
-        base,
-        candidate,
-    )
-    entries: list[dict[str, object]] = []
-    for line in raw.splitlines():
-        if not line.strip():
-            continue
-        parts = line.split("\t")
-        status = parts[0]
-        code = status[0]
-        old_path: str | None = None
-        new_path: str | None = None
-        if code in {"R", "C"}:
-            if len(parts) != 3:
-                raise PackagerError(
-                    "MODIFIED_FILES_DIFF_PARSE_INVALID:" + line
-                )
-            old_path, new_path = parts[1], parts[2]
-        else:
-            if len(parts) != 2:
-                raise PackagerError(
-                    "MODIFIED_FILES_DIFF_PARSE_INVALID:" + line
-                )
-            new_path = parts[1] if code != "D" else None
-            old_path = parts[1] if code != "A" else None
-
-        entry: dict[str, object] = {"status": status}
-        if old_path is not None:
-            entry["previous_path"] = old_path
-            before = git_bytes(git_dir, base, old_path)
-            scan_secret(before, "before:" + old_path)
-            safe_destination(before_root, old_path).write_bytes(before)
-            entry["before_sha256"] = sha256(before)
-            entry["before_bytes"] = len(before)
-        if new_path is not None:
-            entry["path"] = new_path
-            after = git_bytes(git_dir, candidate, new_path)
-            scan_secret(after, "after:" + new_path)
-            safe_destination(after_root, new_path).write_bytes(after)
-            entry["after_sha256"] = sha256(after)
-            entry["after_bytes"] = len(after)
-        entry["deleted"] = code == "D"
-        entry["added"] = code == "A"
-        entry["renamed"] = code == "R"
-        entry["copied"] = code == "C"
-        entries.append(entry)
-    return entries
-
-
-def execution_entries(
-    extra_root: Path | None,
-    execution_root: Path,
-) -> list[dict[str, object]]:
-    if extra_root is None or not extra_root.exists():
-        return []
-    if extra_root.is_symlink() or not extra_root.is_dir():
-        raise PackagerError("EXTRA_FILES_DIR_INVALID")
-
-    entries: list[dict[str, object]] = []
-    for path in sorted(extra_root.rglob("*")):
-        if path.is_symlink():
-            raise PackagerError(
-                "EXTRA_FILE_SYMLINK_REJECTED:" + str(path)
-            )
-        if not path.is_file():
-            continue
-        relative = path.relative_to(extra_root).as_posix()
-        data = path.read_bytes()
-        scan_secret(data, "execution:" + relative)
-        safe_destination(execution_root, relative).write_bytes(data)
-        entries.append(
-            {
-                "path": relative,
-                "sha256": sha256(data),
-                "bytes": len(data),
-            }
-        )
-    return entries
-
-
-def write_checksums(bundle: Path) -> None:
-    checks: list[tuple[str, str]] = []
-    for path in sorted(bundle.rglob("*")):
-        if path.is_file() and path.name != "checksums.sha256":
-            checks.append(
-                (
-                    sha256(path.read_bytes()),
-                    path.relative_to(bundle).as_posix(),
-                )
-            )
-    (bundle / "checksums.sha256").write_text(
-        "".join(f"{digest}  {name}\n" for digest, name in checks),
-        encoding="utf-8",
-    )
-
-
-def verify_checksums(bundle: Path) -> None:
-    checksum_path = bundle / "checksums.sha256"
-    for line in checksum_path.read_text(encoding="utf-8").splitlines():
-        digest, relative = line.split("  ", 1)
-        path = bundle / relative
-        if not path.is_file() or sha256(path.read_bytes()) != digest:
-            raise PackagerError(
-                "MODIFIED_FILES_CHECKSUM_CLOSURE_INVALID:" + relative
-            )
-
-
-def build_bundle(
-    *,
-    git_dir: Path,
-    base: str,
-    candidate: str,
-    task_id: str,
-    extra_dir: Path | None = None,
-    output_root: Path | None = None,
-    now: datetime | None = None,
-) -> dict[str, object]:
-    if TASK_RE.fullmatch(task_id) is None:
-        raise PackagerError("TASK_ID_INVALID")
-    validate_lineage(git_dir, base, candidate)
-
-    timestamp = (now or datetime.now(timezone.utc)).strftime(
-        "%Y%m%dT%H%M%SZ"
-    )
-    safe_task = re.sub(r"[^A-Za-z0-9._-]+", "-", task_id).strip("-")
-    if output_root is None:
-        output_root = Path(
-            tempfile.mkdtemp(
-                prefix=f"aios-modified-files-bundle-{safe_task}-{timestamp}-",
-                dir="/var/tmp",
-            )
-        )
-    else:
-        output_root.mkdir(parents=True, exist_ok=True)
-
-    bundle = output_root / "bundle"
-    before_root = bundle / "repo" / "before"
-    after_root = bundle / "repo" / "after"
-    execution_root = bundle / "execution"
-    before_root.mkdir(parents=True)
-    after_root.mkdir(parents=True)
-    execution_root.mkdir(parents=True)
-
-    changes = diff_entries(
-        git_dir,
-        base,
-        candidate,
-        before_root,
-        after_root,
-    )
-    execution_files = execution_entries(extra_dir, execution_root)
-
-    document_changes = [
-        entry
-        for entry in changes
-        if is_document_path(
-            str(entry.get("path") or entry.get("previous_path") or "")
-        )
-    ]
-    execution_documents = [
-        entry
-        for entry in execution_files
-        if is_document_path(str(entry["path"]))
-    ]
-
-    documents_index = {
-        "schema": "aios.modified-documents.index.v1",
-        "task_id": task_id,
-        "base_oid": base,
-        "candidate_oid": candidate,
-        "repository_documents": document_changes,
-        "execution_documents": execution_documents,
-        "repository_document_count": len(document_changes),
-        "execution_document_count": len(execution_documents),
-    }
-    (bundle / "documents-index.json").write_text(
-        json.dumps(documents_index, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-
-    manifest = {
-        "schema": "aios.all-modified-files.bundle.v1",
-        "task_id": task_id,
-        "base_oid": base,
-        "candidate_oid": candidate,
-        "generated_at": (
-            now or datetime.now(timezone.utc)
-        ).isoformat(),
-        "changed_file_count": len(changes),
-        "execution_file_count": len(execution_files),
-        "repository_document_count": len(document_changes),
-        "execution_document_count": len(execution_documents),
-        "changes": changes,
-        "execution_files": execution_files,
-    }
-    (bundle / "all-modified-files-manifest.json").write_text(
-        json.dumps(manifest, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-    write_checksums(bundle)
-    verify_checksums(bundle)
-
-    zip_name = (
-        f"AIOS_{task_id}_ALL_MODIFIED_FILES_{candidate[:12]}.zip"
-        .replace("/", "-")
-    )
-    zip_path = output_root / zip_name
-    with zipfile.ZipFile(
-        zip_path,
-        "w",
-        compression=zipfile.ZIP_DEFLATED,
-    ) as archive:
-        for path in sorted(bundle.rglob("*")):
-            if path.is_symlink():
-                raise PackagerError(
-                    "BUNDLE_SYMLINK_REJECTED:" + str(path)
-                )
-            if path.is_file():
-                archive.write(
-                    path,
-                    arcname=path.relative_to(bundle).as_posix(),
-                )
-
-    zip_sha = sha256(zip_path.read_bytes())
-    summary = {
-        "schema": "aios.all-modified-files.bundle-summary.v1",
-        "task_id": task_id,
-        "base_oid": base,
-        "candidate_oid": candidate,
-        "bundle_path": str(zip_path),
-        "bundle_sha256": zip_sha,
-        "changed_file_count": len(changes),
-        "execution_file_count": len(execution_files),
-        "repository_document_count": len(document_changes),
-        "execution_document_count": len(execution_documents),
-    }
-    (output_root / "ALL_MODIFIED_FILES_BUNDLE.json").write_text(
-        json.dumps(summary, indent=2, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-    return summary
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("base")
-    parser.add_argument("candidate")
-    parser.add_argument("task_id")
-    parser.add_argument("extra_dir", nargs="?")
-    parser.add_argument(
-        "--authority-git-dir",
-        default=os.environ.get(
-            "AIOS_AUTHORITY_GIT_DIR",
-            "/data/aios-gitops/repo.git",
-        ),
-    )
-    parser.add_argument("--output-root")
-    args = parser.parse_args()
-
-    try:
-        summary = build_bundle(
-            git_dir=Path(args.authority_git_dir),
-            base=args.base,
-            candidate=args.candidate,
-            task_id=args.task_id,
-            extra_dir=Path(args.extra_dir) if args.extra_dir else None,
-            output_root=(
-                Path(args.output_root) if args.output_root else None
-            ),
-        )
-    except PackagerError as exc:
-        print("FATAL:" + str(exc))
-        return 20
-
-    print("ALL_MODIFIED_FILES_BUNDLE=PASS")
-    print("ALL_MODIFIED_FILES_BUNDLE_PATH=" + str(summary["bundle_path"]))
-    print("ALL_MODIFIED_FILES_BUNDLE_SHA256=" + str(summary["bundle_sha256"]))
-    print("CHANGED_FILE_COUNT=" + str(summary["changed_file_count"]))
-    print("EXECUTION_FILE_COUNT=" + str(summary["execution_file_count"]))
-    print(
-        "REPOSITORY_DOCUMENT_COUNT="
-        + str(summary["repository_document_count"])
-    )
-    print(
-        "EXECUTION_DOCUMENT_COUNT="
-        + str(summary["execution_document_count"])
-    )
-    print(
-        "ALL_MODIFIED_FILES_EVIDENCE="
-        + str(Path(str(summary["bundle_path"])).parent)
-    )
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,258 +0,0 @@
-"""Fail-closed Authority Git side-effect boundary.
-
-Only this module may issue the narrowly scoped ref CAS primitives used by the
-durable executor. It never accepts force updates, arbitrary refs, tags, or
-direct production mutations.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-import os
-from pathlib import Path
-import re
-import subprocess
-import tempfile
-from typing import Mapping, Sequence
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_BRANCH_RE = re.compile(r"^refs/heads/agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-
-
-class AuthorityGitError(RuntimeError):
-    pass
-
-
-def _oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise AuthorityGitError(f"{field}_INVALID")
-    return value
-
-
-@dataclass(frozen=True, slots=True)
-class AuthorityGitExecutor:
-    git_dir: Path
-    worktree_root: Path = Path("/var/lib/aios-gitops/worktrees")
-
-    def __post_init__(self) -> None:
-        if not self.git_dir.is_absolute() or self.git_dir.is_symlink():
-            raise AuthorityGitError("AUTHORITY_GIT_DIR_INVALID")
-        if not self.worktree_root.is_absolute() or self.worktree_root.is_symlink():
-            raise AuthorityGitError("WORKTREE_ROOT_INVALID")
-
-    def _git(self, args: Sequence[str], *, check: bool = True) -> str:
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", *args],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if check and result.returncode != 0:
-            raise AuthorityGitError("AUTHORITY_GIT_COMMAND_FAILED")
-        return result.stdout.strip()
-
-    def read_ref(self, ref: str) -> str | None:
-        if not ref.startswith("refs/") or ref.startswith(("refs/tags/", "refs/remotes/")):
-            raise AuthorityGitError("REF_READ_SCOPE_DENIED")
-        value = self._git(["rev-parse", "--verify", ref], check=False)
-        return value if value and OID_RE.fullmatch(value) else None
-
-    def commit_exists(self, oid: str) -> bool:
-        _oid(oid, "commit_oid")
-        result = subprocess.run(["git", f"--git-dir={self.git_dir}", "cat-file", "-e", oid + "^{commit}"], capture_output=True, check=False)
-        return result.returncode == 0
-
-    def ancestry_check(self, older_oid: str, newer_oid: str) -> bool:
-        _oid(older_oid, "older_oid")
-        _oid(newer_oid, "newer_oid")
-        result = subprocess.run(
-            ["git", f"--git-dir={self.git_dir}", "merge-base", "--is-ancestor", older_oid, newer_oid],
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode not in (0, 1):
-            raise AuthorityGitError("ANCESTRY_CHECK_FAILED")
-        return result.returncode == 0
-
-    def create_detached_worktree(
-        self,
-        base_oid: str,
-        worktree_name: str,
-        root: Path | None = None,
-    ) -> Path:
-        _oid(base_oid, "base_oid")
-        if not worktree_name or "/" in worktree_name or "\\" in worktree_name or worktree_name in {".", ".."}:
-            raise AuthorityGitError("WORKTREE_NAME_INVALID")
-        parent = root or self.worktree_root
-        if not parent.is_absolute() or parent.is_symlink():
-            raise AuthorityGitError("WORKTREE_ROOT_INVALID")
-        path = parent / worktree_name
-        if path.exists() or path.is_symlink():
-            raise AuthorityGitError("WORKTREE_ALREADY_EXISTS")
-        parent.mkdir(parents=True, exist_ok=True)
-        self._git(["worktree", "add", "--detach", str(path), base_oid])
-        return path
-
-    def recover_failed_detached_worktree_exact(
-        self,
-        *,
-        path: Path,
-        expected_oid: str,
-        stale_oid: str,
-        target_ref: str,
-    ) -> str:
-        """Recreate one exact clean, detached, single-attempt worktree at its durable head."""
-        _oid(expected_oid, "expected_oid")
-        _oid(stale_oid, "stale_oid")
-        if not TASK_BRANCH_RE.fullmatch(target_ref):
-            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        if self.read_ref(target_ref) is not None:
-            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
-        if (
-            not path.is_absolute()
-            or path.parent != self.worktree_root
-            or path.name in {"", ".", ".."}
-            or path.is_symlink()
-            or not path.is_dir()
-        ):
-            raise AuthorityGitError("WORKTREE_RECOVERY_PATH_INVALID")
-        head = subprocess.run(
-            ["git", "-C", str(path), "rev-parse", "HEAD"],
-            text=True, capture_output=True, check=False,
-        )
-        if head.returncode != 0 or head.stdout.strip() != stale_oid or stale_oid == expected_oid:
-            raise AuthorityGitError("WORKTREE_RECOVERY_HEAD_INVALID")
-        symbolic = subprocess.run(
-            ["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"],
-            text=True, capture_output=True, check=False,
-        )
-        if symbolic.returncode != 1:
-            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_DETACHED")
-        status = subprocess.run(
-            ["git", "-C", str(path), "status", "--porcelain=v1", "--untracked-files=all"],
-            text=True, capture_output=True, check=False,
-        )
-        if status.returncode != 0 or status.stdout:
-            raise AuthorityGitError("WORKTREE_RECOVERY_NOT_CLEAN")
-        parents = self._git(["rev-list", "--parents", "-n", "1", stale_oid]).split()
-        if parents != [stale_oid, expected_oid]:
-            raise AuthorityGitError("WORKTREE_RECOVERY_LINEAGE_INVALID")
-        registered = [
-            line.removeprefix("worktree ")
-            for line in self._git(["worktree", "list", "--porcelain"]).splitlines()
-            if line.startswith("worktree ")
-        ]
-        if registered.count(str(path)) != 1:
-            raise AuthorityGitError("WORKTREE_RECOVERY_REGISTRATION_INVALID")
-        self._git(["worktree", "remove", "--force", str(path)])
-        if path.exists() or path.is_symlink():
-            raise AuthorityGitError("WORKTREE_RECOVERY_REMOVE_FAILED")
-        recreated = self.create_detached_worktree(expected_oid, path.name, path.parent)
-        readback = subprocess.run(
-            ["git", "-C", str(recreated), "rev-parse", "HEAD"],
-            text=True, capture_output=True, check=False,
-        )
-        detached = subprocess.run(
-            ["git", "-C", str(recreated), "symbolic-ref", "-q", "HEAD"],
-            text=True, capture_output=True, check=False,
-        )
-        if readback.returncode != 0 or readback.stdout.strip() != expected_oid or detached.returncode != 1:
-            raise AuthorityGitError("WORKTREE_RECOVERY_READBACK_MISMATCH")
-        return stale_oid
-
-    def create_task_branch_CAS(self, branch: str, expected_base_oid: str, new_oid: str) -> str:
-        if not TASK_BRANCH_RE.fullmatch(branch):
-            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        _oid(expected_base_oid, "expected_base_oid")
-        _oid(new_oid, "new_oid")
-        current = self.read_ref(branch)
-        if current is not None:
-            if current == new_oid:
-                return new_oid
-            raise AuthorityGitError("AUTHORITY_TARGET_BRANCH_ALREADY_EXISTS")
-        if not self.ancestry_check(expected_base_oid, new_oid):
-            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
-        self._git(["update-ref", branch, new_oid, "0" * 40])
-        readback = self.read_ref(branch)
-        if readback != new_oid:
-            raise AuthorityGitError("AUTHORITY_CREATE_READBACK_MISMATCH")
-        return readback
-
-    def advance_task_branch_CAS(self, branch: str, expected_oid: str, new_oid: str) -> str:
-        if not TASK_BRANCH_RE.fullmatch(branch):
-            raise AuthorityGitError("TASK_BRANCH_SCOPE_DENIED")
-        _oid(expected_oid, "expected_oid")
-        _oid(new_oid, "new_oid")
-        current = self.read_ref(branch)
-        if current != expected_oid:
-            if current == new_oid:
-                return new_oid
-            raise AuthorityGitError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
-        if not self.ancestry_check(expected_oid, new_oid):
-            raise AuthorityGitError("NEW_OID_NOT_DESCENDANT")
-        self._git(["update-ref", branch, new_oid, expected_oid])
-        readback = self.read_ref(branch)
-        if readback != new_oid:
-            raise AuthorityGitError("AUTHORITY_CAS_READBACK_MISMATCH")
-        return readback
-
-    def ff_CAS_main_after_verified_protected_merge(self, expected_oid: str, new_oid: str) -> str:
-        _oid(expected_oid, "expected_oid")
-        _oid(new_oid, "new_oid")
-        if not self.ancestry_check(expected_oid, new_oid):
-            raise AuthorityGitError("MAIN_FF_REQUIRED")
-        current = self.read_ref("refs/heads/main")
-        if current != expected_oid:
-            if current == new_oid:
-                return new_oid
-            raise AuthorityGitError("AUTHORITY_MAIN_EXPECTATION_MISMATCH")
-        self._git(["update-ref", "refs/heads/main", new_oid, expected_oid])
-        readback = self.read_ref("refs/heads/main")
-        if readback != new_oid:
-            raise AuthorityGitError("AUTHORITY_MAIN_CAS_READBACK_MISMATCH")
-        return readback
-
-    def commit_file_in_isolated_worktree(
-        self,
-        *,
-        base_oid: str,
-        files: Mapping[str, bytes],
-        message: str,
-        worktree_name: str,
-    ) -> str:
-        _oid(base_oid, "base_oid")
-        if not worktree_name or "/" in worktree_name or "\\" in worktree_name or worktree_name in {".", ".."}:
-            raise AuthorityGitError("WORKTREE_NAME_INVALID")
-        root = self.worktree_root / worktree_name
-        if root.exists() or root.is_symlink():
-            raise AuthorityGitError("WORKTREE_ALREADY_EXISTS")
-        self.worktree_root.mkdir(parents=True, exist_ok=True)
-        self._git(["worktree", "add", "--detach", str(root), base_oid])
-        try:
-            for relative, content in files.items():
-                path = Path(relative)
-                if path.is_absolute() or ".." in path.parts or not path.parts or path.parts[0] == ".git":
-                    raise AuthorityGitError("FILE_PATH_INVALID")
-                target = root / path
-                target.parent.mkdir(parents=True, exist_ok=True)
-                target.write_bytes(content)
-            result = subprocess.run(
-                ["git", "-C", str(root), "add", "--", *files.keys()],
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            if result.returncode != 0:
-                raise AuthorityGitError("WORKTREE_ADD_FAILED")
-            result = subprocess.run(
-                ["git", "-C", str(root), "-c", "user.name=aios-durable-job", "-c", "user.email=aios-durable-job@localhost", "commit", "--no-verify", "-m", message],
-                text=True,
-                capture_output=True,
-                check=False,
-            )
-            if result.returncode != 0:
-                raise AuthorityGitError("WORKTREE_COMMIT_FAILED")
-            return subprocess.check_output(["git", "-C", str(root), "rev-parse", "HEAD"], text=True).strip()
-        finally:
-            subprocess.run(["git", f"--git-dir={self.git_dir}", "worktree", "remove", "--force", str(root)], capture_output=True, check=False)
@@ -1,73 +0,0 @@
-"""HTTP adapter for Owner-authorized task writer provisioning.
-
-Run this module instead of aios_chatgpt_actions_api.py. All existing routes are
-delegated unchanged; only POST /api/task-writer/provision-authorized is added.
-"""
-from __future__ import annotations
-
-import os
-import urllib.parse
-
-import aios_chatgpt_actions_api as api
-from authorized_task_writer_provisioning import (
-    AuthorizedTaskWriterProvisioner,
-    OwnerContext,
-    ProvisioningError,
-)
-
-
-_original_do_post = api.H.do_POST
-_ENDPOINT = "/api/task-writer/provision-authorized"
-
-
-def _owner_authorization(handler):
-    scope = os.getenv(
-        "AIOS_GITOPS_OWNER_PROVISION_SCOPE", "writer:provision"
-    )
-    auth = handler.need(scope)
-    if not auth:
-        return None
-    if auth.get("role") != "owner":
-        handler.sendj({"error": "OWNER_AUTHORIZATION_REQUIRED"}, 403)
-        return None
-    identity = str(auth.get("account") or "").strip()
-    if not identity:
-        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
-        return None
-    return auth
-
-
-def _authorized_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != _ENDPOINT:
-        return _original_do_post(self)
-    auth = _owner_authorization(self)
-    if not auth:
-        return
-    data = self.body()
-    owner_reference = str(data.get("owner_authorization_reference") or "")
-    try:
-        result = AuthorizedTaskWriterProvisioner().provision(
-            data,
-            OwnerContext(
-                identity=str(auth["account"]),
-                role=str(auth["role"]),
-                authorization_reference=owner_reference,
-            ),
-        )
-        return self.sendj(result)
-    except ProvisioningError as exc:
-        body = {"error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        return self.sendj(body, exc.status)
-    except Exception:
-        # Do not expose tool output, paths containing credentials, or traceback data.
-        return self.sendj({"error": "AUTHORIZED_WRITER_BRIDGE_INTERNAL_ERROR"}, 500)
-
-
-api.H.do_POST = _authorized_do_post
-
-
-if __name__ == "__main__":
-    api.main()
@@ -1,288 +0,0 @@
-"""Unified autonomous control-plane primitives.
-
-This is deliberately a library, not another daemon. Task API, workers and host
-recovery code consume the same Admission -> Invariant -> Repair semantics.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-from enum import Enum
-import re
-from typing import Callable, Iterable, Mapping, Sequence
-
-from aios_capability_contract import (
-    capability_contract,
-    has_capabilities,
-    normalize_required_capabilities,
-    normalize_worker_capabilities,
-    registered_capability,
-    validate_capability_contract_registry,
-)
-
-
-class FailureClass(str, Enum):
-    CAPABILITY_CONTRACT_ERROR = "CAPABILITY_CONTRACT_ERROR"
-    CREDENTIAL_PROJECTION_ERROR = "CREDENTIAL_PROJECTION_ERROR"
-    DEPENDENCY_UNAVAILABLE = "DEPENDENCY_UNAVAILABLE"
-    POLICY_DENIED = "POLICY_DENIED"
-    RESOURCE_UNAVAILABLE = "RESOURCE_UNAVAILABLE"
-    WORKER_CRASH = "WORKER_CRASH"
-    LEASE_LOST = "LEASE_LOST"
-    BUSINESS_PERMANENT = "BUSINESS_PERMANENT"
-    UNKNOWN = "UNKNOWN"
-
-
-class RepairLevel(int, Enum):
-    AUTO_LOCAL = 0
-    AUTO_REPAIR_TASK = 1
-    OWNER_APPROVAL = 2
-    MANUAL = 3
-
-
-@dataclass(frozen=True)
-class InvariantResult:
-    name: str
-    passed: bool
-    detail: str = ""
-
-    def as_dict(self) -> dict[str, object]:
-        return asdict(self)
-
-
-@dataclass(frozen=True)
-class AdmissionDecision:
-    admitted: bool
-    state: str
-    invariants: tuple[InvariantResult, ...]
-    failure_class: FailureClass | None = None
-    repair_level: RepairLevel | None = None
-    repair_action: str | None = None
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "schema": "aios.runtime-admission.decision.v1",
-            "admitted": self.admitted,
-            "state": self.state,
-            "invariants": [item.as_dict() for item in self.invariants],
-            "failure_class": None if self.failure_class is None else self.failure_class.value,
-            "repair_level": None if self.repair_level is None else int(self.repair_level),
-            "repair_action": self.repair_action,
-        }
-
-
-@dataclass(frozen=True)
-class RepairDecision:
-    failure_class: FailureClass
-    level: RepairLevel
-    action: str
-    consumes_business_attempt: bool
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "failure_class": self.failure_class.value,
-            "level": int(self.level),
-            "action": self.action,
-            "consumes_business_attempt": self.consumes_business_attempt,
-        }
-
-
-def classify_failure(error: object, *, phase: str = "") -> FailureClass:
-    text = (str(error) + " " + str(phase)).lower()
-    if any(token in text for token in (
-        "credential", "permission denied", "token registry", "secret", "unauthorized"
-    )):
-        return FailureClass.CREDENTIAL_PROJECTION_ERROR
-    if any(token in text for token in (
-        "transport", "unavailable", "timeout", "connection", "bad gateway", "http_5"
-    )):
-        return FailureClass.DEPENDENCY_UNAVAILABLE
-    if any(token in text for token in (
-        "capability", "eligible", "matcher", "contract"
-    )):
-        return FailureClass.CAPABILITY_CONTRACT_ERROR
-    if any(token in text for token in (
-        "policy", "forbidden", "approval required", "not authorized"
-    )):
-        return FailureClass.POLICY_DENIED
-    if any(token in text for token in ("lease lost", "lease_expired", "heartbeat_failed")):
-        return FailureClass.LEASE_LOST
-    if any(token in text for token in ("out of memory", "disk full", "resource")):
-        return FailureClass.RESOURCE_UNAVAILABLE
-    if any(token in text for token in ("worker crash", "process exited", "signal")):
-        return FailureClass.WORKER_CRASH
-    if any(token in text for token in ("invalid release", "business permanent")):
-        return FailureClass.BUSINESS_PERMANENT
-    return FailureClass.UNKNOWN
-
-
-def repair_for_failure(failure: FailureClass) -> RepairDecision:
-    table = {
-        FailureClass.CAPABILITY_CONTRACT_ERROR: RepairDecision(
-            failure, RepairLevel.AUTO_REPAIR_TASK,
-            "create_same_lineage_capability_contract_repair", False,
-        ),
-        FailureClass.CREDENTIAL_PROJECTION_ERROR: RepairDecision(
-            failure, RepairLevel.AUTO_REPAIR_TASK,
-            "restore_service_private_credential_projection", False,
-        ),
-        FailureClass.DEPENDENCY_UNAVAILABLE: RepairDecision(
-            failure, RepairLevel.AUTO_LOCAL,
-            "retry_dependency_health_and_resume", False,
-        ),
-        FailureClass.RESOURCE_UNAVAILABLE: RepairDecision(
-            failure, RepairLevel.AUTO_LOCAL,
-            "heal_runtime_resource_and_resume", False,
-        ),
-        FailureClass.WORKER_CRASH: RepairDecision(
-            failure, RepairLevel.AUTO_LOCAL,
-            "restart_worker_and_resume_same_lineage", False,
-        ),
-        FailureClass.LEASE_LOST: RepairDecision(
-            failure, RepairLevel.AUTO_LOCAL,
-            "recover_lease_and_resume_same_lineage", False,
-        ),
-        FailureClass.POLICY_DENIED: RepairDecision(
-            failure, RepairLevel.OWNER_APPROVAL,
-            "request_bound_owner_authorization", False,
-        ),
-        FailureClass.BUSINESS_PERMANENT: RepairDecision(
-            failure, RepairLevel.MANUAL,
-            "terminal_business_failure", True,
-        ),
-        FailureClass.UNKNOWN: RepairDecision(
-            failure, RepairLevel.AUTO_REPAIR_TASK,
-            "create_diagnostic_repair_task", False,
-        ),
-    }
-    return table[failure]
-
-
-def _probe(
-    name: str,
-    probes: Mapping[str, Callable[[], bool]],
-) -> InvariantResult:
-    fn = probes.get(name)
-    if fn is None:
-        return InvariantResult(name, False, "PROBE_MISSING")
-    try:
-        passed = bool(fn())
-    except Exception as exc:
-        return InvariantResult(name, False, "PROBE_ERROR:" + type(exc).__name__)
-    return InvariantResult(name, passed, "PASS" if passed else "NOT_READY")
-
-
-def runtime_admission(
-    *,
-    worker_capabilities: Iterable[object],
-    required_capabilities: Iterable[object],
-    requested_operations: Sequence[str] = (),
-    probes: Mapping[str, Callable[[], bool]] | None = None,
-) -> AdmissionDecision:
-    """Admission is evaluated before claim; failures do not consume attempts."""
-
-    worker_values = tuple(worker_capabilities)
-    required_values = tuple(required_capabilities)
-    probe_map = probes or {}
-    invariants: list[InvariantResult] = []
-
-    registry = validate_capability_contract_registry()
-    invariants.append(InvariantResult(
-        "capability_contract_registry",
-        bool(registry.get("valid")),
-        "PASS" if registry.get("valid") else "REGISTRY_INVALID",
-    ))
-
-    task_known = all(registered_capability(item) for item in required_values)
-    worker_known = all(registered_capability(item, worker=True) for item in worker_values)
-    invariants.extend((
-        InvariantResult("task_capabilities_registered", task_known, "PASS" if task_known else "UNKNOWN_TASK_CAPABILITY"),
-        InvariantResult("worker_capabilities_registered", worker_known, "PASS" if worker_known else "UNKNOWN_WORKER_CAPABILITY"),
-    ))
-
-    capability_match = (
-        task_known
-        and worker_known
-        and has_capabilities(worker_values, required_values)
-    )
-    invariants.append(InvariantResult(
-        "capability_match",
-        capability_match,
-        "PASS" if capability_match else "WORKER_NOT_ELIGIBLE",
-    ))
-
-    normalized = normalize_required_capabilities(required_values)
-    contracts = [
-        capability_contract(item)
-        for item in normalized
-        if not str(item).startswith("exact:")
-    ]
-    contracts = [item for item in contracts if item is not None]
-
-    forbidden: set[str] = set()
-    dependencies: set[str] = set()
-    health: set[str] = set()
-    for contract in contracts:
-        forbidden.update(contract.forbidden)
-        dependencies.update(contract.dependencies)
-        health.update(contract.health_requirements)
-
-    requested = {str(item).strip().lower() for item in requested_operations if str(item).strip()}
-    forbidden_hit = sorted(requested & {item.lower() for item in forbidden})
-    invariants.append(InvariantResult(
-        "forbidden_operations_absent",
-        not forbidden_hit,
-        "PASS" if not forbidden_hit else "FORBIDDEN:" + ",".join(forbidden_hit),
-    ))
-
-    for name in sorted(dependencies | health):
-        invariants.append(_probe(name, probe_map))
-
-    failed = [item for item in invariants if not item.passed]
-    if not failed:
-        return AdmissionDecision(
-            True,
-            "EXECUTION_READY",
-            tuple(invariants),
-        )
-
-    details = " ".join(item.name + ":" + item.detail for item in failed)
-    failure = classify_failure(details, phase="admission")
-    if any(item.name == "forbidden_operations_absent" and not item.passed for item in failed):
-        failure = FailureClass.POLICY_DENIED
-    elif any("credential" in item.name for item in failed):
-        failure = FailureClass.CREDENTIAL_PROJECTION_ERROR
-    elif any(item.name in {"capability_contract_registry", "task_capabilities_registered", "worker_capabilities_registered", "capability_match"} for item in failed):
-        failure = FailureClass.CAPABILITY_CONTRACT_ERROR
-    elif any(item.name in dependencies or item.name in health for item in failed):
-        failure = FailureClass.DEPENDENCY_UNAVAILABLE
-
-    repair = repair_for_failure(failure)
-    return AdmissionDecision(
-        False,
-        "EXECUTION_READY_FAILED",
-        tuple(invariants),
-        failure,
-        repair.level,
-        repair.action,
-    )
-
-
-def system_invariant_snapshot(
-    *,
-    worker_capabilities: Iterable[object],
-    required_capabilities: Iterable[object],
-    requested_operations: Sequence[str] = (),
-    probes: Mapping[str, Callable[[], bool]] | None = None,
-) -> dict[str, object]:
-    decision = runtime_admission(
-        worker_capabilities=worker_capabilities,
-        required_capabilities=required_capabilities,
-        requested_operations=requested_operations,
-        probes=probes,
-    )
-    return {
-        "schema": "aios.system-invariants.v1",
-        "status": "HEALTHY" if decision.admitted else "DEGRADED",
-        "execution_ready": decision.admitted,
-        "admission": decision.as_dict(),
-    }
@@ -1,89 +0,0 @@
-"""Governed API facade for branch-bound repair leases.
-
-The facade is transport-neutral so the permanent control plane can expose it
-through its existing authenticated loopback/API seam without creating a second
-Git writer or a global credential registry.
-"""
-
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-from branch_repair_lease import LeaseError, RepairLease, RepairLeaseManager, sanitized_lease_view
-
-
-class BranchRepairLeaseAPI:
-    """Validate operation envelopes and return sanitized lease metadata."""
-
-    def __init__(self, manager: RepairLeaseManager) -> None:
-        self.manager = manager
-
-    @staticmethod
-    def _required(request: Mapping[str, Any], name: str) -> Any:
-        value = request.get(name)
-        if value is None or value == "":
-            raise LeaseError(f"missing required field: {name}")
-        return value
-
-    @staticmethod
-    def _view(lease: RepairLease) -> dict[str, Any]:
-        return {"status": "ok", "lease": sanitized_lease_view(lease)}
-
-    def handle(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        try:
-            operation = self._required(request, "operation")
-            owner = str(self._required(request, "owner_identity"))
-            if operation == "issue":
-                lease = self.manager.issue(
-                    task_id=str(self._required(request, "task_id")),
-                    owner_identity=owner,
-                    branch=str(self._required(request, "branch")),
-                    description=str(self._required(request, "description")),
-                    allowed_paths=tuple(self._required(request, "allowed_paths")),
-                    ttl_seconds=int(request.get("ttl_seconds", 3600)),
-                )
-            elif operation == "attach_existing_branch":
-                lease = self.manager.attach_existing_branch(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                )
-            elif operation == "authorize_commit":
-                lease = self.manager.authorize_commit(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                    paths=tuple(self._required(request, "paths")),
-                    content=request.get("content"),
-                )
-            elif operation == "record_commit":
-                lease = self.manager.record_commit(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    expected_head_oid=str(self._required(request, "expected_head_oid")),
-                    new_head_oid=str(self._required(request, "new_head_oid")),
-                    paths=tuple(self._required(request, "paths")),
-                )
-            elif operation == "recover":
-                lease = self.manager.recover(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            elif operation == "renew":
-                lease = self.manager.renew(
-                    str(self._required(request, "lease_id")),
-                    owner_identity=owner,
-                    ttl_seconds=int(self._required(request, "ttl_seconds")),
-                )
-            elif operation == "complete":
-                lease = self.manager.complete(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            elif operation == "revoke":
-                lease = self.manager.revoke(
-                    str(self._required(request, "lease_id")), owner_identity=owner
-                )
-            else:
-                raise LeaseError("unsupported lease operation")
-            return self._view(lease)
-        except (LeaseError, TypeError, ValueError):
-            return {"status": "blocked", "error": "lease_request_rejected"}
@@ -1,48 +0,0 @@
-"""Root-only CLI for the branch-bound repair lease API."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-
-from aios_branch_repair_lease_api import BranchRepairLeaseAPI
-from branch_repair_lease import GitProbe, LeaseStore
-from branch_repair_lease import RepairLeaseManager
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="AIOS branch repair lease CLI")
-    parser.add_argument("--store", required=True)
-    parser.add_argument("--bare-repo", required=True)
-    parser.add_argument("--request-file")
-    parser.add_argument("--request-json")
-    args = parser.parse_args()
-    if hasattr(os, "geteuid") and os.geteuid() != 0:
-        print(json.dumps({"status": "blocked", "error": "root_required"}))
-        return 2
-    if bool(args.request_file) == bool(args.request_json):
-        print(json.dumps({"status": "blocked", "error": "one_request_source_required"}))
-        return 2
-    try:
-        raw = (
-            Path(args.request_file).read_text(encoding="utf-8")
-            if args.request_file
-            else str(args.request_json)
-        )
-        request = json.loads(raw)
-        if not isinstance(request, dict):
-            raise ValueError("request must be an object")
-        api = BranchRepairLeaseAPI(RepairLeaseManager(LeaseStore(args.store), GitProbe(args.bare_repo)))
-        response = api.handle(request)
-        print(json.dumps(response, ensure_ascii=True, sort_keys=True, separators=(",", ":")))
-        return 0 if response.get("status") == "ok" else 1
-    except Exception:
-        print(json.dumps({"status": "blocked", "error": "lease_cli_failed"}))
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,104 +0,0 @@
-"""Read-only validation of recovered campaign authorization evidence."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-from pathlib import Path
-import stat
-from typing import Any
-
-
-class RecoveryEvidenceError(RuntimeError):
-    pass
-
-
-def _digest(path: Path) -> str:
-    h = hashlib.sha256()
-    with path.open("rb") as stream:
-        for block in iter(lambda: stream.read(1024 * 1024), b""):
-            h.update(block)
-    return h.hexdigest()
-
-
-def _secure_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_MISSING")
-    info = path.stat(follow_symlinks=False)
-    if info.st_uid != 0 or stat.S_IMODE(info.st_mode) & 0o022:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_PERMISSIONS")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_INVALID") from exc
-    if not isinstance(value, dict):
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_OBJECT_REQUIRED")
-    return value
-
-
-def load_recovered_authorization(path: str | Path) -> dict[str, Any]:
-    """Verify the recovery receipt, sidecar, and all referenced immutable files."""
-    receipt_path = Path(path)
-    receipt = _secure_json(receipt_path)
-    sidecar = receipt_path.with_suffix(receipt_path.suffix + ".sha256")
-    if sidecar.is_symlink() or not sidecar.is_file():
-        raise RecoveryEvidenceError("RECOVERY_DIGEST_SIDECAR_MISSING")
-    expected = sidecar.read_text(encoding="ascii").split()[0]
-    actual = _digest(receipt_path)
-    if expected != actual:
-        raise RecoveryEvidenceError("RECOVERY_DIGEST_MISMATCH")
-    required = {
-        "schema",
-        "campaign_id",
-        "original_event_id",
-        "original_authorization_digest",
-        "signed_grant_id",
-        "signed_grant_digest",
-        "task_id",
-        "repository",
-        "original_base_oid",
-        "branch",
-        "expected_branch_oid",
-        "recovered_from_existing_evidence",
-        "new_owner_interaction",
-        "recovery_state",
-        "production_side_effect_executed",
-        "global_writes_enabled",
-        "grant_consumed",
-        "owner_authorization_consumed",
-        "original_receipts_immutable",
-        "recovered_at",
-        "evidence_files",
-    }
-    if set(receipt) != required or receipt["schema"] != "aios.owner-authorization-recovery.v1":
-        raise RecoveryEvidenceError("RECOVERY_SCHEMA_INVALID")
-    if receipt["recovered_from_existing_evidence"] is not True or receipt["new_owner_interaction"] is not False:
-        raise RecoveryEvidenceError("RECOVERY_NOT_APPEND_ONLY")
-    if receipt["production_side_effect_executed"] is not False or receipt["global_writes_enabled"] is not False:
-        raise RecoveryEvidenceError("RECOVERY_SCOPE_INVALID")
-    if receipt["recovery_state"] != "RECOVERED_PENDING_CONTINUATION_LEASE":
-        raise RecoveryEvidenceError("RECOVERY_STATE_INVALID")
-    evidence = receipt["evidence_files"]
-    if not isinstance(evidence, list) or not evidence:
-        raise RecoveryEvidenceError("RECOVERY_EVIDENCE_LIST_INVALID")
-    for item in evidence:
-        if not isinstance(item, dict) or set(item) != {"path", "sha256"}:
-            raise RecoveryEvidenceError("RECOVERY_EVIDENCE_ENTRY_INVALID")
-        target = Path(item["path"])
-        if _digest(target) != item["sha256"]:
-            raise RecoveryEvidenceError("RECOVERY_EVIDENCE_DIGEST_MISMATCH")
-    return {
-        "schema": receipt["schema"],
-        "state": receipt["recovery_state"],
-        "campaign_id": receipt["campaign_id"],
-        "original_event_id": receipt["original_event_id"],
-        "original_authorization_digest": receipt["original_authorization_digest"],
-        "signed_grant_id": receipt["signed_grant_id"],
-        "task_id": receipt["task_id"],
-        "repository": receipt["repository"],
-        "original_base_oid": receipt["original_base_oid"],
-        "branch": receipt["branch"],
-        "expected_branch_oid": receipt["expected_branch_oid"],
-        "digest": actual,
-        "new_owner_interaction": False,
-    }
@@ -1,341 +0,0 @@
-"""Canonical fail-closed capability semantics for task eligibility."""
-
-from __future__ import annotations
-
-from collections.abc import Iterable
-from dataclasses import asdict, dataclass
-from typing import Any
-
-
-_TASK_ALIASES: dict[str, frozenset[str]] = {
-    "repository_read": frozenset({"repo.read"}),
-    "git.read": frozenset({"repo.read"}),
-    "repo.read": frozenset({"repo.read"}),
-    "test_execution": frozenset({"test.execute"}),
-    "git.test": frozenset({"test.execute"}),
-    "test.execute": frozenset({"test.execute"}),
-    "governed_git_write": frozenset({"governed.git.write.branch", "governed.git.write.file"}),
-    "governed.git.write": frozenset({"governed.git.write.branch", "governed.git.write.file"}),
-    "governed.write.branch": frozenset({"governed.git.write.branch"}),
-    "governed.write.file": frozenset({"governed.git.write.file"}),
-    "shell": frozenset({"runtime.shell"}),
-    "git": frozenset({"runtime.git"}),
-    "python": frozenset({"runtime.python"}),
-    "code.read": frozenset({"legacy.code.read"}),
-    "code.review": frozenset({"legacy.code.review"}),
-    "code.write": frozenset({"legacy.code.write"}),
-    "code.write.patch": frozenset({"legacy.code.write.patch"}),
-    "test.python": frozenset({"legacy.test.python"}),
-    "test.shell.allowlisted": frozenset({"legacy.test.shell.allowlisted"}),
-    "git.commit": frozenset({"legacy.git.commit"}),
-    "git.diff.read": frozenset({"legacy.git.diff.read"}),
-    "git.force_push": frozenset({"legacy.git.force_push"}),
-    "deploy.production": frozenset({"legacy.deploy.production"}),
-    "secret.transform": frozenset({"legacy.secret.transform"}),
-    "secure_file_transformer": frozenset({"legacy.secure_file_transformer"}),
-    "runtime.shadow": frozenset({"legacy.runtime.shadow"}),
-    "review.security": frozenset({"legacy.review.security"}),
-    "review.api-contract": frozenset({"legacy.review.api-contract"}),
-    "gpu.train": frozenset({"legacy.gpu.train"}),
-    "agent.runtime.hermes": frozenset({"agent.runtime.hermes"}),
-    "agent.runtime.openclaw": frozenset({"agent.runtime.openclaw"}),
-    "engineering.autonomous": frozenset({"engineering.autonomous"}),
-    "release:candidate": frozenset({"release:candidate"}),
-}
-
-_WORKER_ALIASES: dict[str, frozenset[str]] = {
-    "git.read": frozenset({"repo.read"}),
-    "repo.read": frozenset({"repo.read"}),
-    "repository_read": frozenset({"repo.read"}),
-    "git.test": frozenset({"test.execute"}),
-    "test.execute": frozenset({"test.execute"}),
-    "test_execution": frozenset({"test.execute"}),
-    "governed.write.branch": frozenset({"governed.git.write.branch"}),
-    "governed.git.write.branch": frozenset({"governed.git.write.branch"}),
-    "governed.write.file": frozenset({"governed.git.write.file"}),
-    "governed.git.write.file": frozenset({"governed.git.write.file"}),
-    "shell": frozenset({"runtime.shell"}),
-    "git": frozenset({"runtime.git"}),
-    "python": frozenset({"runtime.python"}),
-    "code.read": frozenset({"legacy.code.read"}),
-    "code.review": frozenset({"legacy.code.review"}),
-    "code.write": frozenset({"legacy.code.write"}),
-    "code.write.patch": frozenset({"legacy.code.write.patch"}),
-    "test.python": frozenset({"legacy.test.python"}),
-    "test.shell.allowlisted": frozenset({"legacy.test.shell.allowlisted"}),
-    "git.commit": frozenset({"legacy.git.commit"}),
-    "git.diff.read": frozenset({"legacy.git.diff.read"}),
-    "git.force_push": frozenset({"legacy.git.force_push"}),
-    "deploy.production": frozenset({"legacy.deploy.production"}),
-    "secret.transform": frozenset({"legacy.secret.transform"}),
-    "secure_file_transformer": frozenset({"legacy.secure_file_transformer"}),
-    "runtime.shadow": frozenset({"legacy.runtime.shadow"}),
-    "review.security": frozenset({"legacy.review.security"}),
-    "review.api-contract": frozenset({"legacy.review.api-contract"}),
-    "gpu.train": frozenset({"legacy.gpu.train"}),
-    "agent.runtime.hermes": frozenset({"agent.runtime.hermes"}),
-    "agent.runtime.openclaw": frozenset({"agent.runtime.openclaw"}),
-    "engineering.autonomous": frozenset({"engineering.autonomous"}),
-    "release:candidate": frozenset({"release:candidate"}),
-}
-
-
-
-@dataclass(frozen=True)
-class CapabilityContract:
-    """Versioned runtime contract attached to one canonical semantic capability."""
-
-    name: str
-    min_version: int = 1
-    max_version: int = 1
-    permissions: tuple[str, ...] = ()
-    forbidden: tuple[str, ...] = ()
-    dependencies: tuple[str, ...] = ()
-    health_requirements: tuple[str, ...] = ()
-
-    def as_dict(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-# This registry is the semantic source of truth. Alias tables below are retained
-# as compatibility adapters; startup/tests validate every alias target against
-# this registry so a name cannot be accepted in one layer and be unknown in
-# another.
-_CAPABILITY_CONTRACTS: dict[str, CapabilityContract] = {
-    "repo.read": CapabilityContract("repo.read", permissions=("repository_read",)),
-    "test.execute": CapabilityContract("test.execute", permissions=("test_execution",)),
-    "governed.git.write.branch": CapabilityContract(
-        "governed.git.write.branch",
-        permissions=("governed_branch_write",),
-        dependencies=("writer_lease", "governed_gitops"),
-    ),
-    "governed.git.write.file": CapabilityContract(
-        "governed.git.write.file",
-        permissions=("governed_file_write",),
-        dependencies=("writer_lease", "governed_gitops"),
-    ),
-    "governed.git.write": CapabilityContract(
-        "governed.git.write",
-        permissions=("governed_git_write",),
-        dependencies=("writer_lease", "governed_gitops"),
-    ),
-    "runtime.shell": CapabilityContract("runtime.shell", permissions=("runtime_shell",)),
-    "runtime.git": CapabilityContract("runtime.git", permissions=("runtime_git",)),
-    "runtime.python": CapabilityContract("runtime.python", permissions=("runtime_python",)),
-    "legacy.code.read": CapabilityContract("legacy.code.read"),
-    "legacy.code.review": CapabilityContract("legacy.code.review"),
-    "legacy.code.write": CapabilityContract("legacy.code.write"),
-    "legacy.code.write.patch": CapabilityContract("legacy.code.write.patch"),
-    "legacy.test.python": CapabilityContract("legacy.test.python"),
-    "legacy.test.shell.allowlisted": CapabilityContract("legacy.test.shell.allowlisted"),
-    "legacy.git.commit": CapabilityContract("legacy.git.commit"),
-    "legacy.git.diff.read": CapabilityContract("legacy.git.diff.read"),
-    "legacy.git.force_push": CapabilityContract(
-        "legacy.git.force_push",
-        forbidden=("protected_ref_bypass",),
-    ),
-    "legacy.deploy.production": CapabilityContract(
-        "legacy.deploy.production",
-        permissions=("production_deploy",),
-        dependencies=("owner_approval", "deployment_controller"),
-        health_requirements=("approval_envelope_verified", "runtime_acceptance_available"),
-    ),
-    "legacy.secret.transform": CapabilityContract("legacy.secret.transform"),
-    "legacy.secure_file_transformer": CapabilityContract("legacy.secure_file_transformer"),
-    "legacy.runtime.shadow": CapabilityContract("legacy.runtime.shadow"),
-    "legacy.review.security": CapabilityContract("legacy.review.security"),
-    "legacy.review.api-contract": CapabilityContract("legacy.review.api-contract"),
-    "legacy.gpu.train": CapabilityContract("legacy.gpu.train"),
-    "agent.runtime.hermes": CapabilityContract(
-        "agent.runtime.hermes",
-        dependencies=("hermes_runtime",),
-        health_requirements=("worker_liveness",),
-    ),
-    "agent.runtime.openclaw": CapabilityContract(
-        "agent.runtime.openclaw",
-        dependencies=("openclaw_runtime",),
-        health_requirements=("worker_liveness",),
-    ),
-    "engineering.autonomous": CapabilityContract(
-        "engineering.autonomous",
-        dependencies=("agent_task_control_plane",),
-        health_requirements=("worker_liveness",),
-    ),
-    "release:candidate": CapabilityContract(
-        "release:candidate",
-        min_version=1,
-        max_version=1,
-        permissions=("prepare_release",),
-        forbidden=(
-            "production_deploy",
-            "submit_owner_approval",
-            "tag_publish",
-            "baseline_registry_finalize",
-            "runtime_switch",
-        ),
-        dependencies=(
-            "credential_projection",
-            "trusted_builder",
-        ),
-        health_requirements=(
-            "authenticated_probe",
-            "release_api_health",
-            "worker_liveness",
-        ),
-    ),
-}
-
-
-def capability_contract(name: object) -> CapabilityContract | None:
-    """Return the contract for one canonical or registered capability name."""
-
-    text = _clean(name)
-    direct = _CAPABILITY_CONTRACTS.get(text)
-    if direct is not None:
-        return direct
-    mapped = _TASK_ALIASES.get(text) or _WORKER_ALIASES.get(text)
-    if mapped is None or len(mapped) != 1:
-        return None
-    return _CAPABILITY_CONTRACTS.get(next(iter(mapped)))
-
-
-def registered_capability(name: object, *, worker: bool = False) -> bool:
-    """Fail-closed validation used by registration/task admission."""
-
-    text = _clean(name)
-    if "*" in text:
-        return False
-    aliases = _WORKER_ALIASES if worker else _TASK_ALIASES
-    mapped = aliases.get(text)
-    if mapped is None:
-        return text in _CAPABILITY_CONTRACTS
-    return all(item in _CAPABILITY_CONTRACTS for item in mapped)
-
-
-def validate_capability_contract_registry() -> dict[str, object]:
-    """Prove alias/contract closure and contract safety invariants."""
-
-    alias_targets: set[str] = set()
-    for mapping in (_TASK_ALIASES, _WORKER_ALIASES):
-        for values in mapping.values():
-            alias_targets.update(values)
-    missing = sorted(alias_targets - set(_CAPABILITY_CONTRACTS))
-    invalid_versions = sorted(
-        name
-        for name, contract in _CAPABILITY_CONTRACTS.items()
-        if contract.min_version < 1 or contract.max_version < contract.min_version
-    )
-    permission_forbidden_overlap = sorted(
-        name
-        for name, contract in _CAPABILITY_CONTRACTS.items()
-        if set(contract.permissions) & set(contract.forbidden)
-    )
-    return {
-        "schema": "aios.capability-contract-registry.v1",
-        "contract_count": len(_CAPABILITY_CONTRACTS),
-        "missing_alias_targets": missing,
-        "invalid_versions": invalid_versions,
-        "permission_forbidden_overlap": permission_forbidden_overlap,
-        "valid": not missing and not invalid_versions and not permission_forbidden_overlap,
-    }
-
-
-def capability_contract_snapshot() -> dict[str, dict[str, Any]]:
-    return {
-        name: contract.as_dict()
-        for name, contract in sorted(_CAPABILITY_CONTRACTS.items())
-    }
-
-
-_UNKNOWN_PREFIX = "exact:"
-
-
-def _clean(value: object) -> str:
-    if not isinstance(value, str):
-        raise ValueError("capability must be a string")
-    text = value.strip().lower()
-    if not text:
-        raise ValueError("capability must not be empty")
-    return text
-
-
-def normalize_required_capabilities(values: Iterable[object]) -> frozenset[str]:
-    """Map task-facing names to one semantic vocabulary.
-
-    Unknown names remain explicit exact requirements. They are never treated
-    as wildcards or granted by a failed normalization.
-    """
-
-    result: set[str] = set()
-    for value in values:
-        text = _clean(value)
-        if "*" in text:
-            result.add(_UNKNOWN_PREFIX + text)
-        else:
-            mapped = _TASK_ALIASES.get(text)
-            if mapped is None or any(item not in _CAPABILITY_CONTRACTS for item in mapped):
-                result.add(_UNKNOWN_PREFIX + text)
-            else:
-                result.update(mapped)
-    return frozenset(result)
-
-
-def normalize_worker_capabilities(values: Iterable[object]) -> frozenset[str]:
-    """Map registered worker names to effective semantic capabilities."""
-
-    result: set[str] = set()
-    for value in values:
-        text = _clean(value)
-        if "*" in text:
-            continue
-        mapped = _WORKER_ALIASES.get(text)
-        if mapped is not None and all(item in _CAPABILITY_CONTRACTS for item in mapped):
-            result.update(mapped)
-    if {
-        "governed.git.write.branch",
-        "governed.git.write.file",
-    }.issubset(result):
-        result.add("governed.git.write")
-    return frozenset(result)
-
-
-def has_capabilities(
-    worker_capabilities: Iterable[object],
-    required_capabilities: Iterable[object],
-) -> bool:
-    """Return the single eligibility decision used by poll and claim."""
-
-    required = normalize_required_capabilities(required_capabilities)
-    effective = normalize_worker_capabilities(worker_capabilities)
-    if any(value.startswith(_UNKNOWN_PREFIX) for value in required):
-        return False
-    return required.issubset(effective)
-
-
-def required_capabilities_subset(
-    granted_requirements: Iterable[object],
-    required_requirements: Iterable[object],
-) -> bool:
-    """Check semantic capability containment for delegation constraints."""
-    granted = normalize_required_capabilities(granted_requirements)
-    required = normalize_required_capabilities(required_requirements)
-    if any(value.startswith(_UNKNOWN_PREFIX) for value in granted | required):
-        return False
-    return required.issubset(granted)
-
-
-def normalized_capability_matrix(
-    worker_capabilities: Iterable[object],
-    required_capabilities: Iterable[object],
-) -> dict[str, object]:
-    """Expose non-secret decision evidence for tests and diagnostics."""
-
-    worker_values = tuple(worker_capabilities)
-    required_values = tuple(required_capabilities)
-    worker = normalize_worker_capabilities(worker_values)
-    required = normalize_required_capabilities(required_values)
-    return {
-        "worker_effective": sorted(worker),
-        "task_required": sorted(required),
-        "eligible": has_capabilities(worker_values, required_values),
-    }
@@ -1,68 +1,12 @@
 #!/usr/bin/env python3
 from __future__ import annotations
-import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, urllib.request, uuid
+import hashlib, hmac, json, os, re, subprocess, sys, time, urllib.parse, uuid
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 from typing import Any

-try:
-    from aios_gitops_write_guard import evaluate_git_write
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
-    from aios_gitops_write_guard import evaluate_git_write
-
-from gitea_tag_publication import (
-    GiteaTagClient,
-    GitTagBackend,
-    PublicationConflict,
-    PublicationPending,
-    PublicationManualOwnerReviewRequired,
-    PublicationReconciliationRequired,
-    PublicationRequest,
-    TagPublisher,
-    redact,
-    validate_version,
-)
+sys.path.insert(0, str(Path(os.getenv('AIOS_GITOPS_WORKSPACE', '/data/aios-gitops/workspace')) / 'runtime' / 'agent-os'))
 from orchestrator.action_monitor import ActionMonitor
-from silent_release_hardening import (
-    ApprovalKeyRing,
-    ApprovalRevocationStore,
-    CapabilityAuthorizationError,
-    SagaConflict,
-    SignedApprovalVerifier,
-    SignedReleasePlanApproval,
-    SilentReleaseActionService,
-)
-try:
-    from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
-    from aios_gitops_job_controller import GitOpsJobController, JobError, ServiceUnavailable, JobStore
-try:
-    from authoritative_git import (
-        AuthoritativeGitError,
-        AuthoritativeGitNotFound,
-        AuthoritativeGitOutputTooLarge,
-        authoritative_branches,
-        authoritative_diff,
-        authoritative_commit,
-        authoritative_tags,
-        repository_snapshot,
-        run_authoritative_git,
-    )
-except ModuleNotFoundError:
-    sys.path.insert(0, str(Path(__file__).resolve().parent))
-    from authoritative_git import (
-        AuthoritativeGitError,
-        AuthoritativeGitNotFound,
-        AuthoritativeGitOutputTooLarge,
-        authoritative_branches,
-        authoritative_diff,
-        authoritative_commit,
-        authoritative_tags,
-        repository_snapshot,
-        run_authoritative_git,
-    )

 ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
 WS = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
@@ -72,19 +16,6 @@ HOST = os.getenv('AIOS_GITOPS_HOST', '127.0.0.1')
 PORT = int(os.getenv('AIOS_GITOPS_PORT', '18890'))
 OPENAPI = WS / 'docs' / 'gitops' / 'openapi-chatgpt-actions.yaml'
 BARE_REPO = Path(os.getenv('AIOS_GITOPS_BARE_REPO', str(ROOT / 'runtime' / 'gitea-bin' / 'data' / 'repositories' / 'aios' / 'aios.git')))
-AUTHORITATIVE_GIT_DIR = Path(os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR')) if os.getenv('AIOS_GITOPS_AUTHORITATIVE_GIT_DIR') else None
-REPOSITORY_IDENTITY = os.getenv('AIOS_GITOPS_REPOSITORY_IDENTITY', '')
-SILENT_RELEASE_STATE_ROOT = Path(os.getenv(
-    'AIOS_SILENT_RELEASE_STATE_ROOT',
-    '/var/lib/aios-gitops/silent-release',
-))
-SILENT_RELEASE_EXECUTION_ENABLED = str(os.getenv(
-    'AIOS_SILENT_RELEASE_EXECUTION_ENABLED', 'false'
-)).lower() in {'1', 'true', 'yes', 'on'}
-SILENT_RELEASE_PUBLIC_KEYS = Path(os.getenv(
-    'AIOS_SILENT_RELEASE_PUBLIC_KEYS',
-    '/etc/aios-gitops/silent-release-owner-public-keys.json',
-))
 monitor = ActionMonitor()

 BASE_MODELS = [
@@ -93,49 +24,7 @@ BASE_MODELS = [
  {'id':'base.gpt-5.5','provider':'openai','model':'gpt-5.5','display_name':'GPT-5.5','scope':'global'},
 ]
 SECRET_RE = re.compile(r'(?i)(api[_-]?key|secret[_-]?access[_-]?key|secret|password|token)\s*[:=]\s*["\']?([A-Za-z0-9_./+=:-]{16,})')
-SECRET_VAL_RE = re.compile(
-    r'(?<![A-Za-z0-9_])'
-    r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})'
-)
-
-READ_ONLY_GET_PATHS = frozenset({
-    '/', '/health', '/api/health', '/api/openapi.yaml',
-    '/api/openapi-chatgpt-actions.yaml', '/api/schema', '/api', '/api/status',
-    '/api/base', '/api/baseline', '/base', '/api/ver', '/api/versions', '/ver',
-    '/api/diff', '/diff', '/api/patch', '/api/patches', '/api/branches', '/patch',
-    '/api/model', '/model', '/api/run', '/api/runtime-status', '/run',
-    '/api/action-monitor', '/action-monitor', '/admin/ai-evolution',
-    '/admin/ai-evolution/api/data',
-    '/api/release-consistency', '/api/tag-publication-status',
-    '/api/release-acceptance',
-    '/getReleaseCandidate', '/getReleasePlan', '/getReleaseAcceptance',
-    '/getApprovalEnvelope', '/getReleaseSaga', '/getCapabilityStatus',
-    '/getRecoveryStatus',
-})
-SILENT_RELEASE_POST_PATHS = frozenset({
-    '/createReleaseCandidate',
-    '/createReleaseIntent',
-    '/submitSignedApproval',
-    '/submitOwnerApproval',
-    '/startDeployment',
-})
-
-def reject_non_read_http(handler, method: str, path: str) -> bool:
-    if method == 'GET':
-        return False
-    if path in SILENT_RELEASE_POST_PATHS:
-        return False
-    if (
-        method == 'POST'
-        and path in ('/api/file', '/api/commit-file')
-        and os.getenv('AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED', os.getenv('AIOS_GITOPS_JOB_CONTROLLER_ENABLED', 'false')).lower() in {'1', 'true', 'yes', 'on'}
-    ):
-        return False
-    decision = evaluate_git_write(WS)
-    if decision.allowed:
-        return False
-    handler.sendj(decision.payload(), decision.status_code)
-    return True
+SECRET_VAL_RE = re.compile(r'(sk-[A-Za-z0-9_-]{20,}|HPUA[A-Z0-9]{10,}|SDC[A-Za-z0-9]{20,})')

 def now() -> str: return time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())
 def uid(p='id') -> str: return f'{p}-{int(time.time()*1000)}-{uuid.uuid4().hex[:8]}'
@@ -147,41 +36,6 @@ def sh(args, check=False):
 def jload(p: Path, default):
    try: return json.loads(p.read_text(encoding='utf-8'))
    except Exception: return default
-
-def _file_sha256(path: Path) -> str:
-    digest=hashlib.sha256()
-    with path.open('rb') as source:
-        for chunk in iter(lambda: source.read(1024 * 1024), b''):
-            digest.update(chunk)
-    return digest.hexdigest()
-
-def _build_silent_release_service() -> SilentReleaseActionService:
-    verifier=None
-    if SILENT_RELEASE_PUBLIC_KEYS.is_file():
-        verifier=SignedApprovalVerifier(
-            ApprovalKeyRing.from_file(SILENT_RELEASE_PUBLIC_KEYS),
-            ApprovalRevocationStore(
-                SILENT_RELEASE_STATE_ROOT / 'revocations'
-            ),
-        )
-    policy_path=WS / 'config' / 'gitops' / 'silent-release-policy.json'
-    policy_sha=_file_sha256(policy_path) if policy_path.is_file() else ''
-    return SilentReleaseActionService(
-        SILENT_RELEASE_STATE_ROOT,
-        execution_enabled=SILENT_RELEASE_EXECUTION_ENABLED,
-        approval_verifier=verifier,
-        expected_repository=REPOSITORY_IDENTITY,
-        policy_sha256=policy_sha,
-    )
-
-# Construct once during service startup. If production execution is enabled
-# without every trusted builder/orchestrator dependency, construction fails
-# closed before the HTTP server accepts traffic.
-_SILENT_RELEASE_SERVICE = _build_silent_release_service()
-
-
-def silent_release_service() -> SilentReleaseActionService:
-    return _SILENT_RELEASE_SERVICE
 def relpath(path: str) -> str:
    x = str(path or '').replace('\\','/').strip()
    if not x or x.startswith('/') or '..' in Path(x).parts or Path(x).parts[0] == '.git': raise ValueError('invalid path')
@@ -255,13 +109,9 @@ def ensure_git():
    if not sh(['config','user.name'])['stdout']: sh(['config','user.name','chatgpt-gitops-bot'], True)
 def checkout(branch, base='main', create=False):
    ensure_git(); b=branch_name(branch)
-    exists = sh(['rev-parse','--verify',f'refs/heads/{b}'])['code'] == 0
-    if exists:
-        sh(['checkout',b], True)
-    elif create:
-        sh(['checkout',base], True); sh(['checkout','-b',b], True)
-    else:
-        raise ValueError(f'branch does not exist: {b}')
+    if create or sh(['rev-parse','--verify',b])['code'] != 0:
+        sh(['checkout',base], True); sh(['checkout','-B',b], True)
+    else: sh(['checkout',b], True)
    return b
 def write_file(path, content):
    if content_has_secret(content): raise ValueError('secret_rejected: use secret_ref; plaintext API keys must not enter Git')
@@ -271,19 +121,6 @@ def sync_branch(branch: str) -> dict:
    if not branch or branch in ('main','master') or branch.startswith('main/') or branch.startswith('master/'):
        return {'status':'skipped','reason':'protected_branch','branch':branch}
    if BARE_REPO.exists():
-        common = sh(['rev-parse', '--path-format=absolute', '--git-common-dir'], True)['stdout']
-        if Path(common).resolve() == BARE_REPO.resolve():
-            head = sh(['rev-parse', 'HEAD'], True)['stdout']
-            stored = subprocess.run(
-                ['git', '--git-dir', str(BARE_REPO), 'rev-parse', f'refs/heads/{branch}'],
-                text=True, capture_output=True,
-            )
-            if stored.returncode != 0 or stored.stdout.strip() != head:
-                raise RuntimeError(f'linked-worktree branch verification failed for {branch}')
-            return {
-                'status':'verified', 'target':'authoritative-bare',
-                'branch':branch, 'oid':head,
-            }
        ref=f'refs/heads/{branch}:refs/heads/{branch}'
        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git sync failed for {branch}')
@@ -293,68 +130,15 @@ def sync_branch(branch: str) -> dict:
    return {'status':'synced','target':'origin','branch':branch,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}

 def sync_tag(tag: str) -> dict:
-    raise RuntimeError(
-        'unsafe sync_tag disabled: use TagPublisher with expected tag_oid, '
-        'target_oid, Gitea remote verification, and authenticated API verification'
-    )
-
-def resolve_commit_oid(value: str | None, field: str = 'target_oid') -> str:
-    oid = str(value or '').strip().lower()
-    if not re.fullmatch(r'[0-9a-f]{40}', oid):
-        raise ValueError(f'{field} must be a full 40-character commit OID')
-    try:
-        return authoritative_commit(oid, git_dir=AUTHORITATIVE_GIT_DIR)
-    except (AuthoritativeGitError, ValueError) as exc:
-        raise ValueError(f'{field} does not resolve to the exact approved commit') from exc
-
-def existing_tag_target(tag: str) -> str | None:
-    if not re.fullmatch(r'V\d+R\d+C\d+(?:-[A-Za-z0-9_.-]+)?$', str(tag or '')):
-        raise ValueError('invalid release version')
-    try:
-        result = run_authoritative_git(
-            ['rev-parse', '--verify', f'refs/tags/{tag}^{{commit}}'],
-            check=False,
-            git_dir=AUTHORITATIVE_GIT_DIR,
-        )
-    except AuthoritativeGitError as exc:
-        raise RuntimeError(str(exc)) from exc
-    return result.stdout.strip() if result.returncode == 0 else None
-
-def publication_request_from_query(q: dict[str, list[str]]) -> PublicationRequest:
-    required = ('version', 'target_oid', 'evidence_closure_oid', 'approval_plan_id')
-    missing = [name for name in required if not (q.get(name) or [''])[0]]
-    if missing:
-        raise ValueError('missing release governance fields: ' + ', '.join(missing))
-    return PublicationRequest(
-        (q['version'])[0],
-        (q['target_oid'])[0].lower(),
-        (q['evidence_closure_oid'])[0].lower(),
-        (q['approval_plan_id'])[0],
-    )
-
-def required_authoritative_git_dir() -> Path:
-    snapshot = repository_snapshot(
-        git_dir=AUTHORITATIVE_GIT_DIR,
-        repository_identity=REPOSITORY_IDENTITY,
-    )
-    if not snapshot["repository_available"]:
-        raise RuntimeError(str(snapshot["query_error"] or "AUTHORITATIVE_REPOSITORY_UNAVAILABLE"))
-    return Path(str(snapshot["authoritative_git_dir"]))
-
-
-def publication_publisher() -> TagPublisher:
-    authoritative_repo = required_authoritative_git_dir()
-    return TagPublisher(
-        WS,
-        GitTagBackend(WS, authoritative_repo=authoritative_repo),
-        GiteaTagClient(
-            os.getenv('AIOS_GITOPS_GITEA_API_URL',''),
-            os.getenv('AIOS_GITOPS_GITEA_REPOSITORY',''),
-            Path(os.getenv('AIOS_GITOPS_GITEA_TOKEN_FILE','')),
-            token_line=int(os.getenv('AIOS_GITOPS_GITEA_TOKEN_LINE','1')),
-        ),
-        os.getenv('AIOS_GITOPS_GITEA_REMOTE','gitea'),
-    )
+    if not tag: return {'status':'skipped','reason':'empty_tag'}
+    if BARE_REPO.exists():
+        ref=f'refs/tags/{tag}:refs/tags/{tag}'
+        p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
+        if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag sync failed for {tag}')
+        return {'status':'synced','target':'bare','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
+    p=subprocess.run(['git','push','origin',tag], cwd=str(WS), text=True, capture_output=True)
+    if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag push failed for {tag}')
+    return {'status':'synced','target':'origin','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}

 def commit(paths, msg):
    ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
@@ -374,16 +158,6 @@ def patches():
    for p in sorted((WS/'patches').glob('**/*.json')): out.append(jload(p, {'path':str(p.relative_to(WS))}))
    return out

-def runtime_release_info() -> dict[str, Any]:
-    for candidate in (WS / 'manifest.json', WS.parent / 'manifest.json'):
-        data = jload(candidate, {})
-        if data.get('target_commit'):
-            return {
-                'runtime_release_commit': data.get('target_commit'),
-                'runtime_release_path': str(WS),
-            }
-    return {'runtime_release_commit': None, 'runtime_release_path': str(WS)}
-
 class H(BaseHTTPRequestHandler):
    server_version='AIOSChatGPTGitOps/V1R1C0'
    def sendj(self, data, code=200):
@@ -404,282 +178,44 @@ class H(BaseHTTPRequestHandler):
        if not a['ok']: self.sendj({'error':'unauthorized','hint':'Bearer token required'},401); return None
        if '*' not in a['scopes'] and scope not in a['scopes']: self.sendj({'error':'forbidden','required_scope':scope,'account':a['account']},403); return None
        return a
-    def bridge_release(self, path, data):
-        route = {
-            '/createTagApprovalRequest': '/v2/tag/approval-request',
-            '/requestOrCreateTag': '/v2/tag/publish',
-            '/getTagPublicationStatus': '/v2/tag/status',
-            '/buildProductionArtifact': '/v2/release/artifact',
-            '/executeApprovedProductionRelease': '/v2/release/execute',
-            '/getReleaseConsistency': '/v2/release/consistency',
-            '/runReleaseAcceptance': '/v2/release/acceptance',
-        }.get(path)
-        if route is None:
-            raise ValueError('governed_release_route_invalid')
-        base = os.getenv('AIOS_BRIDGE_V2_URL', 'http://127.0.0.1:18892').rstrip('/')
-        request = urllib.request.Request(
-            base + route,
-            data=json.dumps(data, sort_keys=True, separators=(',', ':')).encode('utf-8'),
-            headers={'Content-Type': 'application/json'},
-            method='POST',
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=30) as response:
-                result = json.loads(response.read().decode('utf-8'))
-                return self.sendj(result, response.status)
-        except urllib.error.HTTPError as exc:
-            try:
-                body = json.loads(exc.read().decode('utf-8'))
-            except Exception:
-                body = {'error': 'bridge_http_error'}
-            return self.sendj(body, exc.code)
-        except (urllib.error.URLError, TimeoutError) as exc:
-            return self.sendj({'error': 'GOVERNED_BRIDGE_UNAVAILABLE', 'detail': type(exc).__name__}, 503)
-    def do_POST(self):
-        path = urllib.parse.urlparse(self.path).path
-        if path in {
-            '/createTagApprovalRequest', '/requestOrCreateTag', '/getTagPublicationStatus',
-            '/buildProductionArtifact', '/executeApprovedProductionRelease',
-            '/getReleaseConsistency', '/runReleaseAcceptance',
-        }:
-            actor = self.need('tag:create')
-            if not actor:
-                return
-            return self.bridge_release(path, self.body())
-        if reject_non_read_http(self, 'POST', path):
-            return
-        return self.sendj({'error': 'not_found', 'path': path}, 404)
    def do_GET(self):
-        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path
-        if path not in READ_ONLY_GET_PATHS: return self.sendj({'error':'not_found','path':path},404)
-        q=urllib.parse.parse_qs(u.query)
+        u=urllib.parse.urlparse(self.path); path=u.path.rstrip('/') if u.path != '/' else u.path; q=urllib.parse.parse_qs(u.query)
        try:
            if path in ('/health','/api/health'): return self.sendj({'status':'ok','service':'chatgpt-gitops-adapter','workspace':str(WS)})
            if path in ('/api/openapi.yaml','/api/openapi-chatgpt-actions.yaml','/api/schema'):
                return self.sendt(OPENAPI.read_text(encoding='utf-8'), 'application/yaml; charset=utf-8') if OPENAPI.exists() else self.sendj({'error':'schema_missing'},404)
            if path in ('/api','/api/status'): return self.sendj(api_spec())
            if path in ('/api/base','/api/baseline','/base'):
-                data=jload(WS/'baseline'/'current.json', {})
-                data.setdefault('authoritative_repository', repository_snapshot(
-                    git_dir=AUTHORITATIVE_GIT_DIR,
-                    repository_identity=REPOSITORY_IDENTITY,
-                ))
-                return self.sendj(data)
+                data=jload(WS/'baseline'/'current.json', {}); data.setdefault('git', sh(['rev-parse','--short','HEAD'])['stdout']); return self.sendj(data)
            if path in ('/api/ver','/api/versions','/ver'):
-                snapshot = repository_snapshot(
-                    git_dir=AUTHORITATIVE_GIT_DIR,
-                    repository_identity=REPOSITORY_IDENTITY,
-                )
-                if not snapshot['repository_available']:
-                    return self.sendj({
-                        'repository_available': False,
-                        'query_error': snapshot['query_error'],
-                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
-                        'local_authoritative_tags': [],
-                    }, 503)
-                try:
-                    tags = authoritative_tags(git_dir=AUTHORITATIVE_GIT_DIR)
-                except AuthoritativeGitError as exc:
-                    return self.sendj({
-                        'repository_available': False,
-                        'query_error': str(exc),
-                        'registry_versions': [p.name for p in (WS/'versions').glob('*')],
-                        'local_authoritative_tags': [],
-                    }, 503)
-                registry = [p.name for p in (WS/'versions').glob('*')]
-                return self.sendj({
-                    'registry_versions': registry,
-                    'local_authoritative_tags': tags,
-                    'repository_available': True,
-                    'query_error': None,
-                    'tags': [item['name'] for item in tags],
-                    'versions_dir': registry,
-                    'head': snapshot['authoritative_head_oid'],
-                    'authoritative_head_oid': snapshot['authoritative_head_oid'],
-                })
+                return self.sendj({'tags':sh(['tag','--list','V*'])['stdout'].splitlines(),'versions_dir':[p.name for p in (WS/'versions').glob('*')],'head':sh(['rev-parse','--short','HEAD'])['stdout']})
            if path in ('/api/diff','/diff'):
-                frm=(q.get('from') or [''])[0]
-                to=(q.get('to') or [''])[0]
-                try:
-                    diff=authoritative_diff(frm, to, git_dir=required_authoritative_git_dir())
-                except ValueError as exc:
-                    return self.sendj({'error':redact(exc)},400)
-                except AuthoritativeGitNotFound as exc:
-                    return self.sendj({'error':redact(exc)},404)
-                except AuthoritativeGitOutputTooLarge as exc:
-                    return self.sendj({'error':redact(exc)},413)
-                except (AuthoritativeGitError, RuntimeError) as exc:
-                    return self.sendj({'error':redact(exc)},503)
-                return self.sendj({'from':frm,'to':to,'diff':diff})
-            if path in ('/api/patch','/api/patches','/api/branches','/patch'):
-                snapshot = repository_snapshot(
-                    git_dir=AUTHORITATIVE_GIT_DIR,
-                    repository_identity=REPOSITORY_IDENTITY,
-                )
-                if not snapshot['repository_available']:
-                    return self.sendj({
-                        'repository_available': False,
-                        'query_error': snapshot['query_error'],
-                        'metadata_patches': patches(),
-                        'authoritative_branches': [],
-                    }, 503)
-                try:
-                    branches = authoritative_branches(git_dir=AUTHORITATIVE_GIT_DIR)
-                except AuthoritativeGitError as exc:
-                    return self.sendj({
-                        'repository_available': False,
-                        'query_error': str(exc),
-                        'metadata_patches': patches(),
-                        'authoritative_branches': [],
-                    }, 503)
-                metadata = patches()
-                branch_names = {item['name'] for item in branches}
-                metadata_names = {
-                    item.get('branch') for item in metadata
-                    if isinstance(item, dict) and item.get('branch')
-                }
-                orphan = [
-                    item for item in metadata
-                    if item.get('branch') and item.get('branch') not in branch_names
-                ]
-                missing = [
-                    item for item in branches
-                    if item['name'] not in metadata_names
-                ]
-                return self.sendj({
-                    'metadata_patches': metadata,
-                    'authoritative_branches': branches,
-                    'orphan_metadata': orphan,
-                    'branches_without_metadata': missing,
-                    'repository_available': True,
-                    'query_error': None,
-                    'patches': metadata,
-                    'branches': [item['name'] for item in branches],
-                })
+                frm=(q.get('from') or ['HEAD~1'])[0]; to=(q.get('to') or ['HEAD'])[0]; return self.sendj({'from':frm,'to':to,'diff':sh(['diff',frm,to])})
+            if path in ('/api/patch','/api/patches','/api/branches','/patch'): return self.sendj({'patches':patches(),'branches':sh(['branch','--format','%(refname:short)'])['stdout'].splitlines()})
            if path in ('/api/model','/model'): return self.sendj({'base':BASE_MODELS,'custom':model_docs(),'priority':[jload(p,{}) for p in sorted((WS/'config'/'model_priority').glob('*.json'))]})
            if path in ('/api/run','/api/runtime-status','/run'):
                svc=subprocess.run(['systemctl','is-active','aios-gitops-model-api'], text=True, capture_output=True)
-                snapshot = repository_snapshot(
-                    git_dir=AUTHORITATIVE_GIT_DIR,
-                    repository_identity=REPOSITORY_IDENTITY,
-                )
-                workspace_branch = None
-                if (WS / '.git').exists():
-                    result = sh(['rev-parse','--abbrev-ref','HEAD'])
-                    workspace_branch = result['stdout'] or None
-                payload = {
-                    'service':'aios-gitops-model-api',
-                    'status':svc.stdout.strip() or svc.stderr.strip(),
-                    'workspace_branch':workspace_branch,
-                    **runtime_release_info(),
-                    **snapshot,
-                    'writes_enabled': str(os.getenv('AIOS_GITOPS_WRITES_ENABLED','false')).lower() in {'1','true','yes','on'},
-                }
-                return self.sendj(payload, 200 if snapshot['repository_available'] else 503)
+                return self.sendj({'service':'aios-gitops-model-api','status':svc.stdout.strip() or svc.stderr.strip(),'workspace_branch':sh(['rev-parse','--abbrev-ref','HEAD'])['stdout']})
            if path in ('/api/action-monitor','/action-monitor'):
                latest=monitor.latest()
                ldict={'event_id':latest.event_id,'action':latest.action,'error':latest.error,'context':latest.context,'created_at':latest.created_at} if latest else None
                return self.sendj({'events':[{"event_id":e.event_id,"action":e.action,"error":e.error,"context":e.context,"created_at":e.created_at} for e in monitor.list_events()],'latest':ldict})
-            if path == '/api/tag-publication-status':
-                version=(q.get('version') or [''])[0]
-                try:
-                    version=validate_version(version)
-                    status=publication_publisher().get_tag_publication_status(version)
-                except ValueError:
-                    return self.sendj({'error':'invalid release version'},400)
-                return self.sendj(status)
-            if path == '/api/release-consistency':
-                request=publication_request_from_query(q)
-                return self.sendj(publication_publisher().get_release_consistency(request))
-            if path == '/api/release-acceptance':
-                request=publication_request_from_query(q)
-                return self.sendj(publication_publisher().run_release_acceptance(request))
-            if path in (
-                '/getReleaseCandidate',
-                '/getReleasePlan',
-                '/getReleaseAcceptance',
-                '/getApprovalEnvelope',
-                '/getReleaseSaga',
-                '/getCapabilityStatus',
-            ):
-                candidate_id=(q.get('candidate_id') or [''])[0]
-                if not candidate_id:
-                    return self.sendj({'error':'candidate_id is required'},400)
-                service=silent_release_service()
-                if path == '/getReleaseCandidate':
-                    return self.sendj(
-                        service.get_release_candidate(candidate_id)
-                    )
-                if path == '/getApprovalEnvelope':
-                    return self.sendj(
-                        service.get_approval_envelope(candidate_id)
-                    )
-                if path == '/getReleasePlan':
-                    return self.sendj(service.get_release_plan(candidate_id))
-                if path == '/getReleaseAcceptance':
-                    return self.sendj(service.get_acceptance(candidate_id))
-                if path == '/getCapabilityStatus':
-                    return self.sendj(
-                        service.get_capability_status(candidate_id)
-                    )
-                return self.sendj(service.get_release_saga(candidate_id))
-            if path == '/getRecoveryStatus':
-                return self.sendj(
-                    silent_release_service().get_recovery_status()
-                )
                        # Admin AI Evolution Dashboard
            if path in ('/admin/ai-evolution','/admin/ai-evolution/'):
                return self.ai_evolution_page()
            if path in ('/admin/ai-evolution/api/data'):
                return self.ai_evolution_data()
            return self.sendj({'error':'not_found','path':path},404)
-        except FileNotFoundError:
-            return self.sendj({'error':'release candidate not found'},404)
-        except ValueError as e:
-            error=redact(e)
-            monitor.record_failure('do_GET', error, {'path':path})
-            return self.sendj({'error':error},400)
        except Exception as e:
-            error=redact(e)
-            monitor.record_failure('do_GET', error, {'path':path})
-            return self.sendj({'error':error},500)
+            monitor.record_failure('do_GET', str(e), {'path':path})
+            return self.sendj({'error':str(e)},500)
    def do_PUT(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if reject_non_read_http(self, 'PUT', path): return
-        data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
        if path == '/api/model-priority': return self.model_priority(data)
        return self.sendj({'error':'not_found','path':path},404)
    def do_POST(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if reject_non_read_http(self, 'POST', path): return
-        data=self.body()
+        path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
        try:
-            if path == '/createReleaseCandidate':
-                a=self.need('release:candidate')
-                if not a: return
-                return self.sendj(
-                    silent_release_service().create_release_candidate(data)
-                )
-            if path == '/createReleaseIntent':
-                a=self.need('release:candidate')
-                if not a: return
-                return self.sendj(
-                    silent_release_service().create_release_intent(data)
-                )
-            if path in ('/submitOwnerApproval','/submitSignedApproval'):
-                a=self.need('release:approve')
-                if not a: return
-                return self.sendj(
-                    silent_release_service().submit_owner_approval(data)
-                )
-            if path == '/startDeployment':
-                a=self.need('release:deploy')
-                if not a: return
-                return self.sendj(
-                    silent_release_service().start_deployment(
-                        str(data.get('candidate_id') or '')
-                    )
-                )
            if path in ('/api/branch','/api/create-branch'): return self.branch(data)
            if path in ('/api/file','/api/commit-file'): return self.file(data)
            if path == '/api/commit': return self.commit(data)
@@ -690,30 +226,9 @@ class H(BaseHTTPRequestHandler):
            if path == '/api/model-priority': return self.model_priority(data)
            if path == '/api/nl': return self.nl(data)
            return self.sendj({'error':'not_found','path':path},404)
-        except (ValueError, FileNotFoundError) as e:
-            error=redact(e)
-            monitor.record_failure('do_POST', error, {'path':path})
-            return self.sendj({'error':error},400)
-        except CapabilityAuthorizationError as e:
-            error=redact(e)
-            monitor.record_failure('do_POST', error, {'path':path})
-            return self.sendj({'error':error},403)
-        except SagaConflict as e:
-            error=redact(e)
-            monitor.record_failure('do_POST', error, {'path':path})
-            return self.sendj({'error':error},409)
        except Exception as e:
-            error=redact(e)
-            monitor.record_failure('do_POST', error, {'path':path})
-            return self.sendj({'error':error},500)
-    def do_PATCH(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if reject_non_read_http(self, 'PATCH', path): return
-        return self.sendj({'error':'not_found','path':path},404)
-    def do_DELETE(self):
-        path=urllib.parse.urlparse(self.path).path.rstrip('/')
-        if reject_non_read_http(self, 'DELETE', path): return
-        return self.sendj({'error':'not_found','path':path},404)
+            monitor.record_failure('do_POST', str(e), {'path':path})
+            return self.sendj({'error':str(e)},500)
    def branch(self,data):
        a=self.need('branch:create');
        if not a: return
@@ -722,44 +237,7 @@ class H(BaseHTTPRequestHandler):
    def file(self,data):
        a=self.need('file:write');
        if not a: return
-        if os.getenv('AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED', os.getenv('AIOS_GITOPS_JOB_CONTROLLER_ENABLED', 'false')).lower() not in {'1','true','yes','on'}:
-            return self.sendj({'error':'DURABLE_JOB_CONTROLLER_UNAVAILABLE','retryable':True},503)
-        try:
-            path = relpath(str(data.get('path') or ''))
-            branch = str(data.get('branch') or '')
-            expected = str(data.get('expected_branch_oid') or '')
-            campaign_id = str(data.get('campaign_id') or os.getenv('AIOS_GITOPS_CAMPAIGN_ID') or '')
-            supplied_digest = str(data.get('payload_digest') or '')
-            content = data.get('content')
-            payload_bytes = None
-            if content is not None:
-                payload_bytes = content.encode('utf-8') if isinstance(content, str) else json.dumps(content, sort_keys=True, ensure_ascii=False).encode('utf-8')
-            payload_digest = supplied_digest or hashlib.sha256(payload_bytes or b'').hexdigest()
-            if not campaign_id or not branch or not expected:
-                return self.sendj({'error':'JOB_BINDING_REQUIRED','retryable':False},409)
-            request = {
-                'campaign_id': campaign_id,
-                'repository': REPOSITORY_IDENTITY or 'aios/aios',
-                'operation': 'commit-file',
-                'branch': branch,
-                'expected_branch_oid': expected,
-                'payload_digest': payload_digest,
-                # The controller persists only the binding and digest. Raw
-                # content is never copied into durable state or logs.
-            }
-            receipt = GitOpsJobController(
-                JobStore(Path(os.getenv('AIOS_GITOPS_JOB_ROOT', '/var/lib/aios-gitops/jobs')))
-            ).submit(request, payload=payload_bytes)
-            return self.sendj({
-                'job_id': receipt.job_id,
-                'state': receipt.state.value,
-                'side_effect_state': receipt.side_effect_state,
-                'retryable': receipt.http_status == 503,
-            }, receipt.http_status)
-        except ServiceUnavailable as exc:
-            return self.sendj({'error':str(exc),'layer':'durable_job','retryable':True,'side_effect_state':'UNKNOWN'},503)
-        except JobError as exc:
-            return self.sendj({'error':str(exc),'retryable':False},409)
+        b=checkout(data.get('branch'), data.get('base','main'), bool(data.get('create_branch'))); r=write_file(data.get('path'), data.get('content','')); c=commit([r], data.get('message') or f'chore(chatgpt): update {r}'); audit(a['account'],'file',r,{'branch':b,'commit':c}); self.sendj({'status':'committed','branch':b,'path':r,'commit':c})
    def commit(self,data):
        a=self.need('commit:create');
        if not a: return
@@ -774,41 +252,12 @@ class H(BaseHTTPRequestHandler):
        if not a: return
        ver=data.get('version') or data.get('tag')
        if not re.match(r'^V\d+R\d+C\d+(-[A-Za-z0-9_.-]+)?$', ver or ''): return self.sendj({'error':'version must match VxRxCx'},400)
-        if not data.get('target_oid') or not data.get('evidence_closure_oid') or not data.get('approval_plan_id'):
-            return self.sendj({
-                'error':'production_tag_evidence_required',
-                'required':['version','target_oid','evidence_closure_oid','approval_plan_id'],
-            },400)
-        try:
-            target_oid=resolve_commit_oid(data.get('target_oid'))
-            evidence_oid=resolve_commit_oid(data.get('evidence_closure_oid'), 'evidence_closure_oid')
-        except ValueError as exc:
-            return self.sendj({'error':'invalid_tag_target','detail':str(exc)},400)
+        if data.get('confirm') != True:
+            self.sendj({'status':'confirm_required','operation':'tag','hint':'This operation creates a Git tag. Confirm to proceed.','x-openai-isConsequential':True}, 428)
+            return
        if a['role'] != 'owner' or not data.get('execute'):
-            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'request':req,'commit':c})
-        request=PublicationRequest(ver,target_oid,evidence_oid,str(data.get('approval_plan_id')))
-        main_before=sh(['rev-parse','refs/heads/main'], True)['stdout']
-        publisher=publication_publisher()
-        try:
-            publication=publisher.publish(request)
-        except PublicationManualOwnerReviewRequired as exc:
-            audit(a['account'],'tag_manual_owner_review_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':redact(exc)})
-            return self.sendj({'status':'MANUAL_OWNER_REVIEW_REQUIRED','error':redact(exc),'main_changed':False,'force_push':False},409)
-        except PublicationConflict as exc:
-            audit(a['account'],'tag_conflict',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
-            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},409)
-        except PublicationPending as exc:
-            audit(a['account'],'tag_pending',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
-            return self.sendj({'status':'REMOTE_PUSH_PENDING','error':str(exc),'main_changed':False,'force_push':False},503)
-        except PublicationReconciliationRequired as exc:
-            audit(a['account'],'tag_reconciliation_required',ver,{'target_oid':target_oid,'approval_plan_id':data.get('approval_plan_id'),'error':str(exc)})
-            return self.sendj({'status':'RECONCILIATION_REQUIRED','error':str(exc),'main_changed':False,'force_push':False},502)
-        main_after=sh(['rev-parse','refs/heads/main'], True)['stdout']
-        if main_after != main_before:
-            raise RuntimeError('main changed during tag operation')
-        result={'status':publication['state'],'version':ver,'tag_name':ver,'tag_oid':publication['tag_oid'],'target_oid':target_oid,'expected_target_oid':target_oid,'evidence_closure_oid':evidence_oid,'approval_plan_id':data.get('approval_plan_id'),'workspace_head':sh(['rev-parse','HEAD'],True)['stdout'],'main_oid_before':main_before,'main_oid_after':main_after,'main_changed':False,'force_push':False,'publication':publication}
-        audit(a['account'],'tag',ver,result)
-        self.sendj(result)
+            b=checkout(data.get('branch') or f'request/tag-{safe(ver)}', 'main', True); req={'version':ver,'requested_by':a['account'],'approval_required':True,'created_at':now()}; r=write_json(f'baseline/tag_requests/{safe(ver)}.json', req); c=commit([r], f'chore(chatgpt): request tag {ver}'); return self.sendj({'status':'approval_required','branch':b,'commit':c})
+        out=sh(['tag','-a',ver,'-m',data.get('message') or f'release {ver}'], True); self.sendj({'status':'tagged','version':ver,'git':out,'sync':sync_tag(ver)})
    def rollback(self,data):
        a=self.need('rollback:request');
        if not a: return
@@ -903,10 +352,7 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer
        cmd_filter=(params.get('command') or [None])[0]
        bl=jload(WS/'baseline'/'current.json',{})
        current_ver=bl.get('current_baseline','V1R3C1')
-        try:
-            tags=[item['name'] for item in authoritative_tags(git_dir=required_authoritative_git_dir()) if str(item['name']).startswith('V')]
-        except (AuthoritativeGitError, RuntimeError) as exc:
-            return self.sendj({'error':redact(exc),'repository_available':False},503)
+        tags=sh(['tag','--list','V*'])['stdout'].splitlines() if WS.exists() else []
        versions=[]
        if (WS/'baseline'/'promotions').exists():
            for p in sorted((WS/'baseline'/'promotions').glob('*.json')):
@@ -944,10 +390,9 @@ return{vs,cmds,ar,cmd,cdet,tot,sok,sfail,runs,baseline,refreshMsg,loadCmd,selVer


 def api_spec():
-    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /getReleaseCandidate','GET /getApprovalEnvelope','GET /getReleaseSaga','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl','POST /createReleaseCandidate','POST /submitOwnerApproval','POST /startDeployment'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True,'silent_release_execution_enabled':SILENT_RELEASE_EXECUTION_ENABLED,'silent_release_shadow_default':True}}
+    return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True}}

 def main():
    print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
    ThreadingHTTPServer((HOST,PORT), H).serve_forever()
 if __name__ == '__main__': main()
-
@@ -1,224 +0,0 @@
-"""ChatGPT GitOps Bridge v2 contract and governed release operations."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import hashlib
-from pathlib import Path
-from typing import Any, Callable, Mapping
-
-
-BRIDGE_SCHEMA_VERSION = "aios.chatgpt-gitops-bridge.v2"
-BRIDGE_OPERATIONS = (
-    "getRuntimeStatus",
-    "getGovernedWriteCapabilities",
-    "createGovernedTask",
-    "acquireWriterLease",
-    "bootstrapWriterLease",
-    "renewWriterLease",
-    "commitFileGoverned",
-    "commitFilesGoverned",
-    "getGitOpsJob",
-    "resumeGitOpsJob",
-    "reconcileGitOpsJob",
-    "createTagApprovalRequest",
-    "requestOrCreateTag",
-    "getTagPublicationStatus",
-    "buildProductionArtifact",
-    "executeApprovedProductionRelease",
-    "getReleaseConsistency",
-    "runReleaseAcceptance",
-    "getControlPlaneSnapshot",
-)
-
-OPERATION_REQUIRED_FIELDS = {
-    "createGovernedTask": ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key"),
-    "acquireWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
-    "bootstrapWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
-    "renewWriterLease": ("schema", "task_id", "repository", "branch_mode", "base_oid", "expected_branch_oid", "target_branch", "generation", "lease_seconds"),
-    "commitFileGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "path", "content_base64", "message"),
-    "commitFilesGoverned": ("task_id", "repository", "expected_branch_oid", "target_branch", "generation", "idempotency_key", "files", "message"),
-    "getGitOpsJob": ("job_id",),
-    "resumeGitOpsJob": ("job_id", "expected_revision"),
-    "reconcileGitOpsJob": ("job_id", "expected_revision"),
-    "createTagApprovalRequest": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "owner_approval", "execute"),
-    "requestOrCreateTag": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
-    "getTagPublicationStatus": ("version",),
-    "buildProductionArtifact": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "executeApprovedProductionRelease": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id", "execute"),
-    "getReleaseConsistency": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "runReleaseAcceptance": ("version", "target_oid", "evidence_closure_oid", "approval_plan_id"),
-    "getControlPlaneSnapshot": (),
-}
-
-BRIDGE_OPERATION_CONTRACTS = {
-    "acquireWriterLease": {
-        "method": "POST",
-        "path": "/v2/writer-lease",
-        "required_fields": OPERATION_REQUIRED_FIELDS["acquireWriterLease"],
-        "response_fields": (
-            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
-            "create_target_branch", "worktree_mode", "cas_ref_update_required",
-        ),
-    },
-    "bootstrapWriterLease": {
-        "method": "POST",
-        "path": "/v2/writer-lease/bootstrap",
-        "required_fields": OPERATION_REQUIRED_FIELDS["bootstrapWriterLease"],
-        "response_fields": (
-            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
-            "create_target_branch", "worktree_mode", "cas_ref_update_required",
-            "recovered", "bootstrapped", "runtime_rehydrated",
-            "durable_branch_lease_present", "idempotent",
-        ),
-    },
-    "renewWriterLease": {
-        "method": "POST",
-        "path": "/v2/writer-lease/renew",
-        "required_fields": OPERATION_REQUIRED_FIELDS["renewWriterLease"],
-        "response_fields": (
-            "task_id", "job_id", "generation", "lease_seconds", "lease_expires_at",
-            "recovered", "bootstrapped", "runtime_rehydrated",
-            "durable_branch_lease_present", "idempotent",
-        ),
-    },
-    "commitFileGoverned": {
-        "method": "POST", "path": "/v2/commit-file",
-        "required_fields": OPERATION_REQUIRED_FIELDS["commitFileGoverned"],
-        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
-    },
-    "commitFilesGoverned": {
-        "method": "POST", "path": "/v2/commit-files",
-        "required_fields": OPERATION_REQUIRED_FIELDS["commitFilesGoverned"],
-        "response_fields": ("job_id", "commit_oid", "commit_visible", "branch_mode", "target_branch", "generation"),
-    },
-}
-
-
-class RuntimeDriftError(RuntimeError):
-    pass
-
-
-class BridgeV2Error(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class ControlPlaneReleaseManifest:
-    control_plane_release_version: str
-    control_plane_target_oid: str
-    artifact_sha256: str
-    runtime_path: Path
-    bridge_schema_version: str
-    repository_identity: str
-    authoritative_git_dir: Path
-    deployment_state: str
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "control_plane_release_version": self.control_plane_release_version,
-            "control_plane_target_oid": self.control_plane_target_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "runtime_path": str(self.runtime_path),
-            "bridge_schema_version": self.bridge_schema_version,
-            "repository_identity": self.repository_identity,
-            "authoritative_git_dir": str(self.authoritative_git_dir),
-            "deployment_state": self.deployment_state,
-        }
-
-    def validate(self, artifact: Path, *, observed_oid: str, approved_root: Path = Path("/opt/aios/gitops-control-plane")) -> dict[str, object]:
-        try:
-            runtime = self.runtime_path.resolve(strict=True)
-            root = approved_root.resolve(strict=True)
-            artifact_path = artifact.resolve(strict=True)
-            runtime.relative_to(root)
-            artifact_path.relative_to(runtime)
-        except (OSError, ValueError):
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT") from None
-        mutable_markers = {"workspace", "workspaces", "worktree", "worktrees"}
-        if mutable_markers.intersection(part.lower() for part in runtime.parts):
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
-        valid = (
-            len(self.control_plane_target_oid) == 40
-            and observed_oid == self.control_plane_target_oid
-            and len(self.artifact_sha256) == 64
-            and hashlib.sha256(artifact_path.read_bytes()).hexdigest() == self.artifact_sha256
-            and self.bridge_schema_version == BRIDGE_SCHEMA_VERSION
-            and self.repository_identity == "aios/aios"
-            and self.authoritative_git_dir == Path("/data/aios-gitops/repo.git")
-            and self.authoritative_git_dir.is_absolute()
-            and self.deployment_state == "STAGING"
-        )
-        if not valid:
-            raise RuntimeDriftError("CONTROL_PLANE_RUNTIME_DRIFT")
-        return {**self.as_dict(), "drift_status": "PASS"}
-
-
-class BridgeV2Adapter:
-    """Thin operation adapter; all mutating handlers are injected seams."""
-
-    def __init__(self, *, runtime_status: Mapping[str, Any], handlers: Mapping[str, Callable[[Mapping[str, Any]], Any]] | None = None) -> None:
-        self.runtime_status = dict(runtime_status)
-        self.handlers = dict(handlers or {})
-
-    def getRuntimeStatus(self) -> dict[str, Any]:
-        return {"bridge_schema_version": BRIDGE_SCHEMA_VERSION, **self.runtime_status}
-
-    def getGovernedWriteCapabilities(self) -> dict[str, Any]:
-        return {
-            "bridge_schema_version": BRIDGE_SCHEMA_VERSION,
-            "legacy_writes_enabled": False,
-            "governed_writes_enabled": True,
-            "operations": list(BRIDGE_OPERATIONS),
-            "operation_contracts": {
-                operation: {
-                    **contract,
-                    "required_fields": list(contract["required_fields"]),
-                    "response_fields": list(contract["response_fields"]),
-                }
-                for operation, contract in BRIDGE_OPERATION_CONTRACTS.items()
-            },
-            "force_push": False,
-            "main_write": False,
-            "tag_write": False,
-            "baseline_write": False,
-            "production_write": False,
-            "approved_release_operations": True,
-            "approved_release_scope": {
-                "version": "V2R2C1",
-                "target_oid": "998d30304787e31e5ae607c0bd86b5edb2b0e5ad",
-                "evidence_closure_oid": "a8b906d1bc24088c19647e98de6a679268f6d0a2",
-                "approval_plan_id": "sha256:c0df52008ae7f64cec5ee2d28947aa7b892066c670ab8295e4549140b1a7500e",
-            },
-        }
-
-    @staticmethod
-    def legacy_write_disabled() -> dict[str, object]:
-        return {"error": "LEGACY_WRITE_DISABLED", "replacement": "createGovernedTask", "governed_writes_available": True}
-
-    def _call(self, operation: str, request: Mapping[str, Any]) -> Any:
-        required = OPERATION_REQUIRED_FIELDS[operation]
-        if any(key not in request for key in required):
-            raise BridgeV2Error("BRIDGE_REQUEST_FIELDS_MISSING")
-        handler = self.handlers.get(operation)
-        if handler is None:
-            raise BridgeV2Error("GOVERNED_HANDLER_UNAVAILABLE")
-        return handler(dict(request))
-
-    def createGovernedTask(self, request: Mapping[str, Any]) -> Any: return self._call("createGovernedTask", request)
-    def acquireWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("acquireWriterLease", request)
-    def bootstrapWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("bootstrapWriterLease", request)
-    def renewWriterLease(self, request: Mapping[str, Any]) -> Any: return self._call("renewWriterLease", request)
-    def commitFileGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFileGoverned", request)
-    def commitFilesGoverned(self, request: Mapping[str, Any]) -> Any: return self._call("commitFilesGoverned", request)
-    def getGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("getGitOpsJob", request)
-    def resumeGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("resumeGitOpsJob", request)
-    def reconcileGitOpsJob(self, request: Mapping[str, Any]) -> Any: return self._call("reconcileGitOpsJob", request)
-    def createTagApprovalRequest(self, request: Mapping[str, Any]) -> Any: return self._call("createTagApprovalRequest", request)
-    def requestOrCreateTag(self, request: Mapping[str, Any]) -> Any: return self._call("requestOrCreateTag", request)
-    def getTagPublicationStatus(self, request: Mapping[str, Any]) -> Any: return self._call("getTagPublicationStatus", request)
-    def buildProductionArtifact(self, request: Mapping[str, Any]) -> Any: return self._call("buildProductionArtifact", request)
-    def executeApprovedProductionRelease(self, request: Mapping[str, Any]) -> Any: return self._call("executeApprovedProductionRelease", request)
-    def getReleaseConsistency(self, request: Mapping[str, Any]) -> Any: return self._call("getReleaseConsistency", request)
-    def runReleaseAcceptance(self, request: Mapping[str, Any]) -> Any: return self._call("runReleaseAcceptance", request)
-
-    def getControlPlaneSnapshot(self, request: Mapping[str, Any] | None = None) -> Any: return self._call("getControlPlaneSnapshot", request or {})
@@ -1,692 +0,0 @@
-"""Governed continuation executor for exact existing task branches.
-
-The executor composes the existing continuation lease and durable Job store.
-All Git and Gitea side effects live behind injected narrow interfaces so the
-state machine can prove Authority, Git-network, API-branch, and commit-object
-agreement before it reports completion.
-"""
-
-from __future__ import annotations
-
-import base64
-from dataclasses import asdict, dataclass
-from datetime import datetime, timezone
-import hashlib
-import json
-import os
-from pathlib import Path, PurePosixPath
-import re
-import subprocess
-from typing import Callable, Mapping, Protocol
-from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlsplit
-from urllib.request import Request, urlopen
-
-from aios_authority_git_executor import AuthorityGitExecutor
-from aios_continuation_lease import WriterLeaseRequestV2
-from aios_gitops_job_controller import GitOpsJobController, JobState
-from aios_gitops_reconciliation_core import ReconciliationAction, RemoteObservation, decide_reconciliation
-from authorized_task_writer_provisioning import validate_writer_lease_request_v2
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SECRET_PATTERNS = (
-    re.compile(rb"gh[pousr]_[A-Za-z0-9]{20,}"),
-    re.compile(rb"(?i)(?:token|password|secret|api[_-]?key)\s*[:=]\s*[\"'][^\"'\s]{12,}[\"']"),
-    re.compile(rb"-----BEGIN " + rb"(?:RSA |EC |OPENSSH )?PRIVATE KEY-----"),
-)
-
-
-class ContinuationExecutionError(RuntimeError):
-    """Stable fail-closed continuation execution error."""
-
-
-class DetachedWorkspace(Protocol):
-    def is_detached(self) -> bool: ...
-    def head_oid(self) -> str: ...
-    def commit_files(self, files: Mapping[str, bytes], message: str) -> str: ...
-
-
-class AuthorityPort(Protocol):
-    def branch_exists(self, branch: str) -> bool: ...
-    def branch_head(self, branch: str) -> str: ...
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str: ...
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
-
-
-class RemotePort(Protocol):
-    def repository_identity(self) -> str: ...
-    def push_new_exact(self, branch: str, new: str) -> None: ...
-    def push_exact(self, branch: str, expected: str, new: str) -> None: ...
-    def read_git_ref(self, branch: str) -> str | None: ...
-    def read_api_branch(self, branch: str) -> str | None: ...
-    def commit_visible(self, oid: str) -> bool: ...
-
-
-class CredentialProjection(Protocol):
-    def project(self) -> None: ...
-    def revoke(self) -> None: ...
-
-
-def _run(argv: list[str], *, cwd: Path | None = None, environment: Mapping[str, str] | None = None) -> str:
-    result = subprocess.run(
-        argv,
-        cwd=cwd,
-        env=None if environment is None else dict(environment),
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise ContinuationExecutionError("SUBPROCESS_FAILED")
-    return result.stdout.strip()
-
-
-@dataclass(slots=True)
-class AuthorityGitAdapter:
-    """Branch-name adapter over the existing narrow AuthorityGitExecutor."""
-
-    executor: AuthorityGitExecutor
-
-    @staticmethod
-    def _ref(branch: str) -> str:
-        return f"refs/heads/{branch}"
-
-    def branch_exists(self, branch: str) -> bool:
-        return self.executor.read_ref(self._ref(branch)) is not None
-
-    def branch_head(self, branch: str) -> str:
-        value = self.executor.read_ref(self._ref(branch))
-        if value is None:
-            raise ContinuationExecutionError("EXISTING_BRANCH_MISSING")
-        return value
-
-    def is_ancestor(self, older: str, newer: str) -> bool:
-        return self.executor.ancestry_check(older, newer)
-
-    def create_task_branch_cas(self, branch: str, expected_base: str, new: str) -> str:
-        return self.executor.create_task_branch_CAS(self._ref(branch), expected_base, new)
-
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str:
-        return self.executor.advance_task_branch_CAS(self._ref(branch), expected, new)
-
-
-@dataclass(slots=True)
-class DetachedGitWorkspace:
-    path: Path
-
-    def __post_init__(self) -> None:
-        if not self.path.is_absolute() or self.path.is_symlink() or not self.path.is_dir():
-            raise ContinuationExecutionError("WORKTREE_PATH_INVALID")
-        top = Path(_run(["git", "rev-parse", "--show-toplevel"], cwd=self.path)).resolve()
-        if top != self.path.resolve():
-            raise ContinuationExecutionError("WORKTREE_PATH_INVALID")
-
-    def is_detached(self) -> bool:
-        result = subprocess.run(
-            ["git", "symbolic-ref", "-q", "HEAD"],
-            cwd=self.path,
-            capture_output=True,
-            check=False,
-        )
-        return result.returncode == 1
-
-    def head_oid(self) -> str:
-        return _run(["git", "rev-parse", "HEAD"], cwd=self.path)
-
-    def _dirty_paths(self) -> set[str]:
-        command = subprocess.run(
-            ["git", "status", "--porcelain=v1", "--untracked-files=all"],
-            cwd=self.path,
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if command.returncode != 0:
-            raise ContinuationExecutionError("SUBPROCESS_FAILED")
-        output = command.stdout
-        result: set[str] = set()
-        for line in output.splitlines():
-            path = line[3:]
-            if " -> " in path:
-                path = path.split(" -> ", 1)[1]
-            result.add(path)
-        return result
-
-    def materialize_files(self, files: Mapping[str, bytes]) -> None:
-        dirty = self._dirty_paths()
-        expected_paths = set(files)
-        if dirty and dirty != expected_paths:
-            raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
-        for relative, content in files.items():
-            target = (self.path / relative).resolve()
-            try:
-                target.relative_to(self.path.resolve())
-            except ValueError as exc:
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED") from exc
-            if target.is_symlink():
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED")
-            target.parent.mkdir(parents=True, exist_ok=True)
-            target.write_bytes(content)
-
-    def commit_files(self, files: Mapping[str, bytes], message: str) -> str:
-        expected_paths = set(files)
-        if self._dirty_paths() != expected_paths:
-            raise ContinuationExecutionError("WORKTREE_DIRTY_SCOPE_MISMATCH")
-        for relative, content in files.items():
-            target = (self.path / relative).resolve()
-            try:
-                target.relative_to(self.path.resolve())
-            except ValueError as exc:
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED") from exc
-            if not target.is_file() or target.is_symlink() or target.read_bytes() != content:
-                raise ContinuationExecutionError("AUTHORING_PAYLOAD_MISMATCH")
-        _run(["git", "add", "--", *sorted(expected_paths)], cwd=self.path)
-        staged = set(_run(["git", "diff", "--cached", "--name-only"], cwd=self.path).splitlines())
-        if staged != expected_paths:
-            raise ContinuationExecutionError("STAGED_SCOPE_MISMATCH")
-        environment = os.environ.copy()
-        environment.update(
-            {
-                "GIT_AUTHOR_NAME": "AIOS Governed Continuation",
-                "GIT_AUTHOR_EMAIL": "aios-governed-continuation@localhost",
-                "GIT_COMMITTER_NAME": "AIOS Governed Continuation",
-                "GIT_COMMITTER_EMAIL": "aios-governed-continuation@localhost",
-            }
-        )
-        _run(["git", "commit", "--no-gpg-sign", "-m", message, "--", *sorted(expected_paths)], cwd=self.path, environment=environment)
-        if not self.is_detached():
-            raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
-        return self.head_oid()
-
-
-@dataclass(slots=True)
-class ServerSideCredentialProjection:
-    ssh_key_path: Path
-    api_token_path: Path
-    active: bool = False
-
-    def project(self) -> None:
-        for path in (self.ssh_key_path, self.api_token_path):
-            if path.is_symlink() or not path.is_file() or path.stat().st_size < 32:
-                raise ContinuationExecutionError("CREDENTIAL_PROJECTION_MISSING")
-        self.active = True
-
-    def revoke(self) -> None:
-        self.active = False
-
-
-@dataclass(slots=True)
-class GiteaContinuationRemote:
-    workspace: Path
-    credential: ServerSideCredentialProjection
-    remote_name: str = "gitea"
-    repository: str = "aios/aios"
-    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
-    expected_host: str = "g.cnnetmkt.top"
-
-    @staticmethod
-    def validate_remote_url(value: str, expected_host: str = "g.cnnetmkt.top") -> None:
-        if value.startswith(("/", "file:")) or value.endswith("/data/aios-gitops/repo.git"):
-            raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-        if "://" in value:
-            parsed = urlsplit(value)
-            host, path = parsed.hostname, parsed.path
-        else:
-            location = value.split("@", 1)[-1]
-            host, separator, path = location.partition(":")
-            if not separator:
-                raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-            path = "/" + path
-        if host != expected_host or path.rstrip("/") not in {"/aios/aios.git", "/git/aios/aios.git"}:
-            raise ContinuationExecutionError("GITEA_REMOTE_IDENTITY_INVALID")
-
-    def repository_identity(self) -> str:
-        url = _run(["git", "remote", "get-url", self.remote_name], cwd=self.workspace)
-        self.validate_remote_url(url, self.expected_host)
-        if self.repository != "aios/aios":
-            raise ContinuationExecutionError("REMOTE_REPOSITORY_IDENTITY_MISMATCH")
-        return self.repository
-
-    def _require_projected(self) -> None:
-        if not self.credential.active:
-            raise ContinuationExecutionError("CREDENTIAL_PROJECTION_MISSING")
-
-    def read_git_ref(self, branch: str) -> str | None:
-        self._require_projected()
-        output = _run(["git", "ls-remote", self.remote_name, f"refs/heads/{branch}"], cwd=self.workspace)
-        if not output:
-            return None
-        oid, ref = output.split(maxsplit=1)
-        if ref != f"refs/heads/{branch}" or not OID_RE.fullmatch(oid):
-            raise ContinuationExecutionError("GITEA_GIT_READBACK_INVALID")
-        return oid
-
-    def push_new_exact(self, branch: str, new: str) -> None:
-        self._require_projected()
-        self.repository_identity()
-        if self.read_git_ref(branch) is not None:
-            raise ContinuationExecutionError("GITEA_TARGET_BRANCH_ALREADY_EXISTS")
-        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
-        if self.read_git_ref(branch) != new:
-            raise ContinuationExecutionError("GITEA_CREATE_READBACK_MISMATCH")
-
-    def push_exact(self, branch: str, expected: str, new: str) -> None:
-        self._require_projected()
-        self.repository_identity()
-        if self.read_git_ref(branch) != expected:
-            raise ContinuationExecutionError("GITEA_BRANCH_EXPECTATION_MISMATCH")
-        _run(["git", "push", self.remote_name, f"{new}:refs/heads/{branch}"], cwd=self.workspace)
-
-    def _api(self, path: str) -> object:
-        self._require_projected()
-        token = self.credential.api_token_path.read_text(encoding="utf-8").strip()
-        request = Request(
-            self.api_base.rstrip("/") + path,
-            headers={"Accept": "application/json", "Authorization": f"token {token}"},
-        )
-        try:
-            with urlopen(request, timeout=20) as response:
-                return json.loads(response.read().decode("utf-8"))
-        except HTTPError as exc:
-            if exc.code == 404:
-                return None
-            raise ContinuationExecutionError(f"GITEA_API_HTTP_{exc.code}") from exc
-        except (URLError, TimeoutError, OSError, json.JSONDecodeError) as exc:
-            raise ContinuationExecutionError("GITEA_API_UNAVAILABLE") from exc
-
-    def read_api_branch(self, branch: str) -> str | None:
-        owner, name = self.repository.split("/", 1)
-        page = 1
-        while page <= 100:
-            value = self._api(f"/repos/{quote(owner)}/{quote(name)}/branches?page={page}&limit=50")
-            if value is None:
-                return None
-            if not isinstance(value, list):
-                raise ContinuationExecutionError("GITEA_API_BRANCH_COLLECTION_INVALID")
-            for item in value:
-                if not isinstance(item, dict) or item.get("name") != branch:
-                    continue
-                oid = item.get("commit", {}).get("id")
-                if not isinstance(oid, str) or not OID_RE.fullmatch(oid):
-                    raise ContinuationExecutionError("GITEA_API_BRANCH_INVALID")
-                return oid
-            if len(value) < 50:
-                return None
-            page += 1
-        raise ContinuationExecutionError("GITEA_API_BRANCH_PAGINATION_LIMIT")
-
-    def commit_visible(self, oid: str) -> bool:
-        owner, name = self.repository.split("/", 1)
-        value = self._api(f"/repos/{quote(owner)}/{quote(name)}/git/commits/{oid}")
-        if not isinstance(value, dict):
-            return False
-        observed = value.get("sha") or value.get("id")
-        return observed == oid
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationPermissions:
-    create_target_branch: bool = False
-    force_push: bool = False
-    tag_write: bool = False
-    baseline_write: bool = False
-    production_write: bool = False
-    main_write: bool = False
-
-    def validate(self) -> None:
-        if any(asdict(self).values()):
-            raise ContinuationExecutionError("MUTATION_PERMISSION_DENIED")
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationRuntimeBinding:
-    request: WriterLeaseRequestV2
-    job_id: str
-    workspace_path: Path
-    lease_not_before: datetime
-    lease_expires_at: datetime
-    original_receipt_valid: bool
-    original_grant_consumed: bool
-    permissions: ContinuationPermissions
-
-
-@dataclass(frozen=True, slots=True)
-class ContinuationCommit:
-    idempotency_key: str
-    files: Mapping[str, bytes]
-    message: str
-
-    def payload(self) -> bytes:
-        if not self.idempotency_key or not self.message.strip() or not self.files:
-            raise ContinuationExecutionError("COMMIT_REQUEST_INVALID")
-        normalized: dict[str, str] = {}
-        for path, content in self.files.items():
-            pure = PurePosixPath(path)
-            if (
-                not isinstance(path, str)
-                or pure.is_absolute()
-                or ".." in pure.parts
-                or path.startswith((".git/", "baseline/", "production/"))
-                or not isinstance(content, bytes)
-            ):
-                raise ContinuationExecutionError("COMMIT_PATH_REJECTED")
-            if any(pattern.search(content) for pattern in SECRET_PATTERNS):
-                raise ContinuationExecutionError("SECRET_LIKE_PAYLOAD_REJECTED")
-            normalized[path] = base64.b64encode(content).decode("ascii")
-        return json.dumps(
-            {"files_base64": normalized, "message": self.message},
-            sort_keys=True,
-            separators=(",", ":"),
-        ).encode("utf-8")
-
-
-class ContinuationExecutor:
-    def __init__(
-        self,
-        controller: GitOpsJobController,
-        authority: AuthorityPort,
-        workspace: DetachedWorkspace,
-        remote: RemotePort,
-        credential: CredentialProjection,
-        *,
-        now: Callable[[], datetime] = lambda: datetime.now(timezone.utc),
-    ) -> None:
-        self.controller = controller
-        self.authority = authority
-        self.workspace = workspace
-        self.remote = remote
-        self.credential = credential
-        self.now = now
-        self._observed_generations: dict[str, int] = {}
-
-    def observe_generation(self, branch: str, generation: int) -> None:
-        self._observed_generations[branch] = max(generation, self._observed_generations.get(branch, 0))
-
-    def _max_generation(self, branch: str, *, exclude_job_id: str | None = None) -> int:
-        observed = self._observed_generations.get(branch, 0)
-        with self.controller.store._connect() as connection:
-            if exclude_job_id is None:
-                row = connection.execute(
-                    "SELECT MAX(generation) AS generation FROM branch_leases WHERE branch=?",
-                    (branch,),
-                ).fetchone()
-            else:
-                row = connection.execute(
-                    "SELECT MAX(generation) AS generation FROM branch_leases "
-                    "WHERE branch=? AND job_id!=?",
-                    (branch, exclude_job_id),
-                ).fetchone()
-        durable = int(row["generation"] or 0)
-        return max(observed, durable)
-
-    @staticmethod
-    def _request_mapping(request: WriterLeaseRequestV2) -> dict[str, object]:
-        return {
-            "schema": WriterLeaseRequestV2.schema,
-            "task_id": request.task_id,
-            "job_id": request.job_id,
-            "repository": request.repository,
-            "branch_mode": request.branch_mode,
-            "base_oid": request.base_oid,
-            "expected_branch_oid": request.expected_branch_oid,
-            "target_branch": request.target_branch,
-            "generation": request.generation,
-            "lease_seconds": request.lease_seconds,
-        }
-
-    def _validate_preflight(self, binding: ContinuationRuntimeBinding, *, job_id: str | None = None) -> None:
-        request = binding.request
-        request_mapping = self._request_mapping(request)
-        normalized = validate_writer_lease_request_v2(request_mapping, self.authority)
-        expected_normalized = {
-            **request_mapping,
-            "create_target_branch": request.branch_mode == "CREATE_NEW",
-            "worktree_mode": (
-                "detached_at_base_oid"
-                if request.branch_mode == "CREATE_NEW"
-                else "detached_at_expected_head"
-            ),
-            "cas_ref_update_required": True,
-        }
-        if normalized != expected_normalized:
-            raise ContinuationExecutionError("CONTINUATION_NORMALIZATION_INVALID")
-        if not binding.original_receipt_valid or not binding.original_grant_consumed:
-            raise ContinuationExecutionError("ORIGINAL_GRANT_LINEAGE_INVALID")
-        binding.permissions.validate()
-        now = self.now()
-        if now < binding.lease_not_before:
-            raise ContinuationExecutionError("LEASE_NOT_ACTIVE")
-        if now >= binding.lease_expires_at:
-            raise ContinuationExecutionError("LEASE_EXPIRED")
-        if request.generation <= self._max_generation(request.target_branch, exclude_job_id=job_id):
-            raise ContinuationExecutionError("GENERATION_NOT_MONOTONIC")
-        if not self.workspace.is_detached():
-            raise ContinuationExecutionError("WORKTREE_NOT_DETACHED")
-        if self.workspace.head_oid() != request.expected_branch_oid:
-            raise ContinuationExecutionError("WORKTREE_HEAD_MISMATCH")
-        if self.remote.repository_identity() != request.repository:
-            raise ContinuationExecutionError("REMOTE_REPOSITORY_IDENTITY_MISMATCH")
-
-    def _job_request(self, binding: ContinuationRuntimeBinding, commit: ContinuationCommit, payload: bytes) -> dict[str, object]:
-        request = binding.request
-        return {
-            "idempotency_key": commit.idempotency_key,
-            "campaign_id": request.task_id,
-            "task_id": request.task_id,
-            "repository": request.repository,
-            "operation": "CONTINUATION_COMMIT_FILES",
-            "branch": request.target_branch,
-            "expected_branch_oid": request.expected_branch_oid,
-            "base_oid": request.base_oid,
-            "branch_mode": request.branch_mode,
-            "payload_digest": hashlib.sha256(payload).hexdigest(),
-            "lineage_anchor_oid": request.base_oid,
-            "generation": request.generation,
-        }
-
-    def execute(
-        self,
-        binding: ContinuationRuntimeBinding,
-        commit: ContinuationCommit,
-        *,
-        before_complete: Callable[[str], None] | None = None,
-    ) -> dict[str, object]:
-        commit.payload()
-        if not binding.job_id or binding.request.job_id != binding.job_id:
-            raise ContinuationExecutionError("RUNTIME_LINEAGE_MISSING_JOB_ID")
-        current = self.controller.store.read(binding.job_id)
-        current_state = JobState(current["state"])
-        if current_state == JobState.COMPLETED:
-            return self.controller.store._receipt(current, duplicate=True).as_dict()
-        if current_state == JobState.REMOTE_VERIFIED:
-            receipt = json.loads(str(current["receipt_json"] or "{}"))
-            commit_oid = str(receipt.get("authority_oid") or "")
-            if not OID_RE.fullmatch(commit_oid):
-                raise ContinuationExecutionError("GOVERNED_COMMIT_OID_INVALID")
-            if before_complete is not None:
-                before_complete(commit_oid)
-            return self.controller.advance(
-                binding.job_id,
-                JobState.COMPLETED,
-                side_effect_state="REMOTE_VERIFIED",
-                receipt=receipt,
-            ).as_dict()
-        self._validate_preflight(binding, job_id=binding.job_id)
-        request = binding.request
-        projected = False
-        try:
-            self.credential.project()
-            projected = True
-            row = self.controller.store.read(binding.job_id)
-            state = JobState(row["state"])
-            if state == JobState.REQUESTED:
-                self.controller.advance(
-                    binding.job_id,
-                    JobState.AUTHORIZED,
-                    side_effect_state="AUTHORIZED",
-                    receipt={"task_id": request.task_id, "original_grant_consumed": True},
-                    expected_revision=int(row["revision"]),
-                )
-                row = self.controller.store.read(binding.job_id)
-                state = JobState(row["state"])
-            if state == JobState.AUTHORIZED:
-                self.controller.lease_job(
-                    binding.job_id,
-                    lease_id=f"lease-{binding.job_id}",
-                    lineage_anchor_oid=request.base_oid,
-                    current_head_oid=request.expected_branch_oid,
-                    generation=request.generation,
-                    lease_expires_at=binding.lease_expires_at.astimezone(timezone.utc).isoformat(),
-                    expected_revision=int(row["revision"]),
-                )
-                row = self.controller.store.read(binding.job_id)
-                state = JobState(row["state"])
-            if state == JobState.LEASED:
-                self.controller.advance(binding.job_id, JobState.WORKTREE_READY,
-                                        side_effect_state="WORKTREE_READY", expected_revision=int(row["revision"]))
-                row = self.controller.store.read(binding.job_id)
-                state = JobState(row["state"])
-            if state == JobState.WORKTREE_READY:
-                self.controller.advance(binding.job_id, JobState.EXECUTING,
-                                        side_effect_state="IN_PROGRESS", expected_revision=int(row["revision"]))
-            elif state != JobState.EXECUTING:
-                raise ContinuationExecutionError("JOB_EXECUTION_STATE_INVALID")
-            new_oid = self.workspace.commit_files(commit.files, commit.message)
-            if not OID_RE.fullmatch(new_oid) or not self.authority.is_ancestor(request.expected_branch_oid, new_oid):
-                raise ContinuationExecutionError("NON_FAST_FORWARD_COMMIT")
-            if request.branch_mode == "CREATE_NEW":
-                authority_oid = self.authority.create_task_branch_cas(request.target_branch, request.base_oid, new_oid)
-            else:
-                authority_oid = self.authority.compare_and_swap_branch(request.target_branch, request.expected_branch_oid, new_oid)
-            if authority_oid != new_oid:
-                raise ContinuationExecutionError("AUTHORITY_CAS_READBACK_MISMATCH")
-            self.controller.advance(
-                binding.job_id,
-                JobState.LOCAL_VERIFIED,
-                side_effect_state="LOCAL_VERIFIED",
-                receipt={"authority_oid": authority_oid, "force_push": False},
-            )
-            try:
-                self.controller.advance(binding.job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS")
-                if request.branch_mode == "CREATE_NEW":
-                    self.remote.push_new_exact(request.target_branch, new_oid)
-                else:
-                    self.remote.push_exact(request.target_branch, request.expected_branch_oid, new_oid)
-            except Exception:
-                return self._remote_pending(binding.job_id, authority_oid, new_oid)
-            return self._finish_remote_verification(
-                binding.job_id,
-                authority_oid,
-                new_oid,
-                before_complete=before_complete,
-            )
-        finally:
-            if projected:
-                self.credential.revoke()
-
-    def _observe_remote(self, branch: str, oid: str) -> tuple[str | None, str | None, bool]:
-        return self.remote.read_git_ref(branch), self.remote.read_api_branch(branch), self.remote.commit_visible(oid)
-
-    def _remote_pending(self, job_id: str, authority_oid: str, new_oid: str) -> dict[str, object]:
-        receipt = {
-            "authority_oid": authority_oid,
-            "desired_remote_oid": new_oid,
-            "remote_verified": False,
-            "force_push": False,
-        }
-        result = self.controller.advance(
-            job_id,
-            JobState.RECONCILIATION_REQUIRED,
-            side_effect_state="REMOTE_PUSH_PENDING",
-            receipt=receipt,
-        )
-        return result.as_dict()
-
-    def _finish_remote_verification(
-        self,
-        job_id: str,
-        authority_oid: str,
-        new_oid: str,
-        *,
-        before_complete: Callable[[str], None] | None = None,
-    ) -> dict[str, object]:
-        row = self.controller.store.read(job_id)
-        branch = row["branch"]
-        request = json.loads(row["request_json"])["binding"]
-        git_oid, api_oid, visible = self._observe_remote(branch, new_oid)
-        decision = decide_reconciliation(RemoteObservation("aios/aios", branch, new_oid, authority_oid, git_oid, api_oid, visible, datetime.now(timezone.utc).isoformat(), request.get("expected_branch_oid")))
-        if decision.action is not ReconciliationAction.MARK_REMOTE_VERIFIED:
-            return self._remote_pending(job_id, authority_oid, new_oid)
-        receipt = {
-            "authority_oid": authority_oid,
-            "git_remote_oid": git_oid,
-            "api_branch_oid": api_oid,
-            "commit_visible": True,
-            "remote_verified": True,
-            "reconciliation_decision": decision.action.value,
-            "force_push": False,
-        }
-        self.controller.advance(
-            job_id,
-            JobState.REMOTE_VERIFIED,
-            side_effect_state="REMOTE_VERIFIED",
-            receipt=receipt,
-        )
-        if before_complete is not None:
-            before_complete(new_oid)
-        return self.controller.advance(
-            job_id,
-            JobState.COMPLETED,
-            side_effect_state="REMOTE_VERIFIED",
-            receipt=receipt,
-        ).as_dict()
-
-    def reconcile(self, job_id: str) -> dict[str, object]:
-        row = self.controller.store.read(job_id)
-        state = JobState(row["state"])
-        if state == JobState.COMPLETED:
-            return self.controller.store._receipt(row, duplicate=True).as_dict()
-        if state != JobState.RECONCILIATION_REQUIRED:
-            raise ContinuationExecutionError("JOB_NOT_RECONCILABLE")
-        request = json.loads(row["request_json"])["binding"]
-        receipt = json.loads(row["receipt_json"])
-        new_oid = receipt["desired_remote_oid"]
-        authority_oid = self.authority.branch_head(row["branch"])
-        try:
-            generation = int(request.get("generation") or 0)
-        except (TypeError, ValueError) as exc:
-            raise ContinuationExecutionError("DURABLE_BINDING_GENERATION_INVALID") from exc
-        if generation > 0:
-            with self.controller.store._connect() as connection:
-                earlier = connection.execute(
-                    "SELECT 1 FROM jobs WHERE branch=? AND state=? "
-                    "AND CAST(json_extract(request_json, '$.binding.generation') AS INTEGER) < ? LIMIT 1",
-                    (row["branch"], JobState.RECONCILIATION_REQUIRED.value, generation),
-                ).fetchone()
-            if earlier is not None:
-                raise ContinuationExecutionError("EARLIER_RECONCILIATION_REQUIRED")
-        self.credential.project()
-        try:
-            git_oid, api_oid, visible = self._observe_remote(row["branch"], new_oid)
-            if authority_oid == git_oid == api_oid == new_oid and visible:
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST")
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            expected_oid = request["expected_branch_oid"]
-            if (
-                self.authority.is_ancestor(new_oid, authority_oid)
-                and git_oid is not None
-                and git_oid == api_oid
-                and self.authority.is_ancestor(git_oid, new_oid)
-            ):
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_CHAIN")
-                self.remote.push_exact(row["branch"], git_oid, new_oid)
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            if authority_oid == new_oid and git_oid == api_oid == expected_oid:
-                self.controller.advance(job_id, JobState.RECONCILING, side_effect_state="OBSERVATION_FIRST_RETRY")
-                self.remote.push_exact(row["branch"], expected_oid, new_oid)
-                return self._finish_remote_verification(job_id, new_oid, new_oid)
-            return self.controller.store._receipt(row, duplicate=True).as_dict()
-        finally:
-            self.credential.revoke()
@@ -1,157 +0,0 @@
-"""Campaign-aware continuation leases for an existing Git branch.
-
-This module is deliberately transport-neutral. It validates branch lineage
-and hands ref mutation to an injected compare-and-swap broker; it does not run
-Git, inspect credentials, or create a branch itself.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, replace
-from datetime import datetime, timedelta, timezone
-import re
-from typing import Protocol
-
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TARGET_BRANCH = "agent/autonomous-release-campaign-v1-20260807"
-LINEAGE_ANCHOR = "69b45e81dcd2c3707c367003b08c55fd361faae8"
-CAMPAIGN_HEAD = "bba675fab3b7e0c5fba7066720252b3c91b9f20d"
-
-
-class ContinuationError(RuntimeError):
-    """Stable fail-closed error for lease or branch binding violations."""
-
-
-class BranchProbe(Protocol):
-    def branch_exists(self, branch: str) -> bool: ...
-    def branch_head(self, branch: str) -> str: ...
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-
-
-class RefCAS(Protocol):
-    def compare_and_swap_branch(self, branch: str, expected: str, new: str) -> str: ...
-
-
-def _oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise ContinuationError(f"{field}_invalid")
-    return value
-
-
-@dataclass(frozen=True, slots=True)
-class WriterLeaseRequestV2:
-    task_id: str
-    repository: str
-    branch_mode: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    generation: int
-    lease_seconds: int = 900
-    job_id: str = ""
-
-    schema = "aios.task-writer-lease.v2"
-    accepted_schemas = frozenset({"aios.task-writer-lease.v2", "aios.task-writer-lease-request.v2"})
-
-    def validate(self, probe: BranchProbe) -> None:
-        if not self.task_id or self.repository != "aios/aios":
-            raise ContinuationError("request_identity_invalid")
-        if not self.job_id or not self.job_id.startswith("job-"):
-            raise ContinuationError("job_id_invalid")
-        if self.branch_mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
-            raise ContinuationError("branch_mode_invalid")
-        _oid(self.base_oid, "base_oid")
-        _oid(self.expected_branch_oid, "expected_branch_oid")
-        if self.target_branch in {"main", "master"} or self.target_branch.startswith(("refs/", "tags/")):
-            raise ContinuationError("protected_branch_rejected")
-        if not isinstance(self.generation, int) or isinstance(self.generation, bool) or self.generation < 1:
-            raise ContinuationError("generation_invalid")
-        if not isinstance(self.lease_seconds, int) or not 1 <= self.lease_seconds <= 86_400:
-            raise ContinuationError("lease_duration_invalid")
-        if self.branch_mode == "CONTINUE_EXISTING":
-            if not probe.branch_exists(self.target_branch):
-                raise ContinuationError("EXISTING_BRANCH_MISSING")
-            actual = _oid(probe.branch_head(self.target_branch), "actual_branch_oid")
-            if actual != self.expected_branch_oid:
-                raise ContinuationError("EXISTING_BRANCH_OID_CONFLICT")
-            if not probe.is_ancestor(self.base_oid, actual):
-                raise ContinuationError("BASE_NOT_ANCESTOR_OF_BRANCH")
-        elif hasattr(probe, "commit_exists") and not probe.commit_exists(self.base_oid):
-            raise ContinuationError("BASE_COMMIT_NOT_FOUND")
-        elif self.branch_mode == "CREATE_NEW" and probe.branch_exists(self.target_branch):
-            raise ContinuationError("TARGET_BRANCH_ALREADY_EXISTS")
-        elif self.branch_mode == "CREATE_NEW" and self.base_oid != self.expected_branch_oid:
-            raise ContinuationError("CREATE_NEW_BASE_EXPECTATION_MISMATCH")
-
-
-@dataclass(frozen=True, slots=True)
-class CampaignWriterLease:
-    task_id: str
-    repository: str
-    branch: str
-    lineage_anchor_oid: str
-    current_head_oid: str
-    generation: int
-    lease_expires_at: datetime
-    append_only: bool = True
-    renewable: bool = True
-    multi_commit: bool = True
-    recoverable: bool = True
-    state: str = "ACTIVE"
-    branch_bound: bool = True
-
-    def __post_init__(self) -> None:
-        _oid(self.lineage_anchor_oid, "lineage_anchor_oid")
-        _oid(self.current_head_oid, "current_head_oid")
-        if not all((self.append_only, self.renewable, self.multi_commit, self.recoverable, self.branch_bound)):
-            raise ContinuationError("lease_capability_downgrade")
-
-
-class ContinuationLeaseManager:
-    """State machine for a multi-commit lease with CAS-only ref updates."""
-
-    def __init__(self, probe: BranchProbe, refs: RefCAS, *, now=datetime.now) -> None:
-        self.probe = probe
-        self.refs = refs
-        self.now = now
-
-    def open(self, request: WriterLeaseRequestV2) -> CampaignWriterLease:
-        request.validate(self.probe)
-        if request.branch_mode != "CONTINUE_EXISTING":
-            raise ContinuationError("CREATE_NEW_REQUIRES_SEPARATE_PROVISIONER")
-        return CampaignWriterLease(
-            task_id=request.task_id,
-            repository=request.repository,
-            branch=request.target_branch,
-            lineage_anchor_oid=request.base_oid,
-            current_head_oid=request.expected_branch_oid,
-            generation=request.generation,
-            lease_expires_at=self.now(timezone.utc) + timedelta(seconds=request.lease_seconds),
-        )
-
-    def renew(self, lease: CampaignWriterLease, seconds: int) -> CampaignWriterLease:
-        if lease.state != "ACTIVE" or not lease.renewable or seconds < 1:
-            raise ContinuationError("lease_not_renewable")
-        return replace(lease, lease_expires_at=self.now(timezone.utc) + timedelta(seconds=seconds))
-
-    def append_commit(self, lease: CampaignWriterLease, new_head_oid: str) -> CampaignWriterLease:
-        if lease.state != "ACTIVE":
-            raise ContinuationError("lease_not_active")
-        _oid(new_head_oid, "new_head_oid")
-        if not self.probe.is_ancestor(lease.current_head_oid, new_head_oid):
-            raise ContinuationError("NON_FAST_FORWARD_COMMIT")
-        try:
-            actual = self.refs.compare_and_swap_branch(
-                lease.branch, lease.current_head_oid, new_head_oid
-            )
-        except Exception as exc:
-            raise ContinuationError("BRANCH_LEASE_STALE") from exc
-        if actual != new_head_oid:
-            raise ContinuationError("BRANCH_LEASE_STALE")
-        return replace(lease, current_head_oid=new_head_oid)
-
-    def supersede(self, lease: CampaignWriterLease) -> CampaignWriterLease:
-        if lease.state not in {"ACTIVE", "RECOVERABLE_FAILURE", "RECONCILIATION_REQUIRED"}:
-            raise ContinuationError("lease_not_supersedable")
-        return replace(lease, generation=lease.generation + 1, state="SUPERSEDED")
@@ -1,25 +0,0 @@
-"""Separate read, write, and release plane readiness evaluation."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Mapping
-
-
-@dataclass(frozen=True, slots=True)
-class RuntimeStatus:
-    read_plane: Mapping[str, bool]
-    write_plane: Mapping[str, bool]
-    release_plane: Mapping[str, bool]
-
-    @property
-    def release_control_plane_ready(self) -> bool:
-        return all(self.read_plane.values()) and all(self.write_plane.values()) and all(self.release_plane.values())
-
-    def as_dict(self) -> dict[str, object]:
-        return {
-            "READ_PLANE": dict(self.read_plane),
-            "WRITE_PLANE": dict(self.write_plane),
-            "RELEASE_PLANE": dict(self.release_plane),
-            "release_control_plane_ready": self.release_control_plane_ready,
-        }
@@ -1,58 +0,0 @@
-"""Workspace-independent authority/network/Gitea ref sentinel."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from pathlib import Path
-import subprocess
-from typing import Callable, Mapping
-
-
-class SentinelError(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class SentinelInputs:
-    authority_git_dir: Path
-    gitea_remote: str
-    gitea_api: str
-    ref: str
-    expected_oid: str
-
-
-@dataclass(frozen=True, slots=True)
-class SentinelResult:
-    authority_oid: str | None
-    network_oid: str | None
-    gitea_oid: str | None
-    equal: bool
-    error: str | None = None
-
-
-def authority_oid(inputs: SentinelInputs) -> str:
-    result = subprocess.run(
-        ["git", "--git-dir", str(inputs.authority_git_dir), "rev-parse", inputs.ref],
-        text=True,
-        capture_output=True,
-        check=False,
-    )
-    if result.returncode != 0:
-        raise SentinelError("AUTHORITY_REF_UNAVAILABLE")
-    return result.stdout.strip()
-
-
-def evaluate(
-    inputs: SentinelInputs,
-    *,
-    network_reader: Callable[[str, str], str | None],
-    gitea_reader: Callable[[str, str], str | None],
-) -> SentinelResult:
-    try:
-        local = authority_oid(inputs)
-        network = network_reader(inputs.gitea_remote, inputs.ref)
-        gitea = gitea_reader(inputs.gitea_api, inputs.ref)
-        equal = local == network == gitea == inputs.expected_oid
-        return SentinelResult(local, network, gitea, equal, None if equal else "OID_MISMATCH")
-    except SentinelError as exc:
-        return SentinelResult(None, None, None, False, str(exc))
@@ -1,26 +0,0 @@
-"""Non-sensitive control-plane snapshot assembly."""
-from __future__ import annotations
-
-from typing import Any, Mapping
-
-
-def _copy(value: Mapping[str, Any] | None, keys: tuple[str, ...]) -> dict[str, Any]:
-    value = value or {}
-    return {key: value.get(key) for key in keys}
-
-
-def build_control_plane_snapshot(*, target_version: str, runtime: Mapping[str, Any] | None = None, repository: Mapping[str, Any] | None = None, production: Mapping[str, Any] | None = None, task: Mapping[str, Any] | None = None, capabilities: Mapping[str, Any] | None = None, credential_broker: Mapping[str, Any] | None = None) -> dict[str, Any]:
-    return {
-        "version": {"target_release": target_version},
-        "runtime": _copy(runtime, ("bridge_schema_version", "control_plane_release_version", "runtime_release_commit", "runtime_path", "artifact_sha256", "drift_status")),
-        "repository": _copy(repository, ("identity", "authority_git_dir", "authority_main_oid")),
-        "production": _copy(production, ("baseline_version", "target_oid", "deployment_state")),
-        "task": _copy(task, ("task_id", "branch", "authority_branch_oid", "gitea_git_oid", "gitea_api_oid", "commit_visible", "generation", "reconciliation_state")),
-        "capabilities": _copy(capabilities, ("legacy_writes_enabled", "governed_writes_enabled", "force_push", "main_write", "tag_write", "baseline_write", "production_write")),
-        "credential_broker": _copy(credential_broker, ("status", "provider")),
-        "secret_material_exposed": False,
-    }
-
-
-def getControlPlaneSnapshot(**kwargs: Any) -> dict[str, Any]:
-    return build_control_plane_snapshot(**kwargs)
@@ -1,124 +0,0 @@
-"""Metadata-only, server-side credential lease broker."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-import os
-from pathlib import Path
-import secrets
-import re
-from typing import Any, Callable, Mapping
-
-
-@dataclass(frozen=True, slots=True)
-class CredentialLease:
-    lease_id: str
-    task_id: str
-    repository: str
-    target_branch: str
-    generation: int
-    issued_at: str
-    expires_at: str
-    scopes: tuple[str, ...]
-    provider: str
-    state: str = "ACTIVE"
-    scope_type: str = "system"
-    tenant_id: str | None = None
-    user_id: str | None = None
-    project_id: str | None = None
-    run_id: str | None = None
-
-    def as_dict(self) -> dict[str, Any]:
-        return {"lease_id": self.lease_id, "task_id": self.task_id, "repository": self.repository, "target_branch": self.target_branch, "generation": self.generation, "issued_at": self.issued_at, "expires_at": self.expires_at, "scopes": list(self.scopes), "provider": self.provider, "state": self.state, "scope_type": self.scope_type, "tenant_id": self.tenant_id, "user_id": self.user_id, "project_id": self.project_id, "run_id": self.run_id}
-
-
-class FileCredentialProvider:
-    def __init__(self, token_path: str | os.PathLike[str], *, actor: str = "aios-autonomy-agent") -> None:
-        self.token_path = Path(token_path)
-        self.actor = actor
-
-    def environment(self, lease: CredentialLease) -> dict[str, str]:
-        if not self.token_path.is_file():
-            raise RuntimeError("CREDENTIAL_PROVIDER_UNAVAILABLE")
-        return {"CREDENTIAL_FILE": str(self.token_path), "GITEA_MACHINE_ACTOR": self.actor}
-
-
-class CredentialBroker:
-    def __init__(self, provider: Any, *, now: Callable[[], datetime] | None = None) -> None:
-        self.provider = provider
-        self.now = now or (lambda: datetime.now(timezone.utc))
-        self._leases: dict[str, CredentialLease] = {}
-
-    def issue(self, *, task_id: str, repository: str, target_branch: str, generation: int, scopes: tuple[str, ...] = ("git:push", "gitea:read"), lease_seconds: int = 900, scope_type: str = "system", tenant_id: str | None = None, user_id: str | None = None, project_id: str | None = None, run_id: str | None = None) -> dict[str, Any]:
-        if repository != "aios/aios" or not target_branch.startswith("agent/") or generation < 1 or not 1 <= lease_seconds <= 86400:
-            raise ValueError("CREDENTIAL_LEASE_BINDING_INVALID")
-        if scope_type == "tenant":
-            if not tenant_id:
-                raise ValueError("CREDENTIAL_SCOPE_DENY")
-        elif scope_type in {"system", "global"}:
-            if any((tenant_id, user_id, project_id, run_id)):
-                raise ValueError("CREDENTIAL_SCOPE_DENY")
-        else:
-            raise ValueError("CREDENTIAL_SCOPE_DENY")
-        now = self.now().astimezone(timezone.utc)
-        lease = CredentialLease("lease-" + secrets.token_hex(16), task_id, repository, target_branch, generation, now.isoformat(), (now + timedelta(seconds=lease_seconds)).isoformat(), tuple(scopes), type(self.provider).__name__, "ACTIVE", scope_type, tenant_id, user_id, project_id, run_id)
-        self._leases[lease.lease_id] = lease
-        return lease.as_dict()
-
-    def _get(self, lease_id: str) -> CredentialLease:
-        lease = self._leases.get(lease_id)
-        if lease is None:
-            raise KeyError("CREDENTIAL_LEASE_NOT_FOUND")
-        if lease.state == "ACTIVE" and self.now().astimezone(timezone.utc) >= datetime.fromisoformat(lease.expires_at):
-            lease = CredentialLease(**{**lease.as_dict(), "scopes": tuple(lease.scopes), "state": "EXPIRED"})
-            self._leases[lease_id] = lease
-        return lease
-
-    def environment(self, lease_id: str) -> Mapping[str, str]:
-        lease = self._get(lease_id)
-        if lease.state != "ACTIVE":
-            raise RuntimeError("CREDENTIAL_LEASE_NOT_ACTIVE")
-        environment = self.provider.environment(lease)
-        for key, value in environment.items():
-            upper = str(key).upper()
-            if not isinstance(value, str):
-                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-            sensitive = any(marker in upper for marker in ("CREDENTIAL", "TOKEN", "SECRET", "PASSWORD", "PRIVATE_KEY", "API_KEY"))
-            if re.search(r"(?i)bearer\s+\S+|(?:token|secret|password|api[_-]?key)\s*[:=]", value):
-                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-            if sensitive and upper.endswith("_FILE"):
-                candidate = Path(value)
-                credential_root = Path("/run/credentials")
-                try:
-                    resolved = candidate.resolve(strict=False)
-                except OSError as exc:
-                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY") from exc
-                if not candidate.is_absolute() or not (resolved == credential_root or credential_root in resolved.parents):
-                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-            elif sensitive and upper.endswith("_REFERENCE"):
-                if re.fullmatch(r"(?:systemd-credential|vault|secret-manager):[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}", value) is None:
-                    raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-            elif sensitive:
-                raise RuntimeError("CREDENTIAL_SECRET_EXPOSURE_DENY")
-        return environment
-
-    def authorize(self, lease_id: str, *, task_id: str, operation: str, scope_type: str = "system", tenant_id: str | None = None, user_id: str | None = None, project_id: str | None = None, run_id: str | None = None) -> Mapping[str, str]:
-        lease = self._get(lease_id)
-        if lease.state != "ACTIVE" or lease.task_id != task_id or operation not in lease.scopes:
-            raise RuntimeError("CREDENTIAL_SCOPE_DENY")
-        requested = (scope_type, tenant_id, user_id, project_id, run_id)
-        actual = (lease.scope_type, lease.tenant_id, lease.user_id, lease.project_id, lease.run_id)
-        if requested != actual:
-            raise RuntimeError("CREDENTIAL_SCOPE_DENY")
-        return self.environment(lease_id)
-
-    def status(self, lease_id: str) -> dict[str, Any]:
-        return self._get(lease_id).as_dict()
-
-    def revoke(self, lease_id: str) -> dict[str, Any]:
-        lease = self._get(lease_id)
-        if lease.state == "REVOKED":
-            return lease.as_dict()
-        updated = CredentialLease(**{**lease.as_dict(), "scopes": tuple(lease.scopes), "state": "REVOKED"})
-        self._leases[lease_id] = updated
-        return updated.as_dict()
@@ -1,125 +0,0 @@
-"""Non-Owner Gitea machine capability and branch reconciliation boundary."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from typing import Any, Mapping, Protocol
-
-
-class MachineBrokerError(RuntimeError):
-    pass
-
-
-class GiteaTransport(Protocol):
-    def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str: ...
-    def create_or_update_pr(self, branch: str, target: str, title: str, body: str) -> Mapping[str, Any]: ...
-    def publish_status(self, branch: str, state: str, description: str) -> Mapping[str, Any]: ...
-    def protected_merge(self, pr_number: int) -> Mapping[str, Any]: ...
-    def read_branch(self, branch: str) -> str | None: ...
-    def whoami(self) -> Mapping[str, Any]: ...
-    def repository(self, owner: str, name: str) -> Mapping[str, Any]: ...
-
-
-@dataclass(frozen=True, slots=True)
-class MachineCredentialProjection:
-    """Opaque systemd credential reference; the credential value is never accepted."""
-
-    reference: str
-    account: str
-    owner_account: str = "aiman"
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "MachineCredentialProjection":
-        if set(value) != {"scheme", "name", "account"}:
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        if value["scheme"] != "systemd-credential" or value["name"] != "gitea-machine-token":
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        return cls(f"{value['scheme']}:{value['name']}", str(value["account"]))
-
-    def __post_init__(self) -> None:
-        if self.reference != "systemd-credential:gitea-machine-token":
-            raise MachineBrokerError("CREDENTIAL_REFERENCE_INVALID")
-        if not self.account or self.account == self.owner_account:
-            raise MachineBrokerError("OWNER_MACHINE_IDENTITY_REJECTED")
-
-
-@dataclass(frozen=True, slots=True)
-class CampaignCapabilityReceipt:
-    campaign_id: str
-    task_id: str
-    repository: str
-    branch: str
-    expected_oid: str
-    capabilities: frozenset[str]
-    denied: frozenset[str]
-
-    def require(self, capability: str) -> None:
-        if capability in self.denied or capability not in self.capabilities:
-            raise MachineBrokerError("CAPABILITY_DENIED")
-        if self.branch in {"main", "master"}:
-            raise MachineBrokerError("PROTECTED_BRANCH_DENIED")
-
-
-class GiteaMachineBroker:
-    def __init__(self, transport: GiteaTransport, credential: MachineCredentialProjection, receipt: CampaignCapabilityReceipt) -> None:
-        self.transport = transport
-        self.credential = credential
-        self.receipt = receipt
-
-    def verify_identity(self) -> Mapping[str, Any]:
-        identity = dict(self.transport.whoami())
-        login = identity.get("login") or identity.get("username")
-        if not isinstance(login, str) or not login or login == self.credential.owner_account or login != self.credential.account:
-            raise MachineBrokerError("GITEA_MACHINE_IDENTITY_INVALID")
-        owner, name = self.receipt.repository.split("/", 1)
-        repo = dict(self.transport.repository(owner, name))
-        if repo.get("full_name") != self.receipt.repository:
-            raise MachineBrokerError("GITEA_REPOSITORY_MISMATCH")
-        return {"login": login, "repository": self.receipt.repository, "owner_account": self.credential.owner_account}
-
-    def push_branch(self, new_oid: str) -> str:
-        self.receipt.require("exact_task_branch_push")
-        return self.transport.compare_and_swap_branch(self.receipt.branch, self.receipt.expected_oid, new_oid)
-
-    def create_pr(self, title: str, body: str) -> Mapping[str, Any]:
-        self.receipt.require("pr_create_update")
-        return self.transport.create_or_update_pr(self.receipt.branch, "main", title, body)
-
-    def status(self, state: str, description: str, context: str = "aios/durable-release") -> Mapping[str, Any]:
-        self.receipt.require("status_publish")
-        return self.transport.publish_status(self.receipt.branch, state, description, context)
-
-    def merge(self, pr_number: int) -> Mapping[str, Any]:
-        self.receipt.require("protected_merge")
-        return self.transport.protected_merge(pr_number)
-
-    def readback(self) -> str | None:
-        self.receipt.require("remote_readback")
-        return self.transport.read_branch(self.receipt.branch)
-
-
-def reconcile_exact_branch(authority_oid: str, gitea_oid: str | None, expected_oid: str) -> str:
-    if authority_oid != expected_oid:
-        return "AUTHORITY_EXPECTATION_MISMATCH"
-    if gitea_oid is None:
-        return "CREATE_REQUIRED"
-    if gitea_oid == expected_oid:
-        return "ALREADY_IN_SYNC"
-    return "MANUAL_OWNER_REVIEW_REQUIRED"
-
-
-def reconcile_fast_forward(
-    remote_oid: str | None,
-    expected_old_oid: str,
-    new_oid: str,
-    *,
-    old_is_ancestor_of_new: bool,
-) -> str:
-    """Return a bounded action for an active Job/lease branch scope."""
-    if remote_oid is None:
-        return "CREATE_REQUIRED"
-    if remote_oid == new_oid:
-        return "ALREADY_IN_SYNC"
-    if remote_oid == expected_old_oid and old_is_ancestor_of_new:
-        return "FAST_FORWARD_REQUIRED"
-    return "MANUAL_OWNER_REVIEW_REQUIRED"
@@ -1,208 +0,0 @@
-"""Gitea HTTP/Git transport using only a projected systemd credential."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-import json
-import os
-from pathlib import Path
-import subprocess
-import tempfile
-from typing import Any, Mapping
-from urllib.error import HTTPError, URLError
-from urllib.parse import quote, urlencode
-from urllib.request import Request, urlopen
-
-
-class GiteaTransportError(RuntimeError):
-    pass
-
-
-def _safe_oid(value: str, field: str) -> str:
-    if not isinstance(value, str) or len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
-        raise GiteaTransportError(f"{field}_INVALID")
-    return value
-
-
-@dataclass(slots=True)
-class GiteaMachineTransport:
-    api_base: str
-    repository_id: str
-    remote_url: str
-    authority_git_dir: Path
-    credential_name: str = "gitea-machine-token"
-    actor: str = "aios-autonomy-agent"
-    timeout: int = 20
-    expected_merge_head: str | None = None
-    expected_merge_base: str | None = None
-
-    def __post_init__(self) -> None:
-        if self.credential_name != "gitea-machine-token":
-            raise GiteaTransportError("CREDENTIAL_NAME_INVALID")
-        if "/" not in self.repository_id or self.repository_id.startswith("/"):
-            raise GiteaTransportError("REPOSITORY_INVALID")
-        if not self.api_base.startswith("https://") and not self.api_base.startswith("http://127.0.0.1"):
-            raise GiteaTransportError("GITEA_API_SCOPE_INVALID")
-        if not self.remote_url.startswith("https://"):
-            raise GiteaTransportError("GITEA_REMOTE_SCOPE_INVALID")
-
-    @property
-    def _credential_path(self) -> Path:
-        directory = os.environ.get("CREDENTIALS_DIRECTORY", "")
-        if not directory:
-            raise GiteaTransportError("CREDENTIAL_PROJECTION_MISSING")
-        path = Path(directory) / self.credential_name
-        if path.is_symlink() or not path.is_file():
-            raise GiteaTransportError("CREDENTIAL_PROJECTION_MISSING")
-        return path
-
-    def _token(self) -> str:
-        value = self._credential_path.read_text(encoding="utf-8").strip()
-        if not value:
-            raise GiteaTransportError("CREDENTIAL_EMPTY")
-        return value
-
-    def _request(self, method: str, path: str, body: Mapping[str, Any] | None = None) -> tuple[int, Any]:
-        data = None if body is None else json.dumps(dict(body), separators=(",", ":")).encode()
-        headers = {"Accept": "application/json", "Authorization": f"token {self._token()}"}
-        if data is not None:
-            headers["Content-Type"] = "application/json"
-        request = Request(self.api_base.rstrip("/") + path, data=data, headers=headers, method=method)
-        try:
-            with urlopen(request, timeout=self.timeout) as response:
-                raw = response.read()
-                return response.status, json.loads(raw.decode()) if raw else {}
-        except HTTPError as exc:
-            # Never include response bodies: Gitea may echo sensitive request context.
-            raise GiteaTransportError(f"GITEA_HTTP_{exc.code}") from exc
-        except (URLError, TimeoutError, OSError) as exc:
-            raise GiteaTransportError("GITEA_NETWORK_ERROR") from exc
-
-    def whoami(self) -> Mapping[str, Any]:
-        return self._request("GET", "/user")[1]
-
-    def repository_info(self) -> Mapping[str, Any]:
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("GET", f"/repos/{quote(owner)}/{quote(name)}")[1]
-
-    def repository(self, owner: str, name: str) -> Mapping[str, Any]:
-        if f"{owner}/{name}" != self.repository_id:
-            raise GiteaTransportError("REPOSITORY_SCOPE_DENIED")
-        return self.repository_info()
-
-    def read_branch(self, branch: str) -> str | None:
-        owner, name = self.repository_id.split("/", 1)
-        try:
-            value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/branches/{quote(branch, safe='/')}")[1]
-        except GiteaTransportError as exc:
-            if str(exc) == "GITEA_HTTP_404":
-                return None
-            raise
-        sha = value.get("commit", {}).get("id") if isinstance(value, dict) else None
-        return _safe_oid(sha, "remote_branch_oid")
-
-    def _askpass(self) -> tuple[Path, dict[str, str]]:
-        credential = self._credential_path
-        fd, name = tempfile.mkstemp(prefix="aios-gitea-askpass-", dir="/tmp")
-        path = Path(name)
-        os.fchmod(fd, 0o700)
-        script = "#!/bin/sh\ncase \"$1\" in *Username*) printf '%s\\n' \"$GITEA_MACHINE_ACTOR\" ;; *) cat \"$CREDENTIAL_FILE\" ;; esac\n"
-        with os.fdopen(fd, "w", encoding="utf-8") as stream:
-            stream.write(script)
-            stream.flush()
-            os.fsync(stream.fileno())
-        return path, {
-            "GIT_ASKPASS": str(path),
-            "GIT_TERMINAL_PROMPT": "0",
-            "GITEA_MACHINE_ACTOR": self.actor,
-            "CREDENTIAL_FILE": str(credential),
-        }
-
-    def _push_branch_fast_forward(self, branch: str, new_oid: str) -> None:
-        askpass, additions = self._askpass()
-        environment = os.environ.copy()
-        environment.update(additions)
-        try:
-            result = subprocess.run(
-                ["git", f"--git-dir={self.authority_git_dir}", "push", self.remote_url, f"{new_oid}:refs/heads/{branch}"],
-                text=True,
-                capture_output=True,
-                check=False,
-                env=environment,
-                timeout=self.timeout,
-            )
-            if result.returncode != 0:
-                raise GiteaTransportError("GITEA_BRANCH_CREATE_FAILED")
-        finally:
-            askpass.unlink(missing_ok=True)
-
-    def compare_and_swap_branch(self, branch: str, expected_oid: str, new_oid: str) -> str:
-        _safe_oid(expected_oid, "expected_oid")
-        _safe_oid(new_oid, "new_oid")
-        current = self.read_branch(branch)
-        if current == new_oid:
-            return new_oid
-        if current is None:
-            self._push_branch_fast_forward(branch, new_oid)
-            readback = self.read_branch(branch)
-            if readback != new_oid:
-                raise GiteaTransportError("GITEA_BRANCH_CREATE_READBACK_MISMATCH")
-            return readback
-        if current != expected_oid:
-            raise GiteaTransportError("GITEA_BRANCH_EXPECTATION_MISMATCH")
-        # The preflight read binds the expected old tip. The Git receive-pack
-        # then enforces the actual fast-forward CAS while transferring the new
-        # objects; no force/lease override or arbitrary ref is permitted.
-        self._push_branch_fast_forward(branch, new_oid)
-        readback = self.read_branch(branch)
-        if readback != new_oid:
-            raise GiteaTransportError("GITEA_BRANCH_CAS_READBACK_MISMATCH")
-        return readback
-
-    def _pulls(self) -> list[Mapping[str, Any]]:
-        owner, name = self.repository_id.split("/", 1)
-        query = urlencode({"state": "all", "base_branch": "main", "limit": 100})
-        value = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/pulls?{query}")[1]
-        return value if isinstance(value, list) else []
-
-    def create_or_update_pr(self, branch: str, target: str, title: str, body: str) -> Mapping[str, Any]:
-        if target != "main":
-            raise GiteaTransportError("PR_BASE_SCOPE_DENIED")
-        head = self.read_branch(branch)
-        if head is None:
-            raise GiteaTransportError("PR_HEAD_MISSING")
-        matches = [p for p in self._pulls() if (p.get("head") or {}).get("ref") == branch and (p.get("base") or {}).get("ref") == target]
-        open_matches = [p for p in matches if p.get("state") == "open"]
-        if len(open_matches) > 1:
-            raise GiteaTransportError("MULTIPLE_MATCHING_PRS")
-        if open_matches:
-            if (open_matches[0].get("head") or {}).get("sha") != head:
-                raise GiteaTransportError("PR_HEAD_CONFLICT")
-            return open_matches[0]
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/pulls", {"head": branch, "base": target, "title": title, "body": body, "allow_maintainer_edit": False})[1]
-
-    def publish_status(self, branch: str, state: str, description: str, context: str = "aios/durable-release") -> Mapping[str, Any]:
-        oid = self.read_branch(branch)
-        if oid is None:
-            raise GiteaTransportError("STATUS_BRANCH_MISSING")
-        owner, name = self.repository_id.split("/", 1)
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/statuses/{oid}", {"state": state, "context": context, "description": description})[1]
-
-    def protected_merge(self, pr_number: int) -> Mapping[str, Any]:
-        if not isinstance(pr_number, int) or pr_number < 1:
-            raise GiteaTransportError("PR_NUMBER_INVALID")
-        owner, name = self.repository_id.split("/", 1)
-        pr = self._request("GET", f"/repos/{quote(owner)}/{quote(name)}/pulls/{pr_number}")[1]
-        if pr.get("state") != "open" or (pr.get("base") or {}).get("ref") != "main":
-            raise GiteaTransportError("PR_MERGE_BINDING_INVALID")
-        if pr.get("mergeable") is False:
-            raise GiteaTransportError("PR_NOT_MERGEABLE")
-        head_oid = (pr.get("head") or {}).get("sha")
-        base_oid = (pr.get("base") or {}).get("sha")
-        if self.expected_merge_head is not None and head_oid != self.expected_merge_head:
-            raise GiteaTransportError("PR_HEAD_EXPECTATION_MISMATCH")
-        if self.expected_merge_base is not None and base_oid != self.expected_merge_base:
-            raise GiteaTransportError("PR_BASE_EXPECTATION_MISMATCH")
-        body = {"do": "fast-forward-only", "force_merge": False, "merge_when_checks_succeed": False, "head_commit_id": head_oid}
-        return self._request("POST", f"/repos/{quote(owner)}/{quote(name)}/pulls/{pr_number}/merge", body)[1]
@@ -1,93 +0,0 @@
-"""Canonical Gitea transport and slash-branch verification."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import json
-import os
-from pathlib import Path
-import subprocess
-from typing import Any, Callable, Mapping, Optional
-from urllib.parse import quote
-from urllib.request import Request, urlopen
-
-from aios_gitops_reconciliation_core import RemoteObservation
-
-
-@dataclass(frozen=True, slots=True)
-class GiteaPublisherConfig:
-    repository: str = "aios/aios"
-    api_base: str = "https://g.cnnetmkt.top/git/api/v1"
-    remote_name: str = "gitea-http"
-
-
-class GiteaPublisher:
-    def __init__(self, workspace: Path, *, config: GiteaPublisherConfig = GiteaPublisherConfig(), credential: Any = None, api_get: Callable[[str], Any] | None = None, git_ref: Callable[[str], Optional[str]] | None = None) -> None:
-        self.workspace = Path(workspace)
-        self.config = config
-        self.credential = credential
-        self._api_get = api_get
-        self._git_ref = git_ref
-
-    @staticmethod
-    def validate_repository(repository: str) -> None:
-        if repository != "aios/aios":
-            raise ValueError("REPOSITORY_IDENTITY_MISMATCH")
-
-    @staticmethod
-    def validate_branch(branch: str) -> None:
-        if not isinstance(branch, str) or not branch.startswith("agent/") or branch in {"main", "master"}:
-            raise ValueError("BRANCH_SCOPE_DENIED")
-
-    def repository_identity(self) -> str:
-        self.validate_repository(self.config.repository)
-        return self.config.repository
-
-    def _environment(self) -> dict[str, str]:
-        if self.credential is not None and hasattr(self.credential, "environment"):
-            return dict(self.credential.environment())
-        return {}
-
-    def read_git_ref(self, branch: str) -> Optional[str]:
-        self.validate_branch(branch)
-        if self._git_ref is not None:
-            return self._git_ref(branch)
-        result = subprocess.run(["git", "-C", str(self.workspace), "ls-remote", self.config.remote_name, f"refs/heads/{branch}"], text=True, capture_output=True, check=False, env={**os.environ, **self._environment(), "GIT_TERMINAL_PROMPT": "0"})
-        if result.returncode != 0 or not result.stdout.strip():
-            return None
-        return result.stdout.split()[0]
-
-    def _api(self, path: str) -> Any:
-        if self._api_get is not None:
-            return self._api_get(path)
-        headers = {"Accept": "application/json"}
-        env = self._environment()
-        if env.get("AIOS_GITEA_TOKEN"):
-            headers["Authorization"] = "token " + env["AIOS_GITEA_TOKEN"]
-        with urlopen(Request(self.config.api_base.rstrip("/") + path, headers=headers), timeout=20) as response:
-            return json.loads(response.read() or b"{}")
-
-    def read_api_branch(self, branch: str) -> Optional[str]:
-        self.validate_branch(branch)
-        for page in range(1, 101):
-            value = self._api(f"/repos/aios/aios/branches?page={page}&limit=50")
-            if not isinstance(value, list):
-                return None
-            for item in value:
-                if isinstance(item, Mapping) and item.get("name") == branch:
-                    commit = item.get("commit")
-                    return commit.get("id") if isinstance(commit, Mapping) else None
-            if len(value) < 50:
-                return None
-        raise RuntimeError("GITEA_BRANCH_PAGINATION_LIMIT")
-
-    def commit_visible(self, oid: str) -> bool:
-        if not isinstance(oid, str) or len(oid) != 40:
-            return False
-        try:
-            value = self._api(f"/repos/aios/aios/git/commits/{quote(oid, safe='')}")
-            return isinstance(value, Mapping) and value.get("sha", oid) == oid
-        except Exception:
-            return False
-
-    def observe(self, branch: str, desired_oid: str, authority_oid: Optional[str], *, expected_oid: Optional[str] = None, observed_at: str = "") -> RemoteObservation:
-        return RemoteObservation(self.repository_identity(), branch, desired_oid, authority_oid, self.read_git_ref(branch), self.read_api_branch(branch), self.commit_visible(desired_oid), observed_at, expected_oid)
@@ -1,707 +0,0 @@
-"""SQLite-backed durable GitOps Job Controller.
-
-The controller owns durable intent, idempotency, lease metadata, state
-transitions, receipts, and payload references. A worker owns Git side effects
-behind the campaign capability and branch-CAS boundaries.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from enum import Enum
-import hashlib
-import json
-import os
-from pathlib import Path
-import sqlite3
-import tempfile
-from datetime import datetime, timezone
-from typing import Any, Callable, Mapping
-
-
-class JobError(RuntimeError):
-    pass
-
-
-class ServiceUnavailable(JobError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class LeaseRenewalResult:
-    """Durable outcome of one writer-lease recovery attempt."""
-
-    renewed: bool
-    idempotent: bool
-    durable: bool
-    lease_expires_at: str | None
-
-    def __bool__(self) -> bool:
-        return self.renewed or self.idempotent
-
-
-class BindingConflict(JobError):
-    pass
-
-
-class JobState(str, Enum):
-    REQUESTED = "REQUESTED"
-    AUTHORIZED = "AUTHORIZED"
-    LEASED = "LEASED"
-    WORKTREE_READY = "WORKTREE_READY"
-    EXECUTING = "EXECUTING"
-    LOCAL_VERIFIED = "LOCAL_VERIFIED"
-    REMOTE_SYNCING = "REMOTE_SYNCING"
-    REMOTE_VERIFIED = "REMOTE_VERIFIED"
-    COMPLETED = "COMPLETED"
-    RECOVERABLE_FAILURE = "RECOVERABLE_FAILURE"
-    RECONCILING = "RECONCILING"
-    RECONCILIATION_REQUIRED = "RECONCILIATION_REQUIRED"
-    MANUAL_OWNER_REVIEW_REQUIRED = "MANUAL_OWNER_REVIEW_REQUIRED"
-
-
-_ORDER = {
-    JobState.REQUESTED: 0,
-    JobState.AUTHORIZED: 1,
-    JobState.LEASED: 2,
-    JobState.WORKTREE_READY: 3,
-    JobState.EXECUTING: 4,
-    JobState.LOCAL_VERIFIED: 5,
-    JobState.REMOTE_SYNCING: 6,
-    JobState.REMOTE_VERIFIED: 7,
-    JobState.COMPLETED: 8,
-}
-_RECOVERABLE = {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}
-_TERMINAL = {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED}
-
-
-def utc_now() -> str:
-    return datetime.now(timezone.utc).isoformat().replace("+00:00", "Z")
-
-
-def parse_utc(value: str) -> datetime:
-    normalized = value[:-1] + "+00:00" if value.endswith("Z") else value
-    parsed = datetime.fromisoformat(normalized)
-    if parsed.tzinfo is None:
-        raise ValueError("LEASE_EXPIRY_INVALID")
-    return parsed.astimezone(timezone.utc)
-
-
-def canonical_json(value: Any) -> bytes:
-    return (
-        json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n"
-    ).encode("utf-8")
-
-
-def sha256_json(value: Any) -> str:
-    return hashlib.sha256(canonical_json(value)).hexdigest()
-
-
-class PayloadStore:
-    """Content-addressed filesystem payloads; raw content never enters SQLite."""
-
-    def __init__(self, root: str | os.PathLike[str]) -> None:
-        self.root = Path(root)
-        if not self.root.is_absolute() or self.root.is_symlink():
-            raise JobError("PAYLOAD_ROOT_INVALID")
-        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
-        os.chmod(self.root, 0o700)
-
-    def put(self, content: bytes, expected_digest: str) -> tuple[str, int]:
-        digest = hashlib.sha256(content).hexdigest()
-        if digest != expected_digest:
-            raise JobError("PAYLOAD_DIGEST_MISMATCH")
-        if len(expected_digest) != 64 or any(ch not in "0123456789abcdef" for ch in expected_digest):
-            raise JobError("PAYLOAD_DIGEST_INVALID")
-        target = self.root / expected_digest
-        if target.is_symlink():
-            raise JobError("PAYLOAD_PATH_SYMLINK")
-        if target.is_file():
-            if target.stat().st_size != len(content) or hashlib.sha256(target.read_bytes()).hexdigest() != digest:
-                raise JobError("PAYLOAD_EXISTING_MISMATCH")
-            return f"sha256/{digest}", len(content)
-        fd, temporary = tempfile.mkstemp(prefix=".payload-", dir=self.root)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "wb") as stream:
-                stream.write(content)
-                stream.flush()
-                os.fsync(stream.fileno())
-            os.replace(temporary, target)
-            os.chmod(target, 0o600)
-        finally:
-            if os.path.exists(temporary):
-                os.unlink(temporary)
-        return f"sha256/{digest}", len(content)
-
-    def read_verified(self, reference: str, expected_digest: str, expected_size: int) -> bytes:
-        if reference != f"sha256/{expected_digest}":
-            raise JobError("PAYLOAD_REFERENCE_MISMATCH")
-        path = self.root / expected_digest
-        if path.is_symlink() or not path.is_file():
-            raise JobError("PAYLOAD_MISSING")
-        content = path.read_bytes()
-        if len(content) != expected_size or hashlib.sha256(content).hexdigest() != expected_digest:
-            raise JobError("PAYLOAD_VERIFY_FAILED")
-        return content
-
-
-@dataclass(frozen=True, slots=True)
-class JobReceipt:
-    job_id: str
-    idempotency_key: str
-    state: JobState
-    side_effect_state: str
-    http_status: int
-    revision: int
-    receipt: Mapping[str, Any] | None = None
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "job_id": self.job_id,
-            "idempotency_key": self.idempotency_key,
-            "state": self.state.value,
-            "side_effect_state": self.side_effect_state,
-            "http_status": self.http_status,
-            "revision": self.revision,
-            "receipt": dict(self.receipt) if self.receipt else None,
-        }
-
-
-class JobStore:
-    SCHEMA_VERSION = 1
-
-    def __init__(self, root: str | os.PathLike[str], *, payload_root: str | os.PathLike[str] | None = None) -> None:
-        self.root = Path(root)
-        if not self.root.is_absolute() or self.root.is_symlink():
-            raise JobError("JOB_ROOT_INVALID")
-        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
-        os.chmod(self.root, 0o700)
-        self.db_path = self.root / "state.sqlite3"
-        self.payloads = PayloadStore(payload_root or self.root.parent / "payloads" / "sha256")
-        self._initialize()
-
-    def _connect(self) -> sqlite3.Connection:
-        if self.db_path.is_symlink():
-            raise ServiceUnavailable("JOB_DB_SYMLINK")
-        connection = sqlite3.connect(self.db_path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA journal_mode=WAL")
-        connection.execute("PRAGMA synchronous=FULL")
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    def _initialize(self) -> None:
-        try:
-            with self._connect() as connection:
-                connection.executescript(
-                    """
-                    CREATE TABLE IF NOT EXISTS metadata (key TEXT PRIMARY KEY, value TEXT NOT NULL);
-                    CREATE TABLE IF NOT EXISTS jobs (
-                      job_id TEXT PRIMARY KEY, idempotency_key TEXT NOT NULL UNIQUE,
-                      campaign_id TEXT NOT NULL, repository TEXT NOT NULL, operation TEXT NOT NULL,
-                      branch TEXT NOT NULL, expected_branch_oid TEXT NOT NULL,
-                      payload_digest TEXT NOT NULL, payload_ref TEXT, payload_size INTEGER,
-                      state TEXT NOT NULL, side_effect_state TEXT NOT NULL,
-                      revision INTEGER NOT NULL, request_json TEXT NOT NULL,
-                      receipt_json TEXT, created_at TEXT NOT NULL, updated_at TEXT NOT NULL
-                    );
-                    CREATE TABLE IF NOT EXISTS idempotency_keys (
-                      key TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE,
-                      binding_json TEXT NOT NULL, created_at TEXT NOT NULL,
-                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS branch_leases (
-                      lease_id TEXT PRIMARY KEY, job_id TEXT NOT NULL UNIQUE,
-                      branch TEXT NOT NULL, lineage_anchor_oid TEXT NOT NULL,
-                      current_head_oid TEXT NOT NULL, generation INTEGER NOT NULL,
-                      lease_expires_at TEXT NOT NULL, state TEXT NOT NULL,
-                      revision INTEGER NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS state_transitions (
-                      sequence INTEGER PRIMARY KEY AUTOINCREMENT, job_id TEXT NOT NULL,
-                      from_state TEXT, to_state TEXT NOT NULL, revision INTEGER NOT NULL,
-                      side_effect_state TEXT NOT NULL, created_at TEXT NOT NULL,
-                      FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    CREATE TABLE IF NOT EXISTS receipts (
-                      receipt_id TEXT PRIMARY KEY, job_id TEXT NOT NULL,
-                      kind TEXT NOT NULL, digest TEXT NOT NULL, payload_json TEXT NOT NULL,
-                      created_at TEXT NOT NULL, FOREIGN KEY(job_id) REFERENCES jobs(job_id)
-                    );
-                    INSERT OR REPLACE INTO metadata(key, value) VALUES('schema_version', '1');
-                    """
-                )
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def _mirror(self, job: Mapping[str, Any]) -> None:
-        directory = self.root / str(job["job_id"])
-        directory.mkdir(mode=0o700, exist_ok=True)
-        (directory / "receipts").mkdir(mode=0o700, exist_ok=True)
-        (directory / "logs-digest").mkdir(mode=0o700, exist_ok=True)
-        for name, value in (("request.json", job["request"]), ("state.json", job)):
-            target = directory / name
-            fd, temporary = tempfile.mkstemp(prefix=".mirror-", dir=directory)
-            try:
-                os.fchmod(fd, 0o600)
-                with os.fdopen(fd, "wb") as stream:
-                    stream.write(canonical_json(value))
-                    stream.flush()
-                    os.fsync(stream.fileno())
-                os.replace(temporary, target)
-            finally:
-                if os.path.exists(temporary):
-                    os.unlink(temporary)
-
-    def read(self, job_id: str) -> dict[str, Any]:
-        try:
-            with self._connect() as connection:
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        if row is None:
-            raise JobError("JOB_NOT_FOUND")
-        return dict(row)
-
-    def _receipt(self, row: Mapping[str, Any], *, duplicate: bool) -> JobReceipt:
-        state = JobState(row["state"])
-        if state == JobState.COMPLETED:
-            status, side = 200, "COMPLETED"
-        elif state in _RECOVERABLE:
-            status = 202
-            side = row["side_effect_state"] if row["side_effect_state"] == "REMOTE_PUSH_PENDING" else "RESUME_SAME_JOB"
-        elif row["side_effect_state"] == "UNKNOWN":
-            status, side = 503, "UNKNOWN"
-        else:
-            status, side = 202, "SAME_JOB" if duplicate else "QUEUED"
-        receipt = json.loads(row["receipt_json"]) if row["receipt_json"] else None
-        return JobReceipt(row["job_id"], row["idempotency_key"], state, side, status, int(row["revision"]), receipt)
-
-
-class GitOpsJobController:
-    def __init__(self, store: JobStore) -> None:
-        self.store = store
-
-    @staticmethod
-    def _binding(request: Mapping[str, Any]) -> dict[str, str]:
-        fields = ("campaign_id", "repository", "operation", "branch", "expected_branch_oid", "payload_digest")
-        if any(not isinstance(request.get(field), str) or not request[field].strip() for field in fields):
-            raise JobError("JOB_BINDING_INVALID")
-        oid = request["expected_branch_oid"]
-        digest = request["payload_digest"]
-        if len(oid) != 40 or any(ch not in "0123456789abcdef" for ch in oid):
-            raise JobError("EXPECTED_BRANCH_OID_INVALID")
-        if len(digest) != 64 or any(ch not in "0123456789abcdef" for ch in digest):
-            raise JobError("PAYLOAD_DIGEST_INVALID")
-        if request["branch"] in {"main", "master"} or request["branch"].startswith(("refs/", "tags/")):
-            raise JobError("PROTECTED_BRANCH_REJECTED")
-        binding = {field: str(request[field]) for field in fields}
-        # Operation-specific, non-secret binding inputs must survive the
-        # durable round trip and participate in idempotency. Arbitrary request
-        # fields are intentionally discarded rather than persisted.
-        optional = (
-            "idempotency_key",
-            "task_id",
-            "new_branch_oid",
-            "authorization_recovery_digest",
-            "lineage_anchor_oid",
-            "base_oid",
-            "branch_mode",
-            "generation",
-            "expected_main_oid",
-            "pr_number",
-            "target_branch",
-            "check_context",
-            "check_state",
-            "check_description",
-        )
-        for field in optional:
-            value = request.get(field)
-            if value is None:
-                continue
-            if isinstance(value, bool) or not isinstance(value, (str, int)):
-                raise JobError("JOB_BINDING_OPTION_INVALID")
-            text = str(value).strip()
-            if not text or len(text) > 512:
-                raise JobError("JOB_BINDING_OPTION_INVALID")
-            binding[field] = text
-        return binding
-
-    def submit(self, request: Mapping[str, Any], *, payload: bytes | None = None) -> JobReceipt:
-        binding = self._binding(request)
-        payload_ref = request.get("payload_ref")
-        payload_size = request.get("payload_size")
-        if payload is not None:
-            payload_ref, payload_size = self.store.payloads.put(payload, binding["payload_digest"])
-        if payload_ref is not None and payload_ref != f"sha256/{binding['payload_digest']}":
-            raise JobError("PAYLOAD_REFERENCE_MISMATCH")
-        if payload_ref is not None and (not isinstance(payload_size, int) or payload_size < 0):
-            raise JobError("PAYLOAD_SIZE_INVALID")
-        client_idempotency_key = binding.get("idempotency_key")
-        if client_idempotency_key is not None:
-            if len(client_idempotency_key) > 128 or not all(
-                character.isalnum() or character in "._:-" for character in client_idempotency_key
-            ):
-                raise JobError("IDEMPOTENCY_KEY_INVALID")
-            key = sha256_json({"client_idempotency_key": client_idempotency_key})
-        else:
-            key = sha256_json(binding)
-        job_id = "job-" + key[:32]
-        durable_request = dict(binding)
-        if payload_ref is not None:
-            durable_request.update({"payload_ref": str(payload_ref), "payload_size": int(payload_size)})
-        now = utc_now()
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                existing = connection.execute("SELECT * FROM jobs WHERE idempotency_key=?", (key,)).fetchone()
-                if existing is not None:
-                    if json.loads(existing["request_json"]).get("binding") != binding:
-                        raise BindingConflict("BINDING_CONFLICT")
-                    row = dict(existing)
-                    connection.commit()
-                    return self.store._receipt(row, duplicate=True)
-                connection.execute(
-                    "INSERT INTO jobs(job_id,idempotency_key,campaign_id,repository,operation,branch,expected_branch_oid,payload_digest,payload_ref,payload_size,state,side_effect_state,revision,request_json,receipt_json,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)",
-                    (job_id, key, binding["campaign_id"], binding["repository"], binding["operation"], binding["branch"], binding["expected_branch_oid"], binding["payload_digest"], payload_ref, payload_size, JobState.REQUESTED.value, "NONE", 0, json.dumps({"binding": binding, **durable_request}, sort_keys=True), None, now, now),
-                )
-                connection.execute("INSERT INTO idempotency_keys(key,job_id,binding_json,created_at) VALUES(?,?,?,?)", (key, job_id, json.dumps(binding, sort_keys=True), now))
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, None, JobState.REQUESTED.value, 0, "NONE", now))
-                row = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except BindingConflict:
-            raise
-        except sqlite3.IntegrityError:
-            row = self.store.read(job_id)
-            return self.store._receipt(row, duplicate=True)
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        row["request"] = json.loads(row["request_json"])
-        self.store._mirror(row)
-        return self.store._receipt(row, duplicate=False)
-
-    def lease_job(
-        self,
-        job_id: str,
-        *,
-        lease_id: str,
-        lineage_anchor_oid: str,
-        current_head_oid: str,
-        generation: int,
-        lease_expires_at: str,
-        expected_revision: int,
-    ) -> JobReceipt:
-        """Atomically create a branch lease and move its Job to LEASED."""
-        if generation < 1 or any(len(oid) != 40 for oid in (lineage_anchor_oid, current_head_oid)):
-            raise JobError("LEASE_BINDING_INVALID")
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-                if row is None:
-                    raise JobError("JOB_NOT_FOUND")
-                if int(row["revision"]) != expected_revision:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                if row["branch"] in {"main", "master"}:
-                    raise JobError("PROTECTED_BRANCH_REJECTED")
-                now = utc_now()
-                connection.execute("INSERT INTO branch_leases(lease_id,job_id,branch,lineage_anchor_oid,current_head_oid,generation,lease_expires_at,state,revision) VALUES(?,?,?,?,?,?,?,?,?)", (lease_id, job_id, row["branch"], lineage_anchor_oid, current_head_oid, generation, lease_expires_at, "ACTIVE", 0))
-                next_revision = expected_revision + 1
-                updated = connection.execute("UPDATE jobs SET state=?,side_effect_state=?,revision=?,updated_at=? WHERE job_id=? AND revision=?", (JobState.LEASED.value, "LEASED", next_revision, now, job_id, expected_revision))
-                if updated.rowcount != 1:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, row["state"], JobState.LEASED.value, next_revision, "LEASED", now))
-                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except sqlite3.IntegrityError as exc:
-            raise JobError("LEASE_CONFLICT") from exc
-        except (JobError, BindingConflict):
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        result["request"] = json.loads(result["request_json"])
-        self.store._mirror(result)
-        return self.store._receipt(result, duplicate=True)
-
-    def update_lease(self, lease_id: str, *, expected_revision: int, current_head_oid: str, generation: int, state: str = "ACTIVE", lease_expires_at: str | None = None) -> None:
-        if len(current_head_oid) != 40 or generation < 1:
-            raise JobError("LEASE_BINDING_INVALID")
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                if lease_expires_at is None:
-                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, state, lease_id, expected_revision))
-                else:
-                    updated = connection.execute("UPDATE branch_leases SET current_head_oid=?,generation=?,lease_expires_at=?,state=?,revision=revision+1 WHERE lease_id=? AND revision=?", (current_head_oid, generation, lease_expires_at, state, lease_id, expected_revision))
-                if updated.rowcount != 1:
-                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
-                connection.commit()
-        except JobError:
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def renew_lease(
-        self,
-        *,
-        branch: str,
-        lineage_anchor_oid: str,
-        current_head_oid: str,
-        generation: int,
-        lease_expires_at: str,
-    ) -> LeaseRenewalResult:
-        if (
-            not branch
-            or len(lineage_anchor_oid) != 40
-            or len(current_head_oid) != 40
-            or generation < 1
-            or not lease_expires_at.strip()
-        ):
-            raise JobError("LEASE_BINDING_INVALID")
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                rows = connection.execute(
-                    "SELECT lease_id, revision, generation, state, lease_expires_at "
-                    "FROM branch_leases "
-                    "WHERE branch=? AND lineage_anchor_oid=? AND current_head_oid=? "
-                    "AND generation=? AND state='ACTIVE' ORDER BY revision DESC",
-                    (branch, lineage_anchor_oid, current_head_oid, generation),
-                ).fetchall()
-                if not rows:
-                    connection.commit()
-                    return LeaseRenewalResult(False, False, False, None)
-                if len(rows) != 1:
-                    raise JobError("LEASE_BINDING_CONFLICT")
-                row = rows[0]
-                try:
-                    current_expires_at = parse_utc(str(row["lease_expires_at"]))
-                    requested_expires_at = parse_utc(lease_expires_at)
-                except (TypeError, ValueError) as exc:
-                    raise JobError("LEASE_EXPIRY_INVALID") from exc
-                now = datetime.now(timezone.utc)
-                if requested_expires_at <= now:
-                    raise JobError("LEASE_EXPIRY_INVALID")
-                if current_expires_at > now:
-                    connection.commit()
-                    return LeaseRenewalResult(
-                        False,
-                        True,
-                        True,
-                        str(row["lease_expires_at"]),
-                    )
-                updated = connection.execute(
-                    "UPDATE branch_leases SET lease_expires_at=?,revision=revision+1 "
-                    "WHERE lease_id=? AND revision=? AND generation=? "
-                    "AND state='ACTIVE' AND lease_expires_at=?",
-                    (
-                        lease_expires_at,
-                        row["lease_id"],
-                        int(row["revision"]),
-                        generation,
-                        row["lease_expires_at"],
-                    ),
-                )
-                if updated.rowcount != 1:
-                    current = connection.execute(
-                        "SELECT lease_expires_at, generation, state FROM branch_leases "
-                        "WHERE lease_id=?",
-                        (row["lease_id"],),
-                    ).fetchone()
-                    if (
-                        current is not None
-                        and int(current["generation"]) == generation
-                        and current["state"] == "ACTIVE"
-                        and parse_utc(str(current["lease_expires_at"])) > now
-                    ):
-                        connection.commit()
-                        return LeaseRenewalResult(
-                            False,
-                            True,
-                            True,
-                            str(current["lease_expires_at"]),
-                        )
-                    raise JobError("LEASE_REVISION_CAS_CONFLICT")
-                connection.commit()
-                return LeaseRenewalResult(True, False, True, lease_expires_at)
-        except JobError:
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-
-    def advance(self, job_id: str, state: JobState, *, side_effect_state: str, receipt: Mapping[str, Any] | None = None, expected_revision: int | None = None) -> JobReceipt:
-        return self._advance(
-            job_id,
-            state,
-            side_effect_state=side_effect_state,
-            receipt=receipt,
-            expected_revision=expected_revision,
-        )
-
-    def _advance(
-        self,
-        job_id: str,
-        state: JobState,
-        *,
-        side_effect_state: str,
-        receipt: Mapping[str, Any] | None = None,
-        expected_revision: int | None = None,
-        _allow_verified_external_recovery: bool = False,
-    ) -> JobReceipt:
-        try:
-            with self.store._connect() as connection:
-                connection.execute("BEGIN IMMEDIATE")
-                row = connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone()
-                if row is None:
-                    raise JobError("JOB_NOT_FOUND")
-                previous = JobState(row["state"])
-                revision = int(row["revision"])
-                if expected_revision is not None and expected_revision != revision:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                recovery_transition = (
-                    _allow_verified_external_recovery
-                    and previous == JobState.MANUAL_OWNER_REVIEW_REQUIRED
-                    and state == JobState.COMPLETED
-                )
-                if previous in _TERMINAL and state != previous and not recovery_transition:
-                    raise JobError("JOB_TERMINAL")
-                if state not in _RECOVERABLE | {JobState.RECONCILING, JobState.MANUAL_OWNER_REVIEW_REQUIRED}:
-                    if previous in _RECOVERABLE:
-                        raise JobError("RECONCILE_REQUIRED")
-                    if previous != JobState.RECONCILING and _ORDER.get(state, -1) < _ORDER.get(previous, -1):
-                        raise JobError("JOB_STATE_REGRESSION")
-                next_revision = revision + 1
-                receipt_json = json.dumps(dict(receipt), sort_keys=True) if receipt is not None else row["receipt_json"]
-                now = utc_now()
-                updated = connection.execute("UPDATE jobs SET state=?,side_effect_state=?,revision=?,receipt_json=?,updated_at=? WHERE job_id=? AND revision=?", (state.value, side_effect_state, next_revision, receipt_json, now, job_id, revision))
-                if updated.rowcount != 1:
-                    raise JobError("REVISION_CAS_CONFLICT")
-                connection.execute("INSERT INTO state_transitions(job_id,from_state,to_state,revision,side_effect_state,created_at) VALUES(?,?,?,?,?,?)", (job_id, previous.value, state.value, next_revision, side_effect_state, now))
-                if receipt is not None:
-                    digest = hashlib.sha256(canonical_json(receipt)).hexdigest()
-                    connection.execute("INSERT INTO receipts(receipt_id,job_id,kind,digest,payload_json,created_at) VALUES(?,?,?,?,?,?)", (f"receipt-{job_id}-{next_revision}", job_id, state.value, digest, json.dumps(dict(receipt), sort_keys=True), now))
-                result = dict(connection.execute("SELECT * FROM jobs WHERE job_id=?", (job_id,)).fetchone())
-                connection.commit()
-        except (JobError, BindingConflict):
-            raise
-        except sqlite3.Error as exc:
-            raise ServiceUnavailable("JOB_DB_UNAVAILABLE") from exc
-        result["request"] = json.loads(result["request_json"])
-        self.store._mirror(result)
-        return self.store._receipt(result, duplicate=True)
-
-    @staticmethod
-    def _validate_verified_external_merge_proof(
-        job_id: str,
-        binding: Mapping[str, Any],
-        proof: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        if not isinstance(proof, Mapping):
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-
-        def require_oid(field: str) -> str:
-            value = proof.get(field)
-            if not isinstance(value, str) or len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
-                raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-            return value
-
-        if proof.get("proof_schema") != "aios.job-recovery.v1":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_INVALID")
-        if proof.get("job_id") != job_id:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("operation") != "PROTECTED_MERGE" or binding.get("operation") != "PROTECTED_MERGE":
-            raise JobError("EXTERNAL_SIDE_EFFECT_OPERATION_REJECTED")
-        if proof.get("pr_number") != 53 or str(binding.get("pr_number")) != "53":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("pr_merged") is not True or proof.get("protected_merge") is not True:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("force_push") is not False:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if proof.get("machine_actor") != "aios-autonomy-agent":
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-
-        expected_head = str(binding.get("expected_branch_oid", ""))
-        expected_base = str(binding.get("expected_main_oid", ""))
-        head_oid = require_oid("head_oid")
-        base_oid = require_oid("base_oid")
-        merged_main = require_oid("main_oid_after_protected_merge")
-        gitea_merged_main = require_oid("gitea_main_oid_after_protected_merge")
-        authority_merged_main = require_oid("authority_main_oid_after_protected_merge")
-        current_gitea = require_oid("current_gitea_main_oid")
-        current_authority = require_oid("current_authority_main_oid")
-        if head_oid != expected_head or base_oid != expected_base:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if not (merged_main == gitea_merged_main == authority_merged_main == head_oid):
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        if current_gitea != current_authority or proof.get("current_main_descends_from_protected_merge") is not True:
-            raise JobError("EXTERNAL_SIDE_EFFECT_PROOF_MISMATCH")
-        return dict(proof)
-
-    def complete_verified_external_side_effect(
-        self,
-        job_id: str,
-        proof: Mapping[str, Any],
-        *,
-        expected_revision: int | None = None,
-    ) -> JobReceipt:
-        """Close one historical manual job from independently verified proof.
-
-        This is deliberately narrower than advance: it is only valid for the
-        known protected PR53 recovery shape and preserves the old receipt.
-        The actual state change still uses the normal revision-CAS path.
-        """
-        current = self.store.read(job_id)
-        revision = int(current["revision"])
-        if expected_revision is not None and expected_revision != revision:
-            raise JobError("REVISION_CAS_CONFLICT")
-        request = json.loads(current["request_json"])
-        binding = request.get("binding", request)
-        normalized_proof = self._validate_verified_external_merge_proof(job_id, binding, proof)
-        existing_receipt = json.loads(current["receipt_json"]) if current["receipt_json"] else None
-        if JobState(current["state"]) == JobState.COMPLETED:
-            if (
-                existing_receipt
-                and existing_receipt.get("recovered_from_historical_manual") is True
-                and existing_receipt.get("proof") == normalized_proof
-            ):
-                return self.store._receipt(current, duplicate=True)
-            raise JobError("JOB_TERMINAL")
-        if JobState(current["state"]) != JobState.MANUAL_OWNER_REVIEW_REQUIRED:
-            raise JobError("EXTERNAL_SIDE_EFFECT_RECOVERY_STATE_INVALID")
-        recovery_receipt = {
-            "recovered_from_historical_manual": True,
-            "recovery_kind": "VERIFIED_EXTERNAL_SIDE_EFFECT",
-            "historical_receipt": existing_receipt,
-            "proof": normalized_proof,
-        }
-        return self._advance(
-            job_id,
-            JobState.COMPLETED,
-            side_effect_state="REMOTE_VERIFIED",
-            receipt=recovery_receipt,
-            expected_revision=revision,
-            _allow_verified_external_recovery=True,
-        )
-
-    def reconcile(self, job_id: str, observer: Callable[[Mapping[str, Any]], Mapping[str, Any]]) -> JobReceipt:
-        current = self.store.read(job_id)
-        if JobState(current["state"]) not in _RECOVERABLE:
-            return self.store._receipt(current, duplicate=True)
-        self.advance(job_id, JobState.RECONCILING, side_effect_state="IN_PROGRESS")
-        try:
-            observed = dict(observer(current))
-            stable = JobState(observed.get("state", JobState.REQUESTED.value))
-            if stable in {JobState.RECOVERABLE_FAILURE, JobState.RECONCILING}:
-                raise JobError("RECONCILIATION_UNSTABLE")
-            return self.advance(job_id, stable, side_effect_state=str(observed.get("side_effect_state", "NONE")), receipt=observed.get("receipt"))
-        except Exception as exc:
-            self.advance(job_id, JobState.RECONCILIATION_REQUIRED, side_effect_state="UNKNOWN", receipt={"error_code": type(exc).__name__})
-            raise JobError("RECONCILIATION_REQUIRED") from exc
-
-    def resume(self, job_id: str) -> JobReceipt:
-        current = self.store.read(job_id)
-        if JobState(current["state"]) in _TERMINAL:
-            raise JobError("JOB_TERMINAL")
-        return self.reconcile(job_id, lambda _current: {"state": JobState.REQUESTED.value, "side_effect_state": "RESUME_SAME_JOB"})
@@ -1,279 +0,0 @@
-"""Durable Job side-effect executor for the AIOS campaign control plane."""
-
-from __future__ import annotations
-
-import argparse
-import base64
-from dataclasses import dataclass, replace
-import json
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_authority_git_executor import AuthorityGitExecutor, AuthorityGitError
-from aios_campaign_recovery import RecoveryEvidenceError, load_recovered_authorization
-from aios_gitea_machine_broker import CampaignCapabilityReceipt, GiteaMachineBroker, MachineBrokerError
-from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore
-
-
-TASK_ID = "AIOS_AUTONOMOUS_RELEASE_CAMPAIGN_V1"
-CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
-REPOSITORY = "aios/aios"
-BRANCH = "agent/autonomous-release-campaign-v1-20260807"
-EXPECTED_BRANCH_OID = "bba675fab3b7e0c5fba7066720252b3c91b9f20d"
-AUTHORIZATION_DIGEST = "6b0bf550eb702126e967eeff2d561fa808444b924d8a71f5399accad508ed3b2"
-LINEAGE_ANCHOR = "69b45e81dcd2c3707c367003b08c55fd361faae8"
-
-
-class JobExecutionError(RuntimeError):
-    pass
-
-
-@dataclass(slots=True)
-class DurableJobExecutor:
-    controller: GitOpsJobController
-    authority: AuthorityGitExecutor
-    broker: GiteaMachineBroker
-    recovery_path: Path
-
-    def _request(self, job_id: str) -> tuple[dict[str, Any], dict[str, Any]]:
-        row = self.controller.store.read(job_id)
-        try:
-            request = json.loads(row["request_json"])
-        except (KeyError, TypeError, json.JSONDecodeError) as exc:
-            raise JobExecutionError("JOB_REQUEST_INVALID") from exc
-        return row, dict(request.get("binding") or {})
-
-    def _validate_campaign(self, request: Mapping[str, Any]) -> str:
-        operation = str(request.get("operation", ""))
-        expected_branch_oid = request.get("expected_branch_oid")
-        required = {
-            "task_id": TASK_ID,
-            "campaign_id": CAMPAIGN_ID,
-            "repository": REPOSITORY,
-            "branch": BRANCH,
-            "authorization_recovery_digest": AUTHORIZATION_DIGEST,
-        }
-        for key, expected in required.items():
-            if request.get(key) != expected:
-                raise JobExecutionError(f"JOB_{key.upper()}_MISMATCH")
-        new_oid = request.get("new_branch_oid")
-        if not isinstance(new_oid, str) or len(new_oid) != 40 or any(ch not in "0123456789abcdef" for ch in new_oid):
-            raise JobExecutionError("NEW_BRANCH_OID_INVALID")
-        if not isinstance(expected_branch_oid, str) or len(expected_branch_oid) != 40 or any(ch not in "0123456789abcdef" for ch in expected_branch_oid):
-            raise JobExecutionError("EXPECTED_BRANCH_OID_INVALID")
-        if operation == "ADVANCE_EXISTING_CAMPAIGN_BRANCH" and expected_branch_oid == new_oid:
-            raise JobExecutionError("EXPECTED_BRANCH_OID_INVALID")
-        if operation != "ADVANCE_EXISTING_CAMPAIGN_BRANCH" and expected_branch_oid != new_oid:
-            raise JobExecutionError("POST_ADVANCE_HEAD_BINDING_INVALID")
-        try:
-            recovery = load_recovered_authorization(self.recovery_path)
-        except RecoveryEvidenceError as exc:
-            raise JobExecutionError(str(exc)) from exc
-        if recovery["digest"] != AUTHORIZATION_DIGEST:
-            raise JobExecutionError("RECOVERY_DIGEST_MISMATCH")
-        for key, expected in required.items():
-            if key == "campaign_id":
-                actual = recovery.get(key)
-            elif key == "authorization_recovery_digest":
-                continue
-            else:
-                actual = recovery.get({"expected_branch_oid": "expected_branch_oid"}.get(key, key))
-            if actual is not None and actual != expected:
-                raise JobExecutionError("RECOVERY_BINDING_MISMATCH")
-        if recovery.get("expected_branch_oid") != EXPECTED_BRANCH_OID:
-            raise JobExecutionError("RECOVERY_BRANCH_OID_MISMATCH")
-        authority_head = self.authority.read_ref(f"refs/heads/{BRANCH}")
-        if authority_head not in {expected_branch_oid, new_oid}:
-            raise JobExecutionError("AUTHORITY_BRANCH_EXPECTATION_MISMATCH")
-        if not self.authority.ancestry_check(expected_branch_oid, new_oid):
-            raise JobExecutionError("NEW_OID_NOT_DESCENDANT")
-        if not self.authority.ancestry_check(EXPECTED_BRANCH_OID, new_oid):
-            raise JobExecutionError("NEW_OID_OUTSIDE_AUTHORIZED_LINEAGE")
-        identity = self.broker.verify_identity()
-        if identity.get("repository") != REPOSITORY or identity.get("login") == "aiman":
-            raise JobExecutionError("MACHINE_IDENTITY_SCOPE_INVALID")
-        return new_oid
-
-    def dry_run(self, job_id: str) -> dict[str, Any]:
-        _row, request = self._request(job_id)
-        new_oid = self._validate_campaign(request)
-        remote = self.broker.readback()
-        if remote is None:
-            action = "CREATE_REQUIRED"
-        elif remote == new_oid:
-            action = "ALREADY_IN_SYNC"
-        elif remote == request["expected_branch_oid"]:
-            action = "FAST_FORWARD_REQUIRED"
-        else:
-            action = "MANUAL_OWNER_REVIEW_REQUIRED"
-        if action == "MANUAL_OWNER_REVIEW_REQUIRED":
-            raise JobExecutionError("GITEA_BRANCH_CONFLICT")
-        return {
-            "decision": "SAFE_TO_ADVANCE",
-            "authority_action": "CAS_REQUIRED",
-            "gitea_action": action,
-            "previous_branch_oid": request["expected_branch_oid"],
-            "final_branch_oid": new_oid,
-            "force_push": False,
-        }
-
-    def _recover_requested(self, job_id: str) -> dict[str, Any]:
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) in {JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}:
-            self.controller.resume(job_id)
-            row = self.controller.store.read(job_id)
-        return row
-
-    def execute(self, job_id: str, *, dry_run: bool = False) -> dict[str, Any]:
-        try:
-            return self._execute_unprotected(job_id, dry_run=dry_run)
-        except Exception as exc:
-            try:
-                row = self.controller.store.read(job_id)
-                state = JobState(row["state"])
-                if state not in {JobState.COMPLETED, JobState.MANUAL_OWNER_REVIEW_REQUIRED, JobState.RECOVERABLE_FAILURE, JobState.RECONCILIATION_REQUIRED}:
-                    self.controller.advance(job_id, JobState.RECOVERABLE_FAILURE, side_effect_state="UNKNOWN", receipt={"error_code": type(exc).__name__})
-            except Exception:
-                pass
-            raise
-
-    def _execute_unprotected(self, job_id: str, *, dry_run: bool = False) -> dict[str, Any]:
-        row, request = self._request(job_id)
-        operation = request.get("operation")
-        if operation == "ADVANCE_EXISTING_CAMPAIGN_BRANCH":
-            if dry_run:
-                return self.dry_run(job_id)
-            return self._advance_campaign(job_id)
-        if operation == "COMMIT_FILE":
-            return self._commit_file(job_id, request)
-        if operation == "SYNC_TASK_BRANCH_TO_GITEA":
-            new_oid = self._validate_campaign(request)
-            final = self.broker.push_branch(new_oid)
-            return {"operation": operation, "remote_verified": final == new_oid, "final_network_oid": final}
-        if operation == "CREATE_PR":
-            self._validate_campaign(request)
-            return dict(self.broker.create_pr("AIOS autonomous release control plane", "Durable campaign continuation; exact head and recovery evidence are bound in the Job."))
-        if operation == "PUBLISH_CHECK":
-            self._validate_campaign(request)
-            context = request.get("check_context", "aios/durable-release")
-            state = request.get("check_state", "success")
-            description = request.get("check_description", "Durable campaign control-plane check passed")
-            return dict(self.broker.status(str(state), str(description), str(context)))
-        if operation == "PROTECTED_MERGE":
-            self._validate_campaign(request)
-            number = int(request.get("pr_number", "0"))
-            self.broker.transport.expected_merge_head = request["expected_branch_oid"]
-            expected_main = request.get("expected_main_oid")
-            if expected_main is not None:
-                self.broker.transport.expected_merge_base = expected_main
-            return dict(self.broker.merge(number))
-        if operation == "RECONCILE_AUTHORITY_MAIN":
-            self._validate_campaign(request)
-            old = request.get("expected_main_oid")
-            new = request.get("new_branch_oid")
-            if not isinstance(old, str) or not isinstance(new, str):
-                raise JobExecutionError("MAIN_RECONCILIATION_BINDING_INVALID")
-            gitea_main = self.broker.transport.read_branch("main")
-            if gitea_main != new:
-                raise JobExecutionError("GITEA_MAIN_EXPECTATION_MISMATCH")
-            if not self.authority.ancestry_check(old, new):
-                raise JobExecutionError("MAIN_OID_NOT_DESCENDANT")
-            return {"authority_main": self.authority.ff_CAS_main_after_verified_protected_merge(old, new)}
-        raise JobExecutionError("OPERATION_NOT_ALLOWED")
-
-    def _advance_campaign(self, job_id: str) -> dict[str, Any]:
-        self._recover_requested(job_id)
-        row, request = self._request(job_id)
-        new_oid = self._validate_campaign(request)
-        expected_oid = request["expected_branch_oid"]
-        state = JobState(row["state"])
-        if state == JobState.REQUESTED:
-            receipt = self.controller.advance(job_id, JobState.AUTHORIZED, side_effect_state="AUTHORIZED", receipt={"authorization_digest": AUTHORIZATION_DIGEST, "task_id": TASK_ID})
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.AUTHORIZED:
-            self.controller.lease_job(job_id, lease_id=f"lease-{job_id}", lineage_anchor_oid=LINEAGE_ANCHOR, current_head_oid=expected_oid, generation=1, lease_expires_at="2099-01-01T00:00:00Z", expected_revision=int(row["revision"]))
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.LEASED:
-            self.controller.advance(job_id, JobState.WORKTREE_READY, side_effect_state="WORKTREE_READY", receipt={"branch": BRANCH, "expected_oid": expected_oid})
-            row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.WORKTREE_READY:
-            self.controller.advance(job_id, JobState.EXECUTING, side_effect_state="IN_PROGRESS")
-            row = self.controller.store.read(job_id)
-        authority_before = self.authority.read_ref(f"refs/heads/{BRANCH}")
-        if authority_before == expected_oid:
-            authority_oid = self.authority.advance_task_branch_CAS(f"refs/heads/{BRANCH}", expected_oid, new_oid)
-        elif authority_before == new_oid:
-            authority_oid = new_oid
-        else:
-            raise JobExecutionError("AUTHORITY_BRANCH_CONFLICT")
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.EXECUTING:
-            self.controller.advance(job_id, JobState.LOCAL_VERIFIED, side_effect_state="LOCAL_VERIFIED", receipt={"authority": {"branch": BRANCH, "previous_oid": expected_oid, "new_oid": new_oid, "CAS_success": True, "readback_oid": authority_oid}})
-        row = self.controller.store.read(job_id)
-        remote_before = self.broker.readback()
-        if remote_before != new_oid:
-            if remote_before not in {None, expected_oid}:
-                raise JobExecutionError("GITEA_BRANCH_CONFLICT")
-            if JobState(row["state"]) == JobState.LOCAL_VERIFIED:
-                if hasattr(self.broker, "receipt"):
-                    self.broker.receipt = replace(self.broker.receipt, expected_oid=expected_oid)
-                self.controller.advance(job_id, JobState.REMOTE_SYNCING, side_effect_state="IN_PROGRESS", receipt={"gitea": {"previous_oid": remote_before, "desired_oid": new_oid, "force_push": False}})
-            final_network = self.broker.push_branch(new_oid)
-        else:
-            final_network = new_oid
-        final_api = self.broker.readback()
-        if final_api != new_oid:
-            raise JobExecutionError("GITEA_BRANCH_READBACK_MISMATCH")
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) in {JobState.LOCAL_VERIFIED, JobState.REMOTE_SYNCING}:
-            self.controller.advance(job_id, JobState.REMOTE_VERIFIED, side_effect_state="REMOTE_VERIFIED", receipt={"gitea": {"machine_actor": "aios-autonomy-agent", "previous_oid": remote_before, "desired_oid": new_oid, "final_network_oid": final_network, "final_API_oid": final_api, "force_push": False}})
-        row = self.controller.store.read(job_id)
-        if JobState(row["state"]) == JobState.REMOTE_VERIFIED:
-            self.controller.advance(job_id, JobState.COMPLETED, side_effect_state="REMOTE_VERIFIED", receipt={"authority_oid": authority_oid, "network_oid": final_network, "gitea_api_oid": final_api, "force_push": False})
-        return self.controller.store._receipt(self.controller.store.read(job_id), duplicate=True).as_dict()
-
-    def _commit_file(self, job_id: str, request: Mapping[str, Any]) -> dict[str, Any]:
-        row = self.controller.store.read(job_id)
-        payload_ref = request.get("payload_ref")
-        if not payload_ref:
-            raise JobExecutionError("PAYLOAD_REQUIRED")
-        payload = self.controller.store.payloads.read_verified(payload_ref, row["payload_digest"], int(request["payload_size"]))
-        try:
-            spec = json.loads(payload.decode())
-            path = str(spec["path"])
-            content = base64.b64decode(spec["content_base64"], validate=True)
-        except Exception as exc:
-            raise JobExecutionError("COMMIT_FILE_PAYLOAD_INVALID") from exc
-        new_oid = self.authority.commit_file_in_isolated_worktree(base_oid=row["expected_branch_oid"], files={path: content}, message="chore(gitops): durable commit-file", worktree_name=job_id)
-        return {"operation": "COMMIT_FILE", "new_oid": new_oid}
-
-
-def build_from_environment(job_root: Path) -> DurableJobExecutor:
-    from aios_gitea_machine_transport import GiteaMachineTransport
-    from aios_gitea_machine_broker import MachineCredentialProjection
-
-    account = __import__("os").environ.get("AIOS_GITEA_MACHINE_ACCOUNT", "aios-autonomy-agent")
-    api = __import__("os").environ.get("AIOS_GITEA_API", "https://g.cnnetmkt.top/git/api/v1")
-    remote = __import__("os").environ.get("AIOS_GITEA_REMOTE", "https://g.cnnetmkt.top/git/aios/aios.git")
-    authority_dir = Path(__import__("os").environ.get("AIOS_GITOPS_AUTHORITY_GIT_DIR", "/data/aios-gitops/repo.git"))
-    worktree_root = Path(__import__("os").environ.get("AIOS_GITOPS_WORKTREE_ROOT", "/var/lib/aios-gitops/worktrees"))
-    recovery = Path(__import__("os").environ.get("AIOS_RELEASE_RECOVERY_RECEIPT", "/var/lib/aios-gitops/release-campaigns/AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807/authorization-recovery.json"))
-    transport = GiteaMachineTransport(api, REPOSITORY, remote, authority_dir)
-    credential = MachineCredentialProjection.from_mapping({"scheme": "systemd-credential", "name": "gitea-machine-token", "account": account})
-    receipt = CampaignCapabilityReceipt(CAMPAIGN_ID, TASK_ID, REPOSITORY, BRANCH, EXPECTED_BRANCH_OID, frozenset({"exact_task_branch_push", "pr_create_update", "status_publish", "protected_merge", "remote_readback"}), frozenset({"direct_main_push", "force_push", "tag_update", "tag_delete", "baseline_write", "production_deploy"}))
-    return DurableJobExecutor(GitOpsJobController(JobStore(job_root)), AuthorityGitExecutor(authority_dir, worktree_root), GiteaMachineBroker(transport, credential, receipt), recovery)
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--job-root", required=True, type=Path)
-    parser.add_argument("--job-id", required=True)
-    parser.add_argument("--dry-run", action="store_true")
-    args = parser.parse_args(argv)
-    result = build_from_environment(args.job_root).execute(args.job_id, dry_run=args.dry_run)
-    print(json.dumps(result, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,80 +0,0 @@
-"""Pure, observation-first decisions for governed GitOps reconciliation."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from enum import Enum
-import re
-from typing import Optional
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-
-
-class ReconciliationAction(str, Enum):
-    NOOP = "NOOP"
-    PUSH_EXACT = "PUSH_EXACT"
-    VERIFY_REMOTE = "VERIFY_REMOTE"
-    MARK_REMOTE_VERIFIED = "MARK_REMOTE_VERIFIED"
-    MARK_RECONCILIATION_REQUIRED = "MARK_RECONCILIATION_REQUIRED"
-    FAIL_CONFLICT = "FAIL_CONFLICT"
-
-
-@dataclass(frozen=True, slots=True)
-class RemoteObservation:
-    repository_identity: str
-    branch: str
-    desired_oid: str
-    authority_oid: Optional[str]
-    remote_git_oid: Optional[str]
-    remote_api_oid: Optional[str]
-    commit_visible: bool
-    observed_at: str
-    expected_oid: Optional[str] = None
-
-    @property
-    def all_equal(self) -> bool:
-        values = (self.authority_oid, self.remote_git_oid, self.remote_api_oid, self.desired_oid)
-        return all(isinstance(value, str) for value in values) and len(set(values)) == 1
-
-
-@dataclass(frozen=True, slots=True)
-class ReconciliationDecision:
-    action: ReconciliationAction
-    state: str
-    reason: str
-    retry_safe: bool = False
-
-
-def _valid_oid(value: Optional[str]) -> bool:
-    return value is None or bool(OID_RE.fullmatch(value))
-
-
-def decide_reconciliation(observation: RemoteObservation) -> ReconciliationDecision:
-    """Decide from a fresh observation; never complete on a missing remote."""
-    if observation.repository_identity != "aios/aios":
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "REPOSITORY_IDENTITY_MISMATCH")
-    if not observation.branch.startswith("agent/"):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "BRANCH_SCOPE_DENIED")
-    if not _valid_oid(observation.desired_oid) or not _valid_oid(observation.expected_oid):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "OID_INVALID")
-    if observation.authority_oid is None:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "AUTHORITY_UNAVAILABLE")
-    if observation.authority_oid != observation.desired_oid:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "AUTHORITY_CONFLICT")
-    present = [oid for oid in (observation.remote_git_oid, observation.remote_api_oid) if oid is not None]
-    if any(oid not in {observation.desired_oid, observation.expected_oid} for oid in present):
-        return ReconciliationDecision(ReconciliationAction.FAIL_CONFLICT, "CONFLICT", "REMOTE_OID_CONFLICT")
-    if observation.all_equal and observation.commit_visible:
-        return ReconciliationDecision(ReconciliationAction.MARK_REMOTE_VERIFIED, "REMOTE_VERIFIED", "ALL_OIDS_EQUAL_AND_VISIBLE")
-    if observation.remote_git_oid is None and observation.remote_api_oid is None:
-        return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "REMOTE_PUSH_PENDING", "AUTHORITY_DESIRED_REMOTE_MISSING")
-    if observation.remote_git_oid == observation.desired_oid or observation.remote_api_oid == observation.desired_oid:
-        return ReconciliationDecision(ReconciliationAction.VERIFY_REMOTE, "REMOTE_VERIFY_PENDING", "REMOTE_PROOF_PARTIAL")
-    if observation.expected_oid is not None and observation.remote_git_oid == observation.expected_oid and observation.remote_api_oid == observation.expected_oid:
-        return ReconciliationDecision(ReconciliationAction.PUSH_EXACT, "REMOTE_PUSH_PENDING", "SAFE_EXACT_FAST_FORWARD_RETRY", retry_safe=True)
-    if not observation.commit_visible:
-        return ReconciliationDecision(ReconciliationAction.VERIFY_REMOTE, "COMMIT_VISIBILITY_PENDING", "COMMIT_VISIBILITY_LAG")
-    return ReconciliationDecision(ReconciliationAction.MARK_RECONCILIATION_REQUIRED, "RECONCILIATION_REQUIRED", "PARTIAL_REMOTE_OBSERVATION")
-
-
-def reconcile_observation(**kwargs: object) -> ReconciliationDecision:
-    return decide_reconciliation(RemoteObservation(**kwargs))
@@ -1,52 +0,0 @@
-#!/usr/bin/env python3
-"""Fail-closed policy for in-process Git mutation handlers."""
-from __future__ import annotations
-
-import os
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Mapping
-
-_TRUE = frozenset({"1", "true", "yes", "on"})
-
-
-@dataclass(frozen=True)
-class GitWriteDecision:
-    allowed: bool
-    status_code: int
-    error: str
-    reason: str
-    workspace: str
-
-    def payload(self) -> dict[str, str]:
-        return {
-            "status": "allowed" if self.allowed else "blocked",
-            "error": self.error,
-            "reason": self.reason,
-            "workspace": self.workspace,
-        }
-
-
-def _real(path: Path) -> Path:
-    return Path(os.path.realpath(os.path.abspath(str(path))))
-
-
-def evaluate_git_write(workspace: Path | str, env: Mapping[str, str] | None = None) -> GitWriteDecision:
-    values = os.environ if env is None else env
-    lexical = Path(os.path.abspath(str(workspace)))
-    canonical = _real(lexical)
-    shown = str(lexical)
-    if str(values.get("AIOS_GITOPS_WRITES_ENABLED", "false")).strip().lower() not in _TRUE:
-        return GitWriteDecision(False, 423, "gitops_writes_disabled", "AIOS_GITOPS_WRITES_ENABLED is false", shown)
-    if lexical != canonical:
-        return GitWriteDecision(False, 409, "workspace_symlink_forbidden", "workspace must be a canonical non-symlink path", shown)
-    controller = _real(Path(values.get("AIOS_GITOPS_CONTROLLER_PATH", "/data/aios-gitops/worktrees/controller")))
-    role = str(values.get("AIOS_GITOPS_WORKSPACE_ROLE", "")).strip().lower()
-    if canonical == controller or role == "runtime-anchor":
-        return GitWriteDecision(False, 423, "runtime_anchor_read_only", "controller/runtime-anchor is read-only", str(canonical))
-    writer_root = _real(Path(values.get("AIOS_GITOPS_APPROVED_WRITER_ROOT", "/data/aios-gitops/worktrees")))
-    try:
-        canonical.relative_to(writer_root)
-    except ValueError:
-        return GitWriteDecision(False, 409, "workspace_not_approved_writer", "workspace is outside the approved writer root", str(canonical))
-    return GitWriteDecision(True, 200, "", "approved isolated writer", str(canonical))
@@ -1,100 +0,0 @@
-"""Single supervised socket-activated worker for durable GitOps Jobs.
-
-The worker consumes durable requests and reconciliation queries. Repository
-mutation is a separate injected executor and remains impossible while the
-legacy global write gate is false.
-"""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-from pathlib import Path
-import signal
-import socket
-import threading
-from typing import Any, Mapping
-
-from aios_gitops_job_controller import GitOpsJobController, JobError, JobState, JobStore, ServiceUnavailable
-
-
-def runtime_policy(environment: Mapping[str, str] | None = None) -> dict[str, bool]:
-    env = environment or os.environ
-    legacy = env.get("AIOS_GITOPS_WRITES_ENABLED", "false").lower() in {"1", "true", "yes", "on"}
-    durable = env.get("AIOS_GITOPS_DURABLE_JOB_EXECUTION_ENABLED", "false").lower() in {"1", "true", "yes", "on"}
-    # Legacy direct Git mutation remains disabled. Authorized durable Jobs use
-    # their own campaign/task capability and may mutate only through the
-    # worker's lease/CAS path while the legacy gate stays false.
-    return {"legacy_global_write": legacy, "durable_job_execution": durable, "repository_mutation_allowed": durable}
-
-
-def handle_request(controller: GitOpsJobController, request: Mapping[str, Any], executor: Any | None = None) -> dict[str, Any]:
-    job_id = str(request.get("job_id") or "")
-    if not job_id:
-        raise JobError("JOB_ID_REQUIRED")
-    if request.get("action") == "execute":
-        if executor is None:
-            raise JobError("JOB_EXECUTOR_UNAVAILABLE")
-        result = executor.execute(job_id, dry_run=bool(request.get("dry_run", False)))
-        receipt = controller.store._receipt(controller.store.read(job_id), duplicate=True)
-        return {"job": result, **receipt.as_dict()}
-    if request.get("action") == "resume":
-        receipt = controller.resume(job_id)
-    else:
-        row = controller.store.read(job_id)
-        receipt = controller.store._receipt(row, duplicate=True)
-    return receipt.as_dict()
-
-
-def serve_socket(sock: socket.socket, controller: GitOpsJobController, stopping: threading.Event, executor: Any | None = None) -> None:
-    sock.listen(32)
-    sock.settimeout(1.0)
-    while not stopping.is_set():
-        try:
-            connection, _ = sock.accept()
-        except socket.timeout:
-            continue
-        with connection:
-            try:
-                raw = connection.makefile("rb").readline(1_048_576)
-                request = json.loads(raw.decode("utf-8"))
-                response = {"status": "ok", **handle_request(controller, request, executor)}
-            except ServiceUnavailable as exc:
-                response = {"status": "error", "error": str(exc), "retryable": True, "side_effect_state": "UNKNOWN"}
-            except Exception as exc:
-                response = {"status": "error", "error": type(exc).__name__, "retryable": False}
-            connection.sendall((json.dumps(response, sort_keys=True) + "\n").encode("utf-8"))
-
-
-def socket_from_systemd() -> socket.socket:
-    if os.environ.get("LISTEN_FDS") != "1":
-        raise RuntimeError("SOCKET_ACTIVATION_REQUIRED")
-    return socket.fromfd(3, socket.AF_UNIX, socket.SOCK_STREAM)
-
-
-def main(argv: list[str] | None = None) -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--job-root", required=True, type=Path)
-    args = parser.parse_args(argv)
-    policy = runtime_policy()
-    if policy["legacy_global_write"]:
-        raise RuntimeError("LEGACY_GLOBAL_WRITES_MUST_REMAIN_FALSE")
-    if not policy["durable_job_execution"]:
-        raise RuntimeError("DURABLE_JOB_EXECUTION_GATE_CLOSED")
-    controller = GitOpsJobController(JobStore(args.job_root))
-    from aios_gitops_job_executor import build_from_environment
-    executor = build_from_environment(args.job_root)
-    stopping = threading.Event()
-    signal.signal(signal.SIGTERM, lambda *_: stopping.set())
-    signal.signal(signal.SIGINT, lambda *_: stopping.set())
-    sock = socket_from_systemd()
-    try:
-        serve_socket(sock, controller, stopping, executor)
-    finally:
-        sock.close()
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,69 +0,0 @@
-"""CLI client for the governed local writer service."""
-
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import socket
-import sys
-
-
-def _parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="Send one governed-local-writer request")
-    parser.add_argument("--socket", required=True, help="AF_UNIX socket path")
-    group = parser.add_mutually_exclusive_group(required=True)
-    group.add_argument("--request", help="Request JSON string")
-    group.add_argument("--request-file", help="Path to JSON request file")
-    return parser.parse_args()
-
-
-def _load_request_text(args: argparse.Namespace) -> str:
-    if args.request is not None:
-        return args.request
-    request_path = os.fspath(args.request_file)
-    with open(request_path, "r", encoding="utf-8") as request_file:
-        return request_file.read()
-
-
-def send_request(socket_path: str, request_text: str) -> dict[str, object]:
-    """Open one Unix socket, send one NDJSON request, and parse one NDJSON response."""
-    payload = json.loads(request_text)
-    if not isinstance(payload, dict):
-        raise ValueError("request must be a JSON object")
-
-    with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as client:
-        client.connect(socket_path)
-        client.sendall((json.dumps(payload) + "\n").encode("utf-8"))
-        response_chunks: list[str] = []
-        while True:
-            chunk = client.recv(1024 * 1024).decode("utf-8")
-            if not chunk:
-                break
-            response_chunks.append(chunk)
-            if "\n" in chunk:
-                break
-        response_text = "".join(response_chunks)
-
-    response_line = response_text.split("\n", 1)[0].strip()
-    if not response_line:
-        raise RuntimeError("empty response")
-    response = json.loads(response_line)
-    if not isinstance(response, dict):
-        raise RuntimeError("invalid response")
-    return response
-
-
-def main() -> None:
-    args = _parse_args()
-    request_text = _load_request_text(args)
-    response = send_request(args.socket, request_text)
-    print(json.dumps(response, separators=(",", ":"), sort_keys=True))
-
-
-if __name__ == "__main__":
-    try:
-        main()
-    except Exception as exc:  # pragma: no cover - CLI entrypoint behavior
-        print(json.dumps({"status": "error", "error": str(exc)}), file=sys.stderr)
-        raise SystemExit(1)
@@ -1,931 +0,0 @@
-"""Unix-socket service for governed local writer operations."""
-
-from __future__ import annotations
-
-import json
-import hashlib
-import argparse
-import importlib.util
-import os
-import re
-import socket
-import subprocess
-import sys
-import tempfile
-import uuid
-from dataclasses import dataclass, field
-from datetime import datetime, timezone
-from pathlib import Path
-from typing import Any, Callable, Mapping, Protocol
-
-from governed_local_writer import (
-    AppendCommitRequest,
-    AuthorizationError,
-    BranchPolicy,
-    CreateBranchRequest,
-    GovernedAuthorization,
-    PeerIdentity,
-    PRINCIPAL,
-    TASK_ID,
-    extract_peer_identity,
-    contains_secret_like_content,
-    load_authorization_file,
-    validate_file_changes,
-)
-
-
-class ExistingGitOpsHandler:
-    """Delegate repository mutations to the installed GitOps handler seam."""
-
-    def __init__(
-        self,
-        *,
-        workspace_by_branch: Mapping[str, str | os.PathLike[str]],
-        bare_repo: str | os.PathLike[str],
-        api_source: str | os.PathLike[str],
-    ) -> None:
-        self.workspace_by_branch = {str(k): Path(v) for k, v in workspace_by_branch.items()}
-        self.bare_repo = Path(bare_repo)
-        self.api_source = Path(api_source)
-
-    @staticmethod
-    def _restore_env(previous: Mapping[str, str | None]) -> None:
-        for key, value in previous.items():
-            if value is None:
-                os.environ.pop(key, None)
-            else:
-                os.environ[key] = value
-
-    def _load_api(self, workspace: Path):
-        if not self.api_source.is_file() or self.api_source.is_symlink():
-            raise RuntimeError("installed GitOps handler source is unavailable")
-        keys = (
-            "AIOS_GITOPS_WORKSPACE",
-            "AIOS_GITOPS_BARE_REPO",
-            "AIOS_GITOPS_WRITES_ENABLED",
-            "PYTHONDONTWRITEBYTECODE",
-            "GIT_CONFIG_COUNT",
-            "GIT_CONFIG_KEY_0",
-            "GIT_CONFIG_VALUE_0",
-            "GIT_CONFIG_KEY_1",
-            "GIT_CONFIG_VALUE_1",
-        )
-        previous = {key: os.environ.get(key) for key in keys}
-        os.environ.update(
-            {
-                "AIOS_GITOPS_WORKSPACE": str(workspace),
-                "AIOS_GITOPS_BARE_REPO": str(self.bare_repo),
-                "AIOS_GITOPS_WRITES_ENABLED": "true",
-                "PYTHONDONTWRITEBYTECODE": "1",
-                "GIT_CONFIG_COUNT": "2",
-                "GIT_CONFIG_KEY_0": "safe.directory",
-                "GIT_CONFIG_VALUE_0": str(workspace),
-                "GIT_CONFIG_KEY_1": "safe.directory",
-                "GIT_CONFIG_VALUE_1": str(self.bare_repo),
-            }
-        )
-        module_name = f"_governed_gitops_api_{uuid.uuid4().hex}"
-        try:
-            spec = importlib.util.spec_from_file_location(module_name, self.api_source)
-            if spec is None or spec.loader is None:
-                raise RuntimeError("unable to load installed GitOps handler")
-            module = importlib.util.module_from_spec(spec)
-            sys.modules[module_name] = module
-            spec.loader.exec_module(module)
-            decision = module.evaluate_git_write(module.WS)
-            if not decision.allowed:
-                raise RuntimeError("existing GitOps write gate denied bootstrap")
-            return module, previous, module_name
-        except Exception:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-            raise
-
-    def _workspace(self, branch: str) -> Path:
-        workspace = self.workspace_by_branch.get(branch)
-        if workspace is None or not workspace.is_dir():
-            raise RuntimeError("branch workspace is not authorized")
-        return workspace
-
-    @staticmethod
-    def _git(workspace: Path, args: list[str]) -> str:
-        result = subprocess.run(
-            ["git", *args], cwd=workspace, text=True, capture_output=True, check=False
-        )
-        if result.returncode != 0:
-            raise RuntimeError("governed handler git probe failed")
-        return result.stdout.strip()
-
-    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
-        workspace = self._workspace(request.branch)
-        # A prior handler call may have completed the fast-forward sync before
-        # the process observed a post-commit error. Reconcile only an exact,
-        # metadata-only result; never overwrite or move an existing ref here.
-        try:
-            existing = self._git(
-                workspace,
-                [
-                    "--git-dir",
-                    str(self.bare_repo),
-                    "rev-parse",
-                    f"refs/heads/{request.branch}",
-                ],
-            )
-        except RuntimeError:
-            existing = ""
-        if existing:
-            parent = self._git(workspace, ["--git-dir", str(self.bare_repo), "rev-parse", f"{existing}^1"])
-            changed = self._git(
-                workspace,
-                [
-                    "--git-dir",
-                    str(self.bare_repo),
-                    "diff-tree",
-                    "--no-commit-id",
-                    "--name-only",
-                    "-r",
-                    existing,
-                ],
-            ).splitlines()
-            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
-            if parent != request.base_oid or changed != [f"patches/{safe_branch}.branch.json"]:
-                raise RuntimeError("existing branch is not an exact metadata-only bootstrap")
-            return {"head_oid": existing, "parent_oid": parent, "handler_status": "reconciled"}
-        module, previous, module_name = self._load_api(workspace)
-        phase = "loaded"
-        try:
-            phase = "verify_base"
-            parent = self._git(
-                workspace,
-                ["--git-dir", str(self.bare_repo), "rev-parse", "refs/heads/main"],
-            )
-            if parent != request.base_oid:
-                raise RuntimeError("authorized base OID drift")
-            phase = "checkout"
-            module.checkout(request.branch, base=request.base_oid, create=True)
-            phase = "write_metadata"
-            safe_branch = re.sub(r"[^A-Za-z0-9_.-]+", "-", request.branch).strip("-")
-            metadata_path = f"patches/{safe_branch}.branch.json"
-            module.write_json(
-                metadata_path,
-                {
-                    "schema": "aios.governed-local-writer-bootstrap.v1",
-                    "task_id": TASK_ID,
-                    "principal": PRINCIPAL,
-                    "branch": request.branch,
-                    "parent_oid": request.base_oid,
-                    "authorization_sha256": request.authorization_digest,
-                },
-            )
-            phase = "commit_and_sync"
-            result = module.commit(
-                [metadata_path], "chore(governance): bootstrap repair lease branch"
-            )
-            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
-            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
-            if first_parent != request.base_oid or (request.head_oid and head_oid != request.head_oid):
-                raise RuntimeError("bootstrap branch lineage check failed")
-            return {
-                "head_oid": head_oid,
-                "parent_oid": first_parent,
-                "handler_status": str(result.get("status")),
-            }
-        except Exception as exc:
-            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
-        finally:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-
-    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
-        workspace = self._workspace(request.branch)
-        module, previous, module_name = self._load_api(workspace)
-        phase = "loaded"
-        try:
-            phase = "verify_head"
-            current = self._git(workspace, ["rev-parse", "HEAD"])
-            if current != request.expected_head_oid:
-                raise RuntimeError("branch head advanced or is stale")
-            phase = "checkout"
-            module.checkout(request.branch, base=request.expected_head_oid, create=False)
-            phase = "write_files"
-            paths: list[str] = []
-            for change in request.changes:
-                paths.append(module.write_file(change.path, change.content))
-            phase = "commit_and_sync"
-            result = module.commit(paths, request.commit_message)
-            head_oid = self._git(workspace, ["rev-parse", "HEAD"])
-            first_parent = self._git(workspace, ["rev-parse", "HEAD^1"])
-            if first_parent != request.expected_head_oid or head_oid == first_parent:
-                raise RuntimeError("append commit lineage check failed")
-            return {
-                "head_oid": head_oid,
-                "parent_oid": first_parent,
-                "handler_status": str(result.get("status")),
-            }
-        except Exception as exc:
-            raise RuntimeError(f"handler_phase={phase};error={exc.__class__.__name__}") from exc
-        finally:
-            sys.modules.pop(module_name, None)
-            self._restore_env(previous)
-
-
-class GovernedWriterHandler(Protocol):
-    """Small adapter interface for real writer backend handlers."""
-
-    def create_branch(self, request: CreateBranchRequest) -> Mapping[str, object]:
-        """Create a branch using internal repo services."""
-
-    def append_commit(self, request: AppendCommitRequest) -> Mapping[str, object]:
-        """Append a commit using internal repo services."""
-
-
-class AuditSink(Protocol):
-    """Pluggable sink for sanitized audit records."""
-
-    def append(self, record: "AuditRecord") -> None:
-        """Persist one audit record."""
-
-
-@dataclass
-class AuditRecord:
-    """Sanitized audit log entry."""
-
-    authorization_digest: str
-    peer_pid: int
-    peer_uid: int
-    peer_gid: int
-    peer_executable: str | None
-    timestamp: datetime
-    operation: str
-    branch: str
-    result: str
-
-
-class InMemoryAuditSink:
-    """Simple in-memory audit log used by tests."""
-
-    def __init__(self) -> None:
-        self.records: list[AuditRecord] = []
-
-    def append(self, record: AuditRecord) -> None:
-        self.records.append(record)
-
-
-@dataclass
-class _AuthorizationState:
-    """Tracks one-shot operation consumption."""
-
-    create_done: set[str] = field(default_factory=set)
-    append_done: set[str] = field(default_factory=set)
-    consumed: bool = False
-
-
-class GovernedLocalWriterService:
-    """Policy-aware AF_UNIX service that calls an injected handler."""
-
-    def __init__(
-        self,
-        socket_path: str | os.PathLike[str],
-        authorization: GovernedAuthorization,
-        handler: GovernedWriterHandler,
-        *,
-        audit_sink: AuditSink | None = None,
-        peer_identity_fn: Callable[[socket.socket], PeerIdentity] | None = None,
-        state_path: str | os.PathLike[str] | None = None,
-    ) -> None:
-        self.socket_path = Path(socket_path)
-        self.authorization = authorization
-        self.handler = handler
-        self.peer_identity_fn = peer_identity_fn or extract_peer_identity
-        self.state = _AuthorizationState()
-        self.audit_sink = audit_sink or InMemoryAuditSink()
-        self.state_path = Path(state_path) if state_path is not None else None
-        self._load_state()
-
-    def _load_state(self) -> None:
-        """Restore one-shot state without restoring request or secret material."""
-        if self.state_path is None or not self.state_path.exists():
-            return
-        try:
-            raw = json.loads(self.state_path.read_text(encoding="utf-8"))
-            if not isinstance(raw, dict):
-                raise ValueError("state must be an object")
-            if raw.get("authorization_sha256") != self.authorization.authorization_sha256:
-                raise ValueError("state authorization digest mismatch")
-            self.state.create_done = {str(v) for v in raw.get("create_done", [])}
-            self.state.append_done = {str(v) for v in raw.get("append_done", [])}
-            self.state.consumed = bool(raw.get("consumed", False))
-        except (OSError, ValueError, TypeError, json.JSONDecodeError) as exc:
-            raise AuthorizationError("authorization state is invalid") from exc
-
-    def _persist_state(self) -> None:
-        if self.state_path is None:
-            return
-        self.state_path.parent.mkdir(parents=True, exist_ok=True)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "create_done": sorted(self.state.create_done),
-            "append_done": sorted(self.state.append_done),
-            "consumed": self.state.consumed,
-        }
-        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            os.replace(temp_name, self.state_path)
-            os.chmod(self.state_path, 0o600)
-        finally:
-            if os.path.exists(temp_name):
-                os.unlink(temp_name)
-
-    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> None:
-        self.audit_sink.append(
-            AuditRecord(
-                authorization_digest=self.authorization.authorization_sha256,
-                peer_pid=peer.pid,
-                peer_uid=peer.uid,
-                peer_gid=peer.gid,
-                peer_executable=peer.executable,
-                timestamp=datetime.now(tz=timezone.utc),
-                operation=operation,
-                branch=branch,
-                result=result,
-            )
-        )
-
-    def _require_request_field(self, request: Mapping[str, Any], field_name: str) -> str:
-        value = request.get(field_name)
-        if not isinstance(value, str) or not value:
-            raise AuthorizationError(f"{field_name} must be a non-empty string")
-        return value
-
-    def _branch_policy(self, branch: str) -> BranchPolicy:
-        policy = self.authorization.branch_operations.get(branch)
-        if policy is None:
-            raise AuthorizationError("branch is not authorized")
-        return policy
-
-    def _ensure_not_consumed(self) -> None:
-        if self.state.consumed:
-            raise AuthorizationError("authorization consumed")
-        if datetime.now(tz=timezone.utc) >= self.authorization.expires_at:
-            raise AuthorizationError("authorization expired")
-
-    def _mark_success(self, op: str, branch: str) -> None:
-        if op == "create_branch":
-            self.state.create_done.add(branch)
-        elif op == "append_commit":
-            self.state.append_done.add(branch)
-
-        if self.state.create_done.issuperset(self.authorization.create_branches) and self.state.append_done.issuperset(
-            self.authorization.append_branches
-        ):
-            self.state.consumed = True
-        self._persist_state()
-
-    def _validate_request(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        task_id = self._require_request_field(request, "task_id")
-        if task_id != TASK_ID:
-            raise AuthorizationError("invalid task_id")
-
-        principal = self._require_request_field(request, "principal")
-        if principal != PRINCIPAL:
-            raise AuthorizationError("invalid principal")
-
-        operation = self._require_request_field(request, "op")
-        if operation not in {"create_branch", "append_commit"}:
-            raise AuthorizationError("unsupported operation")
-        if operation in self.authorization.denied_operations:
-            raise AuthorizationError("operation denied by policy")
-
-        branch = self._require_request_field(request, "branch")
-        self._ensure_not_consumed()
-        policy = self._branch_policy(branch)
-
-        if operation == "create_branch":
-            if policy.create_branch is None:
-                raise AuthorizationError("branch does not allow create_branch")
-            if branch in self.state.create_done:
-                raise AuthorizationError("create_branch already used for this branch")
-
-            base_oid = self._require_request_field(request, "base_oid")
-            raw_head_oid = request.get("head_oid")
-            if raw_head_oid is not None and (not isinstance(raw_head_oid, str) or not raw_head_oid):
-                raise AuthorizationError("head_oid must be a non-empty string when supplied")
-            head_oid = str(raw_head_oid) if raw_head_oid is not None else None
-            if base_oid != policy.create_branch.base_oid:
-                raise AuthorizationError("base_oid mismatch")
-            if policy.create_branch.head_oid is not None and head_oid != policy.create_branch.head_oid:
-                raise AuthorizationError("head_oid mismatch")
-
-            return {
-                "operation": operation,
-                "branch": branch,
-                "base_oid": base_oid,
-                "head_oid": head_oid,
-            }
-
-        if policy.append_commit is None:
-            raise AuthorizationError("branch does not allow append_commit")
-        if policy.create_branch is not None and branch not in self.state.create_done:
-            raise AuthorizationError("append_commit requires prior successful create_branch")
-        if branch in self.state.append_done:
-            raise AuthorizationError("append_commit already used for this branch")
-
-        expected_head = policy.append_commit.expected_head_oid
-        if "expected_head_oid" in request:
-            supplied_head = self._require_request_field(request, "expected_head_oid")
-        elif "current_head_oid" in request:
-            supplied_head = self._require_request_field(request, "current_head_oid")
-        else:
-            raise AuthorizationError("expected_head_oid or current_head_oid required")
-        if not re.fullmatch(r"[0-9a-fA-F]{40}", supplied_head):
-            raise AuthorizationError("head check must be a full commit OID")
-        if expected_head is not None and supplied_head != expected_head:
-            raise AuthorizationError("head check failed")
-
-        if request.get("force") is True or request.get("non_fast_forward") is True:
-            raise AuthorizationError("non-fast-forward operations are not allowed")
-        if request.get("history_rewrite") is True:
-            raise AuthorizationError("history rewrite is not allowed")
-        parent_oids = request.get("parent_oids")
-        if parent_oids is not None:
-            if not isinstance(parent_oids, list) or parent_oids != [supplied_head]:
-                raise AuthorizationError("parent_oids must contain exactly expected_head_oid")
-
-        changes = request.get("changes")
-        if not isinstance(changes, list):
-            raise AuthorizationError("changes must be a list")
-        validated_changes = validate_file_changes(changes, policy.append_commit.allowed_paths)
-        commit_message = request.get("commit_message", "chore(governance): append governed commit")
-        if not isinstance(commit_message, str) or not commit_message.strip() or len(commit_message) > 200:
-            raise AuthorizationError("commit_message must be a short non-empty string")
-        if "\n" in commit_message or "\r" in commit_message or contains_secret_like_content(commit_message):
-            raise AuthorizationError("commit_message failed policy")
-
-        return {
-            "operation": operation,
-            "branch": branch,
-            "expected_head_oid": supplied_head,
-            "changes": validated_changes,
-            "commit_message": commit_message.strip(),
-        }
-
-    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
-        """Run one request through policy checks and handler adapter."""
-        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
-        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
-        try:
-            details = self._validate_request(raw_request)
-            operation = str(details["operation"])
-            branch = str(details["branch"])
-
-            if operation == "create_branch":
-                self.handler.create_branch(
-                    CreateBranchRequest(
-                        branch=branch,
-                        base_oid=str(details["base_oid"]),
-                        head_oid=(
-                            str(details["head_oid"])
-                            if details.get("head_oid") is not None
-                            else None
-                        ),
-                        authorization_digest=self.authorization.authorization_sha256,
-                    )
-                )
-                self._mark_success("create_branch", branch)
-                self._new_audit(peer, operation, branch, "ok")
-                return {
-                    "status": "ok",
-                    "operation": operation,
-                    "branch": branch,
-                    "result": "applied",
-                }
-
-            self.handler.append_commit(
-                AppendCommitRequest(
-                    branch=branch,
-                    expected_head_oid=str(details["expected_head_oid"]),
-                    changes=tuple(details["changes"]),
-                    authorization_digest=self.authorization.authorization_sha256,
-                    commit_message=str(details["commit_message"]),
-                )
-            )
-            self._mark_success("append_commit", branch)
-            self._new_audit(peer, operation, branch, "ok")
-            return {
-                "status": "ok",
-                "operation": operation,
-                "branch": branch,
-                "result": "applied",
-            }
-        except Exception as error:
-            self._new_audit(peer, operation or "unknown", branch, f"error:{error.__class__.__name__}")
-            if isinstance(error, PermissionError):
-                code = "permission_denied"
-            elif isinstance(error, AuthorizationError):
-                code = "request_denied"
-            else:
-                code = "handler_failed"
-            if code == "handler_failed" and str(error).startswith("handler_phase="):
-                code = str(error)
-            return {
-                "status": "error",
-                "operation": operation or "unknown",
-                "branch": branch,
-                "error": code,
-            }
-
-    def _write_json(self, connection: socket.socket, payload: Mapping[str, Any]) -> None:
-        connection.sendall((json.dumps(payload) + "\n").encode("utf-8"))
-
-    def _handle_client(self, connection: socket.socket) -> None:
-        with connection:
-            try:
-                peer = self.peer_identity_fn(connection)
-            except Exception:
-                self._write_json(
-                    connection,
-                    {
-                        "status": "error",
-                        "operation": "connection",
-                        "branch": "",
-                        "error": "peer identity validation failed",
-                    },
-                )
-                return
-
-            with connection.makefile("r", encoding="utf-8") as stream:
-                for raw_line in stream:
-                    line = raw_line.strip()
-                    if not line:
-                        continue
-                    try:
-                        request = json.loads(line)
-                    except json.JSONDecodeError:
-                        self._write_json(
-                            connection,
-                            {
-                                "status": "error",
-                                "operation": "request",
-                                "branch": "",
-                                "error": "invalid json",
-                            },
-                        )
-                        continue
-                    if not isinstance(request, Mapping):
-                        self._write_json(
-                            connection,
-                            {
-                                "status": "error",
-                                "operation": "request",
-                                "branch": "",
-                                "error": "request must be a JSON object",
-                            },
-                        )
-                        continue
-                    self._write_json(connection, self.process_request(request, peer))
-
-    def _bind_socket(self) -> socket.socket:
-        if self.socket_path.exists():
-            raise RuntimeError("governed writer socket already exists")
-        parent = self.socket_path.parent
-        if not parent.is_dir():
-            raise RuntimeError("governed writer socket parent is missing")
-        if parent.is_symlink():
-            raise RuntimeError("governed writer socket parent must not be a symlink")
-        server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        server.bind(str(self.socket_path))
-        os.chmod(self.socket_path, 0o600)
-        server.listen(16)
-        return server
-
-    def serve(self) -> None:
-        """Serve newline-delimited JSON over a filesystem AF_UNIX socket."""
-        server = self._bind_socket()
-        try:
-            while True:
-                connection, _ = server.accept()
-                self._handle_client(connection)
-        finally:
-            server.close()
-            if self.socket_path.exists():
-                self.socket_path.unlink()
-
-
-class JsonAuditSink:
-    """Append-only root-owned audit sink containing no request payloads."""
-
-    def __init__(self, path: str | os.PathLike[str]) -> None:
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-
-    def append(self, record: AuditRecord) -> None:
-        payload = {
-            "authorization_sha256": record.authorization_digest,
-            "peer_pid": record.peer_pid,
-            "peer_uid": record.peer_uid,
-            "peer_gid": record.peer_gid,
-            "peer_executable": record.peer_executable,
-            "timestamp": record.timestamp.isoformat(),
-            "operation": record.operation,
-            "branch": record.branch,
-            "result": record.result,
-        }
-        line = (json.dumps(payload, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
-        fd = os.open(self.path, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600)
-        try:
-            os.fchmod(fd, 0o600)
-            os.write(fd, line)
-        finally:
-            os.close(fd)
-
-
-
-# V2R1C6 durable receipt overlay.  This subclasses the original root-only
-# writer in-place so the existing AF_UNIX/SO_PEERCRED and handler policy remain
-# the only mutation path.
-_LegacyGovernedLocalWriterService = GovernedLocalWriterService
-
-class GovernedLocalWriterService(_LegacyGovernedLocalWriterService):
-    """Existing writer with durable request receipts and safe recovery."""
-
-    def _load_state(self) -> None:
-        super()._load_state()
-        self.state.receipts = {}
-        if self.state_path is None or not self.state_path.exists():
-            return
-        raw = json.loads(self.state_path.read_text(encoding="utf-8"))
-        if not isinstance(raw, dict):
-            raise AuthorizationError("authorization state is invalid")
-        receipts = raw.get("receipts", {})
-        if not isinstance(receipts, dict):
-            raise AuthorizationError("authorization receipts are invalid")
-        self.state.receipts = {
-            str(key): dict(value)
-            for key, value in receipts.items()
-            if isinstance(value, dict)
-        }
-
-    def _persist_state(self) -> None:
-        if self.state_path is None:
-            return
-        self.state_path.parent.mkdir(parents=True, exist_ok=True)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "create_done": sorted(self.state.create_done),
-            "append_done": sorted(self.state.append_done),
-            "consumed": bool(self.state.consumed),
-            "receipts": self.state.receipts,
-        }
-        fd, temp_name = tempfile.mkstemp(prefix=".writer-state-", dir=self.state_path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            os.replace(temp_name, self.state_path)
-            os.chmod(self.state_path, 0o600)
-        finally:
-            if os.path.exists(temp_name):
-                os.unlink(temp_name)
-
-    def _request_identity(self, request: Mapping[str, Any]) -> dict[str, str]:
-        canonical = json.dumps(dict(request), sort_keys=True, separators=(",", ":"), ensure_ascii=True)
-        fallback = hashlib.sha256(canonical.encode("utf-8")).hexdigest()
-        request_id = request.get("request_id")
-        idempotency_key = request.get("idempotency_key")
-        request_id = request_id.strip() if isinstance(request_id, str) and request_id.strip() else "legacy-" + fallback
-        idempotency_key = idempotency_key.strip() if isinstance(idempotency_key, str) and idempotency_key.strip() else "legacy-" + fallback
-        for field_name, value in (("request_id", request_id), ("idempotency_key", idempotency_key)):
-            if len(value) > 200 or "\n" in value or "\r" in value:
-                raise AuthorizationError(field_name + " is invalid")
-        return {
-            "request_id": request_id,
-            "idempotency_key": idempotency_key,
-            "request_fingerprint": fallback,
-        }
-
-    def _find_receipt(self, details: Mapping[str, Any], compare_fingerprint: bool = True):
-        request_id = str(details["request_id"])
-        idempotency_key = str(details["idempotency_key"])
-        fingerprint = str(details.get("request_fingerprint", ""))
-        for receipt in self.state.receipts.values():
-            if receipt.get("request_id") == request_id or receipt.get("idempotency_key") == idempotency_key:
-                if compare_fingerprint and receipt.get("request_fingerprint") != fingerprint:
-                    raise AuthorizationError("idempotency key reused with different request")
-                return receipt
-        return None
-
-    @staticmethod
-    def _receipt_response(receipt: Mapping[str, object], status: str = "receipt") -> dict[str, object]:
-        response = {
-            "status": status,
-            "request_id": receipt.get("request_id"),
-            "idempotency_key": receipt.get("idempotency_key"),
-            "operation": receipt.get("operation"),
-            "branch": receipt.get("branch", ""),
-            "receipt_status": receipt.get("status"),
-        }
-        for field_name in ("commit_oid", "final_head", "parent_oid", "audit_sha256", "error_code", "safe_to_retry"):
-            if field_name in receipt:
-                response[field_name] = receipt[field_name]
-        return response
-
-    def _new_receipt(self, details: Mapping[str, Any]) -> dict[str, object]:
-        return {
-            "request_id": str(details["request_id"]),
-            "idempotency_key": str(details["idempotency_key"]),
-            "request_fingerprint": str(details["request_fingerprint"]),
-            "operation": str(details["operation"]),
-            "branch": str(details.get("branch", "")),
-            "expected_head_oid": str(details.get("expected_head_oid", "")),
-            "status": "accepted",
-            "created_at": datetime.now(tz=timezone.utc).isoformat(),
-            "safe_to_retry": False,
-        }
-
-    def _new_audit(self, peer: PeerIdentity, operation: str, branch: str, result: str) -> str:
-        super()._new_audit(peer, operation, branch, result)
-        payload = {
-            "authorization_sha256": self.authorization.authorization_sha256,
-            "peer_pid": peer.pid,
-            "peer_uid": peer.uid,
-            "peer_gid": peer.gid,
-            "peer_executable": peer.executable,
-            "operation": operation,
-            "branch": branch,
-            "result": result,
-        }
-        return hashlib.sha256(json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")).hexdigest()
-
-    def _mark_success(self, op: str, branch: str) -> None:
-        if op == "create_branch":
-            self.state.create_done.add(branch)
-        elif op in {"append_commit", "append_files", "append_batch"}:
-            self.state.append_done.add(branch)
-        # The provisioning grant is one-shot; the task writer lease itself must
-        # support multiple append receipts for the exact authorized branches.
-        self.state.consumed = False
-        self._persist_state()
-
-    def _validate_durable(self, raw_request: Mapping[str, Any]) -> dict[str, Any]:
-        operation = self._require_request_field(raw_request, "op")
-        identity = self._request_identity(raw_request)
-        if operation == "query_receipt":
-            return {"operation": operation, **identity}
-        if operation == "recover_request":
-            branch = self._require_request_field(raw_request, "branch")
-            policy = self._branch_policy(branch)
-            if policy.append_commit is None:
-                raise AuthorizationError("branch does not allow recovery")
-            expected = raw_request.get("expected_head_oid") or policy.append_commit.expected_head_oid
-            if not isinstance(expected, str) or not re.fullmatch(r"[0-9a-fA-F]{40}", expected):
-                raise AuthorizationError("recovery requires expected_head_oid")
-            return {"operation": operation, "branch": branch, "expected_head_oid": expected.lower(), **identity}
-        if operation not in {"create_branch", "append_commit", "append_files", "append_batch"}:
-            raise AuthorizationError("unsupported operation")
-        request = dict(raw_request)
-        if operation in {"append_files", "append_batch"}:
-            request["op"] = "append_commit"
-        if operation in {"append_commit", "append_files", "append_batch"}:
-            self.state.consumed = False
-        branch = request.get("branch")
-        removed = False
-        dynamic_expected = False
-        if isinstance(branch, str) and branch in self.state.append_done:
-            self.state.append_done.remove(branch)
-            removed = True
-            policy = self.authorization.branch_operations.get(branch)
-            if policy is not None and policy.append_commit is not None and policy.append_commit.expected_head_oid is not None:
-                from governed_local_writer import BranchAppendPolicy, BranchPolicy
-                self.authorization.branch_operations[branch] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=branch, expected_head_oid=None, allowed_paths=policy.append_commit.allowed_paths))
-                dynamic_expected = True
-        try:
-            details = super()._validate_request(request)
-        finally:
-            if dynamic_expected:
-                policy = self.authorization.branch_operations.get(str(branch))
-                if policy is not None and policy.append_commit is not None:
-                    from governed_local_writer import BranchAppendPolicy, BranchPolicy
-                    self.authorization.branch_operations[str(branch)] = BranchPolicy(create_branch=policy.create_branch, append_commit=BranchAppendPolicy(branch=str(branch), expected_head_oid=str(raw_request.get("expected_head_oid") or ""), allowed_paths=policy.append_commit.allowed_paths))
-            if removed:
-                self.state.append_done.add(str(branch))
-        details.update(identity)
-        details["operation"] = operation
-        return details
-
-    def _recover_backend(self, details: Mapping[str, Any]) -> dict[str, object]:
-        if not hasattr(self.handler, "_workspace") or not hasattr(self.handler, "_git"):
-            raise RuntimeError("recovery backend unavailable")
-        workspace = self.handler._workspace(str(details["branch"]))
-        expected = str(details["expected_head_oid"])
-        current = self.handler._git(workspace, ["rev-parse", "HEAD"])
-        if current == expected:
-            return {"status": "not_started", "final_head": current}
-        parent = self.handler._git(workspace, ["rev-parse", "HEAD^1"])
-        if parent != expected:
-            raise RuntimeError("external branch advance during recovery")
-        return {"status": "applied", "commit_oid": current, "final_head": current, "parent_oid": parent}
-
-    def process_request(self, raw_request: Mapping[str, Any], peer: PeerIdentity) -> Mapping[str, Any]:
-        operation = raw_request.get("op") if isinstance(raw_request.get("op"), str) else "unknown"
-        branch = raw_request.get("branch") if isinstance(raw_request.get("branch"), str) else ""
-        try:
-            details = self._validate_durable(raw_request)
-            operation = str(details["operation"])
-            branch = str(details.get("branch", ""))
-            if operation == "query_receipt":
-                receipt = self._find_receipt(details, compare_fingerprint=False)
-                return self._receipt_response(receipt) if receipt is not None else {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"]}
-            if operation == "recover_request":
-                receipt = self._find_receipt(details, compare_fingerprint=False)
-                if receipt is None:
-                    return {"status": "not_found", "request_id": details["request_id"], "idempotency_key": details["idempotency_key"], "safe_to_retry": True}
-                if receipt.get("status") == "applied":
-                    return self._receipt_response(receipt)
-                recovered = self._recover_backend(details)
-                if recovered.get("status") == "applied":
-                    receipt.update({"status": "applied", "commit_oid": recovered.get("commit_oid"), "final_head": recovered.get("final_head"), "parent_oid": recovered.get("parent_oid"), "safe_to_retry": False})
-                    self._mark_success("append_commit", branch)
-                    return self._receipt_response(receipt)
-                receipt["safe_to_retry"] = True
-                self._persist_state()
-                return self._receipt_response(receipt)
-            receipt = self._find_receipt(details)
-            if receipt is not None:
-                return self._receipt_response(receipt)
-            receipt = self._new_receipt(details)
-            self.state.receipts[str(details["request_id"])] = receipt
-            self._persist_state()
-            if operation == "create_branch":
-                result = self.handler.create_branch(CreateBranchRequest(branch=branch, base_oid=str(details["base_oid"]), head_oid=str(details["head_oid"]) if details.get("head_oid") is not None else None, authorization_digest=self.authorization.authorization_sha256))
-                commit_oid = str(result.get("head_oid", ""))
-                parent_oid = str(result.get("parent_oid", ""))
-                audit_sha = self._new_audit(peer, operation, branch, "ok")
-                receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
-                self._mark_success("create_branch", branch)
-                return self._receipt_response(receipt, status="ok") | {"result": "applied"}
-            result = self.handler.append_commit(AppendCommitRequest(branch=branch, expected_head_oid=str(details["expected_head_oid"]), changes=tuple(details["changes"]), authorization_digest=self.authorization.authorization_sha256, commit_message=str(details["commit_message"])))
-            commit_oid = str(result.get("head_oid", ""))
-            parent_oid = str(result.get("parent_oid", ""))
-            audit_sha = self._new_audit(peer, operation, branch, "ok")
-            receipt.update({"status": "applied", "commit_oid": commit_oid, "final_head": commit_oid, "parent_oid": parent_oid, "audit_sha256": audit_sha, "safe_to_retry": False})
-            self._mark_success("append_commit", branch)
-            return self._receipt_response(receipt, status="ok") | {"result": "applied"}
-        except Exception as error:
-            try:
-                identity = self._request_identity(raw_request)
-                receipt = self.state.receipts.get(identity["request_id"])
-                if receipt is not None and receipt.get("status") == "accepted":
-                    receipt.update({"status": "failed", "error_code": error.__class__.__name__, "safe_to_retry": False})
-                    self._persist_state()
-            except Exception:
-                pass
-            self._new_audit(peer, operation, branch, "error:" + error.__class__.__name__)
-            return {"status": "error", "operation": operation, "branch": branch, "error": "request_denied" if isinstance(error, AuthorizationError) else "handler_failed"}
-
-def _parse_args() -> argparse.Namespace:
-    parser = argparse.ArgumentParser(description="AIOS governed local writer")
-    parser.add_argument("--socket", required=True)
-    parser.add_argument("--authorization", required=True)
-    parser.add_argument("--state", required=True)
-    parser.add_argument("--audit", required=True)
-    parser.add_argument("--repair-branch", required=True)
-    parser.add_argument("--repair-workspace", required=True)
-    parser.add_argument("--candidate-branch", required=True)
-    parser.add_argument("--candidate-workspace", required=True)
-    parser.add_argument("--bare-repo", required=True)
-    parser.add_argument("--api-source", required=True)
-    return parser.parse_args()
-
-
-def main() -> int:
-    if hasattr(os, "geteuid") and os.geteuid() != 0:
-        print("governed local writer requires uid 0", file=sys.stderr)
-        return 2
-    args = _parse_args()
-    authorization = load_authorization_file(args.authorization)
-    handler = ExistingGitOpsHandler(
-        workspace_by_branch={
-            args.repair_branch: args.repair_workspace,
-            args.candidate_branch: args.candidate_workspace,
-        },
-        bare_repo=args.bare_repo,
-        api_source=args.api_source,
-    )
-    service = GovernedLocalWriterService(
-        args.socket,
-        authorization,
-        handler,
-        audit_sink=JsonAuditSink(args.audit),
-        state_path=args.state,
-    )
-    service.serve()
-    return 0
-
-
-if __name__ == "__main__":  # pragma: no cover - systemd entrypoint
-    raise SystemExit(main())
@@ -1,59 +0,0 @@
-"""Central fail-closed policy seam for governed task and continuation requests."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-import re
-from typing import Any, Mapping
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedPolicyInput:
-    identity: str
-    task_id: str
-    repository: str
-    operation: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    generation: int
-    risk: str = "engineering"
-    requested_capabilities: tuple[str, ...] = ()
-    previous_generation: int | None = None
-
-
-@dataclass(frozen=True, slots=True)
-class PolicyDecision:
-    decision: str
-    reason: str
-
-    def as_dict(self) -> dict[str, str]:
-        return {"decision": self.decision, "reason": self.reason}
-
-
-def evaluate_policy(value: GovernedPolicyInput | Mapping[str, Any]) -> PolicyDecision:
-    if isinstance(value, Mapping):
-        value = GovernedPolicyInput(**value)
-    if value.repository != "aios/aios":
-        return PolicyDecision("DENY", "REPOSITORY_IDENTITY_MISMATCH")
-    if not OID_RE.fullmatch(value.base_oid) or not OID_RE.fullmatch(value.expected_branch_oid):
-        return PolicyDecision("DENY", "OID_INVALID")
-    if not value.target_branch.startswith("agent/") or value.target_branch in {"main", "master"}:
-        return PolicyDecision("DENY", "BRANCH_SCOPE_DENIED")
-    if "force_push" in value.requested_capabilities or "force" in value.operation.lower():
-        return PolicyDecision("DENY", "FORCE_PUSH_DENIED")
-    if {"main_write", "tag_write", "baseline_write", "production_write", "production_deploy", "tag_mutation", "baseline_mutation"}.intersection(value.requested_capabilities):
-        return PolicyDecision("DENY", "MUTATION_SCOPE_DENIED")
-    if not isinstance(value.generation, int) or isinstance(value.generation, bool) or value.generation < 1:
-        return PolicyDecision("DENY", "GENERATION_INVALID")
-    if value.previous_generation is not None and value.generation <= value.previous_generation:
-        return PolicyDecision("MANUAL_OWNER_REVIEW_REQUIRED", "GENERATION_NOT_MONOTONIC")
-    if not value.task_id:
-        return PolicyDecision("DENY", "TASK_ID_INVALID")
-    return PolicyDecision("ALLOW", "GOVERNED_ENGINEERING_SCOPE")
-
-
-class GovernedPolicy:
-    def decide(self, request: GovernedPolicyInput | Mapping[str, Any]) -> PolicyDecision:
-        return evaluate_policy(request)
@@ -1,84 +0,0 @@
-"""Durable governed task binding for CREATE_NEW and CONTINUE_EXISTING."""
-from __future__ import annotations
-
-from dataclasses import dataclass, asdict
-import hashlib
-import json
-from pathlib import Path
-import re
-from typing import Any, Mapping
-
-from aios_gitops_job_controller import GitOpsJobController, JobStore
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-
-
-class BootstrapError(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedTaskBinding:
-    task_id: str
-    repository: str
-    base_oid: str
-    target_branch: str
-    risk: str
-    description: str
-    idempotency_key: str
-    expected_branch_oid: str
-    branch_mode: str
-    generation: int
-    job_id: str | None = None
-
-    def response(self, *, idempotent: bool = False) -> dict[str, Any]:
-        return {"task_id": self.task_id, "repository": self.repository, "base_oid": self.base_oid, "target_branch": self.target_branch, "expected_branch_oid": self.expected_branch_oid, "generation": self.generation, "branch_mode": self.branch_mode, "create_target_branch": self.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if self.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True, "idempotent": idempotent, "state": "BOUND", "job_id": self.job_id}
-
-
-def _safe(value: str) -> str:
-    return re.sub(r"[^A-Za-z0-9_.-]+", "-", value).strip("-")[:120] or "task"
-
-
-class GovernedTaskBootstrap:
-    def __init__(self, authority: Any, root: Path, *, remote_name: str, token_path: Path, ssh_key_path: Path, api_base: str = "https://g.cnnetmkt.top/git/api/v1") -> None:
-        self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True)
-
-    def _store(self, task_id: str) -> tuple[JobStore, GitOpsJobController]:
-        root = self.job_root / _safe(task_id); store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
-
-    def _metadata(self, task_id: str) -> Path:
-        return self.task_meta_root / (_safe(task_id) + ".json")
-
-    def _read_existing(self, task_id: str) -> GovernedTaskBinding | None:
-        path = self._metadata(task_id)
-        if not path.is_file() or path.is_symlink(): return None
-        return GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
-
-    def _write(self, binding: GovernedTaskBinding) -> None:
-        path = self._metadata(binding.task_id); temporary = path.with_suffix(".tmp"); temporary.write_text(json.dumps(asdict(binding), sort_keys=True), encoding="utf-8"); temporary.replace(path)
-
-    def create(self, request: Mapping[str, Any]) -> dict[str, Any]:
-        values = {key: str(request[key]) for key in ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")}
-        if values["repository"] != "aios/aios" or not OID_RE.fullmatch(values["base_oid"]): raise BootstrapError("TASK_BINDING_INVALID")
-        if not BRANCH_RE.fullmatch(values["target_branch"]): raise BootstrapError("TARGET_BRANCH_INVALID")
-        existing = self._read_existing(values["task_id"])
-        if existing is not None:
-            if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description")): raise BootstrapError("TASK_BINDING_CONFLICT")
-            return existing.response(idempotent=True)
-        if not self.authority.commit_exists(values["base_oid"]): raise BootstrapError("BASE_COMMIT_NOT_FOUND")
-        current = self.authority.read_ref("refs/heads/" + values["target_branch"])
-        expected = str(request.get("expected_branch_oid") or values["base_oid"])
-        if current is None:
-            mode, generation = "CREATE_NEW", 1
-            if expected != values["base_oid"]: raise BootstrapError("EXPECTED_BASE_CONFLICT")
-        else:
-            if expected != current: raise BootstrapError("EXISTING_BRANCH_OID_CONFLICT")
-            mode, generation = "CONTINUE_EXISTING", int(request.get("generation", 2))
-            if generation < 1: raise BootstrapError("GENERATION_INVALID")
-        payload = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
-        _, controller = self._store(values["task_id"])
-        receipt = controller.submit({"idempotency_key": values["idempotency_key"], "campaign_id": values["task_id"], "task_id": values["task_id"], "repository": values["repository"], "operation": "GOVERNED_TASK_CREATE", "branch": values["target_branch"], "expected_branch_oid": expected, "payload_digest": hashlib.sha256(payload).hexdigest(), "lineage_anchor_oid": values["base_oid"]}, payload=payload)
-        binding = GovernedTaskBinding(**values, expected_branch_oid=expected, branch_mode=mode, generation=generation, job_id=receipt.job_id)
-        self._write(binding)
-        return binding.response()
@@ -1,456 +0,0 @@
-#!/usr/bin/env python3
-"""Disabled-by-default TLS edge for the read-only GPT Online Task ingress.
-
-The internal AIOS ingress remains loopback-only. This service is a separate edge
-that may bind non-loopback only when the owner explicitly approves it. It
-forwards only the tiny read-only ingress API and never proxies the canonical
-Bridge or Task API.
-"""
-
-from __future__ import annotations
-
-from collections import defaultdict, deque
-from dataclasses import dataclass
-import hashlib
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import secrets
-import ssl
-import sys
-import threading
-import time
-import urllib.error
-import urllib.request
-from typing import Any, Mapping
-from urllib.parse import urlsplit
-
-UPSTREAM = "http://127.0.0.1:18945"
-MAX_BODY = 64 * 1024
-MAX_RESPONSE = 256 * 1024
-MAX_CONCURRENT_REQUESTS = 32
-REQUEST_TIMEOUT_SECONDS = 20
-RATE_WINDOW_SECONDS = 60
-RATE_LIMIT_REQUESTS = 60
-RATE_BURST_REQUESTS = 15
-RATE_MAX_CLIENTS = 4096
-_AUDIT_SALT = secrets.token_bytes(32)
-PUBLIC_APPROVAL_ENV = "AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED"
-PUBLIC_DOMAIN_ENV = "AIOS_GPT_EDGE_PUBLIC_DOMAIN"
-TASK_PATH_RE = re.compile(r"^/v1/read-only-tasks(?:/[A-Za-z0-9][A-Za-z0-9._:-]{7,127})?$")
-
-
-def _client_pseudonym(value: str) -> str:
-    return hashlib.sha256(_AUDIT_SALT + value.encode("utf-8", "replace")).hexdigest()[:16]
-
-
-def audit(event: str, **fields: object) -> None:
-    safe = {
-        "event": event,
-        "ts_unix_ms": int(time.time() * 1000),
-    }
-    for key, value in fields.items():
-        if key in {"authorization", "body", "token", "cookie", "client_ip"}:
-            continue
-        safe[key] = value
-    print(
-        json.dumps(safe, sort_keys=True, separators=(",", ":")),
-        file=sys.stderr,
-        flush=True,
-    )
-
-
-class EdgeError(RuntimeError):
-    def __init__(self, code: str, status: int = 400) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def public_bind_allowed(host: str, approval: str) -> str:
-    value = host.strip()
-    if value in {"127.0.0.1", "::1", "localhost"}:
-        return value
-    if approval != "1":
-        raise RuntimeError("GPT_EDGE_PUBLIC_BIND_OWNER_APPROVAL_REQUIRED")
-    if value not in {"0.0.0.0", "::"}:
-        raise RuntimeError("GPT_EDGE_BIND_ADDRESS_INVALID")
-    return value
-
-
-def validated_public_domain(value: str) -> str:
-    domain = value.strip().lower()
-    if not domain:
-        return ""
-    if len(domain) > 253 or re.fullmatch(
-        r"(?=.{1,253}\Z)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?",
-        domain,
-    ) is None:
-        raise RuntimeError("GPT_EDGE_PUBLIC_DOMAIN_INVALID")
-    return domain
-
-
-def validated_edge_identity(host: str, approval: str, domain: str) -> tuple[str, str]:
-    bind_host = public_bind_allowed(host, approval)
-    public_domain = validated_public_domain(domain)
-    if bind_host not in {"127.0.0.1", "::1", "localhost"} and not public_domain:
-        raise RuntimeError("GPT_EDGE_PUBLIC_DOMAIN_REQUIRED")
-    return bind_host, public_domain
-
-
-def validate_tls_file(path: Path, *, key: bool) -> Path:
-    if path.is_symlink() or not path.is_file():
-        raise RuntimeError("GPT_EDGE_TLS_FILE_INVALID")
-    size = path.stat().st_size
-    if size < 16 or size > 256 * 1024:
-        raise RuntimeError("GPT_EDGE_TLS_FILE_INVALID")
-    if key and (path.stat().st_mode & 0o077):
-        raise RuntimeError("GPT_EDGE_TLS_KEY_MODE_INVALID")
-    return path
-
-
-def build_tls_context(cert_path: Path, key_path: Path) -> ssl.SSLContext:
-    cert = validate_tls_file(cert_path, key=False)
-    key = validate_tls_file(key_path, key=True)
-    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-    context.minimum_version = ssl.TLSVersion.TLSv1_2
-    context.options |= ssl.OP_NO_COMPRESSION
-    context.load_cert_chain(certfile=str(cert), keyfile=str(key))
-    return context
-
-
-def allowed_route(method: str, raw_path: str) -> str:
-    parsed = urlsplit(raw_path)
-    if parsed.query or parsed.fragment:
-        raise EdgeError("QUERY_OR_FRAGMENT_DENY", 400)
-    path = parsed.path
-    if method == "GET" and path in {"/health", "/openapi.json"}:
-        return path
-    if method == "POST" and path == "/v1/read-only-tasks":
-        return path
-    if method == "GET" and TASK_PATH_RE.fullmatch(path):
-        return path
-    raise EdgeError("ROUTE_DENY", 404)
-
-
-def route_label(method: str, path: str) -> str:
-    if method == "GET" and path == "/health":
-        return "health"
-    if method == "GET" and path == "/openapi.json":
-        return "openapi"
-    if method == "POST" and path == "/v1/read-only-tasks":
-        return "task_create"
-    if method == "GET" and path.startswith("/v1/read-only-tasks/"):
-        return "task_status"
-    return "unknown"
-
-
-def forwarded_headers(headers: Mapping[str, str], *, body: bool) -> dict[str, str]:
-    result = {"Accept": "application/json"}
-    authorization = headers.get("Authorization")
-    if not isinstance(authorization, str) or not authorization.startswith("Bearer "):
-        raise EdgeError("AUTHORIZATION_REQUIRED", 401)
-    token = authorization[7:]
-    if len(token) < 32 or len(token) > 4096 or any(ch.isspace() for ch in token):
-        raise EdgeError("AUTHORIZATION_INVALID", 401)
-    result["Authorization"] = authorization
-    if body:
-        content_type = headers.get("Content-Type", "")
-        if content_type.split(";", 1)[0].strip().lower() != "application/json":
-            raise EdgeError("CONTENT_TYPE_INVALID", 415)
-        result["Content-Type"] = "application/json"
-    return result
-
-
-class RateLimiter:
-    def __init__(
-        self,
-        *,
-        window_seconds: int = RATE_WINDOW_SECONDS,
-        limit: int = RATE_LIMIT_REQUESTS,
-        burst: int = RATE_BURST_REQUESTS,
-        max_clients: int = RATE_MAX_CLIENTS,
-        now_fn=time.monotonic,
-    ) -> None:
-        self.window_seconds = window_seconds
-        self.limit = limit
-        self.burst = burst
-        self.max_clients = max_clients
-        self.now_fn = now_fn
-        self._lock = threading.Lock()
-        self._events: dict[str, deque[float]] = defaultdict(deque)
-
-    def _prune_stale(self, cutoff: float) -> None:
-        stale = [
-            key
-            for key, events in self._events.items()
-            if not events or events[-1] <= cutoff
-        ]
-        for key in stale:
-            self._events.pop(key, None)
-
-    def allowed(self, key: str) -> bool:
-        now = self.now_fn()
-        cutoff = now - self.window_seconds
-        with self._lock:
-            if key not in self._events and len(self._events) >= self.max_clients:
-                self._prune_stale(cutoff)
-                if len(self._events) >= self.max_clients:
-                    return False
-            events = self._events[key]
-            while events and events[0] <= cutoff:
-                events.popleft()
-            if len(events) >= self.limit + self.burst:
-                return False
-            events.append(now)
-            return True
-
-
-@dataclass(frozen=True)
-class Proxy:
-    upstream: str = UPSTREAM
-    timeout: int = REQUEST_TIMEOUT_SECONDS
-
-    def request(
-        self,
-        method: str,
-        path: str,
-        headers: Mapping[str, str],
-        body: bytes | None,
-    ) -> tuple[int, bytes, str]:
-        if self.upstream != UPSTREAM:
-            raise EdgeError("UPSTREAM_DRIFT_DENY", 503)
-        req = urllib.request.Request(
-            self.upstream + path,
-            method=method,
-            data=body,
-            headers=dict(headers),
-        )
-        try:
-            with urllib.request.urlopen(req, timeout=self.timeout) as response:
-                raw = response.read(MAX_RESPONSE + 1)
-                status = response.status
-                content_type = response.headers.get("Content-Type", "application/json")
-        except urllib.error.HTTPError as exc:
-            raw = exc.read(MAX_RESPONSE + 1)
-            status = exc.code
-            content_type = exc.headers.get("Content-Type", "application/json")
-        except Exception as exc:
-            raise EdgeError("UPSTREAM_UNAVAILABLE", 502) from exc
-        if len(raw) > MAX_RESPONSE:
-            raise EdgeError("UPSTREAM_RESPONSE_TOO_LARGE", 502)
-        if content_type.split(";", 1)[0].strip().lower() != "application/json":
-            raise EdgeError("UPSTREAM_CONTENT_TYPE_INVALID", 502)
-        return status, raw, "application/json"
-
-
-class EdgeServer(ThreadingHTTPServer):
-    daemon_threads = True
-    request_queue_size = 64
-    allow_reuse_address = True
-
-
-class Handler(BaseHTTPRequestHandler):
-    proxy = Proxy()
-    limiter = RateLimiter()
-    concurrency = threading.BoundedSemaphore(MAX_CONCURRENT_REQUESTS)
-    expected_domain = ""
-
-    server_version = "AIOSGPTIngressEdge/1.0"
-    sys_version = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def respond_json(self, value: Mapping[str, Any], status: int) -> None:
-        raw = canonical(value)
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("X-Content-Type-Options", "nosniff")
-        self.send_header("Referrer-Policy", "no-referrer")
-        self.send_header("Content-Security-Policy", "default-src 'none'")
-        self.send_header("Strict-Transport-Security", "max-age=31536000")
-        self.send_header("Content-Length", str(len(raw)))
-        self.end_headers()
-        self.wfile.write(raw)
-
-    def send_proxy_response(self, status: int, raw: bytes, content_type: str) -> None:
-        self.send_response(status)
-        self.send_header("Content-Type", content_type)
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("X-Content-Type-Options", "nosniff")
-        self.send_header("Referrer-Policy", "no-referrer")
-        self.send_header("Content-Security-Policy", "default-src 'none'")
-        self.send_header("Strict-Transport-Security", "max-age=31536000")
-        self.send_header("Content-Length", str(len(raw)))
-        self.end_headers()
-        self.wfile.write(raw)
-
-    def client_key(self) -> str:
-        return str(self.client_address[0])
-
-    def validate_host(self) -> None:
-        if not self.expected_domain:
-            return
-        host = self.headers.get("Host", "").split(":", 1)[0].lower()
-        if not hmac.compare_digest(host, self.expected_domain):
-            raise EdgeError("HOST_HEADER_DENY", 421)
-
-    def body(self) -> bytes:
-        try:
-            length = int(self.headers.get("Content-Length", "-1"))
-        except ValueError as exc:
-            raise EdgeError("CONTENT_LENGTH_INVALID") from exc
-        if length < 1 or length > MAX_BODY:
-            raise EdgeError("REQUEST_SIZE_INVALID", 413)
-        raw = self.rfile.read(length)
-        if len(raw) != length:
-            raise EdgeError("REQUEST_BODY_TRUNCATED", 400)
-        # Validate JSON at the edge so malformed bodies do not consume upstream work.
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except Exception as exc:
-            raise EdgeError("REQUEST_JSON_INVALID", 400) from exc
-        if not isinstance(value, Mapping):
-            raise EdgeError("REQUEST_JSON_OBJECT_REQUIRED", 400)
-        return canonical(value)
-
-    def handle_proxy(self, method: str) -> None:
-        client_id = _client_pseudonym(self.client_key())
-        started = time.monotonic()
-        acquired = self.concurrency.acquire(blocking=False)
-        if not acquired:
-            audit("EDGE_BUSY", client_id=client_id, method=method)
-            self.respond_json({"error": "EDGE_BUSY"}, 503)
-            return
-        label = "unknown"
-        try:
-            self.validate_host()
-            path = allowed_route(method, self.path)
-            label = route_label(method, path)
-            if path == "/health" and method == "GET":
-                self.respond_json(
-                    {
-                        "status": "ok",
-                        "service": "aios-gpt-https-edge",
-                        "upstream": "loopback-readonly-ingress",
-                    },
-                    200,
-                )
-                audit(
-                    "EDGE_REQUEST",
-                    client_id=client_id,
-                    method=method,
-                    route=label,
-                    status=200,
-                    duration_ms=int((time.monotonic() - started) * 1000),
-                )
-                return
-            if not self.limiter.allowed(self.client_key()):
-                audit(
-                    "EDGE_RATE_LIMIT",
-                    client_id=client_id,
-                    method=method,
-                    route=label,
-                )
-                self.respond_json({"error": "RATE_LIMITED"}, 429)
-                return
-            has_body = method == "POST"
-            headers = forwarded_headers(self.headers, body=has_body)
-            body = self.body() if has_body else None
-            status, raw, content_type = self.proxy.request(
-                method,
-                path,
-                headers,
-                body,
-            )
-            self.send_proxy_response(status, raw, content_type)
-            audit(
-                "EDGE_REQUEST",
-                client_id=client_id,
-                method=method,
-                route=label,
-                status=status,
-                duration_ms=int((time.monotonic() - started) * 1000),
-            )
-        except EdgeError as exc:
-            audit(
-                "EDGE_REJECT",
-                client_id=client_id,
-                method=method,
-                route=label,
-                status=exc.status,
-                error=exc.code,
-            )
-            self.respond_json({"error": exc.code}, exc.status)
-        finally:
-            self.concurrency.release()
-
-    def do_GET(self) -> None:
-        self.handle_proxy("GET")
-
-    def do_POST(self) -> None:
-        self.handle_proxy("POST")
-
-    def do_PUT(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-    def do_PATCH(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-    def do_DELETE(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-    def do_CONNECT(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-    def do_OPTIONS(self) -> None:
-        self.respond_json({"error": "METHOD_DENY"}, 405)
-
-
-def serve() -> None:
-    host, public_domain = validated_edge_identity(
-        os.environ.get("AIOS_GPT_EDGE_HOST", "127.0.0.1"),
-        os.environ.get(PUBLIC_APPROVAL_ENV, "0"),
-        os.environ.get(PUBLIC_DOMAIN_ENV, ""),
-    )
-    port = int(os.environ.get("AIOS_GPT_EDGE_PORT", "18443"))
-    if not 1024 <= port <= 65535:
-        raise RuntimeError("GPT_EDGE_PORT_INVALID")
-    Handler.expected_domain = public_domain
-
-    credentials = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-    cert_path = Path(
-        os.environ.get(
-            "AIOS_GPT_EDGE_TLS_CERT_FILE",
-            str(credentials / "tls_cert"),
-        )
-    )
-    key_path = Path(
-        os.environ.get(
-            "AIOS_GPT_EDGE_TLS_KEY_FILE",
-            str(credentials / "tls_key"),
-        )
-    )
-    context = build_tls_context(cert_path, key_path)
-
-    server = EdgeServer((host, port), Handler)
-    server.socket = context.wrap_socket(server.socket, server_side=True)
-    server.serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,561 +0,0 @@
-#!/usr/bin/env python3
-"""Owner-approved activation/rollback controller for the AIOS GPT HTTPS edge.
-
-This controller never creates approval, TLS, or ingress credentials. It consumes
-owner-managed inputs, applies one exact public-bind overlay, verifies the live
-edge, and provides an idempotent rollback path.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import argparse
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import socket
-import ssl
-import stat
-import subprocess
-import tempfile
-import time
-import urllib.request
-from typing import Any, Mapping
-
-APPROVAL_SCHEMA = "aios.gpt-https-edge.public-approval.v1"
-STATE_SCHEMA = "aios.gpt-https-edge.activation-state.v1"
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-APPROVAL_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$")
-DOMAIN_RE = re.compile(
-    r"(?=.{1,253}\Z)"
-    r"(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+"
-    r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?"
-)
-
-EDGE_UNIT = "aios-gpt-https-edge.service"
-INGRESS_UNIT = "aios-gpt-online-task-ingress.service"
-PUBLIC_HOST = "0.0.0.0"
-PUBLIC_PORT = 18443
-INGRESS_HEALTH = "http://127.0.0.1:18945/health"
-DROPIN_NAME = "zzzzzzzzzz-owner-approved-public.conf"
-
-
-class ActivationError(RuntimeError):
-    pass
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def sha256_bytes(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-
-def sha256_file(path: Path) -> str:
-    return sha256_bytes(path.read_bytes())
-
-
-def parse_time(value: object, *, field: str) -> datetime:
-    if not isinstance(value, str) or not value.strip():
-        raise ActivationError("APPROVAL_" + field.upper() + "_INVALID")
-    text = value.strip()
-    if text.endswith("Z"):
-        text = text[:-1] + "+00:00"
-    try:
-        parsed = datetime.fromisoformat(text)
-    except ValueError as exc:
-        raise ActivationError("APPROVAL_" + field.upper() + "_INVALID") from exc
-    if parsed.tzinfo is None:
-        raise ActivationError("APPROVAL_" + field.upper() + "_INVALID")
-    return parsed.astimezone(timezone.utc)
-
-
-def validate_domain(value: object) -> str:
-    if not isinstance(value, str):
-        raise ActivationError("APPROVAL_DOMAIN_INVALID")
-    domain = value.strip().lower()
-    if DOMAIN_RE.fullmatch(domain) is None:
-        raise ActivationError("APPROVAL_DOMAIN_INVALID")
-    return domain
-
-
-def validate_root_file(
-    path: Path,
-    *,
-    exact_mode: int | None = None,
-    max_size: int = 256 * 1024,
-) -> Path:
-    if path.is_symlink() or not path.is_file():
-        raise ActivationError("OWNER_FILE_INVALID")
-    info = path.stat()
-    if info.st_uid != 0 or info.st_gid != 0:
-        raise ActivationError("OWNER_FILE_OWNERSHIP_INVALID")
-    mode = stat.S_IMODE(info.st_mode)
-    if exact_mode is not None and mode != exact_mode:
-        raise ActivationError("OWNER_FILE_MODE_INVALID")
-    if info.st_size < 16 or info.st_size > max_size:
-        raise ActivationError("OWNER_FILE_SIZE_INVALID")
-    return path
-
-
-def certificate_dns_names(cert_path: Path) -> tuple[str, ...]:
-    try:
-        decoded = ssl._ssl._test_decode_cert(str(cert_path))
-    except Exception as exc:
-        raise ActivationError("TLS_CERT_DECODE_INVALID") from exc
-    names = [
-        value
-        for kind, value in decoded.get("subjectAltName", ())
-        if kind == "DNS"
-    ]
-    if not names:
-        for rdn in decoded.get("subject", ()):
-            for key, value in rdn:
-                if key == "commonName":
-                    names.append(value)
-    return tuple(names)
-
-
-def cert_matches_domain(cert_path: Path, domain: str) -> bool:
-    names = certificate_dns_names(cert_path)
-    try:
-        return bool(names) and any(ssl._dnsname_match(name, domain) for name in names)
-    except ssl.CertificateError:
-        return False
-
-
-def validate_tls_pair(
-    cert_path: Path,
-    key_path: Path,
-    domain: str,
-    *,
-    now_fn=time.time,
-) -> dict[str, Any]:
-    validate_root_file(cert_path)
-    validate_root_file(key_path, exact_mode=0o600)
-    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-    context.minimum_version = ssl.TLSVersion.TLSv1_2
-    context.options |= ssl.OP_NO_COMPRESSION
-    try:
-        context.load_cert_chain(str(cert_path), str(key_path))
-    except Exception as exc:
-        raise ActivationError("TLS_CERT_KEY_PAIR_INVALID") from exc
-    if not cert_matches_domain(cert_path, domain):
-        raise ActivationError("TLS_CERT_DOMAIN_MISMATCH")
-    decoded = ssl._ssl._test_decode_cert(str(cert_path))
-    not_after = decoded.get("notAfter")
-    if not not_after:
-        raise ActivationError("TLS_CERT_EXPIRY_MISSING")
-    remaining = ssl.cert_time_to_seconds(not_after) - now_fn()
-    if remaining < 7 * 86400:
-        raise ActivationError("TLS_CERT_EXPIRY_TOO_CLOSE")
-    return {
-        "cert_sha256": sha256_file(cert_path),
-        "remaining_days": int(remaining // 86400),
-    }
-
-
-@dataclass(frozen=True)
-class Approval:
-    approval_id: str
-    candidate_oid: str
-    domain: str
-    bind_host: str
-    port: int
-    tls_cert_sha256: str
-    owner: str
-    issued_at: datetime
-    not_before: datetime
-    expires_at: datetime
-    raw_sha256: str
-
-    @classmethod
-    def load(
-        cls,
-        path: Path,
-        *,
-        candidate_oid: str,
-        cert_path: Path,
-        now: datetime | None = None,
-    ) -> "Approval":
-        validate_root_file(path, exact_mode=0o600, max_size=64 * 1024)
-        try:
-            value = json.loads(path.read_text(encoding="utf-8"))
-        except Exception as exc:
-            raise ActivationError("APPROVAL_JSON_INVALID") from exc
-        if not isinstance(value, Mapping):
-            raise ActivationError("APPROVAL_JSON_INVALID")
-        allowed = {
-            "schema",
-            "approval_id",
-            "candidate_oid",
-            "domain",
-            "public_bind",
-            "bind_host",
-            "port",
-            "tls_cert_sha256",
-            "issued_at",
-            "not_before",
-            "expires_at",
-            "owner",
-        }
-        if set(value) != allowed or value.get("schema") != APPROVAL_SCHEMA:
-            raise ActivationError("APPROVAL_FIELDS_INVALID")
-
-        approval_id = value.get("approval_id")
-        if not isinstance(approval_id, str) or APPROVAL_ID_RE.fullmatch(approval_id) is None:
-            raise ActivationError("APPROVAL_ID_INVALID")
-        if not OID_RE.fullmatch(str(value.get("candidate_oid") or "")):
-            raise ActivationError("APPROVAL_CANDIDATE_INVALID")
-        if value["candidate_oid"] != candidate_oid:
-            raise ActivationError("APPROVAL_CANDIDATE_MISMATCH")
-        if value.get("public_bind") is not True:
-            raise ActivationError("APPROVAL_PUBLIC_BIND_REQUIRED")
-        if value.get("bind_host") != PUBLIC_HOST or value.get("port") != PUBLIC_PORT:
-            raise ActivationError("APPROVAL_BINDING_INVALID")
-
-        cert_sha = str(value.get("tls_cert_sha256") or "")
-        if SHA_RE.fullmatch(cert_sha) is None:
-            raise ActivationError("APPROVAL_CERT_SHA_INVALID")
-        if not cert_path.is_file() or sha256_file(cert_path) != cert_sha:
-            raise ActivationError("APPROVAL_CERT_SHA_MISMATCH")
-
-        domain = validate_domain(value.get("domain"))
-        owner = value.get("owner")
-        if not isinstance(owner, str) or not owner.strip() or len(owner) > 255:
-            raise ActivationError("APPROVAL_OWNER_INVALID")
-
-        issued_at = parse_time(value.get("issued_at"), field="issued_at")
-        not_before = parse_time(value.get("not_before"), field="not_before")
-        expires_at = parse_time(value.get("expires_at"), field="expires_at")
-        current = now or datetime.now(timezone.utc)
-        if not (issued_at <= not_before <= expires_at):
-            raise ActivationError("APPROVAL_TIME_ORDER_INVALID")
-        if current < not_before:
-            raise ActivationError("APPROVAL_NOT_YET_VALID")
-        if current >= expires_at:
-            raise ActivationError("APPROVAL_EXPIRED")
-        if expires_at - issued_at > __import__("datetime").timedelta(days=7):
-            raise ActivationError("APPROVAL_VALIDITY_TOO_LONG")
-
-        return cls(
-            approval_id=approval_id,
-            candidate_oid=candidate_oid,
-            domain=domain,
-            bind_host=PUBLIC_HOST,
-            port=PUBLIC_PORT,
-            tls_cert_sha256=cert_sha,
-            owner=owner.strip(),
-            issued_at=issued_at,
-            not_before=not_before,
-            expires_at=expires_at,
-            raw_sha256=sha256_file(path),
-        )
-
-
-def validate_release(release_root: Path) -> dict[str, Path]:
-    if release_root.is_symlink() or not release_root.is_dir():
-        raise ActivationError("IMMUTABLE_RELEASE_INVALID")
-    edge = release_root / "active-runtime/app/aios_gpt_https_edge.py"
-    controller = release_root / "active-runtime/app/aios_gpt_https_edge_activation.py"
-    for path in (edge, controller):
-        if path.is_symlink() or not path.is_file():
-            raise ActivationError("IMMUTABLE_RELEASE_INVALID")
-    return {"edge": edge, "controller": controller}
-
-
-def render_dropin(approval: Approval, release_root: Path) -> str:
-    app = release_root / "active-runtime/app/aios_gpt_https_edge.py"
-    return (
-        "[Service]\n"
-        f"Environment=AIOS_GPT_EDGE_HOST={approval.bind_host}\n"
-        f"Environment=AIOS_GPT_EDGE_PORT={approval.port}\n"
-        "Environment=AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=1\n"
-        f"Environment=AIOS_GPT_EDGE_PUBLIC_DOMAIN={approval.domain}\n"
-        "ExecStart=\n"
-        f"ExecStart=/usr/bin/python3 -B {app}\n"
-        f"ReadOnlyPaths={release_root}\n"
-    )
-
-
-def atomic_write(path: Path, data: str, mode: int = 0o600) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, name = tempfile.mkstemp(prefix="." + path.name + ".", dir=path.parent)
-    try:
-        os.fchmod(fd, mode)
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            handle.write(data)
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(name, path)
-    finally:
-        if os.path.exists(name):
-            os.unlink(name)
-
-
-class Systemd:
-    def run(self, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-        return subprocess.run(
-            ["/usr/bin/systemctl", *args],
-            check=check,
-            text=True,
-            capture_output=True,
-            timeout=30,
-        )
-
-    def active(self, unit: str) -> bool:
-        return self.run("is-active", "--quiet", unit, check=False).returncode == 0
-
-    def enabled(self, unit: str) -> bool:
-        return self.run("is-enabled", "--quiet", unit, check=False).returncode == 0
-
-    def show(self, unit: str, prop: str) -> str:
-        return self.run("show", unit, f"--property={prop}", "--value").stdout.strip()
-
-
-def require_ingress_ready(systemd: Systemd) -> None:
-    if not systemd.active(INGRESS_UNIT):
-        raise ActivationError("INGRESS_SERVICE_NOT_ACTIVE")
-    try:
-        with urllib.request.urlopen(INGRESS_HEALTH, timeout=5) as response:
-            if response.status != 200:
-                raise ActivationError("INGRESS_HEALTH_FAILED")
-            value = json.loads(response.read().decode())
-    except ActivationError:
-        raise
-    except Exception as exc:
-        raise ActivationError("INGRESS_HEALTH_FAILED") from exc
-    if value.get("status") != "ok":
-        raise ActivationError("INGRESS_HEALTH_FAILED")
-
-
-def tls_probe(domain: str, cert_path: Path, *, port: int = PUBLIC_PORT) -> None:
-    context = ssl.create_default_context(cafile=str(cert_path))
-    context.check_hostname = True
-    context.verify_mode = ssl.CERT_REQUIRED
-    try:
-        with socket.create_connection(("127.0.0.1", port), timeout=5) as sock:
-            with context.wrap_socket(sock, server_hostname=domain) as tls_sock:
-                if tls_sock.version() not in {"TLSv1.2", "TLSv1.3"}:
-                    raise ActivationError("EDGE_TLS_VERSION_INVALID")
-    except ActivationError:
-        raise
-    except Exception as exc:
-        raise ActivationError("EDGE_TLS_PROBE_FAILED") from exc
-
-
-def receipt_for(
-    approval: Approval,
-    release_root: Path,
-    *,
-    state: str,
-) -> dict[str, Any]:
-    return {
-        "schema": STATE_SCHEMA,
-        "state": state,
-        "approval_id": approval.approval_id,
-        "approval_sha256": approval.raw_sha256,
-        "candidate_oid": approval.candidate_oid,
-        "domain": approval.domain,
-        "bind_host": approval.bind_host,
-        "port": approval.port,
-        "tls_cert_sha256": approval.tls_cert_sha256,
-        "release_root": str(release_root),
-        "updated_at": datetime.now(timezone.utc).isoformat(),
-    }
-
-
-def activate(
-    *,
-    approval: Approval,
-    release_root: Path,
-    cert_path: Path,
-    key_path: Path,
-    dropin_path: Path,
-    state_path: Path,
-    systemd: Systemd,
-) -> dict[str, Any]:
-    if os.geteuid() != 0:
-        raise ActivationError("ROOT_REQUIRED")
-    release = validate_release(release_root)
-    app = release["edge"]
-    require_ingress_ready(systemd)
-    validate_tls_pair(cert_path, key_path, approval.domain)
-
-    if state_path.is_file():
-        try:
-            existing = json.loads(state_path.read_text(encoding="utf-8"))
-        except Exception:
-            existing = {}
-        if (
-            existing.get("schema") == STATE_SCHEMA
-            and existing.get("state") == "ACTIVE"
-            and existing.get("approval_sha256") == approval.raw_sha256
-            and existing.get("candidate_oid") == approval.candidate_oid
-            and systemd.active(EDGE_UNIT)
-        ):
-            return existing
-
-    dropin = render_dropin(approval, release_root)
-    modified = False
-    try:
-        atomic_write(dropin_path, dropin, mode=0o644)
-        modified = True
-        systemd.run("daemon-reload")
-        systemd.run("enable", EDGE_UNIT)
-        systemd.run("restart", EDGE_UNIT)
-        if not systemd.active(EDGE_UNIT):
-            raise ActivationError("EDGE_SERVICE_NOT_ACTIVE")
-        exec_start = systemd.show(EDGE_UNIT, "ExecStart")
-        environment = systemd.show(EDGE_UNIT, "Environment")
-        if str(app) not in exec_start:
-            raise ActivationError("EDGE_EFFECTIVE_EXECSTART_INVALID")
-        for expected in (
-            f"AIOS_GPT_EDGE_HOST={approval.bind_host}",
-            f"AIOS_GPT_EDGE_PORT={approval.port}",
-            "AIOS_GPT_EDGE_PUBLIC_BIND_APPROVED=1",
-            f"AIOS_GPT_EDGE_PUBLIC_DOMAIN={approval.domain}",
-        ):
-            if expected not in environment:
-                raise ActivationError("EDGE_EFFECTIVE_ENVIRONMENT_INVALID")
-        tls_probe(approval.domain, cert_path, port=approval.port)
-        receipt = receipt_for(approval, release_root, state="ACTIVE")
-        atomic_write(state_path, json.dumps(receipt, indent=2, sort_keys=True) + "\n")
-        return receipt
-    except Exception:
-        if modified:
-            rollback(
-                dropin_path=dropin_path,
-                state_path=state_path,
-                systemd=systemd,
-                reason="activation_failed",
-            )
-        raise
-
-
-def rollback(
-    *,
-    dropin_path: Path,
-    state_path: Path,
-    systemd: Systemd,
-    reason: str,
-) -> dict[str, Any]:
-    if os.geteuid() != 0:
-        raise ActivationError("ROOT_REQUIRED")
-    systemd.run("stop", EDGE_UNIT, check=False)
-    systemd.run("disable", EDGE_UNIT, check=False)
-    dropin_path.unlink(missing_ok=True)
-    systemd.run("daemon-reload")
-    if systemd.active(EDGE_UNIT):
-        raise ActivationError("EDGE_ROLLBACK_SERVICE_STILL_ACTIVE")
-    previous: dict[str, Any] = {}
-    if state_path.is_file():
-        try:
-            previous = json.loads(state_path.read_text(encoding="utf-8"))
-        except Exception:
-            previous = {}
-    receipt = {
-        "schema": STATE_SCHEMA,
-        "state": "ROLLED_BACK",
-        "reason": reason[:255],
-        "candidate_oid": previous.get("candidate_oid"),
-        "approval_id": previous.get("approval_id"),
-        "domain": previous.get("domain"),
-        "updated_at": datetime.now(timezone.utc).isoformat(),
-    }
-    atomic_write(state_path, json.dumps(receipt, indent=2, sort_keys=True) + "\n")
-    return receipt
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("command", choices=("check", "activate", "rollback"))
-    parser.add_argument("--candidate")
-    parser.add_argument("--approval", default="/etc/aios-gitops/gpt-https-edge.approved")
-    parser.add_argument("--tls-cert", default="/etc/aios-gitops/gpt-https-edge-tls.crt")
-    parser.add_argument("--tls-key", default="/etc/aios-gitops/gpt-https-edge-tls.key")
-    parser.add_argument("--release-root")
-    parser.add_argument(
-        "--dropin",
-        default=f"/etc/systemd/system/{EDGE_UNIT}.d/{DROPIN_NAME}",
-    )
-    parser.add_argument(
-        "--state",
-        default="/var/lib/aios-gpt-https-edge-activation/state.json",
-    )
-    parser.add_argument("--reason", default="owner_requested")
-    args = parser.parse_args()
-
-    systemd = Systemd()
-    if args.command == "rollback":
-        value = rollback(
-            dropin_path=Path(args.dropin),
-            state_path=Path(args.state),
-            systemd=systemd,
-            reason=args.reason,
-        )
-        print(json.dumps(value, indent=2, sort_keys=True))
-        return 0
-
-    candidate = str(args.candidate or "")
-    if OID_RE.fullmatch(candidate) is None:
-        raise SystemExit("CANDIDATE_REQUIRED")
-    release_root = (
-        Path(args.release_root)
-        if args.release_root
-        else Path(f"/opt/aios/releases/{candidate}-gpt-https-edge-public")
-    )
-    cert_path = Path(args.tls_cert)
-    key_path = Path(args.tls_key)
-    approval = Approval.load(
-        Path(args.approval),
-        candidate_oid=candidate,
-        cert_path=cert_path,
-    )
-    tls = validate_tls_pair(cert_path, key_path, approval.domain)
-    release = validate_release(release_root)
-    require_ingress_ready(systemd)
-
-    if args.command == "check":
-        value = {
-            "status": "READY",
-            "candidate_oid": candidate,
-            "approval_id": approval.approval_id,
-            "approval_sha256": approval.raw_sha256,
-            "domain": approval.domain,
-            "bind_host": approval.bind_host,
-            "port": approval.port,
-            "edge_sha256": sha256_file(release["edge"]),
-            "controller_sha256": sha256_file(release["controller"]),
-            **tls,
-            "public_network_mutation": False,
-        }
-        print(json.dumps(value, indent=2, sort_keys=True))
-        return 0
-
-    value = activate(
-        approval=approval,
-        release_root=release_root,
-        cert_path=cert_path,
-        key_path=key_path,
-        dropin_path=Path(args.dropin),
-        state_path=Path(args.state),
-        systemd=systemd,
-    )
-    print(json.dumps(value, indent=2, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,816 +0,0 @@
-#!/usr/bin/env python3
-"""Credential-isolated host-side ingress for externally scheduled read-only Online Tasks.
-
-This service is intentionally not a public AIOS control plane. It accepts a tiny,
-authenticated external intent and translates it to the canonical loopback Bridge.
-Callers cannot select repository coordinates, capabilities, execution action,
-worker, branch policy, credentials, verification decisions, or write permissions.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import hmac
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-import json
-import os
-from pathlib import Path
-import re
-import sqlite3
-import threading
-import urllib.error
-import urllib.request
-from typing import Any, Mapping
-
-SCHEMA = "aios.gpt-online-task-ingress.request.v1"
-RESPONSE_SCHEMA = "aios.gpt-online-task-ingress.response.v1"
-OPENAPI_VERSION = "3.1.0"
-
-REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,127}$")
-TASK_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-JOB_ID_RE = re.compile(r"^job-[0-9a-f]{32}$")
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-MAX_BODY = 64 * 1024
-MAX_GOAL = 12_000
-MAX_INSTRUCTIONS = 24_000
-MAX_CRITERIA = 16
-MAX_CRITERION_TEXT = 1_000
-
-READONLY_CAPABILITIES = ("git.read", "git.test")
-REPOSITORY = "aios/aios"
-
-
-class IngressError(RuntimeError):
-    def __init__(self, code: str, status: int = 400) -> None:
-        super().__init__(code)
-        self.code = code
-        self.status = status
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def digest(value: object) -> str:
-    return hashlib.sha256(canonical(value)).hexdigest()
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def load_secret(path: Path, *, code: str) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise RuntimeError(code + "_UNAVAILABLE")
-    value = path.read_text(encoding="utf-8").strip()
-    if len(value) < 32 or "\n" in value or "\r" in value:
-        raise RuntimeError(code + "_INVALID")
-    return value
-
-
-def normalized_request(value: Mapping[str, Any]) -> dict[str, Any]:
-    allowed = {
-        "schema",
-        "request_id",
-        "goal",
-        "instructions",
-        "success_criteria",
-        "constraints",
-    }
-    if set(value) - allowed:
-        raise IngressError("UNKNOWN_FIELDS")
-    if value.get("schema") != SCHEMA:
-        raise IngressError("SCHEMA_INVALID")
-
-    request_id = value.get("request_id")
-    if not isinstance(request_id, str) or REQUEST_ID_RE.fullmatch(request_id) is None:
-        raise IngressError("REQUEST_ID_INVALID")
-
-    goal = value.get("goal")
-    if not isinstance(goal, str) or not goal.strip() or len(goal) > MAX_GOAL:
-        raise IngressError("GOAL_INVALID")
-    instructions = value.get("instructions", "")
-    if not isinstance(instructions, str) or len(instructions) > MAX_INSTRUCTIONS:
-        raise IngressError("INSTRUCTIONS_INVALID")
-
-    criteria = value.get("success_criteria") or []
-    if not isinstance(criteria, list) or len(criteria) > MAX_CRITERIA:
-        raise IngressError("SUCCESS_CRITERIA_INVALID")
-    normalized_criteria = []
-    for item in criteria:
-        if not isinstance(item, Mapping) or set(item) != {"id", "description"}:
-            raise IngressError("SUCCESS_CRITERIA_INVALID")
-        criterion_id = item.get("id")
-        description = item.get("description")
-        if (
-            not isinstance(criterion_id, str)
-            or not criterion_id.strip()
-            or len(criterion_id) > 120
-            or not isinstance(description, str)
-            or not description.strip()
-            or len(description) > MAX_CRITERION_TEXT
-        ):
-            raise IngressError("SUCCESS_CRITERIA_INVALID")
-        normalized_criteria.append(
-            {"id": criterion_id.strip(), "description": description.strip()}
-        )
-
-    constraints = value.get("constraints") or {}
-    if not isinstance(constraints, Mapping):
-        raise IngressError("CONSTRAINTS_INVALID")
-    allowed_constraints = {
-        "max_files",
-        "focus_paths",
-        "notes",
-    }
-    if set(constraints) - allowed_constraints:
-        raise IngressError("CONSTRAINTS_FIELDS_INVALID")
-    normalized_constraints: dict[str, Any] = {}
-    if "max_files" in constraints:
-        max_files = constraints["max_files"]
-        if (
-            not isinstance(max_files, int)
-            or isinstance(max_files, bool)
-            or not 1 <= max_files <= 500
-        ):
-            raise IngressError("MAX_FILES_INVALID")
-        normalized_constraints["max_files"] = max_files
-    if "focus_paths" in constraints:
-        paths = constraints["focus_paths"]
-        if (
-            not isinstance(paths, list)
-            or len(paths) > 32
-            or not all(
-                isinstance(path, str)
-                and path
-                and len(path) <= 512
-                and not path.startswith("/")
-                and ".." not in Path(path).parts
-                for path in paths
-            )
-        ):
-            raise IngressError("FOCUS_PATHS_INVALID")
-        normalized_constraints["focus_paths"] = paths
-    if "notes" in constraints:
-        notes = constraints["notes"]
-        if not isinstance(notes, str) or len(notes) > 4_000:
-            raise IngressError("CONSTRAINT_NOTES_INVALID")
-        normalized_constraints["notes"] = notes
-
-    return {
-        "schema": SCHEMA,
-        "request_id": request_id,
-        "goal": goal.strip(),
-        "instructions": instructions,
-        "success_criteria": normalized_criteria,
-        "constraints": normalized_constraints,
-    }
-
-
-def validated_bind_host(value: str) -> str:
-    host = value.strip()
-    if host not in {"127.0.0.1", "::1", "localhost"}:
-        raise RuntimeError("GPT_INGRESS_NON_LOOPBACK_BIND_DENY")
-    return host
-
-
-def task_id_for(request_id: str) -> str:
-    suffix = hashlib.sha256(request_id.encode("utf-8")).hexdigest()[:24]
-    return "gpt-readonly-" + suffix
-
-
-def branch_for(task_id: str) -> str:
-    return "agent/external-gpt-readonly/" + task_id[-24:]
-
-
-@dataclass(frozen=True)
-class Upstream:
-    bridge_base: str
-    task_base: str
-    control_token: str
-    timeout: int = 20
-
-    def _request(
-        self,
-        base: str,
-        method: str,
-        path: str,
-        body: Mapping[str, Any] | None = None,
-    ) -> tuple[int, dict[str, Any]]:
-        raw_body = None if body is None else canonical(body)
-        headers = {
-            "Authorization": "Bearer " + self.control_token,
-            "Accept": "application/json",
-        }
-        if raw_body is not None:
-            headers["Content-Type"] = "application/json"
-        req = urllib.request.Request(
-            base.rstrip("/") + path,
-            method=method,
-            data=raw_body,
-            headers=headers,
-        )
-        try:
-            with urllib.request.urlopen(req, timeout=self.timeout) as response:
-                raw = response.read()
-                status = response.status
-        except urllib.error.HTTPError as exc:
-            raw = exc.read()
-            status = exc.code
-        except Exception as exc:
-            raise IngressError("UPSTREAM_TRANSPORT_FAILED", 503) from exc
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except Exception as exc:
-            raise IngressError("UPSTREAM_RESPONSE_INVALID", 502) from exc
-        if not isinstance(value, Mapping):
-            raise IngressError("UPSTREAM_RESPONSE_INVALID", 502)
-        return status, dict(value)
-
-    def control_snapshot(self) -> dict[str, Any]:
-        status, value = self._request(
-            self.bridge_base,
-            "GET",
-            "/v2/control-plane-snapshot",
-        )
-        if status != 200:
-            raise IngressError("CONTROL_SNAPSHOT_UNAVAILABLE", 503)
-        return value
-
-    def create_governed_task(
-        self,
-        body: Mapping[str, Any],
-    ) -> tuple[int, dict[str, Any]]:
-        return self._request(
-            self.bridge_base,
-            "POST",
-            "/v2/governed-task",
-            body,
-        )
-
-    def execution_envelope(
-        self,
-        body: Mapping[str, Any],
-    ) -> tuple[int, dict[str, Any]]:
-        return self._request(
-            self.bridge_base,
-            "POST",
-            "/v2/execution-envelope",
-            body,
-        )
-
-    def get_task(self, task_id: str) -> tuple[int, dict[str, Any]]:
-        return self._request(
-            self.task_base,
-            "GET",
-            "/v1/tasks/" + task_id,
-        )
-
-
-class Store:
-    def __init__(self, path: Path) -> None:
-        self.path = Path(path)
-        self._lock = threading.RLock()
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        with self._connect() as con:
-            con.execute(
-                """
-                CREATE TABLE IF NOT EXISTS external_task_requests(
-                  request_id TEXT PRIMARY KEY,
-                  request_sha256 TEXT NOT NULL,
-                  task_id TEXT NOT NULL UNIQUE,
-                  job_id TEXT,
-                  base_oid TEXT,
-                  state TEXT NOT NULL,
-                  created_at TEXT NOT NULL,
-                  updated_at TEXT NOT NULL,
-                  response_json TEXT
-                )
-                """
-            )
-            con.commit()
-
-    def _connect(self) -> sqlite3.Connection:
-        con = sqlite3.connect(self.path, timeout=30)
-        con.row_factory = sqlite3.Row
-        con.execute("PRAGMA busy_timeout=30000")
-        return con
-
-    def get(self, request_id: str) -> sqlite3.Row | None:
-        with self._connect() as con:
-            return con.execute(
-                "SELECT * FROM external_task_requests WHERE request_id=?",
-                (request_id,),
-            ).fetchone()
-
-    def reserve(self, request: Mapping[str, Any], task_id: str) -> sqlite3.Row:
-        request_sha = digest(request)
-        timestamp = now()
-        with self._lock, self._connect() as con:
-            con.execute("BEGIN IMMEDIATE")
-            row = con.execute(
-                "SELECT * FROM external_task_requests WHERE request_id=?",
-                (request["request_id"],),
-            ).fetchone()
-            if row is not None:
-                if row["request_sha256"] != request_sha:
-                    raise IngressError("IDEMPOTENCY_CONFLICT", 409)
-                con.commit()
-                return row
-            con.execute(
-                """
-                INSERT INTO external_task_requests(
-                  request_id,request_sha256,task_id,state,created_at,updated_at
-                ) VALUES(?,?,?,?,?,?)
-                """,
-                (
-                    request["request_id"],
-                    request_sha,
-                    task_id,
-                    "PENDING",
-                    timestamp,
-                    timestamp,
-                ),
-            )
-            con.commit()
-        row = self.get(request["request_id"])
-        assert row is not None
-        return row
-
-    def bound(
-        self,
-        request_id: str,
-        *,
-        job_id: str,
-        base_oid: str,
-        response: Mapping[str, Any],
-    ) -> None:
-        with self._lock, self._connect() as con:
-            con.execute(
-                """
-                UPDATE external_task_requests
-                   SET job_id=?,base_oid=?,state='BOUND',response_json=?,updated_at=?
-                 WHERE request_id=?
-                """,
-                (
-                    job_id,
-                    base_oid,
-                    json.dumps(response, sort_keys=True, separators=(",", ":")),
-                    now(),
-                    request_id,
-                ),
-            )
-            con.commit()
-
-
-class IngressService:
-    def __init__(self, upstream: Upstream, store: Store) -> None:
-        self.upstream = upstream
-        self.store = store
-
-    @staticmethod
-    def _main_oid(snapshot: Mapping[str, Any]) -> str:
-        candidates = [
-            snapshot.get("authoritative_head_oid"),
-            snapshot.get("head"),
-            (snapshot.get("aggregate") or {}).get("authoritative_head_oid")
-            if isinstance(snapshot.get("aggregate"), Mapping)
-            else None,
-        ]
-        for candidate in candidates:
-            if isinstance(candidate, str) and OID_RE.fullmatch(candidate):
-                return candidate
-        raise IngressError("AUTHORITATIVE_HEAD_UNAVAILABLE", 503)
-
-    @staticmethod
-    def _public_response(
-        request_id: str,
-        task_id: str,
-        job_id: str,
-        state: str,
-    ) -> dict[str, Any]:
-        return {
-            "schema": RESPONSE_SCHEMA,
-            "request_id": request_id,
-            "task_id": task_id,
-            "job_id": job_id,
-            "state": state,
-            "execution_mode": "source_capture",
-            "capabilities": list(READONLY_CAPABILITIES),
-            "write_access": False,
-            "official_verification_required": True,
-        }
-
-    def _recover_existing(
-        self,
-        request: Mapping[str, Any],
-        row: sqlite3.Row,
-    ) -> dict[str, Any] | None:
-        task_id = str(row["task_id"])
-        status, task = self.upstream.get_task(task_id)
-        if status == 404:
-            return None
-        if status != 200:
-            raise IngressError("TASK_RECOVERY_FAILED", 503)
-        metadata = task.get("metadata")
-        execution = (
-            metadata.get("execution")
-            if isinstance(metadata, Mapping)
-            and isinstance(metadata.get("execution"), Mapping)
-            else {}
-        )
-        job_id = str(execution.get("job_id") or row["job_id"] or "")
-        base_oid = str(execution.get("base_oid") or row["base_oid"] or "")
-        if (
-            task.get("task_id") != task_id
-            or not JOB_ID_RE.fullmatch(job_id)
-            or not OID_RE.fullmatch(base_oid)
-            or execution.get("action") != "source_capture"
-            or sorted(execution.get("capability_scope") or [])
-            != sorted(READONLY_CAPABILITIES)
-            or (execution.get("governance") or {}).get("writer_lease") is not False
-        ):
-            raise IngressError("TASK_RECOVERY_BINDING_INVALID", 409)
-        response = self._public_response(
-            request["request_id"],
-            task_id,
-            job_id,
-            str(task.get("status") or "BOUND"),
-        )
-        self.store.bound(
-            request["request_id"],
-            job_id=job_id,
-            base_oid=base_oid,
-            response=response,
-        )
-        return response
-
-    def create(self, raw: Mapping[str, Any]) -> dict[str, Any]:
-        request = normalized_request(raw)
-        task_id = task_id_for(request["request_id"])
-        row = self.store.reserve(request, task_id)
-        if row["state"] == "BOUND" and row["response_json"]:
-            return json.loads(row["response_json"])
-
-        recovered = self._recover_existing(request, row)
-        if recovered is not None:
-            return recovered
-
-        snapshot = self.upstream.control_snapshot()
-        base_oid = self._main_oid(snapshot)
-        target_branch = branch_for(task_id)
-        binding_key = "gpt-readonly-binding-" + digest(
-            {"request_id": request["request_id"], "base_oid": base_oid}
-        )[:24]
-        constraints = {
-            **request["constraints"],
-            "repository_mutation": "forbidden",
-            "control_plane_side_effects": "forbidden",
-            "credential_access": "forbidden",
-        }
-        body = {
-            "task_id": task_id,
-            "repository": REPOSITORY,
-            "base_oid": base_oid,
-            "expected_branch_oid": base_oid,
-            "target_branch": target_branch,
-            "branch_mode": "CREATE_NEW",
-            "generation": 1,
-            "risk": "low",
-            "description": "Externally requested read-only governed Online Task.",
-            "idempotency_key": binding_key,
-            "priority": 0,
-            "max_attempts": 3,
-            "require_online_task_projection": True,
-            "online_task": {
-                "goal": request["goal"],
-                "instructions": request["instructions"],
-                "success_criteria": request["success_criteria"],
-                "constraints": constraints,
-                "required_capabilities": list(READONLY_CAPABILITIES),
-                "priority": 0,
-                "max_attempts": 3,
-            },
-            "execution": {
-                "action": "source_capture",
-                "adapter": "source_capture",
-                "capability_scope": list(READONLY_CAPABILITIES),
-                "source_signals": [
-                    "external read-only source analysis request",
-                    "no repository mutation no credential access no control-plane side effects",
-                ],
-            },
-        }
-        status, value = self.upstream.create_governed_task(body)
-        if status not in {200, 201, 202}:
-            if status == 409:
-                recovered = self._recover_existing(request, row)
-                if recovered is not None:
-                    return recovered
-            raise IngressError(
-                "GOVERNED_TASK_CREATE_FAILED",
-                409 if status == 409 else 503,
-            )
-        job_id = str(value.get("job_id") or "")
-        if value.get("task_id") != task_id or JOB_ID_RE.fullmatch(job_id) is None:
-            raise IngressError("GOVERNED_TASK_RESPONSE_INVALID", 502)
-
-        envelope_status, envelope = self.upstream.execution_envelope(
-            {
-                "task_id": task_id,
-                "job_id": job_id,
-                "required_capabilities": list(READONLY_CAPABILITIES),
-                "execution": body["execution"],
-            }
-        )
-        if envelope_status != 200:
-            raise IngressError("EXECUTION_PROJECTION_FAILED", 503)
-        if (
-            envelope.get("task_id") != task_id
-            or envelope.get("job_id") != job_id
-            or envelope.get("base_oid") != base_oid
-            or envelope.get("action") != "source_capture"
-            or sorted(envelope.get("capability_scope") or [])
-            != sorted(READONLY_CAPABILITIES)
-            or (envelope.get("governance") or {}).get("writer_lease") is not False
-        ):
-            raise IngressError("EXECUTION_PROJECTION_INVALID", 502)
-
-        response = self._public_response(
-            request["request_id"],
-            task_id,
-            job_id,
-            "BOUND",
-        )
-        self.store.bound(
-            request["request_id"],
-            job_id=job_id,
-            base_oid=base_oid,
-            response=response,
-        )
-        return response
-
-    def status(self, request_id: str) -> dict[str, Any]:
-        if REQUEST_ID_RE.fullmatch(request_id) is None:
-            raise IngressError("REQUEST_ID_INVALID")
-        row = self.store.get(request_id)
-        if row is None:
-            raise IngressError("REQUEST_NOT_FOUND", 404)
-        task_id = str(row["task_id"])
-        status, task = self.upstream.get_task(task_id)
-        if status == 200 and not row["job_id"]:
-            metadata = task.get("metadata")
-            execution = (
-                metadata.get("execution")
-                if isinstance(metadata, Mapping)
-                and isinstance(metadata.get("execution"), Mapping)
-                else {}
-            )
-            job_id = str(execution.get("job_id") or "")
-            base_oid = str(execution.get("base_oid") or "")
-            if (
-                JOB_ID_RE.fullmatch(job_id)
-                and OID_RE.fullmatch(base_oid)
-                and execution.get("action") == "source_capture"
-                and sorted(execution.get("capability_scope") or [])
-                == sorted(READONLY_CAPABILITIES)
-                and (execution.get("governance") or {}).get("writer_lease") is False
-            ):
-                recovered = self._public_response(
-                    request_id,
-                    task_id,
-                    job_id,
-                    str(task.get("status") or "BOUND"),
-                )
-                self.store.bound(
-                    request_id,
-                    job_id=job_id,
-                    base_oid=base_oid,
-                    response=recovered,
-                )
-                row = self.store.get(request_id) or row
-        if status == 404:
-            return {
-                "schema": RESPONSE_SCHEMA,
-                "request_id": request_id,
-                "task_id": task_id,
-                "state": "PENDING",
-                "official_verification_required": True,
-            }
-        if status != 200:
-            raise IngressError("TASK_STATUS_UNAVAILABLE", 503)
-
-        result = task.get("result") if isinstance(task.get("result"), Mapping) else {}
-        verification = (
-            task.get("verification")
-            if isinstance(task.get("verification"), Mapping)
-            else {}
-        )
-        safe = {
-            "schema": RESPONSE_SCHEMA,
-            "request_id": request_id,
-            "task_id": task_id,
-            "job_id": str(row["job_id"] or ""),
-            "state": str(task.get("status") or "UNKNOWN"),
-            "attempt": int(task.get("attempt") or 0),
-            "claimed": bool(task.get("claimed_by")),
-            "result_status": result.get("status"),
-            "result_classification": result.get("classification"),
-            "official_verification": verification.get("decision"),
-            "official_classification": verification.get("classification"),
-            "write_access": False,
-        }
-        if result.get("execution_mode") == "source_capture":
-            snapshot = result.get("source_snapshot")
-            if isinstance(snapshot, Mapping):
-                safe["source_snapshot_sha256"] = snapshot.get("payload_sha256")
-                safe["source_snapshot_file_count"] = snapshot.get("file_count")
-        return safe
-
-
-def openapi_document() -> dict[str, Any]:
-    return {
-        "openapi": OPENAPI_VERSION,
-        "info": {
-            "title": "AIOS Read-Only Online Task Ingress",
-            "version": "1.0.0",
-        },
-        "paths": {
-            "/v1/read-only-tasks": {
-                "post": {
-                    "operationId": "createReadOnlyOnlineTask",
-                    "security": [{"bearerAuth": []}],
-                    "requestBody": {"required": True},
-                    "responses": {"200": {"description": "Task accepted"}},
-                }
-            },
-            "/v1/read-only-tasks/{request_id}": {
-                "get": {
-                    "operationId": "getReadOnlyOnlineTaskStatus",
-                    "security": [{"bearerAuth": []}],
-                    "responses": {"200": {"description": "Sanitized task status"}},
-                }
-            },
-        },
-        "components": {
-            "securitySchemes": {
-                "bearerAuth": {
-                    "type": "http",
-                    "scheme": "bearer",
-                }
-            }
-        },
-    }
-
-
-class Handler(BaseHTTPRequestHandler):
-    service: IngressService | None = None
-    ingress_token: str = ""
-
-    def log_message(self, *_args: Any) -> None:
-        return
-
-    def respond(self, value: Mapping[str, Any], status: int) -> None:
-        raw = canonical(value)
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("Content-Length", str(len(raw)))
-        self.end_headers()
-        self.wfile.write(raw)
-
-    def authorized(self) -> bool:
-        header = self.headers.get("Authorization", "")
-        return (
-            header.startswith("Bearer ")
-            and bool(self.ingress_token)
-            and hmac.compare_digest(header[7:], self.ingress_token)
-        )
-
-    def body(self) -> dict[str, Any]:
-        try:
-            length = int(self.headers.get("Content-Length", "-1"))
-        except ValueError as exc:
-            raise IngressError("CONTENT_LENGTH_INVALID") from exc
-        if length < 1 or length > MAX_BODY:
-            raise IngressError("REQUEST_SIZE_INVALID", 413)
-        try:
-            value = json.loads(self.rfile.read(length).decode("utf-8"))
-        except Exception as exc:
-            raise IngressError("REQUEST_JSON_INVALID") from exc
-        if not isinstance(value, Mapping):
-            raise IngressError("REQUEST_OBJECT_REQUIRED")
-        return dict(value)
-
-    def do_GET(self) -> None:
-        if self.path == "/health":
-            self.respond(
-                {
-                    "status": "ok",
-                    "service": "aios-gpt-online-task-ingress",
-                    "mode": "read-only",
-                },
-                200,
-            )
-            return
-        if self.path == "/openapi.json":
-            self.respond(openapi_document(), 200)
-            return
-        if not self.authorized():
-            self.respond({"error": "UNAUTHORIZED"}, 401)
-            return
-        match = re.fullmatch(r"/v1/read-only-tasks/([^/?#]+)", self.path)
-        if match is None:
-            self.respond({"error": "NOT_FOUND"}, 404)
-            return
-        try:
-            if self.service is None:
-                raise IngressError("RUNTIME_UNAVAILABLE", 503)
-            self.respond(self.service.status(match.group(1)), 200)
-        except IngressError as exc:
-            self.respond({"error": exc.code}, exc.status)
-
-    def do_POST(self) -> None:
-        if self.path != "/v1/read-only-tasks":
-            self.respond({"error": "NOT_FOUND"}, 404)
-            return
-        if not self.authorized():
-            self.respond({"error": "UNAUTHORIZED"}, 401)
-            return
-        try:
-            if self.service is None:
-                raise IngressError("RUNTIME_UNAVAILABLE", 503)
-            value = self.service.create(self.body())
-            self.respond(value, 200)
-        except IngressError as exc:
-            self.respond({"error": exc.code}, exc.status)
-
-
-def serve() -> None:
-    ingress_token_path = Path(
-        os.environ.get(
-            "AIOS_GPT_INGRESS_TOKEN_FILE",
-            str(
-                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-                / "gpt_ingress_token"
-            ),
-        )
-    )
-    control_token_path = Path(
-        os.environ.get(
-            "AIOS_AGENT_TASK_CONTROL_TOKEN_FILE",
-            str(
-                Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-                / "agent_task_control_token"
-            ),
-        )
-    )
-    ingress_token = load_secret(
-        ingress_token_path,
-        code="GPT_INGRESS_CREDENTIAL",
-    )
-    control_token = load_secret(
-        control_token_path,
-        code="CONTROL_PLANE_CREDENTIAL",
-    )
-
-    state_root = Path(
-        os.environ.get(
-            "AIOS_GPT_INGRESS_STATE_ROOT",
-            "/var/lib/aios-gpt-online-task-ingress",
-        )
-    )
-    host = validated_bind_host(
-        os.environ.get("AIOS_GPT_INGRESS_HOST", "127.0.0.1")
-    )
-    port = int(os.environ.get("AIOS_GPT_INGRESS_PORT", "18945"))
-    if not 1024 <= port <= 65535:
-        raise RuntimeError("GPT_INGRESS_PORT_INVALID")
-
-    Handler.service = IngressService(
-        Upstream(
-            bridge_base=os.environ.get(
-                "AIOS_GOVERNED_WRITE_API_URL",
-                "http://127.0.0.1:18892",
-            ),
-            task_base=os.environ.get(
-                "AIOS_AGENT_TASK_API_URL",
-                "http://127.0.0.1:18940",
-            ),
-            control_token=control_token,
-        ),
-        Store(state_root / "state.sqlite3"),
-    )
-    Handler.ingress_token = ingress_token
-    ThreadingHTTPServer((host, port), Handler).serve_forever()
-
-
-if __name__ == "__main__":
-    serve()
@@ -1,306 +0,0 @@
-"""Uncredentialed deterministic executor for governed Online Agent changes.
-
-This process never receives Agent/Owner/Bridge credentials and never writes Git refs.
-It operates only on an exchange bundle and returns hash-bound changed files + test evidence.
-"""
-from __future__ import annotations
-
-import base64
-from dataclasses import dataclass
-import errno
-import hashlib
-import io
-import json
-import os
-from pathlib import Path
-import re
-import shutil
-import socket
-import subprocess
-import tarfile
-import tempfile
-import time
-from typing import Any, Mapping, Sequence
-
-ALLOWED_PROGRAMS = {"/usr/bin/python3", "/usr/bin/git", "/bin/true", "/usr/bin/true"}
-MAX_ARCHIVE_BYTES = 64 * 1024 * 1024
-MAX_FILE_BYTES = 4 * 1024 * 1024
-SECRET_ENV_TOKENS = ("TOKEN", "SECRET", "PASSWORD", "CREDENTIAL", "AUTHORIZATION", "PRIVATE_KEY")
-REQUEST_ID_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{15,254}$")
-SENSITIVE_VALUE_RE = re.compile(
-    r"(?i)(authorization\s*[:=]\s*bearer\s+\S+|authorization\s+bearer\s+\S+|"
-    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*\S+)"
-)
-
-
-class IsolatedExecutorError(RuntimeError):
-    pass
-
-
-def sha256(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def safe_relative(value: object) -> str:
-    if not isinstance(value, str) or not value or value.startswith("/"):
-        raise IsolatedExecutorError("PATH_INVALID")
-    path = Path(value)
-    if ".." in path.parts or "." in path.parts or any(part in {"", ".git"} for part in path.parts):
-        raise IsolatedExecutorError("PATH_INVALID")
-    return path.as_posix()
-
-
-def resolve_under(root: Path, relative: str) -> Path:
-    root = root.resolve()
-    path = (root / safe_relative(relative)).resolve(strict=False)
-    if path == root or root not in path.parents:
-        raise IsolatedExecutorError("PATH_ESCAPE")
-    return path
-
-
-def _credential_exposure(directory: Path) -> str | None:
-    """Return an exposure code; EACCES is the intended credential isolation proof."""
-    try:
-        if not directory.exists():
-            return None
-        if directory.is_symlink():
-            return "CREDENTIAL_MOUNT_SYMLINK"
-        if os.access(directory, os.R_OK):
-            return "CREDENTIAL_MOUNT_ACCESSIBLE"
-        if directory.is_dir():
-            for child in directory.iterdir():
-                if child.is_file() and os.access(child, os.R_OK):
-                    return "CREDENTIAL_FILE_ACCESSIBLE"
-    except PermissionError:
-        return None
-    return None
-
-
-def assert_uncredentialed() -> None:
-    credentials = Path("/run/credentials")
-    candidates = {credentials}
-    credentials_directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", "/run/credentials"))
-    candidates.add(credentials_directory)
-    leaked = sorted(
-        key for key, value in os.environ.items()
-        if value
-        and (any(token in key.upper() for token in SECRET_ENV_TOKENS) or SENSITIVE_VALUE_RE.search(str(value)))
-    )
-    if leaked:
-        raise IsolatedExecutorError("CREDENTIAL_ENV_EXPOSED:" + ",".join(leaked))
-    for directory in candidates:
-        exposure = _credential_exposure(directory)
-        if exposure is not None:
-            raise IsolatedExecutorError(exposure)
-    # In the intended PrivateNetwork namespace host loopback services are unreachable.
-    try:
-        probe = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-    except OSError as exc:
-        if exc.errno in {errno.EACCES, errno.EPERM, errno.EAFNOSUPPORT}:
-            return
-        raise IsolatedExecutorError("NETWORK_ISOLATION_PROBE_FAILED") from exc
-    probe.settimeout(0.15)
-    try:
-        if probe.connect_ex(("127.0.0.1", 18892)) == 0:
-            raise IsolatedExecutorError("GOVERNED_BRIDGE_REACHABLE")
-    finally:
-        probe.close()
-
-
-def extract_source(archive: Path, root: Path) -> None:
-    if archive.is_symlink() or not archive.is_file() or archive.stat().st_size > MAX_ARCHIVE_BYTES:
-        raise IsolatedExecutorError("SOURCE_ARCHIVE_INVALID")
-    with tarfile.open(archive, "r:gz") as tf:
-        for member in tf.getmembers():
-            path = Path(member.name)
-            if path.is_absolute() or ".." in path.parts or ".git" in path.parts:
-                raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
-            if member.issym() or member.islnk():
-                raise IsolatedExecutorError("SOURCE_ARCHIVE_LINK_DENY")
-        tf.extractall(root, filter="data")
-
-
-def run_command(item: Mapping[str, Any], root: Path) -> dict[str, Any]:
-    argv = item.get("argv")
-    if not isinstance(argv, Sequence) or isinstance(argv, (str, bytes)) or not argv:
-        raise IsolatedExecutorError("COMMAND_INVALID")
-    argv = [str(part) for part in argv]
-    if argv[0] not in ALLOWED_PROGRAMS:
-        raise IsolatedExecutorError("COMMAND_PROGRAM_DENY")
-    if argv[0] == "/usr/bin/python3" and "-m" in argv:
-        index = argv.index("-m")
-        if index + 1 >= len(argv) or argv[index + 1] not in {"pytest", "py_compile"}:
-            raise IsolatedExecutorError("PYTHON_MODULE_DENY")
-    if argv[0] == "/usr/bin/git" and any(
-        token in {"push", "update-ref", "commit", "merge", "rebase", "reset", "clean", "branch"}
-        for token in argv[1:]
-    ):
-        raise IsolatedExecutorError("GIT_MUTATION_DENY")
-    timeout = int(item.get("timeout_seconds") or 300)
-    if not 1 <= timeout <= 1800:
-        raise IsolatedExecutorError("COMMAND_TIMEOUT_INVALID")
-    cwd = root if item.get("cwd", ".") == "." else resolve_under(root, str(item.get("cwd")))
-    started = time.monotonic()
-    completed = subprocess.run(
-        argv,
-        cwd=cwd,
-        capture_output=True,
-        text=True,
-        check=False,
-        timeout=timeout,
-        env={"PATH": "/usr/bin:/bin", "LC_ALL": "C.UTF-8"},
-    )
-    result = {
-        "label": str(item.get("label") or "command"),
-        "exit_code": completed.returncode,
-        "stdout_sha256": sha256(completed.stdout.encode("utf-8", "replace")),
-        "stderr_sha256": sha256(completed.stderr.encode("utf-8", "replace")),
-        "duration_ms": int((time.monotonic() - started) * 1000),
-    }
-    if completed.returncode != 0:
-        raise IsolatedExecutorError(
-            "COMMAND_FAILED:" + result["label"] + ":" + str(completed.returncode)
-        )
-    return result
-
-
-def apply_changes(request: Mapping[str, Any], root: Path) -> list[str]:
-    changes = request.get("change_set")
-    if not isinstance(changes, list) or not changes:
-        raise IsolatedExecutorError("CHANGE_SET_INVALID")
-    changed: list[str] = []
-    for change in changes:
-        if not isinstance(change, Mapping):
-            raise IsolatedExecutorError("CHANGE_INVALID")
-        relative = safe_relative(change.get("path"))
-        path = resolve_under(root, relative)
-        current = path.read_bytes() if path.is_file() else None
-        expected = change.get("expected_sha256")
-        if expected is not None and (current is None or sha256(current) != expected):
-            raise IsolatedExecutorError("SOURCE_DRIFT:" + relative)
-        operation = change.get("operation")
-        if operation == "write_file":
-            content = change.get("content")
-            if not isinstance(content, str):
-                raise IsolatedExecutorError("WRITE_CONTENT_INVALID")
-            path.parent.mkdir(parents=True, exist_ok=True)
-            path.write_text(content, encoding="utf-8")
-        elif operation == "replace_text":
-            if current is None:
-                raise IsolatedExecutorError("REPLACE_SOURCE_MISSING")
-            old = str(change.get("old"))
-            new = str(change.get("new"))
-            count = int(change.get("count", 1))
-            text = current.decode("utf-8")
-            if text.count(old) != count:
-                raise IsolatedExecutorError("REPLACE_COUNT_INVALID:" + relative)
-            path.write_text(text.replace(old, new), encoding="utf-8")
-        elif operation == "delete_file":
-            if path.exists():
-                path.unlink()
-        else:
-            raise IsolatedExecutorError("CHANGE_OPERATION_INVALID")
-        changed.append(relative)
-    return sorted(set(changed))
-
-
-def changed_bundle(root: Path, changed: list[str]) -> list[dict[str, Any]]:
-    files = []
-    for relative in changed:
-        path = resolve_under(root, relative)
-        if path.exists():
-            data = path.read_bytes()
-            if len(data) > MAX_FILE_BYTES:
-                raise IsolatedExecutorError("CHANGED_FILE_TOO_LARGE:" + relative)
-            files.append({
-                "path": relative,
-                "deleted": False,
-                "sha256": sha256(data),
-                "content_b64": base64.b64encode(data).decode("ascii"),
-            })
-        else:
-            files.append({"path": relative, "deleted": True, "sha256": None, "content_b64": None})
-    return files
-
-
-def execute_request(request_path: Path, result_path: Path) -> None:
-    assert_uncredentialed()
-    request = json.loads(request_path.read_text(encoding="utf-8"))
-    if request.get("schema") != "aios.isolated-execution.request.v1":
-        raise IsolatedExecutorError("REQUEST_SCHEMA_INVALID")
-    request_id = request.get("request_id")
-    if not isinstance(request_id, str) or not REQUEST_ID_RE.fullmatch(request_id):
-        raise IsolatedExecutorError("REQUEST_ID_INVALID")
-    source_archive = Path(str(request.get("source_archive") or ""))
-    if not source_archive.is_absolute():
-        raise IsolatedExecutorError("SOURCE_ARCHIVE_PATH_INVALID")
-    expected_archive_sha = str(request.get("source_archive_sha256") or "")
-    if sha256(source_archive.read_bytes()) != expected_archive_sha:
-        raise IsolatedExecutorError("SOURCE_ARCHIVE_SHA_MISMATCH")
-    with tempfile.TemporaryDirectory(prefix="aios-isolated-executor-") as temporary:
-        root = Path(temporary) / "workspace"
-        root.mkdir()
-        extract_source(source_archive, root)
-        changed = apply_changes(request, root)
-        commands = [
-            run_command(item, root)
-            for item in request.get("verification", [])
-            if isinstance(item, Mapping)
-        ]
-        result = {
-            "schema": "aios.isolated-execution.result.v1",
-            "request_id": request_id,
-            "request_sha256": sha256(canonical(request)),
-            "changed_files": changed_bundle(root, changed),
-            "verification": commands,
-            "credential_isolation": {
-                "credential_env_absent": True,
-                "credential_mount_inaccessible": True,
-                "governed_bridge_unreachable": True,
-            },
-        }
-        result["result_sha256"] = sha256(canonical(result))
-        temporary_result = result_path.with_suffix(".tmp")
-        temporary_result.write_text(json.dumps(result, sort_keys=True, separators=(",", ":")), encoding="utf-8")
-        os.replace(temporary_result, result_path)
-
-
-def serve(root: Path) -> None:
-    assert_uncredentialed()
-    requests = root / "requests"
-    results = root / "results"
-    failed = root / "failed"
-    for path in (requests, results, failed):
-        path.mkdir(parents=True, exist_ok=True)
-    while True:
-        for request in sorted(requests.glob("*.json")):
-            if request.is_symlink():
-                continue
-            result = results / request.name
-            try:
-                execute_request(request, result)
-                request.unlink()
-            except Exception as exc:
-                (failed / request.name).write_text(
-                    json.dumps({"error": str(exc) or type(exc).__name__}, sort_keys=True),
-                    encoding="utf-8",
-                )
-                request.unlink(missing_ok=True)
-        time.sleep(0.5)
-
-
-if __name__ == "__main__":
-    import argparse
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--root", default="/var/lib/aios-online-agent-executor")
-    parser.add_argument("--request")
-    parser.add_argument("--result")
-    args = parser.parse_args()
-    if args.request and args.result:
-        execute_request(Path(args.request), Path(args.result))
-    else:
-        serve(Path(args.root))
@@ -1,316 +0,0 @@
-"""Task-scoped hardened wrapper around the existing Action API."""
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-from pathlib import Path
-import urllib.parse
-
-import aios_chatgpt_actions_api as api
-import aios_isolated_writer_policy as policy
-from isolated_writer_authz import AuthorizationError, authorize
-from isolated_writer_commit_file import AtomicCommitFile, CommitFileError, OperationLedger
-from isolated_writer_token_registry import TokenRegistry
-
-_reject = api.reject_non_read_http
-_write_file = api.write_file
-_sync_branch = api.sync_branch
-_original_do_get = api.H.do_GET
-api.OPENAPI = Path(os.getenv("AIOS_GITOPS_ISOLATED_WRITER_OPENAPI", str(api.OPENAPI)))
-
-
-def _registry() -> TokenRegistry:
-    return TokenRegistry(Path(os.environ["AIOS_GITOPS_TOKEN_REGISTRY_V2"]))
-
-
-def _atomic_writer() -> AtomicCommitFile:
-    return AtomicCommitFile(
-        workspace=api.WS,
-        bare_repo=api.BARE_REPO,
-        ledger=OperationLedger(Path(os.environ["AIOS_GITOPS_WRITER_OPERATION_LEDGER"])),
-        remote=os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", ""),
-        audit=policy.append_audit_record,
-    )
-
-
-def _bearer(handler) -> str:
-    value = handler.headers.get("Authorization", "")
-    return value[7:].strip() if value.startswith("Bearer ") else ""
-
-
-def _authorize(handler, *, method: str, path: str, branch=None, target_path=None):
-    grant = authorize(
-        _registry(),
-        _bearer(handler),
-        method=method,
-        path=path,
-        source_ip=str(handler.client_address[0]),
-        workspace=api.WS,
-        branch=branch,
-        target_path=target_path,
-    )
-    grant.record["_source_ip"] = str(handler.client_address[0])
-    return grant
-
-
-def _authorization_error(handler, exc: AuthorizationError):
-    return handler.sendj({"error": exc.code}, exc.status)
-
-
-def _isolated_runtime_status(handler):
-    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
-    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
-    return handler.sendj({
-        "service": os.getenv(
-            "AIOS_GITOPS_SERVICE_AUDIENCE",
-            "aios-isolated-writer.service",
-        ),
-        "status": "active",
-        "runtime_role": os.getenv("AIOS_GITOPS_RUNTIME_ROLE"),
-        "workspace_role": os.getenv("AIOS_GITOPS_WORKSPACE_ROLE"),
-        "writes_enabled": os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").lower()
-        in {"1", "true", "yes", "on"},
-        "allowed_branch": policy.allowed_branch(),
-        "approved_base_oid": policy.allowed_base_oid(),
-        "workspace_branch": branch,
-        "workspace_head_oid": head,
-        "repository_identity": os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY"),
-        "token_policy_version": 2,
-        "atomic_commit_file": True,
-        "path_policy_sha256": policy.configured_path_policy_sha256(),
-    })
-
-
-def _isolated_do_get(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path in {"/health", "/api/health"}:
-        return self.sendj({
-            "status": "ok",
-            "service": os.getenv(
-                "AIOS_GITOPS_SERVICE_AUDIENCE",
-                "aios-isolated-writer.service",
-            ),
-        })
-    if path not in {"/api/runtime-status", "/api/baseline", "/api/patches"}:
-        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
-    try:
-        _authorize(self, method="GET", path=path)
-    except AuthorizationError as exc:
-        return _authorization_error(self, exc)
-    if path == "/api/runtime-status":
-        return _isolated_runtime_status(self)
-    return _original_do_get(self)
-
-
-def _read_commit_file_body(handler):
-    try:
-        length = int(handler.headers.get("Content-Length", "0"))
-    except ValueError:
-        raise CommitFileError("writer_content_length_rejected") from None
-    if length <= 0:
-        raise CommitFileError("writer_request_object_required")
-    if length > 1_100_000:
-        raise CommitFileError("writer_request_too_large", 413)
-    raw = handler.rfile.read(length)
-    try:
-        value = json.loads(raw.decode("utf-8"))
-    except (UnicodeDecodeError, json.JSONDecodeError):
-        raise CommitFileError("writer_request_json_rejected") from None
-    if not isinstance(value, dict):
-        raise CommitFileError("writer_request_object_required")
-    return value
-
-
-def _isolated_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != "/api/commit-file":
-        return self.sendj({"error": "isolated_writer_operation_forbidden"}, 403)
-    try:
-        data = _read_commit_file_body(self)
-        branch = str(data.get("branch") or "")
-        target_path = str(data.get("path") or "")
-        grant = _authorize(
-            self,
-            method="POST",
-            path=path,
-            branch=branch,
-            target_path=target_path,
-        )
-        if api.content_has_secret(str(data.get("content") or "")):
-            raise CommitFileError("writer_secret_content_rejected", 403)
-        result = _atomic_writer().execute(grant, data)
-        return self.sendj(result)
-    except AuthorizationError as exc:
-        return _authorization_error(self, exc)
-    except CommitFileError as exc:
-        return self.sendj({"error": exc.code}, exc.status)
-    except PermissionError:
-        return self.sendj({"error": "isolated_writer_policy_rejected"}, 403)
-
-
-def reject_non_read_http(handler, method: str, path: str) -> bool:
-    if _reject(handler, method, path):
-        return True
-    try:
-        policy.validate_endpoint(method, path, api.WS, api.BARE_REPO)
-        return False
-    except PermissionError as exc:
-        handler.sendj({"error": str(exc)}, 403)
-        return True
-
-
-def checkout(branch, base="main", create=False):
-    api.ensure_git()
-    target = api.branch_name(branch)
-    policy.validate_branch_request({"branch": target, "base": base})
-    exists = api.sh(["rev-parse", "--verify", target])["code"] == 0
-    if exists:
-        if api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"] != target:
-            api.sh(["checkout", target], True)
-    elif create:
-        api.sh(["checkout", "-b", target, base], True)
-    else:
-        raise PermissionError("isolated_writer_branch_missing")
-    policy.require_service_invariants(api.WS, api.BARE_REPO)
-    return target
-
-
-def write_file(path, content):
-    policy.validate_path(path, api.WS)
-    return _write_file(path, content)
-
-
-def sync_branch(branch: str):
-    policy.validate_sync_branch(branch)
-    local = _sync_branch(branch)
-    remote = os.getenv("AIOS_GITOPS_GITEA_PUSH_REMOTE", "").strip()
-    if remote != "gitea-http":
-        raise PermissionError("isolated_writer_gitea_remote_rejected")
-    head = api.sh(["rev-parse", "HEAD"], True)["stdout"]
-    pushed = subprocess.run(
-        ["git", "push", "--porcelain", remote, f"HEAD:refs/heads/{branch}"],
-        cwd=api.WS,
-        text=True,
-        capture_output=True,
-    )
-    if pushed.returncode != 0:
-        raise RuntimeError("isolated_writer_gitea_push_failed")
-    verified = subprocess.run(
-        ["git", "ls-remote", "--heads", remote, f"refs/heads/{branch}"],
-        cwd=api.WS,
-        text=True,
-        capture_output=True,
-    )
-    if verified.returncode != 0:
-        raise RuntimeError("isolated_writer_gitea_verification_failed")
-    fields = verified.stdout.strip().split()
-    if len(fields) != 2 or fields[0] != head or fields[1] != f"refs/heads/{branch}":
-        raise RuntimeError("isolated_writer_gitea_oid_mismatch")
-    return {
-        "status": "verified",
-        "target": "authoritative-bare+gitea",
-        "branch": branch,
-        "oid": head,
-        "local": local.get("status"),
-    }
-
-
-def commit(paths, msg):
-    policy.validate_commit_paths(paths, api.WS)
-    api.ensure_git()
-    selected = [api.relpath(p) for p in paths] if paths else ["."]
-    api.sh(["add", *selected], True)
-    policy.validate_staged_paths(api.WS)
-    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
-    if not api.sh(["status", "--short"])["stdout"]:
-        return {"status": "no_changes", "branch": branch, "sync": sync_branch(branch)}
-    out = api.sh(["commit", "-m", msg], True)
-    branch = api.sh(["rev-parse", "--abbrev-ref", "HEAD"], True)["stdout"]
-    return {
-        "status": "committed",
-        "branch": branch,
-        "rev": api.sh(["rev-parse", "--short", "HEAD"], True)["stdout"],
-        "git": out,
-        "sync": sync_branch(branch),
-    }
-
-
-def audit(actor, action, target, payload):
-    policy.append_audit_record(
-        {
-            "at": api.now(),
-            "actor": actor,
-            "action": action,
-            "target": target,
-            "payload": api.sanitize(payload),
-        }
-    )
-
-
-def _validate_request(self, data, validate):
-    try:
-        validate(data)
-        return True
-    except PermissionError as exc:
-        self.sendj({"error": str(exc)}, 403)
-        return False
-
-
-def _checked_branch(self, data):
-    if not _validate_request(self, data, policy.validate_branch_request):
-        return
-    return _branch(self, data)
-
-
-def _checked_file(self, data):
-    data = dict(data)
-    data.setdefault("branch", policy.allowed_branch())
-    if not _validate_request(self, data, policy.validate_branch_request):
-        return
-    if not _validate_request(
-        self,
-        {"path": data.get("path", "")},
-        lambda item: policy.validate_path(item["path"], api.WS),
-    ):
-        return
-    return _file(self, data)
-
-
-def _checked_commit(self, data):
-    data = dict(data)
-    data.setdefault("branch", policy.allowed_branch())
-    if not _validate_request(self, data, policy.validate_branch_request):
-        return
-    return _commit(self, data)
-
-
-def _checked_patch(self, data):
-    data = dict(data)
-    data["branch"] = policy.allowed_branch()
-    if not _validate_request(self, data, policy.validate_branch_request):
-        return
-    return _patch(self, data)
-
-
-_branch, _file, _commit, _patch = api.H.branch, api.H.file, api.H.commit, api.H.patch
-api.reject_non_read_http = reject_non_read_http
-api.checkout, api.write_file, api.sync_branch, api.commit, api.audit = (
-    checkout,
-    write_file,
-    sync_branch,
-    commit,
-    audit,
-)
-api.H.branch, api.H.file, api.H.commit, api.H.patch = (
-    _checked_branch,
-    _checked_file,
-    _checked_commit,
-    _checked_patch,
-)
-api.H.do_GET = _isolated_do_get
-api.H.do_POST = _isolated_do_post
-
-if __name__ == "__main__":
-    policy.require_service_invariants(api.WS, api.BARE_REPO)
-    api.ThreadingHTTPServer((api.HOST, api.PORT), api.H).serve_forever()
@@ -1,310 +0,0 @@
-"""Fail-closed policy used only by the task-scoped Action writer."""
-from __future__ import annotations
-
-import os
-import json
-import stat
-import subprocess
-import re
-from pathlib import Path, PurePosixPath, PureWindowsPath
-from urllib.parse import unquote
-
-import isolated_writer_path_policy as path_policy
-
-WRITE_ENDPOINTS = frozenset({"/api/commit-file"})
-ALLOWED_ROOTS = (
-    "active-runtime",
-    "docs",
-    "patches",
-    "reports",
-    "scripts",
-    "test",
-    "tests",
-)
-DENIED_ROOTS = ("baseline", "config", "deploy", "deployments", "ops", "runtime", "services")
-_TRUE = frozenset({"1", "true", "yes", "on"})
-_FALSE = frozenset({"0", "false", "no", "off"})
-_DENY_FLAGS = (
-    "AIOS_GITOPS_ALLOW_MAIN_WRITE",
-    "AIOS_GITOPS_ALLOW_TAG_WRITE",
-    "AIOS_GITOPS_ALLOW_BASELINE_WRITE",
-    "AIOS_GITOPS_ALLOW_REGISTRY_WRITE",
-    "AIOS_GITOPS_ALLOW_ROLLBACK",
-    "AIOS_GITOPS_ALLOW_DEPLOYMENT",
-)
-
-
-def enforcement_required() -> bool:
-    return os.getenv("AIOS_GITOPS_ISOLATED_WRITER_ENFORCEMENT", "") == "required"
-
-
-def allowed_branch() -> str:
-    value = os.getenv("AIOS_GITOPS_ALLOWED_BRANCH", "").strip()
-    if not value:
-        raise PermissionError("isolated_writer_missing_allowed_branch")
-    return value
-
-
-def allowed_base_oid() -> str:
-    value = os.getenv("AIOS_GITOPS_ALLOWED_BASE_OID", "").strip().lower()
-    if len(value) != 40 or any(ch not in "0123456789abcdef" for ch in value):
-        raise PermissionError("isolated_writer_invalid_allowed_base_oid")
-    return value
-
-
-def _git(workspace: Path, *args: str) -> str:
-    result = subprocess.run(["git", *args], cwd=workspace, text=True, capture_output=True)
-    if result.returncode != 0:
-        raise PermissionError("isolated_writer_git_validation_failed")
-    return result.stdout.strip()
-
-
-def require_service_invariants(workspace: Path, bare_repo: Path) -> None:
-    if not enforcement_required():
-        return
-    if os.getenv("AIOS_GITOPS_WRITES_ENABLED", "").strip().lower() not in _TRUE:
-        raise PermissionError("isolated_writer_write_gate_required")
-    if os.getenv("AIOS_GITOPS_RUNTIME_ROLE", "") != "isolated-writer":
-        raise PermissionError("isolated_writer_role_required")
-    if os.getenv("AIOS_GITOPS_WORKSPACE_ROLE", "") != "isolated-writer":
-        raise PermissionError("isolated_writer_workspace_role_required")
-    if os.getenv("AIOS_GITOPS_TOKEN_POLICY_VERSION_REQUIRED", "") != "2":
-        raise PermissionError("isolated_writer_token_policy_v2_required")
-    if not os.getenv("AIOS_GITOPS_SERVICE_AUDIENCE", "").strip():
-        raise PermissionError("isolated_writer_service_audience_required")
-    if not os.getenv("AIOS_GITOPS_TOKEN_REGISTRY_V2", "").strip():
-        raise PermissionError("isolated_writer_token_registry_required")
-    if not os.getenv("AIOS_GITOPS_WRITER_OPERATION_LEDGER", "").strip():
-        raise PermissionError("isolated_writer_operation_ledger_required")
-    path_policy.configured_path_policy()
-    for name in _DENY_FLAGS:
-        if os.getenv(name, "").strip().lower() not in _FALSE:
-            raise PermissionError("isolated_writer_forbidden_capability_flag")
-    if os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "") != "aios/aios":
-        raise PermissionError("isolated_writer_repository_identity_rejected")
-    configured_bare_value = os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "").strip()
-    if not configured_bare_value:
-        raise PermissionError("isolated_writer_authoritative_repo_rejected")
-    configured_bare = Path(configured_bare_value)
-    if configured_bare.resolve(strict=True) != bare_repo.resolve(strict=True):
-        raise PermissionError("isolated_writer_authoritative_repo_rejected")
-    writer_root_value = os.getenv("AIOS_GITOPS_APPROVED_WRITER_ROOT", "").strip()
-    if not writer_root_value:
-        raise PermissionError("isolated_writer_workspace_outside_approved_root")
-    writer_root = Path(writer_root_value).resolve(strict=True)
-    lexical_workspace = Path(os.path.abspath(str(workspace)))
-    canonical_workspace = lexical_workspace.resolve(strict=True)
-    if lexical_workspace != canonical_workspace:
-        raise PermissionError("isolated_writer_workspace_symlink_rejected")
-    try:
-        canonical_workspace.relative_to(writer_root)
-    except (ValueError, FileNotFoundError):
-        raise PermissionError("isolated_writer_workspace_outside_approved_root") from None
-    if _git(workspace, "rev-parse", "--abbrev-ref", "HEAD") != allowed_branch():
-        raise PermissionError("isolated_writer_current_branch_rejected")
-    approved_base = allowed_base_oid()
-    try:
-        _git(workspace, "cat-file", "-e", f"{approved_base}^{{commit}}")
-        subprocess.run(
-            ["git", "merge-base", "--is-ancestor", approved_base, "HEAD"],
-            cwd=workspace,
-            check=True,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-    except (PermissionError, subprocess.CalledProcessError):
-        raise PermissionError("isolated_writer_approved_base_not_ancestor") from None
-    if _git(workspace, "merge-base", approved_base, "HEAD") != approved_base:
-        raise PermissionError("isolated_writer_merge_base_rejected")
-    common = Path(_git(workspace, "rev-parse", "--git-common-dir"))
-    if not common.is_absolute():
-        common = (workspace / common).resolve()
-    if common.resolve() != bare_repo.resolve():
-        raise PermissionError("isolated_writer_common_repo_rejected")
-
-
-def approved_audit_log_path() -> Path:
-    root_value = os.getenv("AIOS_GITOPS_APPROVED_AUDIT_ROOT", "").strip()
-    log_value = os.getenv("AIOS_GITOPS_AUDIT_LOG", "").strip()
-    if not root_value or not log_value:
-        raise PermissionError("isolated_writer_audit_path_missing")
-    lexical_root = Path(os.path.abspath(root_value))
-    lexical_log = Path(os.path.abspath(log_value))
-    root = lexical_root.resolve(strict=True)
-    if lexical_root != root or root.is_symlink() or not root.is_dir():
-        raise PermissionError("isolated_writer_audit_root_rejected")
-    try:
-        lexical_log.relative_to(root)
-    except ValueError:
-        raise PermissionError("isolated_writer_audit_path_outside_approved_root") from None
-    if lexical_log.parent.resolve(strict=True) != lexical_log.parent:
-        raise PermissionError("isolated_writer_audit_parent_symlink_rejected")
-    if lexical_log.exists() and lexical_log.is_symlink():
-        raise PermissionError("isolated_writer_audit_log_symlink_rejected")
-    os.chmod(root, 0o750)
-    os.chmod(lexical_log.parent, 0o750)
-    return lexical_log
-
-
-def append_audit_record(record: dict) -> None:
-    path = approved_audit_log_path()
-    flags = os.O_WRONLY | os.O_APPEND | os.O_CREAT
-    if hasattr(os, "O_NOFOLLOW"):
-        flags |= os.O_NOFOLLOW
-    descriptor = os.open(path, flags, 0o600)
-    try:
-        info = os.fstat(descriptor)
-        if not stat.S_ISREG(info.st_mode):
-            raise PermissionError("isolated_writer_audit_log_not_regular")
-        os.fchmod(descriptor, 0o600)
-        line = json.dumps(
-            _audit_sanitize(record),
-            ensure_ascii=False,
-            sort_keys=True,
-            separators=(",", ":"),
-        ).encode("utf-8") + b"\n"
-        os.write(descriptor, line)
-        os.fsync(descriptor)
-    finally:
-        os.close(descriptor)
-    parent_fd = os.open(path.parent, os.O_RDONLY | getattr(os, "O_DIRECTORY", 0))
-    try:
-        os.fsync(parent_fd)
-    finally:
-        os.close(parent_fd)
-
-
-def _audit_sanitize(value):
-    if isinstance(value, dict):
-        return {
-            key: (
-                "[REDACTED]"
-                if any(
-                    marker in str(key).lower()
-                    for marker in (
-                        "authorization",
-                        "credential",
-                        "password",
-                        "secret",
-                        "token",
-                        "private_key",
-                    )
-                )
-                and str(key).lower() != "token_id"
-                else _audit_sanitize(inner)
-            )
-            for key, inner in value.items()
-        }
-    if isinstance(value, list):
-        return [_audit_sanitize(item) for item in value]
-    if isinstance(value, str) and re.search(
-        r"(?i)(authorization\s*:\s*bearer|(?:token|password|secret)\s*[:=])",
-        value,
-    ):
-        return "[REDACTED]"
-    return value
-
-
-def validate_endpoint(method: str, path: str, workspace: Path, bare_repo: Path) -> None:
-    if not enforcement_required():
-        return
-    if method != "POST" or path not in WRITE_ENDPOINTS:
-        raise PermissionError("isolated_writer_operation_forbidden")
-    require_service_invariants(workspace, bare_repo)
-
-
-def validate_branch_request(data: dict) -> None:
-    if not enforcement_required():
-        return
-    branch = allowed_branch() if "branch" not in data else str(data.get("branch") or "").strip()
-    if branch != allowed_branch():
-        raise PermissionError("isolated_writer_branch_rejected")
-    if str(data.get("base", "main")).strip() != "main":
-        raise PermissionError("isolated_writer_base_rejected")
-    if data.get("force") or data.get("force_push"):
-        raise PermissionError("isolated_writer_force_rejected")
-
-
-def validate_path(path: str, workspace: Path | None = None) -> str:
-    if not isinstance(path, str):
-        raise PermissionError("isolated_writer_path_rejected")
-    value = path
-    if not value or value != value.strip() or "\x00" in value or "\\" in value:
-        raise PermissionError("isolated_writer_path_rejected")
-    try:
-        decoded = unquote(value, errors="strict")
-    except (UnicodeDecodeError, ValueError):
-        raise PermissionError("isolated_writer_path_rejected") from None
-    if decoded != value:
-        raise PermissionError("isolated_writer_path_rejected")
-    windows = PureWindowsPath(value)
-    posix = PurePosixPath(value)
-    parts = value.split("/")
-    if (
-        posix.is_absolute()
-        or windows.is_absolute()
-        or bool(windows.drive)
-        or any(part in {"", ".", ".."} for part in parts)
-    ):
-        raise PermissionError("isolated_writer_path_rejected")
-    first = parts[0]
-    service_exact_path = False
-    if first in DENIED_ROOTS:
-        try:
-            path_policy.require_service_path("commit_file.atomic", value)
-            service_exact_path = True
-        except path_policy.PathPolicyError as exc:
-            raise PermissionError(str(exc)) from None
-    if value != "README.md" and first not in ALLOWED_ROOTS and not service_exact_path:
-        raise PermissionError("isolated_writer_path_outside_allowed_roots")
-    if workspace is not None:
-        lexical_root = Path(os.path.abspath(str(workspace)))
-        root = lexical_root.resolve(strict=True)
-        if lexical_root != root:
-            raise PermissionError("isolated_writer_workspace_symlink_rejected")
-        current = root
-        for part in parts:
-            current = current / part
-            if current.is_symlink():
-                raise PermissionError("isolated_writer_path_symlink_rejected")
-        candidate = (root / value).resolve(strict=False)
-        try:
-            candidate.relative_to(root)
-        except ValueError:
-            raise PermissionError("isolated_writer_path_escapes_workspace") from None
-    return value
-
-
-def validate_content_for_path(path: str, content: str) -> None:
-    if path.split("/", 1)[0] not in DENIED_ROOTS:
-        return
-    try:
-        path_policy.validate_content("commit_file.atomic", path, content)
-    except path_policy.PathPolicyError as exc:
-        raise PermissionError(str(exc)) from None
-
-
-def configured_path_policy_sha256() -> str | None:
-    try:
-        return path_policy.configured_path_policy_sha256()
-    except path_policy.PathPolicyError as exc:
-        raise PermissionError(str(exc)) from None
-
-
-def validate_commit_paths(paths: list[str], workspace: Path | None = None) -> None:
-    if enforcement_required():
-        for path in paths:
-            if str(path).strip() != ".":
-                validate_path(str(path), workspace)
-
-
-def validate_staged_paths(workspace: Path) -> None:
-    if not enforcement_required():
-        return
-    for path in _git(workspace, "diff", "--cached", "--name-only").splitlines():
-        validate_path(path, workspace)
-
-
-def validate_sync_branch(branch: str) -> None:
-    if enforcement_required() and branch != allowed_branch():
-        raise PermissionError("isolated_writer_sync_branch_rejected")
@@ -1,232 +0,0 @@
-#!/usr/bin/env python3
-"""Root-owned Model Governance configuration reconciler.
-
-The config contains provider/model/policy metadata only. Raw credentials are rejected by
-aios_model_governance and never stored in the governance database.
-"""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_model_governance import (
-    ModelGovernanceError,
-    ModelGovernanceStore,
-    ModelRecord,
-    ProviderRecord,
-    ScopePolicy,
-)
-
-SCHEMA = "aios.model-governance.bootstrap.v1"
-MAX_CONFIG_BYTES = 512 * 1024
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value, ensure_ascii=False, sort_keys=True, separators=(",", ":")
-    ).encode("utf-8")
-
-
-def fail(code: str) -> None:
-    raise SystemExit(code)
-
-
-def _load(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file() or path.stat().st_size > MAX_CONFIG_BYTES:
-        fail("MODEL_GOVERNANCE_CONFIG_INVALID")
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except json.JSONDecodeError:
-        fail("MODEL_GOVERNANCE_CONFIG_INVALID")
-    if not isinstance(value, Mapping) or value.get("schema") != SCHEMA:
-        fail("MODEL_GOVERNANCE_CONFIG_SCHEMA_INVALID")
-    return dict(value)
-
-
-def _provider_desired(value: Mapping[str, Any]) -> ProviderRecord:
-    return ProviderRecord(
-        provider_id=str(value.get("provider_id") or ""),
-        credential_ref=value.get("credential_ref"),
-        enabled=bool(value.get("enabled", True)),
-        failure_domain=str(value.get("failure_domain") or "default"),
-        max_failures=int(value.get("max_failures") or 3),
-        cooldown_seconds=int(value.get("cooldown_seconds") or 60),
-    )
-
-
-def _model_desired(value: Mapping[str, Any]) -> ModelRecord:
-    return ModelRecord(
-        model_id=str(value.get("model_id") or ""),
-        provider_id=str(value.get("provider_id") or ""),
-        version=str(value.get("version") or ""),
-        capabilities=tuple(value.get("capabilities") or ()),
-        input_cost_micros_per_1k=int(value.get("input_cost_micros_per_1k") or 0),
-        output_cost_micros_per_1k=int(value.get("output_cost_micros_per_1k") or 0),
-        max_input_tokens=int(value.get("max_input_tokens") or 0),
-        max_output_tokens=int(value.get("max_output_tokens") or 0),
-        evaluation_state=str(value.get("evaluation_state") or "APPROVED"),
-        evaluation_sha256=str(value.get("evaluation_sha256") or ""),
-        enabled=bool(value.get("enabled", True)),
-        priority=int(value.get("priority") or 100),
-    )
-
-
-def _policy_desired(value: Mapping[str, Any]) -> ScopePolicy:
-    return ScopePolicy(
-        scope_type=str(value.get("scope_type") or ""),
-        tenant_id=value.get("tenant_id"),
-        project_id=value.get("project_id"),
-        allowed_models=tuple(value.get("allowed_models") or ()),
-        denied_providers=tuple(value.get("denied_providers") or ()),
-        required_capabilities=tuple(value.get("required_capabilities") or ()),
-        pinned_model_id=value.get("pinned_model_id"),
-        pinned_model_version=value.get("pinned_model_version"),
-        max_input_tokens_per_request=int(value.get("max_input_tokens_per_request") or 0),
-        max_output_tokens_per_request=int(value.get("max_output_tokens_per_request") or 0),
-        daily_token_budget=int(value.get("daily_token_budget") or 0),
-        daily_cost_budget_micros=int(value.get("daily_cost_budget_micros") or 0),
-        fallback_limit=int(value.get("fallback_limit") or 0),
-    )
-
-
-def _row_dict(row: object) -> dict[str, Any] | None:
-    return dict(row) if row is not None else None
-
-
-def _provider_matches(row: Mapping[str, Any], desired: ProviderRecord) -> bool:
-    return (
-        row["credential_ref"] == desired.credential_ref
-        and bool(row["enabled"]) == desired.enabled
-        and row["failure_domain"] == desired.failure_domain
-        and int(row["max_failures"]) == desired.max_failures
-        and int(row["cooldown_seconds"]) == desired.cooldown_seconds
-    )
-
-
-def _model_matches(row: Mapping[str, Any], desired: ModelRecord) -> bool:
-    return (
-        row["provider_id"] == desired.provider_id
-        and row["version"] == desired.version
-        and tuple(json.loads(row["capabilities_json"])) == tuple(sorted(set(desired.capabilities)))
-        and int(row["input_cost_micros_per_1k"]) == desired.input_cost_micros_per_1k
-        and int(row["output_cost_micros_per_1k"]) == desired.output_cost_micros_per_1k
-        and int(row["max_input_tokens"]) == desired.max_input_tokens
-        and int(row["max_output_tokens"]) == desired.max_output_tokens
-        and row["evaluation_state"] == desired.evaluation_state
-        and row["evaluation_sha256"] == desired.evaluation_sha256
-        and bool(row["enabled"]) == desired.enabled
-        and int(row["priority"]) == desired.priority
-    )
-
-
-def _policy_matches(row: Mapping[str, Any], desired: ScopePolicy) -> bool:
-    return (
-        row["scope_type"] == desired.scope_type
-        and row["tenant_id"] == desired.tenant_id
-        and row["project_id"] == desired.project_id
-        and tuple(json.loads(row["allowed_models_json"])) == tuple(sorted(set(desired.allowed_models)))
-        and tuple(json.loads(row["denied_providers_json"])) == tuple(sorted(set(desired.denied_providers)))
-        and tuple(json.loads(row["required_capabilities_json"])) == tuple(sorted(set(desired.required_capabilities)))
-        and row["pinned_model_id"] == desired.pinned_model_id
-        and row["pinned_model_version"] == desired.pinned_model_version
-        and int(row["max_input_tokens_per_request"]) == desired.max_input_tokens_per_request
-        and int(row["max_output_tokens_per_request"]) == desired.max_output_tokens_per_request
-        and int(row["daily_token_budget"]) == desired.daily_token_budget
-        and int(row["daily_cost_budget_micros"]) == desired.daily_cost_budget_micros
-        and int(row["fallback_limit"]) == desired.fallback_limit
-    )
-
-
-def apply_config(db_path: Path, config_path: Path) -> dict[str, Any]:
-    config = _load(config_path)
-    config_sha = hashlib.sha256(canonical(config)).hexdigest()
-    providers = config.get("providers") or []
-    models = config.get("models") or []
-    policies = config.get("policies") or []
-    if not all(isinstance(value, list) for value in (providers, models, policies)):
-        fail("MODEL_GOVERNANCE_CONFIG_COLLECTION_INVALID")
-
-    store = ModelGovernanceStore(db_path)
-    changes = {"providers": 0, "models": 0, "policies": 0, "unchanged": 0}
-    try:
-        for item in providers:
-            if not isinstance(item, Mapping):
-                fail("MODEL_GOVERNANCE_PROVIDER_CONFIG_INVALID")
-            desired = _provider_desired(item)
-            row = store.conn.execute(
-                "SELECT * FROM model_governance_providers WHERE provider_id=?",
-                (desired.provider_id,),
-            ).fetchone()
-            if row is not None and _provider_matches(row, desired):
-                changes["unchanged"] += 1
-                continue
-            expected = int(row["revision"]) if row is not None else 0
-            store.register_provider(desired, expected_revision=expected)
-            changes["providers"] += 1
-
-        for item in models:
-            if not isinstance(item, Mapping):
-                fail("MODEL_GOVERNANCE_MODEL_CONFIG_INVALID")
-            desired = _model_desired(item)
-            row = store.conn.execute(
-                "SELECT * FROM model_governance_models WHERE model_id=?",
-                (desired.model_id,),
-            ).fetchone()
-            if row is not None and _model_matches(row, desired):
-                changes["unchanged"] += 1
-                continue
-            expected = int(row["revision"]) if row is not None else 0
-            store.register_model(desired, expected_revision=expected)
-            changes["models"] += 1
-
-        for item in policies:
-            if not isinstance(item, Mapping):
-                fail("MODEL_GOVERNANCE_POLICY_CONFIG_INVALID")
-            desired = _policy_desired(item)
-            row = store.conn.execute(
-                "SELECT * FROM model_governance_scope_policies WHERE scope_key=?",
-                (desired.scope_key,),
-            ).fetchone()
-            if row is not None and _policy_matches(row, desired):
-                changes["unchanged"] += 1
-                continue
-            expected = int(row["revision"]) if row is not None else 0
-            store.set_scope_policy(desired, expected_revision=expected)
-            changes["policies"] += 1
-
-        if not store.verify_audit_chain():
-            fail("MODEL_GOVERNANCE_AUDIT_CHAIN_INVALID")
-        return {
-            "schema": "aios.model-governance.bootstrap-result.v1",
-            "database": str(db_path),
-            "config_sha256": config_sha,
-            "changes": changes,
-            "audit_chain_valid": True,
-        }
-    finally:
-        store.close()
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    parser.add_argument("--db", required=True)
-    parser.add_argument("--config", required=True)
-    parser.add_argument("--output")
-    args = parser.parse_args()
-    try:
-        result = apply_config(Path(args.db), Path(args.config))
-    except ModelGovernanceError as exc:
-        print(json.dumps({"status": "FAILED", "error": exc.code}, sort_keys=True))
-        return 20
-    data = json.dumps(result, indent=2, sort_keys=True) + "\n"
-    if args.output:
-        Path(args.output).write_text(data, encoding="utf-8")
-    print(data, end="")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,302 +0,0 @@
-"""Durable checkpoint journal for the generic Online Agent worker.
-
-The JSON task state remains a fast cache.  This SQLite journal is the durable,
-append-only evidence used for restart/resume/replay decisions.
-"""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import json
-from pathlib import Path
-import sqlite3
-from typing import Any, Mapping
-
-PHASE_ORDER = {
-    "claimed": 10,
-    "workspace_prepared": 20,
-    "verification_passed": 30,
-    "agent_runtime_done": 40,
-    "source_capture_done": 40,
-    "commit_done": 40,
-    "reconciliation_required": 45,
-    "result_pending": 50,
-    "result_submitted": 60,
-}
-
-
-class CheckpointError(RuntimeError):
-    pass
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False, default=str).encode("utf-8")
-
-
-def sha256_json(value: object) -> str:
-    return hashlib.sha256(canonical(value)).hexdigest()
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-@dataclass(frozen=True)
-class CheckpointBinding:
-    task_id: str
-    attempt: int
-    execution_digest: str
-    job_id: str
-    repository: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    generation: int
-
-    def material(self) -> dict[str, Any]:
-        return {
-            "task_id": self.task_id,
-            "attempt": self.attempt,
-            "execution_digest": self.execution_digest,
-            "job_id": self.job_id,
-            "repository": self.repository,
-            "base_oid": self.base_oid,
-            "expected_branch_oid": self.expected_branch_oid,
-            "target_branch": self.target_branch,
-            "generation": self.generation,
-        }
-
-    @property
-    def binding_sha256(self) -> str:
-        return sha256_json(self.material())
-
-
-class CheckpointStore:
-    def __init__(self, path: Path) -> None:
-        self.path = Path(path)
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        with self._connect() as connection:
-            connection.executescript(
-                """
-                CREATE TABLE IF NOT EXISTS checkpoints(
-                  task_id TEXT NOT NULL,
-                  attempt INTEGER NOT NULL,
-                  sequence INTEGER NOT NULL,
-                  phase TEXT NOT NULL,
-                  phase_order INTEGER NOT NULL,
-                  execution_digest TEXT NOT NULL,
-                  job_id TEXT NOT NULL,
-                  repository TEXT NOT NULL,
-                  base_oid TEXT NOT NULL,
-                  expected_branch_oid TEXT NOT NULL,
-                  target_branch TEXT NOT NULL,
-                  generation INTEGER NOT NULL,
-                  binding_sha256 TEXT NOT NULL,
-                  payload_json TEXT NOT NULL,
-                  payload_sha256 TEXT NOT NULL,
-                  created_at TEXT NOT NULL,
-                  PRIMARY KEY(task_id, attempt, sequence)
-                );
-                CREATE INDEX IF NOT EXISTS idx_checkpoints_task_latest
-                  ON checkpoints(task_id, attempt DESC, sequence DESC);
-                CREATE UNIQUE INDEX IF NOT EXISTS idx_checkpoints_exact_replay
-                  ON checkpoints(task_id, attempt, phase, payload_sha256);
-                CREATE TABLE IF NOT EXISTS checkpoint_heads(
-                  task_id TEXT PRIMARY KEY,
-                  attempt INTEGER NOT NULL,
-                  sequence INTEGER NOT NULL,
-                  phase TEXT NOT NULL,
-                  phase_order INTEGER NOT NULL,
-                  execution_digest TEXT NOT NULL,
-                  binding_sha256 TEXT NOT NULL,
-                  payload_sha256 TEXT NOT NULL,
-                  updated_at TEXT NOT NULL
-                );
-                """
-            )
-
-    def _connect(self) -> sqlite3.Connection:
-        connection = sqlite3.connect(self.path, timeout=30.0)
-        connection.row_factory = sqlite3.Row
-        connection.execute("PRAGMA foreign_keys=ON")
-        connection.execute("PRAGMA journal_mode=WAL")
-        connection.execute("PRAGMA synchronous=FULL")
-        connection.execute("PRAGMA busy_timeout=30000")
-        return connection
-
-    @staticmethod
-    def _phase_order(phase: str) -> int:
-        try:
-            return PHASE_ORDER[phase]
-        except KeyError as exc:
-            raise CheckpointError("CHECKPOINT_PHASE_INVALID") from exc
-
-    def append(
-        self,
-        binding: CheckpointBinding,
-        phase: str,
-        payload: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        order = self._phase_order(phase)
-        payload_value = dict(payload)
-        payload_sha = sha256_json(payload_value)
-        with self._connect() as connection:
-            connection.execute("BEGIN IMMEDIATE")
-            replay = connection.execute(
-                """
-                SELECT * FROM checkpoints
-                 WHERE task_id=? AND attempt=? AND phase=? AND payload_sha256=?
-                """,
-                (binding.task_id, binding.attempt, phase, payload_sha),
-            ).fetchone()
-            if replay is not None:
-                connection.commit()
-                return dict(replay)
-
-            head = connection.execute(
-                "SELECT * FROM checkpoint_heads WHERE task_id=?",
-                (binding.task_id,),
-            ).fetchone()
-            if head is not None:
-                head_attempt = int(head["attempt"])
-                head_order = int(head["phase_order"])
-                if binding.attempt < head_attempt:
-                    raise CheckpointError("CHECKPOINT_ATTEMPT_REGRESSION")
-                if binding.attempt == head_attempt:
-                    if head["execution_digest"] != binding.execution_digest:
-                        raise CheckpointError("CHECKPOINT_EXECUTION_DIGEST_CONFLICT")
-                    if head["binding_sha256"] != binding.binding_sha256:
-                        raise CheckpointError("CHECKPOINT_SCOPE_MISMATCH_DENY")
-                    if order < head_order and phase != "reconciliation_required":
-                        raise CheckpointError("CHECKPOINT_PHASE_REGRESSION")
-                    sequence = int(head["sequence"]) + 1
-                else:
-                    sequence = 1
-            else:
-                sequence = 1
-
-            created_at = now()
-            connection.execute(
-                """
-                INSERT INTO checkpoints(
-                  task_id,attempt,sequence,phase,phase_order,execution_digest,job_id,
-                  repository,base_oid,expected_branch_oid,target_branch,generation,
-                  binding_sha256,payload_json,payload_sha256,created_at
-                ) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)
-                """,
-                (
-                    binding.task_id,
-                    binding.attempt,
-                    sequence,
-                    phase,
-                    order,
-                    binding.execution_digest,
-                    binding.job_id,
-                    binding.repository,
-                    binding.base_oid,
-                    binding.expected_branch_oid,
-                    binding.target_branch,
-                    binding.generation,
-                    binding.binding_sha256,
-                    canonical(payload_value).decode("utf-8"),
-                    payload_sha,
-                    created_at,
-                ),
-            )
-            connection.execute(
-                """
-                INSERT INTO checkpoint_heads(
-                  task_id,attempt,sequence,phase,phase_order,execution_digest,
-                  binding_sha256,payload_sha256,updated_at
-                ) VALUES (?,?,?,?,?,?,?,?,?)
-                ON CONFLICT(task_id) DO UPDATE SET
-                  attempt=excluded.attempt,
-                  sequence=excluded.sequence,
-                  phase=excluded.phase,
-                  phase_order=excluded.phase_order,
-                  execution_digest=excluded.execution_digest,
-                  binding_sha256=excluded.binding_sha256,
-                  payload_sha256=excluded.payload_sha256,
-                  updated_at=excluded.updated_at
-                """,
-                (
-                    binding.task_id,
-                    binding.attempt,
-                    sequence,
-                    phase,
-                    order,
-                    binding.execution_digest,
-                    binding.binding_sha256,
-                    payload_sha,
-                    created_at,
-                ),
-            )
-            connection.commit()
-            row = connection.execute(
-                "SELECT * FROM checkpoints WHERE task_id=? AND attempt=? AND sequence=?",
-                (binding.task_id, binding.attempt, sequence),
-            ).fetchone()
-            return dict(row)
-
-    def latest(self, task_id: str) -> dict[str, Any] | None:
-        with self._connect() as connection:
-            row = connection.execute(
-                """
-                SELECT * FROM checkpoints
-                 WHERE task_id=?
-                 ORDER BY attempt DESC, sequence DESC
-                 LIMIT 1
-                """,
-                (task_id,),
-            ).fetchone()
-            if row is None:
-                return None
-            value = dict(row)
-            value["payload"] = json.loads(value.pop("payload_json"))
-            return value
-
-    def latest_for_attempt(self, task_id: str, attempt: int) -> dict[str, Any] | None:
-        with self._connect() as connection:
-            row = connection.execute(
-                """
-                SELECT * FROM checkpoints
-                 WHERE task_id=? AND attempt=?
-                 ORDER BY sequence DESC
-                 LIMIT 1
-                """,
-                (task_id, attempt),
-            ).fetchone()
-            if row is None:
-                return None
-            value = dict(row)
-            value["payload"] = json.loads(value.pop("payload_json"))
-            return value
-
-    def verify_latest_binding(self, binding: CheckpointBinding) -> dict[str, Any] | None:
-        value = self.latest(binding.task_id)
-        if value is None:
-            return None
-        if int(value["attempt"]) > binding.attempt:
-            raise CheckpointError("CHECKPOINT_FUTURE_ATTEMPT")
-        # A previous attempt may be reused only when the immutable execution/scope binding matches.
-        if value["execution_digest"] != binding.execution_digest:
-            return None
-        expected = CheckpointBinding(
-            task_id=value["task_id"],
-            attempt=int(value["attempt"]),
-            execution_digest=value["execution_digest"],
-            job_id=value["job_id"],
-            repository=value["repository"],
-            base_oid=value["base_oid"],
-            expected_branch_oid=value["expected_branch_oid"],
-            target_branch=value["target_branch"],
-            generation=int(value["generation"]),
-        )
-        current_scope = binding.material()
-        historical_scope = expected.material()
-        current_scope.pop("attempt", None)
-        historical_scope.pop("attempt", None)
-        if sha256_json(current_scope) != sha256_json(historical_scope):
-            raise CheckpointError("CHECKPOINT_SCOPE_MISMATCH_DENY")
-        return value
@@ -1,463 +0,0 @@
-"""Bounded read-only repository interface map for governed Online Agent analysis.
-
-The compact map intentionally returns symbols and short source excerpts rather than a
-source archive. It is designed for control-plane consumers that cannot safely ingest a
-multi-megabyte repository snapshot.
-"""
-from __future__ import annotations
-
-import ast
-import hashlib
-import json
-from pathlib import Path
-import re
-from typing import Any, Iterable, Mapping, Sequence
-
-
-SCHEMA = "aios.engineering.interface-map.v1"
-MAX_RESULT_BYTES = 120 * 1024
-TARGET_RESULT_BYTES = 108 * 1024
-MAX_MODULES = 40
-MAX_SYMBOLS = 80
-MAX_TESTS = 40
-MAX_EXCERPTS = 25
-MAX_EXCERPT_CHARS = 1200
-MAX_FILE_BYTES = 2 * 1024 * 1024
-
-ROOTS = (
-    "active-runtime/app",
-    "runtime/agent-os",
-    "tests",
-    "db/migrations",
-    "migrations",
-    "deploy/systemd",
-    "docs/task-plane",
-    "docs/superpowers/specs",
-)
-SUFFIXES = {".py", ".sql", ".service", ".md", ".json", ".yaml", ".yml"}
-
-DEFAULT_TERMS = {
-    "agent", "worker", "fleet", "scheduler", "scheduling", "task", "claim", "lease",
-    "heartbeat", "capacity", "concurrency", "priority", "fairness", "queue", "retry",
-    "backoff", "circuit", "health", "liveness", "scope", "tenant", "project", "trace",
-    "message", "checkpoint", "recovery", "idempotency", "dispatch", "assignment",
-}
-FLEET_CONTRACT_TERMS: dict[str, tuple[str, ...]] = {
-    "FLEET_AGENT_REGISTRATION": ("agent", "register", "worker", "capability", "version"),
-    "FLEET_CAPACITY_SCHEDULING": ("capacity", "slot", "concurrency", "scheduler", "queue"),
-    "FLEET_FAIRNESS": ("fair", "priority", "queue", "tenant", "project", "starvation"),
-    "FLEET_FAULT_ISOLATION": ("failure", "health", "liveness", "timeout", "circuit", "poison"),
-    "FLEET_WORKER_REASSIGNMENT": ("reassign", "assignment", "claim", "lease", "retry", "worker"),
-    "FLEET_SCOPE_ISOLATION": ("tenant", "project", "scope", "conversation", "task", "run"),
-    "FLEET_IDEMPOTENT_DISPATCH": ("idempot", "dispatch", "claim", "lease", "result", "attempt"),
-    "FLEET_FAILURE_RECOVERY": ("checkpoint", "resume", "recover", "retry", "cleanup", "receipt"),
-}
-
-MODEL_GOVERNANCE_CONTRACT_TERMS: dict[str, tuple[str, ...]] = {
-    "MODEL_PROVIDER_REGISTRY": ("model", "provider", "registry", "endpoint", "capability"),
-    "MODEL_SELECTION_POLICY": ("model", "select", "route", "policy", "capability"),
-    "MODEL_VERSION_PINNING": ("model", "version", "pin", "revision", "snapshot"),
-    "MODEL_BUDGET_ACCOUNTING": ("budget", "token", "cost", "quota", "usage"),
-    "MODEL_FALLBACK_POLICY": ("fallback", "retry", "route", "provider", "model"),
-    "MODEL_SCOPE_ISOLATION": ("tenant", "project", "scope", "policy", "model"),
-    "MODEL_CREDENTIAL_BOUNDARY": ("credential", "secret", "provider", "tool", "token"),
-    "MODEL_TRACE_AUDIT": ("trace", "audit", "model", "provider", "request"),
-    "MODEL_EVALUATION_GATE": ("eval", "evaluation", "approval", "quality", "gate"),
-    "MODEL_ROUTING_RESILIENCE": ("route", "retry", "fallback", "timeout", "health"),
-}
-
-PROFILE_CLASSIFICATION = {
-    "fleet": "P2_INTERFACE_MAP_CAPTURED",
-    "model_governance": "MODEL_GOVERNANCE_INTERFACE_MAP_CAPTURED",
-}
-
-MODEL_PROFILE_MARKERS = {
-    "model", "provider", "llm", "inference", "routing", "router", "budget",
-    "token", "cost", "quota", "fallback", "evaluation", "eval", "approval",
-    "version", "pinning",
-}
-SENSITIVE_RE = re.compile(
-    r"(?i)(authorization\s*:\s*bearer\s+\S+|"
-    r"(?:password|passwd|secret|token|api[_-]?key)\s*[:=]\s*['\"]?[^'\"\s,;]+)"
-)
-SQL_TABLE_RE = re.compile(
-    r"(?is)\bcreate\s+table\s+(?:if\s+not\s+exists\s+)?[\"`[]?([A-Za-z_][A-Za-z0-9_.-]*)"
-)
-
-
-class CompactInterfaceMapError(RuntimeError):
-    pass
-
-
-def _sha(data: bytes) -> str:
-    return hashlib.sha256(data).hexdigest()
-
-
-def _bounded_excerpt(text: str, start_line: int, end_line: int) -> str:
-    lines = text.splitlines()
-    start = max(0, start_line - 2)
-    end = min(len(lines), max(end_line + 1, start + 1))
-    excerpt = "\n".join(lines[start:end])
-    excerpt = SENSITIVE_RE.sub("<redacted-sensitive-source-pattern>", excerpt)
-    if len(excerpt) > MAX_EXCERPT_CHARS:
-        excerpt = excerpt[: MAX_EXCERPT_CHARS - 1] + "…"
-    return excerpt
-
-
-def _signal_terms(signals: Sequence[str]) -> set[str]:
-    terms = set(DEFAULT_TERMS)
-    for signal in signals:
-        if not isinstance(signal, str):
-            continue
-        terms.update(
-            token.lower()
-            for token in re.findall(r"[A-Za-z][A-Za-z0-9_.-]{2,63}", signal)
-        )
-    return set(sorted(terms)[:96])
-
-
-def _profile(source_signals: Sequence[str]) -> str:
-    tokens: set[str] = set()
-    for signal in source_signals:
-        if not isinstance(signal, str):
-            continue
-        tokens.update(
-            token.lower()
-            for token in re.findall(r"[A-Za-z][A-Za-z0-9_.-]{2,63}", signal)
-        )
-    model_score = len(tokens & MODEL_PROFILE_MARKERS)
-    return "model_governance" if model_score >= 2 else "fleet"
-
-
-def _contract_terms(profile: str) -> Mapping[str, tuple[str, ...]]:
-    if profile == "model_governance":
-        return MODEL_GOVERNANCE_CONTRACT_TERMS
-    if profile == "fleet":
-        return FLEET_CONTRACT_TERMS
-    raise CompactInterfaceMapError("INTERFACE_MAP_PROFILE_INVALID")
-
-
-def _candidate_files(root: Path, terms: set[str]) -> list[dict[str, Any]]:
-    root = root.resolve()
-    candidates: list[dict[str, Any]] = []
-    for relative_root in ROOTS:
-        directory = (root / relative_root).resolve(strict=False)
-        if directory == root or root not in directory.parents:
-            raise CompactInterfaceMapError("INTERFACE_MAP_SCOPE_INVALID")
-        if not directory.is_dir() or directory.is_symlink():
-            continue
-        for path in sorted(directory.rglob("*")):
-            if path.is_symlink() or not path.is_file() or path.suffix.lower() not in SUFFIXES:
-                continue
-            resolved = path.resolve(strict=True)
-            if root not in resolved.parents:
-                raise CompactInterfaceMapError("INTERFACE_MAP_PATH_ESCAPE")
-            data = path.read_bytes()
-            if len(data) > MAX_FILE_BYTES:
-                continue
-            relative = path.relative_to(root).as_posix()
-            text = data.decode("utf-8", "ignore")
-            searchable = (relative + "\n" + text[:384000]).lower()
-            matched = sorted(term for term in terms if term in searchable)
-            if not matched:
-                continue
-            path_bonus = sum(3 for term in terms if term in relative.lower())
-            test_bonus = 3 if relative.startswith("tests/") else 0
-            score = min(250, len(matched) + path_bonus + test_bonus)
-            candidates.append(
-                {
-                    "path": relative,
-                    "sha256": _sha(data),
-                    "bytes": len(data),
-                    "score": score,
-                    "text": text,
-                    "suffix": path.suffix.lower(),
-                }
-            )
-    candidates.sort(key=lambda item: (-item["score"], item["path"]))
-    return candidates
-
-
-def _python_symbols(item: Mapping[str, Any], terms: set[str]) -> list[dict[str, Any]]:
-    try:
-        tree = ast.parse(str(item["text"]), filename=str(item["path"]))
-    except SyntaxError:
-        return []
-    result: list[dict[str, Any]] = []
-
-    class Visitor(ast.NodeVisitor):
-        def __init__(self) -> None:
-            self.stack: list[str] = []
-
-        def _record(self, node: ast.AST, kind: str, name: str) -> None:
-            qualified = ".".join([*self.stack, name]) if self.stack else name
-            haystack = f"{item['path']} {qualified}".lower()
-            score = sum(3 if term in haystack else 0 for term in terms)
-            if name.startswith("test_"):
-                score += 12
-            result.append(
-                {
-                    "path": item["path"],
-                    "symbol": qualified,
-                    "kind": kind,
-                    "line": int(getattr(node, "lineno", 1)),
-                    "end_line": int(getattr(node, "end_lineno", getattr(node, "lineno", 1))),
-                    "score": score + int(item["score"]),
-                }
-            )
-
-        def visit_ClassDef(self, node: ast.ClassDef) -> Any:
-            self._record(node, "class", node.name)
-            self.stack.append(node.name)
-            self.generic_visit(node)
-            self.stack.pop()
-
-        def visit_FunctionDef(self, node: ast.FunctionDef) -> Any:
-            self._record(node, "function", node.name)
-            self.stack.append(node.name)
-            self.generic_visit(node)
-            self.stack.pop()
-
-        def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef) -> Any:
-            self._record(node, "async_function", node.name)
-            self.stack.append(node.name)
-            self.generic_visit(node)
-            self.stack.pop()
-
-    Visitor().visit(tree)
-    return result
-
-
-def _surface_ref(symbol: Mapping[str, Any]) -> str:
-    return f"{symbol['path']}::{symbol['symbol']}"
-
-
-def _contract_map(
-    symbols: Sequence[Mapping[str, Any]],
-    modules: Sequence[Mapping[str, Any]],
-    contract_terms: Mapping[str, tuple[str, ...]],
-) -> dict[str, Any]:
-    result: dict[str, Any] = {}
-    module_paths = [str(item["path"]) for item in modules]
-    for contract, terms in contract_terms.items():
-        scored: list[tuple[int, str]] = []
-        for symbol in symbols:
-            haystack = _surface_ref(symbol).lower()
-            score = sum(1 for term in terms if term in haystack)
-            if score:
-                scored.append((score, _surface_ref(symbol)))
-        scored.sort(key=lambda item: (-item[0], item[1]))
-        surfaces = [value for _, value in scored[:6]]
-        if not surfaces:
-            for path in module_paths:
-                score = sum(1 for term in terms if term in path.lower())
-                if score:
-                    surfaces.append(path)
-                if len(surfaces) == 6:
-                    break
-        result[contract] = {
-            "status": "PARTIAL" if surfaces else "GAP",
-            "surfaces": surfaces,
-        }
-    return result
-
-
-def _gap_evidence(
-    symbols: Sequence[Mapping[str, Any]],
-    profile: str,
-) -> tuple[list[str], list[str], list[str]]:
-    haystack = "\n".join(_surface_ref(item).lower() for item in symbols)
-
-    if profile == "model_governance":
-        invariants = [
-            "Online Task claim/heartbeat remains the authoritative worker ownership boundary.",
-            "Provider/model credentials remain outside uncredentialed planner/executor processes.",
-            "P0-A tenant/project scope and P0-C trace/audit lineage must constrain model routing.",
-            "P1 retry/checkpoint semantics remain authoritative for model-call execution recovery.",
-        ]
-        failure_windows: list[str] = []
-        if "provider" not in haystack and "model" not in haystack:
-            failure_windows.append("No first-class model/provider registry surface detected.")
-        if "budget" not in haystack and "cost" not in haystack and "quota" not in haystack:
-            failure_windows.append("No explicit durable model budget/cost/quota accounting surface detected.")
-        if "fallback" not in haystack and "route" not in haystack:
-            failure_windows.append("No explicit model fallback/routing policy surface detected.")
-        if "eval" not in haystack and "approval" not in haystack:
-            failure_windows.append("No explicit evaluation/approval gate surface detected for model changes.")
-        if "version" not in haystack and "pin" not in haystack:
-            failure_windows.append("No explicit model-version pinning surface detected.")
-        desired = (
-            ("trace", "P0-C trace/audit lineage"),
-            ("scope", "P0-A tenant/project scope isolation"),
-            ("credential", "P0-C credential governance"),
-            ("checkpoint", "P1 durable execution recovery"),
-            ("message", "P0-B MessageEnvelope/handoff"),
-            ("retry", "P1 retry/idempotency"),
-        )
-    else:
-        invariants = [
-            "Online Task claim/heartbeat remains the authoritative worker ownership boundary.",
-            "Governed mutation remains separated from read-only analysis and requires WriterLease.",
-            "P1 attempt-aware result idempotency and durable checkpoint recovery are reusable fleet primitives.",
-            "Scope/trace/message lineage must remain attached when work is scheduled or reassigned.",
-        ]
-        failure_windows = []
-        if "scheduler" not in haystack:
-            failure_windows.append("No first-class durable fleet scheduler symbol detected; worker-local polling may still be the scheduling mechanism.")
-        if "capacity" not in haystack and "slot" not in haystack:
-            failure_windows.append("No explicit durable worker-capacity/slot primitive detected.")
-        if "fair" not in haystack and "starvation" not in haystack:
-            failure_windows.append("No explicit fairness/starvation policy symbol detected.")
-        if "circuit" not in haystack:
-            failure_windows.append("No explicit circuit-breaker primitive detected for repeated worker/task failures.")
-        if "reassign" not in haystack:
-            failure_windows.append("No explicit worker-reassignment primitive detected beyond lease expiry/retry semantics.")
-        desired = (
-            ("checkpoint", "P1 durable checkpoint/resume"),
-            ("message", "P0-B MessageEnvelope/handoff"),
-            ("trace", "P0-C trace correlation"),
-            ("scope", "P0-A scope isolation"),
-            ("lease", "claim/WriterLease ownership"),
-            ("heartbeat", "worker liveness"),
-            ("idempot", "retry-safe dispatch/result"),
-        )
-
-    reuse_points: list[str] = []
-    for token, label in desired:
-        match = next((item for item in symbols if token in _surface_ref(item).lower()), None)
-        if match is not None:
-            reuse_points.append(f"{label}: {_surface_ref(match)}")
-    return invariants, failure_windows, reuse_points
-
-
-def _trim_to_budget(value: dict[str, Any]) -> dict[str, Any]:
-    def size() -> int:
-        return len(json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8"))
-
-    while size() > TARGET_RESULT_BYTES and value["bounded_excerpts"]:
-        value["bounded_excerpts"].pop()
-    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["functions"]) > 20:
-        value["implementation_map"]["functions"].pop()
-    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["classes"]) > 15:
-        value["implementation_map"]["classes"].pop()
-    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["tests"]) > 15:
-        value["implementation_map"]["tests"].pop()
-    while size() > TARGET_RESULT_BYTES and len(value["implementation_map"]["modules"]) > 20:
-        value["implementation_map"]["modules"].pop()
-    final_size = size()
-    if final_size > MAX_RESULT_BYTES:
-        raise CompactInterfaceMapError("INTERFACE_MAP_RESULT_TOO_LARGE")
-    value["result_bytes"] = final_size
-    return value
-
-
-def build_compact_interface_map(
-    worktree: Path,
-    source_signals: Sequence[str],
-    *,
-    source_commit: str,
-) -> dict[str, Any]:
-    root = Path(worktree)
-    if not root.is_dir() or root.is_symlink():
-        raise CompactInterfaceMapError("INTERFACE_MAP_WORKTREE_INVALID")
-    if re.fullmatch(r"[0-9a-f]{40}", source_commit) is None:
-        raise CompactInterfaceMapError("INTERFACE_MAP_SOURCE_COMMIT_INVALID")
-
-    profile = _profile(source_signals)
-    terms = _signal_terms(source_signals)
-    candidates = _candidate_files(root, terms)
-    if not candidates:
-        raise CompactInterfaceMapError("INTERFACE_MAP_EMPTY")
-
-    module_candidates = candidates[:MAX_MODULES]
-    modules = [
-        {
-            "path": item["path"],
-            "sha256": item["sha256"],
-            "bytes": item["bytes"],
-            "score": item["score"],
-        }
-        for item in module_candidates
-    ]
-
-    symbols: list[dict[str, Any]] = []
-    tables: list[dict[str, Any]] = []
-    systemd_units: list[dict[str, Any]] = []
-    for item in candidates:
-        if item["suffix"] == ".py":
-            symbols.extend(_python_symbols(item, terms))
-        elif item["suffix"] == ".sql":
-            for table in SQL_TABLE_RE.findall(str(item["text"])):
-                tables.append({"path": item["path"], "table": table, "sha256": item["sha256"]})
-        elif item["suffix"] == ".service":
-            systemd_units.append({"path": item["path"], "unit": Path(str(item["path"])).name, "sha256": item["sha256"]})
-
-    symbols.sort(key=lambda item: (-int(item["score"]), str(item["path"]), str(item["symbol"])))
-    all_symbols = list(symbols)
-    test_symbols = [
-        item for item in all_symbols
-        if str(item["path"]).startswith("tests/") or str(item["symbol"]).split(".")[-1].startswith("test_")
-    ][: min(MAX_TESTS, 24)]
-    non_test_symbols = [
-        item for item in all_symbols
-        if item not in test_symbols
-    ][: max(0, MAX_SYMBOLS - len(test_symbols))]
-    symbols = [*test_symbols, *non_test_symbols]
-    symbols.sort(key=lambda item: (-int(item["score"]), str(item["path"]), str(item["symbol"])))
-    classes = [
-        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
-        for item in symbols
-        if item["kind"] == "class"
-    ]
-    functions = [
-        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
-        for item in symbols
-        if item["kind"] in {"function", "async_function"} and not str(item["symbol"]).split(".")[-1].startswith("test_")
-    ]
-    tests = [
-        {k: item[k] for k in ("path", "symbol", "line", "end_line")}
-        for item in symbols
-        if str(item["path"]).startswith("tests/") or str(item["symbol"]).split(".")[-1].startswith("test_")
-    ][:MAX_TESTS]
-
-    excerpts: list[dict[str, Any]] = []
-    by_path = {str(item["path"]): item for item in candidates}
-    for symbol in symbols:
-        if len(excerpts) == MAX_EXCERPTS:
-            break
-        item = by_path.get(str(symbol["path"]))
-        if item is None:
-            continue
-        excerpt = _bounded_excerpt(str(item["text"]), int(symbol["line"]), int(symbol["end_line"]))
-        if not excerpt.strip():
-            continue
-        excerpts.append(
-            {
-                "path": symbol["path"],
-                "symbol": symbol["symbol"],
-                "sha256": item["sha256"],
-                "excerpt": excerpt,
-            }
-        )
-
-    invariants, failure_windows, reuse_points = _gap_evidence(all_symbols, profile)
-    result = {
-        "schema": SCHEMA,
-        "profile": profile,
-        "classification": PROFILE_CLASSIFICATION[profile],
-        "source_commit": source_commit,
-        "implementation_map": {
-            "modules": modules,
-            "classes": classes[:MAX_SYMBOLS],
-            "functions": functions[:MAX_SYMBOLS],
-            "tables": tables[:40],
-            "systemd_units": systemd_units[:20],
-            "tests": tests,
-            "current_invariants": invariants,
-            "failure_windows": failure_windows,
-            "reuse_points": reuse_points,
-        },
-        "bounded_excerpts": excerpts,
-        "contracts": _contract_map(all_symbols, modules, _contract_terms(profile)),
-    }
-    return _trim_to_budget(result)
@@ -1,528 +0,0 @@
-"""Canonical governed execution projection for Online Agent Tasks.
-
-The durable governed binding is authoritative.  Natural-language task fields and
-worker configuration are never allowed to invent repository, ref, generation, or
-idempotency coordinates.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-import hashlib
-import json
-import re
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-import urllib.error
-import urllib.request
-
-
-EXECUTION_SCHEMA = "aios.online-agent.execution.v2"
-PROJECTION_SCHEMA = "aios.online-agent.task-projection.v1"
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
-KEY_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,159}$")
-PROTECTED_PREFIXES = ("main", "master", "refs/", "tags/", "tag/", "release/", "baseline/", "production/")
-MUTATION_ACTIONS = frozenset({"deterministic"})
-READ_ONLY_ACTIONS = frozenset({"source_capture", "agent_runtime"})
-SUPPORTED_ACTIONS = frozenset({"deterministic", "source_capture", "agent_runtime"})
-AGENT_RUNTIME_ADAPTERS = frozenset({"hermes", "openclaw"})
-MAX_AGENT_RUNTIME_INPUT_BYTES = 64 * 1024
-
-
-class ExecutionProjectionError(RuntimeError):
-    """A canonical fail-closed projection or validation error."""
-
-
-class OnlineTaskProjectionClient:
-    """Official HTTP projection client using only a control credential reference."""
-
-    def __init__(self, api_base: str, control_token_path: Path) -> None:
-        self.api_base = api_base.rstrip("/")
-        self.control_token_path = Path(control_token_path)
-
-    def _token(self) -> str:
-        path = self.control_token_path
-        if path.is_symlink() or not path.is_file():
-            _error("ONLINE_TASK_PROJECTION_CONTROL_UNAVAILABLE")
-        value = path.read_text(encoding="utf-8").strip()
-        if len(value) < 32:
-            _error("ONLINE_TASK_PROJECTION_CONTROL_INVALID")
-        return value
-
-    def create(
-        self,
-        projected_task: Mapping[str, Any],
-        *,
-        binding: "GovernedExecutionBinding",
-    ) -> dict[str, Any]:
-        body = dict(projected_task)
-        payload = _canonical(body).encode("utf-8")
-        request = urllib.request.Request(
-            self.api_base + "/v1/tasks",
-            method="POST",
-            data=payload,
-            headers={
-                "Authorization": "Bearer " + self._token(),
-                "Content-Type": "application/json",
-                "Accept": "application/json",
-            },
-        )
-        try:
-            with urllib.request.urlopen(request, timeout=15) as response:
-                result = json.loads(response.read().decode("utf-8"))
-                status = response.status
-        except urllib.error.HTTPError as exc:
-            raw = exc.read(8192).decode("utf-8", "replace")
-            try:
-                error = json.loads(raw).get("error")
-            except (AttributeError, json.JSONDecodeError):
-                error = "HTTP_ERROR"
-            raise ExecutionProjectionError(f"ONLINE_TASK_PROJECTION_FAILED:{exc.code}:{error}") from exc
-        except (OSError, urllib.error.URLError, TimeoutError) as exc:
-            raise ExecutionProjectionError("ONLINE_TASK_PROJECTION_UNAVAILABLE") from exc
-        if status not in {200, 201} or not isinstance(result, dict):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        if result.get("task_id") != binding.task_id or result.get("status") not in {"QUEUED", "VERIFYING", "SUCCEEDED"}:
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        metadata = result.get("metadata")
-        if not isinstance(metadata, Mapping):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_INVALID")
-        returned_execution = validate_execution_envelope(
-            _object(metadata.get("execution"), "ONLINE_TASK_PROJECTION_RESPONSE_INVALID"),
-            binding=binding,
-        )
-        submitted_metadata = _object(body.get("metadata"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID")
-        submitted_execution = validate_execution_envelope(
-            _object(submitted_metadata.get("execution"), "ONLINE_TASK_PROJECTION_REQUEST_INVALID"),
-            binding=binding,
-        )
-        if _canonical(returned_execution) != _canonical(submitted_execution):
-            _error("ONLINE_TASK_PROJECTION_RESPONSE_BINDING_INVALID")
-        return result
-
-
-def _error(code: str) -> None:
-    raise ExecutionProjectionError(code)
-
-
-def _object(value: object, code: str) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        _error(code)
-    return dict(value)
-
-
-def _string(value: object, code: str) -> str:
-    if not isinstance(value, str) or not value.strip():
-        _error(code)
-    return value.strip()
-
-
-def _task_id(value: object) -> str:
-    value = _string(value, "TASK_ID_INVALID")
-    if TASK_RE.fullmatch(value) is None:
-        _error("TASK_ID_INVALID")
-    return value
-
-
-def _oid(value: object, code: str) -> str:
-    value = _string(value, code)
-    if OID_RE.fullmatch(value) is None:
-        _error(code)
-    return value
-
-
-def _branch(value: object) -> str:
-    value = _string(value, "TARGET_BRANCH_INVALID")
-    if BRANCH_RE.fullmatch(value) is None or value.startswith(PROTECTED_PREFIXES):
-        _error("TARGET_BRANCH_INVALID")
-    return value
-
-
-def _generation(value: object) -> int:
-    if not isinstance(value, int) or isinstance(value, bool) or value < 1:
-        _error("GENERATION_INVALID")
-    return value
-
-
-def _canonical(value: object) -> str:
-    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
-
-
-def _digest(value: object) -> str:
-    return hashlib.sha256(_canonical(value).encode("utf-8")).hexdigest()
-
-
-def _source_signals(value: object) -> tuple[str, ...]:
-    """Normalize untrusted natural-language hints before they enter a signed envelope."""
-    if value is None:
-        return ()
-    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
-        _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-    result: list[str] = []
-    for item in value:
-        if not isinstance(item, str):
-            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-        text = " ".join(item.split()).strip()
-        if not text:
-            continue
-        # Projection may accept long task prose, but execution envelopes stay bounded.
-        text = text[:512].rstrip()
-        if text not in result:
-            result.append(text)
-        if len(result) == 16:
-            break
-    return tuple(result)
-
-
-def _agent_runtime_input(value: object) -> dict[str, Any]:
-    if not isinstance(value, Mapping):
-        _error("AGENT_RUNTIME_INPUT_REQUIRED")
-    raw = dict(value)
-    allowed = {
-        "goal", "instructions", "success_criteria", "constraints",
-        "scope", "trace_id",
-    }
-    if set(raw) - allowed:
-        _error("AGENT_RUNTIME_INPUT_FIELDS_INVALID")
-    goal = _string(raw.get("goal"), "AGENT_RUNTIME_GOAL_REQUIRED")
-    instructions = raw.get("instructions", "")
-    if not isinstance(instructions, str):
-        _error("AGENT_RUNTIME_INSTRUCTIONS_INVALID")
-    criteria = raw.get("success_criteria", [])
-    if not isinstance(criteria, list) or len(criteria) > 32:
-        _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-    normalized_criteria: list[dict[str, str]] = []
-    for item in criteria:
-        if not isinstance(item, Mapping):
-            _error("AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-        criterion_id = _string(item.get("id"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID")
-        description = _string(
-            item.get("description"), "AGENT_RUNTIME_SUCCESS_CRITERIA_INVALID"
-        )
-        normalized_criteria.append(
-            {"id": criterion_id[:120], "description": description[:1000]}
-        )
-    constraints = raw.get("constraints", {})
-    if not isinstance(constraints, Mapping):
-        _error("AGENT_RUNTIME_CONSTRAINTS_INVALID")
-    sensitive_markers = ("token", "secret", "password", "credential", "authorization", "api_key", "apikey")
-    for key in constraints:
-        lowered = str(key).lower()
-        if any(marker in lowered for marker in sensitive_markers):
-            _error("AGENT_RUNTIME_SECRET_FIELD_DENY")
-
-    scope = raw.get("scope", {})
-    if not isinstance(scope, Mapping):
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-    scope = {
-        "scope_type": str(scope.get("scope_type") or "legacy"),
-        "tenant_id": scope.get("tenant_id"),
-        "project_id": scope.get("project_id"),
-    }
-    if scope["scope_type"] not in {"legacy", "system", "tenant"}:
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-    if scope["scope_type"] == "tenant":
-        if not isinstance(scope["tenant_id"], str) or not scope["tenant_id"].strip():
-            _error("AGENT_RUNTIME_SCOPE_INVALID")
-    elif scope["tenant_id"] not in (None, "") or scope["project_id"] not in (None, ""):
-        _error("AGENT_RUNTIME_SCOPE_INVALID")
-
-    trace_id = str(raw.get("trace_id") or "").strip()
-    if not trace_id or len(trace_id) > 255:
-        _error("AGENT_RUNTIME_TRACE_ID_INVALID")
-
-    normalized = {
-        "goal": goal[:12000],
-        "instructions": instructions[:32000],
-        "success_criteria": normalized_criteria,
-        "constraints": dict(constraints),
-        "scope": scope,
-        "trace_id": trace_id,
-    }
-    if len(_canonical(normalized).encode("utf-8")) > MAX_AGENT_RUNTIME_INPUT_BYTES:
-        _error("AGENT_RUNTIME_INPUT_TOO_LARGE")
-    return normalized
-
-
-def _capabilities(value: object) -> tuple[str, ...]:
-    if value is None:
-        return ()
-    if not isinstance(value, Sequence) or isinstance(value, (str, bytes)):
-        _error("CAPABILITY_SCOPE_INVALID")
-    result = tuple(sorted({_string(item, "CAPABILITY_SCOPE_INVALID") for item in value}))
-    if any(len(item) > 120 for item in result):
-        _error("CAPABILITY_SCOPE_INVALID")
-    return result
-
-
-@dataclass(frozen=True, slots=True)
-class GovernedExecutionBinding:
-    task_id: str
-    job_id: str
-    repository: str
-    base_oid: str
-    expected_branch_oid: str
-    target_branch: str
-    branch_mode: str
-    generation: int
-    idempotency_key: str
-
-    @classmethod
-    def from_mapping(cls, value: Mapping[str, Any]) -> "GovernedExecutionBinding":
-        data = dict(value)
-        task_id = _task_id(data.get("task_id"))
-        job_id = _string(data.get("job_id"), "JOB_ID_REQUIRED")
-        if TASK_RE.fullmatch(job_id) is None:
-            _error("JOB_ID_INVALID")
-        repository = _string(data.get("repository"), "REPOSITORY_INVALID")
-        if repository != "aios/aios":
-            _error("WRONG_REPOSITORY_ENVELOPE_DENY")
-        base_oid = _oid(data.get("base_oid"), "BASE_OID_INVALID")
-        expected = _oid(data.get("expected_branch_oid"), "EXPECTED_BRANCH_OID_INVALID")
-        target = _branch(data.get("target_branch"))
-        mode = _string(data.get("branch_mode"), "BRANCH_MODE_MISSING")
-        if mode not in {"CREATE_NEW", "CONTINUE_EXISTING"}:
-            _error("BRANCH_MODE_INVALID")
-        generation = _generation(data.get("generation"))
-        if mode == "CREATE_NEW" and expected != base_oid:
-            _error("EXPECTED_BASE_CONFLICT")
-        key = _string(data.get("idempotency_key"), "IDEMPOTENCY_KEY_INVALID")
-        if KEY_RE.fullmatch(key) is None:
-            _error("IDEMPOTENCY_KEY_INVALID")
-        return cls(task_id, job_id, repository, base_oid, expected, target, mode, generation, key)
-
-    def public(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-def binding_from_bootstrap(value: Mapping[str, Any]) -> GovernedExecutionBinding:
-    return GovernedExecutionBinding.from_mapping(value)
-
-
-def validate_execution_envelope(
-    value: Mapping[str, Any],
-    *,
-    binding: GovernedExecutionBinding | None = None,
-    worker_capabilities: Sequence[str] | None = None,
-) -> dict[str, Any]:
-    envelope = dict(value)
-    if envelope.get("schema") != EXECUTION_SCHEMA:
-        _error("EXECUTION_ENVELOPE_SCHEMA_VALIDATION")
-    candidate = GovernedExecutionBinding.from_mapping(envelope)
-    if binding is not None and candidate != binding:
-        comparisons = (
-            (candidate.task_id, binding.task_id, "TASK_BINDING_CONFLICT"),
-            (candidate.job_id, binding.job_id, "JOB_BINDING_CONFLICT"),
-            (candidate.repository, binding.repository, "WRONG_REPOSITORY_ENVELOPE_DENY"),
-            (candidate.base_oid, binding.base_oid, "WRONG_BASE_ENVELOPE_DENY"),
-            (candidate.expected_branch_oid, binding.expected_branch_oid, "WRONG_EXPECTED_HEAD_ENVELOPE_DENY"),
-            (candidate.target_branch, binding.target_branch, "WRONG_BRANCH_ENVELOPE_DENY"),
-            (candidate.generation, binding.generation, "WRONG_GENERATION_ENVELOPE_DENY"),
-            (candidate.branch_mode, binding.branch_mode, "BRANCH_MODE_BINDING_CONFLICT"),
-            (candidate.idempotency_key, binding.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
-        )
-        for actual, expected, code in comparisons:
-            if actual != expected:
-                _error(code)
-    action = _string(envelope.get("action"), "EXECUTION_ACTION_MISSING")
-    if action not in SUPPORTED_ACTIONS:
-        _error("EXECUTION_ACTION_UNSUPPORTED")
-    capability_scope = _capabilities(envelope.get("capability_scope"))
-    if worker_capabilities is not None and not set(capability_scope).issubset(set(worker_capabilities)):
-        _error("CAPABILITY_MISMATCH_DENY")
-    workspace = _object(envelope.get("workspace"), "WORKSPACE_POLICY_REQUIRED")
-    if workspace.get("authority_git_dir") != "/data/aios-gitops/repo.git" or workspace.get("read_only_repository") is not True:
-        _error("WORKSPACE_POLICY_DENY")
-    governance = _object(envelope.get("governance"), "GOVERNANCE_POLICY_REQUIRED")
-    governed_coordinates = (
-        (governance.get("task_id"), candidate.task_id, "TASK_BINDING_CONFLICT"),
-        (governance.get("job_id"), candidate.job_id, "JOB_BINDING_CONFLICT"),
-        (governance.get("idempotency_key"), candidate.idempotency_key, "IDEMPOTENCY_BINDING_CONFLICT"),
-    )
-    for actual_coordinate, expected_coordinate, code in governed_coordinates:
-        if actual_coordinate != expected_coordinate:
-            _error(code)
-    commit_key = _string(governance.get("commit_idempotency_key"), "COMMIT_IDEMPOTENCY_KEY_INVALID")
-    if KEY_RE.fullmatch(commit_key) is None:
-        _error("COMMIT_IDEMPOTENCY_KEY_INVALID")
-    if governance.get("writer_lease") is not (action in MUTATION_ACTIONS):
-        _error("WRITER_LEASE_POLICY_DENY")
-    for field in ("main_write", "production_write", "tag_write", "baseline_write", "force_push", "protected_ref_bypass"):
-        if governance.get(field, False) is not False:
-            _error("POLICY_DENY")
-    changes = envelope.get("change_set")
-    verification = envelope.get("verification")
-    if not isinstance(changes, list) or not isinstance(verification, list):
-        _error("EXECUTION_OPERATIONS_INVALID")
-    if action == "source_capture":
-        if changes or verification:
-            _error("SOURCE_CAPTURE_MUTATION_DENY")
-        signals = list(_source_signals(envelope.get("source_signals") or []))
-        if envelope.get("source_signals") != signals:
-            _error("SOURCE_CAPTURE_SIGNALS_INVALID")
-        if envelope.get("runtime_input") not in (None, {}):
-            _error("SOURCE_CAPTURE_RUNTIME_INPUT_DENY")
-    elif action == "agent_runtime":
-        if changes or verification:
-            _error("AGENT_RUNTIME_MUTATION_DENY")
-        adapter = str(envelope.get("adapter") or "")
-        if adapter not in AGENT_RUNTIME_ADAPTERS:
-            _error("AGENT_RUNTIME_ADAPTER_INVALID")
-        runtime_input = _agent_runtime_input(envelope.get("runtime_input"))
-        if envelope.get("runtime_input") != runtime_input:
-            _error("AGENT_RUNTIME_INPUT_NOT_CANONICAL")
-        required_runtime_capability = f"agent.runtime.{adapter}"
-        if required_runtime_capability not in capability_scope:
-            _error("AGENT_RUNTIME_CAPABILITY_REQUIRED")
-        if envelope.get("source_signals") not in (None, []):
-            _error("AGENT_RUNTIME_SOURCE_SIGNALS_DENY")
-    elif not changes:
-        _error("CHANGE_SET_INVALID")
-    declared = str(envelope.get("execution_digest") or "")
-    material = {key: item for key, item in envelope.items() if key != "execution_digest"}
-    actual = _digest(material)
-    if declared != actual:
-        _error("EXECUTION_DIGEST_INVALID")
-    return {**material, "execution_digest": actual}
-
-
-def project_execution_envelope(
-    binding: GovernedExecutionBinding,
-    execution_request: Mapping[str, Any] | None = None,
-    *,
-    required_capabilities: Sequence[str] = (),
-) -> dict[str, Any]:
-    request = dict(execution_request or {})
-    action = str(request.get("action") or "source_capture")
-    if action not in SUPPORTED_ACTIONS:
-        _error("EXECUTION_ACTION_UNSUPPORTED")
-    capabilities = _capabilities(request.get("capability_scope", required_capabilities))
-    governance = {
-        "task_id": binding.task_id,
-        "job_id": binding.job_id,
-        "idempotency_key": binding.idempotency_key,
-        "commit_idempotency_key": str(request.get("commit_idempotency_key") or f"{binding.task_id}-commit-g{binding.generation}"),
-        "writer_lease": action in MUTATION_ACTIONS,
-        "main_write": False,
-        "production_write": False,
-        "tag_write": False,
-        "baseline_write": False,
-        "force_push": False,
-        "protected_ref_bypass": False,
-    }
-    supplied_governance = request.get("governance")
-    if supplied_governance is not None:
-        governance.update(_object(supplied_governance, "GOVERNANCE_POLICY_REQUIRED"))
-    material: dict[str, Any] = {
-        "schema": EXECUTION_SCHEMA,
-        **binding.public(),
-        "action": action,
-        "adapter": str(
-            request.get("adapter")
-            or ("deterministic" if action == "deterministic" else "source_capture")
-        ),
-        "capability_scope": list(capabilities),
-        "change_set": list(request.get("change_set") or []),
-        "verification": list(request.get("verification") or []),
-        "source_signals": list(_source_signals(request.get("source_signals") or [])) if action == "source_capture" else [],
-        "runtime_input": _agent_runtime_input(request.get("runtime_input")) if action == "agent_runtime" else {},
-        "governance": governance,
-        "workspace": {
-            "authority_git_dir": "/data/aios-gitops/repo.git",
-            "read_only_repository": True,
-            "cleanup_policy": "always",
-        },
-    }
-    envelope = {**material, "execution_digest": _digest(material)}
-    return validate_execution_envelope(envelope, binding=binding)
-
-
-def project_online_task(
-    binding: GovernedExecutionBinding,
-    task_request: Mapping[str, Any],
-    execution_request: Mapping[str, Any] | None = None,
-) -> dict[str, Any]:
-    request = dict(task_request)
-    required = _capabilities(request.get("required_capabilities"))
-    execution_value = dict(execution_request or {})
-    if str(execution_value.get("action") or "source_capture") == "agent_runtime":
-        adapter = str(execution_value.get("adapter") or "")
-        if adapter not in AGENT_RUNTIME_ADAPTERS:
-            _error("AGENT_RUNTIME_ADAPTER_INVALID")
-        runtime_input = execution_value.get("runtime_input")
-        tenant_id = request.get("tenant_id")
-        project_id = request.get("project_id")
-        declared_scope = str(
-            request.get("scope_type")
-            or ("tenant" if isinstance(tenant_id, str) and tenant_id.strip() else "legacy")
-        )
-        if runtime_input is None:
-            runtime_input = {
-                "goal": request.get("goal"),
-                "instructions": request.get("instructions") or "",
-                "success_criteria": request.get("success_criteria") or [],
-                "constraints": request.get("constraints") or {},
-            }
-        elif not isinstance(runtime_input, Mapping):
-            _error("AGENT_RUNTIME_INPUT_REQUIRED")
-        runtime_input = dict(runtime_input)
-        # Scope/trace are authoritative Task identity, never caller-selected runtime hints.
-        runtime_input["scope"] = {
-            "scope_type": declared_scope,
-            "tenant_id": tenant_id,
-            "project_id": project_id,
-        }
-        runtime_input["trace_id"] = str(
-            request.get("trace_id")
-            or request.get("run_id")
-            or binding.task_id
-        )
-        execution_value["runtime_input"] = runtime_input
-    execution = project_execution_envelope(
-        binding,
-        execution_value,
-        required_capabilities=required,
-    )
-    metadata = dict(request.get("metadata") or {})
-    if "execution" in metadata:
-        validate_execution_envelope(_object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"), binding=binding)
-        if metadata["execution"] != execution:
-            _error("EXECUTION_PROJECTION_CONFLICT")
-    metadata["execution"] = execution
-    metadata["execution_projection"] = {
-        "schema": PROJECTION_SCHEMA,
-        "task_id": binding.task_id,
-        "job_id": binding.job_id,
-        "execution_digest": execution["execution_digest"],
-    }
-    return {
-        **request,
-        "task_id": binding.task_id,
-        "metadata": metadata,
-        "required_capabilities": list(required),
-        "idempotency_key": str(request.get("idempotency_key") or f"online-task:{binding.idempotency_key}"),
-    }
-
-
-def resolve_task_execution(
-    task: Mapping[str, Any],
-    binding: GovernedExecutionBinding,
-    *,
-    worker_capabilities: Sequence[str] | None = None,
-) -> tuple[dict[str, Any], str]:
-    metadata = task.get("metadata")
-    if isinstance(metadata, Mapping) and "execution" in metadata:
-        value = validate_execution_envelope(
-            _object(metadata["execution"], "EXECUTION_ENVELOPE_INVALID"),
-            binding=binding,
-            worker_capabilities=worker_capabilities,
-        )
-        return value, "persisted"
-    projected = project_execution_envelope(
-        binding,
-        {"action": "source_capture", "capability_scope": task.get("required_capabilities") or []},
-        required_capabilities=task.get("required_capabilities") or [],
-    )
-    validate_execution_envelope(projected, binding=binding, worker_capabilities=worker_capabilities)
-    return projected, "recovered_projection"
@@ -1,187 +0,0 @@
-"""Durable, authority-bound deterministic execution plans for Online Agent Tasks."""
-from __future__ import annotations
-
-from contextlib import contextmanager
-from dataclasses import dataclass
-import fcntl
-import hashlib
-import json
-from pathlib import Path
-from typing import Any, Mapping
-
-from aios_online_agent_execution import (
-    GovernedExecutionBinding,
-    project_execution_envelope,
-)
-
-
-class ExecutionPlanError(RuntimeError):
-    pass
-
-
-def _canonical(value: object) -> bytes:
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
-
-
-def _digest(value: object) -> str:
-    return hashlib.sha256(_canonical(value)).hexdigest()
-
-
-def _task_key(task_id: str) -> str:
-    readable = "".join(ch if ch.isalnum() or ch in "._-" else "-" for ch in task_id).strip("-")[:72] or "task"
-    return readable + "-" + hashlib.sha256(task_id.encode("utf-8")).hexdigest()[:24]
-
-
-@dataclass(frozen=True)
-class ExecutionPlanRecord:
-    task_id: str
-    job_id: str
-    source_head_oid: str
-    generation: int
-    idempotency_key: str
-    plan_digest: str
-    execution: dict[str, Any]
-
-    def public(self) -> dict[str, Any]:
-        return {
-            "schema": "aios.online-agent.plan-record.v1",
-            "task_id": self.task_id,
-            "job_id": self.job_id,
-            "source_head_oid": self.source_head_oid,
-            "generation": self.generation,
-            "idempotency_key": self.idempotency_key,
-            "plan_digest": self.plan_digest,
-            "execution": dict(self.execution),
-        }
-
-
-class ExecutionPlanStore:
-    def __init__(self, root: Path) -> None:
-        self.root = Path(root)
-        self.root.mkdir(parents=True, exist_ok=True)
-
-    def _path(self, task_id: str) -> Path:
-        return self.root / (_task_key(task_id) + ".json")
-
-    @contextmanager
-    def _lock(self, task_id: str):
-        path = self.root / (_task_key(task_id) + ".lock")
-        with path.open("a+b") as handle:
-            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-            try:
-                yield
-            finally:
-                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
-
-    @staticmethod
-    def _source_head(binding: GovernedExecutionBinding) -> str:
-        return binding.expected_branch_oid if binding.branch_mode == "CONTINUE_EXISTING" else binding.base_oid
-
-    def _read(self, task_id: str) -> ExecutionPlanRecord | None:
-        path = self._path(task_id)
-        if not path.is_file() or path.is_symlink():
-            return None
-        value = json.loads(path.read_text(encoding="utf-8"))
-        if not isinstance(value, Mapping) or value.get("schema") != "aios.online-agent.plan-record.v1":
-            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
-        execution = value.get("execution")
-        if not isinstance(execution, Mapping):
-            raise ExecutionPlanError("EXECUTION_PLAN_RECORD_INVALID")
-        return ExecutionPlanRecord(
-            task_id=str(value.get("task_id") or ""),
-            job_id=str(value.get("job_id") or ""),
-            source_head_oid=str(value.get("source_head_oid") or ""),
-            generation=int(value.get("generation") or 0),
-            idempotency_key=str(value.get("idempotency_key") or ""),
-            plan_digest=str(value.get("plan_digest") or ""),
-            execution=dict(execution),
-        )
-
-    def register(
-        self,
-        binding: GovernedExecutionBinding,
-        request: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        with self._lock(binding.task_id):
-            return self._register_locked(binding, request)
-
-    def _register_locked(
-        self,
-        binding: GovernedExecutionBinding,
-        request: Mapping[str, Any],
-    ) -> dict[str, Any]:
-        if request.get("schema") != "aios.online-agent.plan.v1":
-            raise ExecutionPlanError("EXECUTION_PLAN_SCHEMA_INVALID")
-        if request.get("task_id") != binding.task_id or request.get("job_id") != binding.job_id:
-            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
-        if int(request.get("generation") or 0) != binding.generation:
-            raise ExecutionPlanError("EXECUTION_PLAN_GENERATION_CONFLICT")
-        source_head = str(request.get("source_head_oid") or "")
-        if source_head != self._source_head(binding):
-            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_CONFLICT")
-        key = str(request.get("idempotency_key") or "")
-        if len(key) < 8:
-            raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_INVALID")
-        execution_request = request.get("execution")
-        if not isinstance(execution_request, Mapping) or execution_request.get("action") != "deterministic":
-            raise ExecutionPlanError("EXECUTION_PLAN_DETERMINISTIC_REQUIRED")
-        envelope = project_execution_envelope(binding, execution_request)
-        material = {
-            "task_id": binding.task_id,
-            "job_id": binding.job_id,
-            "source_head_oid": source_head,
-            "generation": binding.generation,
-            "idempotency_key": key,
-            "execution": dict(execution_request),
-        }
-        plan_digest = _digest(material)
-        existing = self._read(binding.task_id)
-        expected_previous = request.get("expected_previous_plan_digest")
-        if existing is not None:
-            if existing.idempotency_key == key:
-                if existing.plan_digest != plan_digest:
-                    raise ExecutionPlanError("EXECUTION_PLAN_IDEMPOTENCY_CONFLICT")
-                return {**existing.public(), "idempotent": True, "execution_digest": envelope["execution_digest"]}
-            if expected_previous != existing.plan_digest:
-                raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
-            if existing.source_head_oid != source_head:
-                raise ExecutionPlanError("EXECUTION_PLAN_STALE_REPLACEMENT_DENY")
-        elif expected_previous not in (None, ""):
-            raise ExecutionPlanError("EXECUTION_PLAN_REPLACEMENT_CAS_MISMATCH")
-
-        record = ExecutionPlanRecord(
-            task_id=binding.task_id,
-            job_id=binding.job_id,
-            source_head_oid=source_head,
-            generation=binding.generation,
-            idempotency_key=key,
-            plan_digest=plan_digest,
-            execution=dict(execution_request),
-        )
-        path = self._path(binding.task_id)
-        temporary = path.with_suffix(".tmp")
-        temporary.write_text(
-            json.dumps(record.public(), sort_keys=True, separators=(",", ":")),
-            encoding="utf-8",
-        )
-        temporary.replace(path)
-        return {**record.public(), "idempotent": False, "execution_digest": envelope["execution_digest"]}
-
-    def resolve(self, binding: GovernedExecutionBinding) -> dict[str, Any] | None:
-        record = self._read(binding.task_id)
-        if record is None:
-            return None
-        if (
-            record.task_id != binding.task_id
-            or record.job_id != binding.job_id
-            or record.generation != binding.generation
-        ):
-            raise ExecutionPlanError("EXECUTION_PLAN_BINDING_CONFLICT")
-        if record.source_head_oid != self._source_head(binding):
-            raise ExecutionPlanError("EXECUTION_PLAN_SOURCE_HEAD_DRIFT")
-        envelope = project_execution_envelope(binding, record.execution)
-        return {
-            "execution": dict(record.execution),
-            "plan_digest": record.plan_digest,
-            "execution_digest": envelope["execution_digest"],
-        }
@@ -1,144 +0,0 @@
-"""HTTP adapter for audited Owner authorization and writer provisioning.
-
-This module layers on top of ``aios_authorized_task_writer_api`` so existing
-routes and the legacy exact ``writer:provision`` route remain available. The
-new endpoint does not mint or modify bearer credentials. It authenticates an
-existing, non-wildcard, explicitly allow-listed Owner credential and then
-invokes the audited broker.
-
-Endpoint:
-    POST /api/governance/owner-authorizations
-"""
-from __future__ import annotations
-
-import os
-import urllib.parse
-from typing import Any, Mapping
-
-import aios_authorized_task_writer_api as bridge_api
-from authorized_task_writer_provisioning import ProvisioningError
-from owner_authorization_broker import (
-    OwnerAuthorizationBroker,
-    OwnerAuthorizationError,
-    OwnerPrincipal,
-)
-
-
-api = bridge_api.api
-_original_do_post = api.H.do_POST
-_ENDPOINT = "/api/governance/owner-authorizations"
-
-
-def _enabled() -> bool:
-    return os.getenv(
-        "AIOS_GITOPS_OWNER_AUTHORIZATION_BROKER_ENABLED", ""
-    ).strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _configured_intake_scope() -> str:
-    scopes = [
-        item.strip()
-        for item in os.getenv(
-            "AIOS_GITOPS_OWNER_AUTHORIZATION_INTAKE_SCOPES", ""
-        ).split(",")
-        if item.strip()
-    ]
-    if len(scopes) != 1:
-        raise OwnerAuthorizationError(
-            "EXACTLY_ONE_HTTP_INTAKE_SCOPE_REQUIRED", 503
-        )
-    scope = scopes[0]
-    if scope == "writer:provision" or scope == "*" or scope.endswith(":*"):
-        raise OwnerAuthorizationError("HTTP_INTAKE_SCOPE_REJECTED", 503)
-    return scope
-
-
-def _scope_set(auth: Mapping[str, Any]) -> frozenset[str]:
-    raw = auth.get("scopes")
-    if raw is None:
-        raw = auth.get("scope")
-    if raw is None:
-        return frozenset()
-    if isinstance(raw, str):
-        candidates = raw.replace(",", " ").split()
-    elif isinstance(raw, (list, tuple, set, frozenset)):
-        candidates = [str(item) for item in raw]
-    else:
-        raise OwnerAuthorizationError("OWNER_SCOPE_EVIDENCE_INVALID", 403)
-    return frozenset(item.strip() for item in candidates if item.strip())
-
-
-def _credential_id(auth: Mapping[str, Any]) -> str:
-    for name in (
-        "credential_id",
-        "token_id",
-        "key_id",
-        "auth_id",
-    ):
-        value = str(auth.get(name) or "").strip()
-        if value:
-            return value
-    return ""
-
-
-def _authenticate_existing_owner(handler) -> OwnerPrincipal | None:
-    scope = _configured_intake_scope()
-    auth = handler.need(scope)
-    if not auth:
-        return None
-    if auth.get("role") != "owner":
-        handler.sendj({"error": "OWNER_ROLE_REQUIRED"}, 403)
-        return None
-    identity = str(auth.get("account") or auth.get("identity") or "").strip()
-    if not identity:
-        handler.sendj({"error": "OWNER_IDENTITY_REQUIRED"}, 403)
-        return None
-    scopes = _scope_set(auth)
-    if any(item == "*" or item.endswith(":*") for item in scopes):
-        handler.sendj(
-            {"error": "WILDCARD_OWNER_CREDENTIAL_REJECTED"}, 403
-        )
-        return None
-    return OwnerPrincipal(
-        identity=identity,
-        role="owner",
-        authenticated_scope=scope,
-        token_scopes=scopes,
-        credential_id=_credential_id(auth),
-    )
-
-
-def _broker_do_post(self):
-    path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-    if path != _ENDPOINT:
-        return _original_do_post(self)
-    if not _enabled():
-        return self.sendj(
-            {"error": "OWNER_AUTHORIZATION_BROKER_DISABLED"}, 503
-        )
-    try:
-        principal = _authenticate_existing_owner(self)
-        if principal is None:
-            return
-        data = self.body()
-        result = OwnerAuthorizationBroker().authorize_and_provision(
-            data, principal
-        )
-        return self.sendj(result)
-    except (OwnerAuthorizationError, ProvisioningError) as exc:
-        body = {"error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        return self.sendj(body, exc.status)
-    except Exception:
-        # Never expose registry data, bearer tokens, signer output or traceback.
-        return self.sendj(
-            {"error": "OWNER_AUTHORIZATION_BROKER_INTERNAL_ERROR"}, 500
-        )
-
-
-api.H.do_POST = _broker_do_post
-
-
-if __name__ == "__main__":
-    api.main()
@@ -1,82 +0,0 @@
-"""Immutable release-lineage contracts used by activation and recovery."""
-
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-from typing import Any, Mapping
-
-
-@dataclass(frozen=True)
-class ReleaseLineage:
-    task_id: str
-    candidate_id: str
-    source_commit: str
-    version: str
-    required_capabilities: tuple[str, ...]
-
-    def as_dict(self) -> dict[str, Any]:
-        return asdict(self)
-
-
-FIXED_V2R2C2 = ReleaseLineage(
-    task_id="r42-release-candidate-v2r2c2-live-20260819",
-    candidate_id="r42-release-candidate-v2r2c2-20260819",
-    source_commit="71e736b05fab13efc06af7a4fe2dc022c1cf9a85",
-    version="V2R2C2",
-    required_capabilities=("release:candidate",),
-)
-
-
-class ReleaseLineageError(RuntimeError):
-    pass
-
-
-def validate_fixed_v2r2c2_task(task: Mapping[str, Any]) -> dict[str, Any]:
-    """Validate identity/source/version without mutating Task state.
-
-    This contract intentionally does not bind status/attempt/revision, because
-    those are lifecycle state and may change through governed retry/recovery.
-    """
-
-    if str(task.get("task_id") or "") != FIXED_V2R2C2.task_id:
-        raise ReleaseLineageError("FIXED_TASK_ID_DRIFT")
-
-    capabilities = task.get("required_capabilities")
-    if (
-        not isinstance(capabilities, list)
-        or tuple(capabilities) != FIXED_V2R2C2.required_capabilities
-    ):
-        raise ReleaseLineageError("FIXED_TASK_CAPABILITY_DRIFT")
-
-    constraints = task.get("constraints")
-    if not isinstance(constraints, Mapping):
-        raise ReleaseLineageError("FIXED_TASK_CONSTRAINTS_MISSING")
-    release = constraints.get("release_candidate")
-    if not isinstance(release, Mapping):
-        raise ReleaseLineageError("FIXED_RELEASE_BINDING_MISSING")
-
-    actual = {
-        "candidate_id": str(release.get("candidate_id") or ""),
-        "source_commit": str(release.get("source_commit") or ""),
-        "version": str(release.get("version") or ""),
-    }
-    expected = {
-        "candidate_id": FIXED_V2R2C2.candidate_id,
-        "source_commit": FIXED_V2R2C2.source_commit,
-        "version": FIXED_V2R2C2.version,
-    }
-    if actual != expected:
-        raise ReleaseLineageError(
-            "FIXED_RELEASE_LINEAGE_DRIFT:"
-            + repr({"expected": expected, "actual": actual})
-        )
-
-    return {
-        "schema": "aios.release-lineage.validation.v1",
-        "status": "VERIFIED",
-        "lineage": FIXED_V2R2C2.as_dict(),
-        "task_status": task.get("status"),
-        "attempt": task.get("attempt"),
-        "max_attempts": task.get("max_attempts"),
-        "revision": task.get("revision"),
-    }
@@ -1,714 +0,0 @@
-#!/usr/bin/env python3
-"""Persistent release-preparation Online Agent worker.
-
-The worker is intentionally narrower than the generic engineering worker:
-it can only consume tasks whose required capability set is exactly
-{"release:candidate"} and whose payload asks for immutable release-candidate
-creation. It never receives Owner signing, deployment, tag, baseline or Git
-write credentials.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timezone
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import socket
-import threading
-import time
-import urllib.error
-import urllib.request
-from typing import Any, Mapping
-from aios_autonomous_control_plane import (
-    classify_failure,
-    repair_for_failure,
-    runtime_admission,
-)
-
-AGENT_ID = os.environ.get(
-    "AIOS_RELEASE_WORKER_AGENT_ID",
-    "online-release-worker-cn-network-mkt-20260819",
-).strip()
-AGENT_VERSION = os.environ.get(
-    "AIOS_RELEASE_WORKER_AGENT_VERSION",
-    "2026-08-19.1-release-candidate",
-).strip()
-TASK_API = os.environ.get(
-    "AIOS_AGENT_TASK_API_URL",
-    "http://127.0.0.1:18940",
-).rstrip("/")
-RELEASE_API = os.environ.get("AIOS_RELEASE_API_URL", "").rstrip("/")
-POLL_SECONDS = int(os.environ.get("AIOS_RELEASE_WORKER_POLL_SECONDS", "3"))
-LEASE_SECONDS = int(os.environ.get("AIOS_RELEASE_WORKER_LEASE_SECONDS", "60"))
-HEARTBEAT_SECONDS = int(
-    os.environ.get("AIOS_RELEASE_WORKER_HEARTBEAT_SECONDS", "15")
-)
-STATE_ROOT = Path(
-    os.environ.get(
-        "AIOS_RELEASE_WORKER_STATE_ROOT",
-        "/var/lib/aios-online-agent-release",
-    )
-)
-EXPECTED_CAPABILITIES = frozenset({"release:candidate"})
-LIVENESS_PATH = Path(
-    os.environ.get(
-        "AIOS_WORKER_LIVENESS_PATH",
-        str(STATE_ROOT / "worker-liveness.json"),
-    )
-)
-CANDIDATE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{7,255}$")
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-VERSION_RE = re.compile(r"^V[0-9]+R[0-9]+C[0-9]+$")
-TASK_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._:-]{2,179}$")
-SECRET_MARKERS = (
-    "authorization",
-    "token",
-    "secret",
-    "credential",
-    "password",
-    "private_key",
-    "signature",
-)
-
-
-class ReleaseWorkerError(RuntimeError):
-    def __init__(self, code: str, *, phase: str) -> None:
-        super().__init__(code)
-        self.code = code
-        self.phase = phase
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value,
-        ensure_ascii=False,
-        sort_keys=True,
-        separators=(",", ":"),
-    ).encode("utf-8")
-
-
-def sha256(value: bytes) -> str:
-    return hashlib.sha256(value).hexdigest()
-
-
-def sanitized(value: Any) -> Any:
-    if isinstance(value, Mapping):
-        result: dict[str, Any] = {}
-        for key, inner in value.items():
-            lowered = str(key).lower()
-            if any(marker in lowered for marker in SECRET_MARKERS):
-                result[str(key)] = "[REDACTED]"
-            else:
-                result[str(key)] = sanitized(inner)
-        return result
-    if isinstance(value, list):
-        return [sanitized(item) for item in value]
-    return value
-
-
-def audit(event: str, **fields: Any) -> None:
-    STATE_ROOT.mkdir(parents=True, exist_ok=True, mode=0o750)
-    path = STATE_ROOT / "events.jsonl"
-    record = {
-        "schema": "aios.release-worker.event.v1",
-        "event": event,
-        "created_at": now(),
-        "agent_id": AGENT_ID,
-        **sanitized(fields),
-    }
-    with path.open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(record, sort_keys=True) + "\n")
-    os.chmod(path, 0o640)
-
-
-def sd_notify(message: str) -> None:
-    target = os.environ.get("NOTIFY_SOCKET", "")
-    if not target:
-        return
-    if target.startswith("@"):
-        address = "\0" + target[1:]
-    else:
-        address = target
-    sock = socket.socket(socket.AF_UNIX, socket.SOCK_DGRAM)
-    try:
-        sock.connect(address)
-        sock.sendall(message.encode("utf-8"))
-    except OSError:
-        # Liveness JSON remains the diagnostic source; systemd will enforce
-        # WatchdogSec if notify transport is persistently broken.
-        pass
-    finally:
-        sock.close()
-
-
-def write_liveness(
-    state: str,
-    *,
-    task_id: str | None = None,
-    stage: str | None = None,
-    error: str | None = None,
-    visible_count: int | None = None,
-) -> None:
-    STATE_ROOT.mkdir(parents=True, exist_ok=True, mode=0o750)
-    value = {
-        "schema": "aios.online-agent.worker-liveness.v1",
-        "agent_id": AGENT_ID,
-        "agent_type": "release-preparation-worker",
-        "agent_version": AGENT_VERSION,
-        "pid": os.getpid(),
-        "state": state,
-        "last_seen_epoch": time.time(),
-        "last_seen_at": now(),
-        "poll_seconds": POLL_SECONDS,
-        "heartbeat_seconds": HEARTBEAT_SECONDS,
-        "api_base": TASK_API,
-        "capabilities": sorted(EXPECTED_CAPABILITIES),
-        "task_id": task_id,
-        "stage": stage,
-        "error": error,
-        "visible_count": visible_count,
-    }
-    LIVENESS_PATH.parent.mkdir(parents=True, exist_ok=True, mode=0o750)
-    temporary = LIVENESS_PATH.with_name(
-        "." + LIVENESS_PATH.name + f".{os.getpid()}.tmp"
-    )
-    temporary.write_text(
-        json.dumps(value, ensure_ascii=False, sort_keys=True) + "\n",
-        encoding="utf-8",
-    )
-    os.chmod(temporary, 0o640)
-    os.replace(temporary, LIVENESS_PATH)
-
-
-def load_credential(name: str) -> str:
-    directory = Path(os.environ.get("CREDENTIALS_DIRECTORY", ""))
-    path = directory / name
-    if path.is_symlink() or not path.is_file():
-        raise ReleaseWorkerError(
-            "CREDENTIAL_UNAVAILABLE:" + name,
-            phase="startup",
-        )
-    value = path.read_text(encoding="utf-8").strip()
-    if len(value) < 24 or any(ch.isspace() for ch in value):
-        raise ReleaseWorkerError(
-            "CREDENTIAL_INVALID:" + name,
-            phase="startup",
-        )
-    return value
-
-
-def http_json(
-    base: str,
-    method: str,
-    route: str,
-    token: str,
-    body: Mapping[str, Any] | None = None,
-    *,
-    timeout: int = 30,
-) -> tuple[int, dict[str, Any]]:
-    data = None if body is None else canonical(body)
-    headers = {"Accept": "application/json"}
-    if token:
-        headers["Authorization"] = "Bearer " + token
-    if data is not None:
-        headers["Content-Type"] = "application/json"
-    request = urllib.request.Request(
-        base + route,
-        method=method,
-        data=data,
-        headers=headers,
-    )
-    try:
-        with urllib.request.urlopen(request, timeout=timeout) as response:
-            raw, status = response.read(), response.status
-    except urllib.error.HTTPError as exc:
-        raw, status = exc.read(), exc.code
-    except (urllib.error.URLError, TimeoutError) as exc:
-        raise ReleaseWorkerError(
-            "HTTP_TRANSPORT_UNAVAILABLE",
-            phase="network",
-        ) from exc
-    try:
-        value = json.loads(raw.decode())
-    except Exception as exc:
-        raise ReleaseWorkerError(
-            "HTTP_RESPONSE_INVALID",
-            phase="network",
-        ) from exc
-    return status, value if isinstance(value, dict) else {}
-
-
-@dataclass(frozen=True)
-class ReleaseRequest:
-    candidate_id: str
-    source_commit: str
-    version: str
-    projection_id: str | None
-
-    @classmethod
-    def from_task(cls, task: Mapping[str, Any]) -> "ReleaseRequest":
-        if not TASK_RE.fullmatch(str(task.get("task_id") or "")):
-            raise ReleaseWorkerError("TASK_ID_INVALID", phase="validation")
-        caps = task.get("required_capabilities")
-        if (
-            not isinstance(caps, list)
-            or frozenset(caps) != EXPECTED_CAPABILITIES
-            or len(caps) != 1
-        ):
-            raise ReleaseWorkerError(
-                "TASK_CAPABILITY_SCOPE_INVALID",
-                phase="validation",
-            )
-        metadata = task.get("metadata")
-        if not isinstance(metadata, Mapping):
-            metadata = {}
-        constraints = task.get("constraints")
-        if not isinstance(constraints, Mapping):
-            constraints = {}
-        release = constraints.get("release_candidate")
-        if not isinstance(release, Mapping):
-            release = metadata.get("release_candidate")
-        if not isinstance(release, Mapping):
-            release = task.get("release_candidate")
-        if not isinstance(release, Mapping):
-            raise ReleaseWorkerError(
-                "RELEASE_CANDIDATE_PAYLOAD_MISSING",
-                phase="validation",
-            )
-        allowed = {
-            "candidate_id",
-            "source_commit",
-            "version",
-            "projection_id",
-        }
-        if set(release) - allowed:
-            raise ReleaseWorkerError(
-                "RELEASE_CANDIDATE_PAYLOAD_FIELDS_INVALID",
-                phase="validation",
-            )
-        candidate_id = str(release.get("candidate_id") or "")
-        source_commit = str(release.get("source_commit") or "")
-        version = str(release.get("version") or "")
-        projection_id = release.get("projection_id")
-        if CANDIDATE_RE.fullmatch(candidate_id) is None:
-            raise ReleaseWorkerError(
-                "RELEASE_CANDIDATE_ID_INVALID",
-                phase="validation",
-            )
-        if OID_RE.fullmatch(source_commit) is None:
-            raise ReleaseWorkerError(
-                "RELEASE_SOURCE_COMMIT_INVALID",
-                phase="validation",
-            )
-        if VERSION_RE.fullmatch(version) is None:
-            raise ReleaseWorkerError(
-                "RELEASE_VERSION_INVALID",
-                phase="validation",
-            )
-        if projection_id is not None:
-            projection_id = str(projection_id)
-            if not re.fullmatch(r"projection-[0-9a-f]{32}", projection_id):
-                raise ReleaseWorkerError(
-                    "RELEASE_PROJECTION_ID_INVALID",
-                    phase="validation",
-                )
-        return cls(
-            candidate_id=candidate_id,
-            source_commit=source_commit,
-            version=version,
-            projection_id=projection_id,
-        )
-
-    def body(self) -> dict[str, str]:
-        return {
-            "candidate_id": self.candidate_id,
-            "source_commit": self.source_commit,
-            "version": self.version,
-        }
-
-
-class Heartbeat:
-    def __init__(
-        self,
-        agent_token: str,
-        task_id: str,
-        lease_token: str,
-    ) -> None:
-        self.agent_token = agent_token
-        self.task_id = task_id
-        self.lease_token = lease_token
-        self.stage = "claimed"
-        self.failure: str | None = None
-        self.stop = threading.Event()
-        self.thread = threading.Thread(
-            target=self._run,
-            name="release-worker-heartbeat",
-            daemon=True,
-        )
-
-    def first(self) -> None:
-        status, value = http_json(
-            TASK_API,
-            "POST",
-            f"/v1/tasks/{self.task_id}/heartbeat",
-            self.agent_token,
-            {
-                "lease_token": self.lease_token,
-                "lease_seconds": LEASE_SECONDS,
-                "progress": {
-                    "stage": self.stage,
-                    "worker_version": AGENT_VERSION,
-                },
-            },
-        )
-        if status != 200:
-            raise ReleaseWorkerError(
-                "TASK_HEARTBEAT_FAILED",
-                phase="heartbeat",
-            )
-        audit(
-            "TASK_HEARTBEAT",
-            task_id=self.task_id,
-            stage=self.stage,
-            api_status=status,
-        )
-        write_liveness(
-            "BUSY",
-            task_id=self.task_id,
-            stage=self.stage,
-        )
-        sd_notify("WATCHDOG=1")
-
-    def _run(self) -> None:
-        while not self.stop.wait(HEARTBEAT_SECONDS):
-            try:
-                status, value = http_json(
-                    TASK_API,
-                    "POST",
-                    f"/v1/tasks/{self.task_id}/heartbeat",
-                    self.agent_token,
-                    {
-                        "lease_token": self.lease_token,
-                        "lease_seconds": LEASE_SECONDS,
-                        "progress": {
-                            "stage": self.stage,
-                            "worker_version": AGENT_VERSION,
-                        },
-                    },
-                )
-                if status != 200:
-                    self.failure = str(value.get("error") or status)
-                    return
-                audit(
-                    "TASK_HEARTBEAT",
-                    task_id=self.task_id,
-                    stage=self.stage,
-                    api_status=status,
-                )
-                write_liveness(
-                    "BUSY",
-                    task_id=self.task_id,
-                    stage=self.stage,
-                )
-                sd_notify("WATCHDOG=1")
-            except Exception as exc:
-                self.failure = type(exc).__name__
-                return
-
-    def ensure(self) -> None:
-        if self.failure:
-            raise ReleaseWorkerError(
-                "TASK_LEASE_LOST",
-                phase="heartbeat",
-            )
-
-    def close(self) -> None:
-        self.stop.set()
-        if self.thread.ident is not None:
-            self.thread.join(timeout=2)
-
-
-def release_admission(
-    task: Mapping[str, Any],
-    *,
-    release_token: str,
-):
-    required = task.get("required_capabilities")
-    if not isinstance(required, list):
-        required = []
-
-    def release_api_health() -> bool:
-        status, value = http_json(
-            RELEASE_API,
-            "GET",
-            "/health",
-            "",
-            timeout=10,
-        )
-        return status == 200 and str(value.get("status") or "").lower() in {"ok", "healthy"}
-
-    def authenticated_probe() -> bool:
-        status, _ = http_json(
-            RELEASE_API,
-            "POST",
-            "/createReleaseCandidate",
-            release_token,
-            {},
-            timeout=10,
-        )
-        # Authentication + credential projection succeeded; the empty release
-        # request is intentionally rejected by request validation.
-        return status == 400
-
-    probes = {
-        "credential_projection": authenticated_probe,
-        "trusted_builder": release_api_health,
-        "authenticated_probe": authenticated_probe,
-        "release_api_health": release_api_health,
-        "worker_liveness": lambda: True,
-    }
-    return runtime_admission(
-        worker_capabilities=EXPECTED_CAPABILITIES,
-        required_capabilities=required,
-        requested_operations=("prepare_release",),
-        probes=probes,
-    )
-
-
-def result_payload(
-    task_id: str,
-    release: ReleaseRequest,
-    builder: Mapping[str, Any],
-) -> dict[str, Any]:
-    builder_candidate = builder.get("candidate_id")
-    if builder_candidate not in {None, release.candidate_id}:
-        raise ReleaseWorkerError(
-            "BUILDER_CANDIDATE_BINDING_INVALID",
-            phase="release",
-        )
-    immutable = {
-        "candidate_id": release.candidate_id,
-        "source_commit": release.source_commit,
-        "version": release.version,
-    }
-    return {
-        "status": "SUCCEEDED",
-        "classification": "RELEASE_CANDIDATE_CREATED",
-        "execution_mode": "release_candidate",
-        "adapter": "release_candidate",
-        "task_id": task_id,
-        "agent_id": AGENT_ID,
-        "release_candidate": immutable,
-        "release_candidate_request_sha256": sha256(canonical(immutable)),
-        "builder_response": sanitized(dict(builder)),
-        "projection_id": release.projection_id,
-        "writer_lease": "NONE",
-        "changed_files": [],
-        "direct_main_write": False,
-        "production_write": False,
-        "tag_write": False,
-        "baseline_write": False,
-        "runtime_switch": False,
-        "owner_approval_submitted": False,
-        "credential_material_exposed": False,
-    }
-
-
-def execute_task(
-    task: Mapping[str, Any],
-    *,
-    agent_token: str,
-    release_token: str,
-) -> bool:
-    task_id = str(task.get("task_id") or "")
-    release = ReleaseRequest.from_task(task)
-    admission = release_admission(
-        task,
-        release_token=release_token,
-    )
-    if not admission.admitted:
-        audit(
-            "TASK_ADMISSION_BLOCKED",
-            task_id=task_id,
-            admission=admission.as_dict(),
-        )
-        write_liveness(
-            "BLOCKED",
-            task_id=task_id,
-            stage="execution_ready",
-            error=admission.failure_class.value if admission.failure_class else "ADMISSION_FAILED",
-        )
-        return False
-    audit(
-        "TASK_ADMISSION_PASSED",
-        task_id=task_id,
-        admission=admission.as_dict(),
-    )
-    status, claimed = http_json(
-        TASK_API,
-        "POST",
-        f"/v1/tasks/{task_id}/claim",
-        agent_token,
-        {"lease_seconds": LEASE_SECONDS},
-    )
-    if status in {409, 423}:
-        return False
-    if status != 200:
-        raise ReleaseWorkerError(
-            "TASK_CLAIM_FAILED",
-            phase="claim",
-        )
-    lease_token = str(claimed.get("lease_token") or "")
-    if len(lease_token) < 16:
-        raise ReleaseWorkerError(
-            "TASK_LEASE_TOKEN_INVALID",
-            phase="claim",
-        )
-    attempt = int(claimed.get("attempt") or 0)
-    audit(
-        "TASK_CLAIMED",
-        task_id=task_id,
-        attempt=attempt,
-    )
-
-    heartbeat = Heartbeat(agent_token, task_id, lease_token)
-    heartbeat.first()
-    heartbeat.thread.start()
-    try:
-        heartbeat.stage = "release_candidate"
-        heartbeat.ensure()
-        status, builder = http_json(
-            RELEASE_API,
-            "POST",
-            "/createReleaseCandidate",
-            release_token,
-            release.body(),
-            timeout=120,
-        )
-        if status not in {200, 201, 202}:
-            raise ReleaseWorkerError(
-                "RELEASE_CANDIDATE_CREATE_FAILED:"
-                + str(builder.get("error") or status),
-                phase="release",
-            )
-        heartbeat.ensure()
-        result = result_payload(task_id, release, builder)
-        idempotency_key = (
-            f"{task_id}-attempt-{attempt}-release-result-v1"
-        )
-        status, submitted = http_json(
-            TASK_API,
-            "POST",
-            f"/v1/tasks/{task_id}/result",
-            agent_token,
-            {
-                "lease_token": lease_token,
-                "idempotency_key": idempotency_key,
-                "result": result,
-            },
-        )
-        if status not in {200, 201, 202}:
-            raise ReleaseWorkerError(
-                "TASK_RESULT_SUBMIT_FAILED",
-                phase="result",
-            )
-        audit(
-            "RESULT_SUBMITTED",
-            task_id=task_id,
-            attempt=attempt,
-            release_candidate_id=release.candidate_id,
-        )
-        return True
-    finally:
-        heartbeat.close()
-
-
-def main() -> int:
-    if not RELEASE_API:
-        raise SystemExit("FATAL:AIOS_RELEASE_API_URL_REQUIRED")
-    agent_token = load_credential("agent_token")
-    release_token = load_credential("release_candidate_token")
-    STATE_ROOT.mkdir(parents=True, exist_ok=True, mode=0o750)
-    audit(
-        "WORKER_STARTED",
-        capabilities=sorted(EXPECTED_CAPABILITIES),
-        release_api=RELEASE_API,
-    )
-    write_liveness("STARTING", stage="startup")
-    sd_notify("READY=1\nSTATUS=release worker ready")
-    while True:
-        try:
-            status, response = http_json(
-                TASK_API,
-                "POST",
-                "/v1/tasks/poll",
-                agent_token,
-                {"limit": 100},
-            )
-            if status != 200:
-                raise ReleaseWorkerError(
-                    "TASK_POLL_FAILED",
-                    phase="poll",
-                )
-            tasks = response.get("tasks")
-            if not isinstance(tasks, list):
-                tasks = []
-            write_liveness(
-                "IDLE",
-                stage="poll",
-                visible_count=len(tasks),
-            )
-            sd_notify("WATCHDOG=1\nSTATUS=release worker poll ok")
-            handled = False
-            for raw in tasks:
-                if not isinstance(raw, Mapping):
-                    continue
-                caps = raw.get("required_capabilities")
-                if (
-                    not isinstance(caps, list)
-                    or frozenset(caps) != EXPECTED_CAPABILITIES
-                ):
-                    continue
-                try:
-                    handled = execute_task(
-                        raw,
-                        agent_token=agent_token,
-                        release_token=release_token,
-                    ) or handled
-                except ReleaseWorkerError as exc:
-                    failure = classify_failure(exc.code, phase=exc.phase)
-                    repair = repair_for_failure(failure)
-                    audit(
-                        "TASK_EXECUTION_FAILED",
-                        task_id=raw.get("task_id"),
-                        phase=exc.phase,
-                        error=exc.code,
-                        failure_class=failure.value,
-                        repair=repair.as_dict(),
-                    )
-            time.sleep(0 if handled else POLL_SECONDS)
-        except KeyboardInterrupt:
-            return 0
-        except Exception as exc:
-            audit(
-                "WORKER_LOOP_ERROR",
-                error=type(exc).__name__,
-            )
-            write_liveness(
-                "DEGRADED",
-                stage="loop",
-                error=type(exc).__name__,
-            )
-            time.sleep(POLL_SECONDS)
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,559 +0,0 @@
-"""Credential-isolated durable coordinator for the release-preparation supervisor.
-
-The coordinator owns only its Online Task agent credential.  It never forwards
-that credential to Hermes/OpenClaw and never submits a Task result while the
-supervision goal is incomplete.  Its job is deliberately small: claim the one
-fixed supervisor Task after an exact coordinator projection and keep a durable
-heartbeat lease while later phases observe and repair through governed APIs.
-"""
-from __future__ import annotations
-
-from datetime import datetime, timezone
-import http.client
-import json
-import os
-from pathlib import Path
-import re
-import socket
-import tempfile
-import time
-from typing import Any, Mapping
-import urllib.error
-import urllib.request
-
-
-API_BASE = os.environ.get(
-    "AIOS_AGENT_TASK_API_URL", "http://127.0.0.1:18940"
-).rstrip("/")
-AGENT_ID = os.environ.get(
-    "AIOS_AGENT_ID",
-    "online-engineering-worker-cn-network-mkt-autonomous-20260815",
-)
-TASK_ID = os.environ.get(
-    "AIOS_RELEASE_PREPARATION_SUPERVISOR_TASK_ID",
-    "r42-release-preparation-autonomous-supervisor-20260820",
-)
-EXPECTED_EXECUTION_DIGEST = os.environ.get(
-    "AIOS_RELEASE_PREPARATION_SUPERVISOR_EXECUTION_DIGEST", ""
-)
-RUNTIME_CAPABILITY = "agent.runtime.openclaw"
-COORDINATOR_CAPABILITY = "engineering.autonomous"
-REQUIRED_CAPABILITIES = [RUNTIME_CAPABILITY, COORDINATOR_CAPABILITY]
-POLL_SECONDS = int(os.environ.get("AIOS_SUPERVISOR_COORDINATOR_POLL_SECONDS", "5"))
-HEARTBEAT_SECONDS = int(
-    os.environ.get("AIOS_SUPERVISOR_COORDINATOR_HEARTBEAT_SECONDS", "10")
-)
-LEASE_SECONDS = int(os.environ.get("AIOS_SUPERVISOR_COORDINATOR_LEASE_SECONDS", "300"))
-STATE_ROOT = Path(
-    os.environ.get(
-        "AIOS_SUPERVISOR_COORDINATOR_STATE_ROOT",
-        "/var/lib/aios-release-preparation-supervisor-coordinator",
-    )
-)
-BROKER_SOCKET = Path(os.environ.get(
-    "AIOS_OWNER_AUTH_BROKER_SOCKET",
-    "/run/aios-owner-authorization-broker/broker.sock",
-))
-BROKER_ACCOUNT = "chatgpt-governed-implementer-singlehost"
-EXTERNAL_REQUEST_SHA256 = "08fc2f3d1b64a2ca11da9f22da48de834cff3442fa7fa2d3bc390f8dbf9b254a"
-SUPERVISOR_EXECUTION_DIGEST = "491457595667a95809f6f3cd19e9e7c9e74181070fd8038b86f30eb41bdfc231"
-BUILDER_TASK_ID = "r42-trusted-candidate-builder-runtime-wiring-20260820"
-BUILDER_BASE_OID = "d957a216a6e9bd4c2292ffc6e44876a1c08fa1e3"
-BUILDER_TARGET_BRANCH = "agent/r42-trusted-candidate-builder-runtime-wiring-20260820"
-BUILDER_IDEMPOTENCY_KEY = "r42-trusted-candidate-builder-runtime-wiring-binding-v1"
-GATE_AMENDMENT_CLASSIFICATION = "SUPERVISOR_GLOBAL_EXTERNAL_ACK_GATE_REMEDIATED"
-
-
-class CoordinatorError(RuntimeError):
-    def __init__(self, code: str) -> None:
-        super().__init__(code)
-        self.code = code
-
-
-class UnixHTTPConnection(http.client.HTTPConnection):
-    def __init__(self, socket_path: Path, *, timeout: int = 30) -> None:
-        super().__init__("localhost", timeout=timeout)
-        self.socket_path = socket_path
-
-    def connect(self) -> None:
-        sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-        sock.settimeout(self.timeout)
-        sock.connect(str(self.socket_path))
-        self.sock = sock
-
-
-def now() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def canonical(value: object) -> bytes:
-    return json.dumps(
-        value, sort_keys=True, separators=(",", ":"), ensure_ascii=False
-    ).encode("utf-8")
-
-
-def atomic_json(path: Path, value: Mapping[str, Any]) -> None:
-    path.parent.mkdir(parents=True, mode=0o750, exist_ok=True)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise CoordinatorError("COORDINATOR_STATE_SYMLINK_REJECTED")
-    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=str(path.parent))
-    try:
-        os.fchmod(fd, 0o640)
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            json.dump(dict(value), handle, ensure_ascii=False, sort_keys=True)
-            handle.write("\n")
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temporary, path)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def audit(event_type: str, **fields: Any) -> None:
-    record = {
-        "event_type": event_type,
-        "created_at": now(),
-        "agent_id": AGENT_ID,
-        "task_id": TASK_ID,
-        "credential_material_exposed": False,
-        "planner_credential_material_exposed": False,
-        "lease_material_exposed": False,
-        **fields,
-    }
-    STATE_ROOT.mkdir(parents=True, mode=0o750, exist_ok=True)
-    with (STATE_ROOT / "events.jsonl").open("a", encoding="utf-8") as handle:
-        handle.write(json.dumps(record, ensure_ascii=False, sort_keys=True) + "\n")
-    atomic_json(STATE_ROOT / "liveness.json", record)
-
-
-def api_call(
-    method: str,
-    route: str,
-    token: str,
-    body: Mapping[str, Any] | None = None,
-) -> tuple[int, dict[str, Any]]:
-    payload = None if body is None else canonical(dict(body))
-    headers = {"Authorization": "Bearer " + token, "Accept": "application/json"}
-    if payload is not None:
-        headers["Content-Type"] = "application/json"
-    request = urllib.request.Request(
-        API_BASE + route, data=payload, headers=headers, method=method
-    )
-    try:
-        with urllib.request.urlopen(request, timeout=20) as response:
-            value = json.loads(response.read().decode("utf-8"))
-            return response.status, value if isinstance(value, dict) else {}
-    except urllib.error.HTTPError as exc:
-        try:
-            value = json.loads(exc.read(4096).decode("utf-8", "replace"))
-        except Exception:
-            value = {"error": "HTTP_ERROR"}
-        return exc.code, value if isinstance(value, dict) else {"error": "HTTP_ERROR"}
-    except (urllib.error.URLError, TimeoutError):
-        return 599, {"error": "AGENT_TASK_API_UNAVAILABLE"}
-
-
-def broker_call(
-    method: str,
-    route: str,
-    body: Mapping[str, Any] | None = None,
-) -> tuple[int, dict[str, Any]]:
-    if not BROKER_SOCKET.is_absolute():
-        raise CoordinatorError("OWNER_BROKER_SOCKET_INVALID")
-    try:
-        if BROKER_SOCKET.is_symlink():
-            raise CoordinatorError("OWNER_BROKER_SOCKET_INVALID")
-    except OSError as exc:
-        raise CoordinatorError("OWNER_BROKER_UNAVAILABLE") from exc
-    connection = UnixHTTPConnection(BROKER_SOCKET)
-    payload = None if body is None else canonical(dict(body))
-    headers = {"Accept": "application/json", "X-AIOS-Account": BROKER_ACCOUNT}
-    if payload is not None:
-        headers["Content-Type"] = "application/json"
-    try:
-        connection.request(method, route, body=payload, headers=headers)
-        response = connection.getresponse()
-        raw = response.read()
-        value = json.loads(raw.decode("utf-8"))
-        if not isinstance(value, Mapping):
-            raise CoordinatorError("OWNER_BROKER_RESPONSE_INVALID")
-        return response.status, dict(value)
-    except (OSError, TimeoutError, http.client.HTTPException, ValueError) as exc:
-        raise CoordinatorError("OWNER_BROKER_UNAVAILABLE") from exc
-    finally:
-        connection.close()
-
-
-def authorize_actor(
-    actor_type: str,
-    *,
-    external_ack: Mapping[str, Any] | None = None,
-    host_authorization: Mapping[str, Any] | None = None,
-) -> dict[str, Any]:
-    if actor_type == "external_connector":
-        expected = {
-            "account": BROKER_ACCOUNT,
-            "capability": "governed-task:project",
-            "operation": "createGovernedTask",
-            "single_use": True,
-            "request_sha256": EXTERNAL_REQUEST_SHA256,
-        }
-        if external_ack is None:
-            raise CoordinatorError("WAIT_EXTERNAL_ACK")
-        if dict(external_ack) != expected:
-            raise CoordinatorError("EXTERNAL_ACK_INVALID")
-        return {
-            "actor_type": actor_type,
-            "decision": "ALLOW_EXTERNAL_CONNECTOR_EXACT_ACK",
-            "external_ack_required": True,
-            "request_sha256": EXTERNAL_REQUEST_SHA256,
-            "authorized_capabilities": ["governed-task:project"],
-        }
-    if actor_type == "credentialed_host_coordinator":
-        if not isinstance(host_authorization, Mapping):
-            raise CoordinatorError("HOST_COORDINATOR_DURABLE_OWNER_REQUIRED")
-        constraints = host_authorization.get("constraints")
-        capabilities = host_authorization.get("capabilities")
-        if (
-            host_authorization.get("account") != BROKER_ACCOUNT
-            or host_authorization.get("persistent_until_revoked") is not True
-            or host_authorization.get("separate_owner_release_approval_still_required") is not True
-            or not isinstance(capabilities, list)
-            or "governed-task:project" not in capabilities
-            or not isinstance(constraints, Mapping)
-            or constraints.get("repository") != "aios/aios"
-            or constraints.get("allowed_target_prefix") != "agent/"
-            or constraints.get("max_task_risk") not in {"low", "engineering"}
-            or re.fullmatch(r"[0-9a-f]{64}", str(host_authorization.get("policy_sha256") or "")) is None
-            or not str(host_authorization.get("grant_id") or "")
-        ):
-            raise CoordinatorError("HOST_COORDINATOR_DURABLE_OWNER_DENY")
-        return {
-            "actor_type": actor_type,
-            "decision": "ALLOW_HOST_COORDINATOR_GOVERNED_PROJECTION",
-            "external_ack_required": False,
-            "durable_owner_governed_task_project": "verified",
-            "grant_id": str(host_authorization["grant_id"]),
-            "policy_sha256": str(host_authorization["policy_sha256"]),
-            # Do not inherit release:candidate even if the durable policy also has it.
-            "authorized_capabilities": ["governed-task:project"],
-        }
-    raise CoordinatorError("UNKNOWN_ACTOR_DENY")
-
-
-def builder_request() -> dict[str, Any]:
-    capabilities = [
-        "git.read",
-        "git.test",
-        "governed.write.branch",
-        "governed.write.file",
-    ]
-    return {
-        "task_id": BUILDER_TASK_ID,
-        "repository": "aios/aios",
-        "base_oid": BUILDER_BASE_OID,
-        "expected_branch_oid": BUILDER_BASE_OID,
-        "target_branch": BUILDER_TARGET_BRANCH,
-        "generation": 1,
-        "branch_mode": "CREATE_NEW",
-        "risk": "engineering",
-        "description": "Wire TrustedCandidateBuilder through the canonical authenticated Release API and fixed candidate retry chain.",
-        "idempotency_key": BUILDER_IDEMPOTENCY_KEY,
-        "priority": 100,
-        "max_attempts": 3,
-        "require_online_task_projection": True,
-        "online_task": {
-            "goal": "Implement and verify TrustedCandidateBuilder runtime wiring from the fixed d957a216 lineage.",
-            "instructions": (
-                "Capture the real Builder and Release API contracts, implement only the fixed governed branch, "
-                "prove authenticated POST {} returns HTTP 400, and stop before Owner release approval or Production. "
-                "No main write, force push, tag, baseline, production deploy, runtime switch, credential forwarding, "
-                "or legacy candidate input."
-            ),
-            "success_criteria": [
-                {"id": "builder_wiring", "description": "TrustedCandidateBuilder wiring is verified."},
-                {"id": "release_api", "description": "Authenticated Release API POST {} returns HTTP 400."},
-                {"id": "governed_candidate", "description": "All modified files are committed only to the fixed governed branch."},
-            ],
-            "constraints": {
-                "main_write": False,
-                "production_write": False,
-                "owner_release_approval": False,
-                "tag_publish": False,
-                "baseline_finalize": False,
-                "runtime_switch": False,
-                "credential_forwarding": False,
-                "legacy_candidate_input": False,
-            },
-            "required_capabilities": capabilities,
-            "priority": 100,
-            "max_attempts": 3,
-        },
-        "execution": {
-            "action": "source_capture",
-            "adapter": "source_capture",
-            "capability_scope": capabilities,
-            "source_signals": [
-                "TrustedCandidateBuilder runtime wiring",
-                "Release API authenticated POST empty object HTTP 400",
-                "fixed V2R2C2 retry-extension attempt 2",
-                "V2R2C2 and V2R2C3 candidate verification",
-            ],
-        },
-    }
-
-
-def gate_amendment(host_decision: Mapping[str, Any]) -> dict[str, Any]:
-    return {
-        "schema": "aios.release-preparation.gate-amendment.v1",
-        "classification": GATE_AMENDMENT_CLASSIFICATION,
-        "supervisor_task_id": TASK_ID,
-        "supervisor_execution_digest": SUPERVISOR_EXECUTION_DIGEST,
-        "actor_type": "credentialed_host_coordinator",
-        "operation": "createGovernedTask",
-        "repository": "aios/aios",
-        "original_external_request_sha256": EXTERNAL_REQUEST_SHA256,
-        "external_connector_rule": "ACK_STILL_REQUIRED",
-        "host_coordinator_rule": "DURABLE_OWNER_GOVERNED_TASK_PROJECT",
-        "owner_grant_id": host_decision["grant_id"],
-        "owner_policy_sha256": host_decision["policy_sha256"],
-        "builder_task_id": BUILDER_TASK_ID,
-        "builder_base_oid": BUILDER_BASE_OID,
-        "builder_expected_branch_oid": BUILDER_BASE_OID,
-        "builder_target_branch": BUILDER_TARGET_BRANCH,
-        "builder_generation": 1,
-        "builder_idempotency_key": BUILDER_IDEMPOTENCY_KEY,
-    }
-
-
-def ensure_builder_projection() -> dict[str, Any]:
-    status, authorization = broker_call("GET", "/v1/capabilities")
-    if status != 200:
-        raise CoordinatorError("HOST_COORDINATOR_DURABLE_OWNER_DENY")
-    decision = authorize_actor(
-        "credentialed_host_coordinator",
-        host_authorization=authorization,
-    )
-    request = builder_request()
-    status, receipt = broker_call(
-        "POST",
-        "/v1/project-governed-task",
-        {
-            "idempotency_key": BUILDER_IDEMPOTENCY_KEY,
-            "request": request,
-            "amendment": gate_amendment(decision),
-        },
-    )
-    upstream = receipt.get("upstream_response")
-    amendment = receipt.get("gate_amendment")
-    if (
-        status != 200
-        or receipt.get("operation_state") != "EXECUTED"
-        or receipt.get("capability") != "governed-task:project"
-        or receipt.get("grant_id") != decision["grant_id"]
-        or receipt.get("policy_sha256") != decision["policy_sha256"]
-        or receipt.get("external_capability_projection_required") is not False
-        or not isinstance(upstream, Mapping)
-        or upstream.get("task_id") != BUILDER_TASK_ID
-        or upstream.get("base_oid") != BUILDER_BASE_OID
-        or upstream.get("expected_branch_oid") != BUILDER_BASE_OID
-        or upstream.get("target_branch") != BUILDER_TARGET_BRANCH
-        or upstream.get("generation") != 1
-        or not isinstance(amendment, Mapping)
-        or amendment.get("classification") != GATE_AMENDMENT_CLASSIFICATION
-        or re.fullmatch(r"[0-9a-f]{64}", str(amendment.get("amendment_sha256") or "")) is None
-    ):
-        raise CoordinatorError("BUILDER_PROJECTION_RECEIPT_INVALID")
-    return {
-        **decision,
-        "builder_task_id": BUILDER_TASK_ID,
-        "builder_binding_verified": True,
-        "gate_amendment_sha256": amendment["amendment_sha256"],
-    }
-
-
-def load_agent_token() -> str:
-    path = Path(os.environ.get("CREDENTIALS_DIRECTORY", "")) / "agent_token"
-    if path.is_symlink() or not path.is_file():
-        raise CoordinatorError("COORDINATOR_AGENT_CREDENTIAL_UNAVAILABLE")
-    token = path.read_text(encoding="utf-8").strip()
-    if len(token) < 24 or any(character.isspace() for character in token):
-        raise CoordinatorError("COORDINATOR_AGENT_CREDENTIAL_INVALID")
-    return token
-
-
-def validate_task(task: Mapping[str, Any]) -> dict[str, Any]:
-    if task.get("task_id") != TASK_ID or task.get("status") != "QUEUED":
-        raise CoordinatorError("SUPERVISOR_TASK_STATE_INVALID")
-    if task.get("required_capabilities") != REQUIRED_CAPABILITIES:
-        raise CoordinatorError("SUPERVISOR_COORDINATOR_CAPABILITIES_INVALID")
-    metadata = task.get("metadata")
-    if not isinstance(metadata, Mapping):
-        raise CoordinatorError("SUPERVISOR_EXECUTION_METADATA_MISSING")
-    execution = metadata.get("execution")
-    if not isinstance(execution, Mapping):
-        raise CoordinatorError("SUPERVISOR_EXECUTION_METADATA_MISSING")
-    governance = execution.get("governance")
-    if (
-        execution.get("action") != "agent_runtime"
-        or execution.get("adapter") != "openclaw"
-        or execution.get("capability_scope") != REQUIRED_CAPABILITIES
-        or execution.get("execution_digest") != EXPECTED_EXECUTION_DIGEST
-        or execution.get("change_set") != []
-        or execution.get("verification") != []
-        or not isinstance(governance, Mapping)
-        or governance.get("writer_lease") is not False
-        or any(
-            governance.get(field) is not False
-            for field in (
-                "main_write",
-                "production_write",
-                "tag_write",
-                "baseline_write",
-                "force_push",
-                "protected_ref_bypass",
-            )
-        )
-    ):
-        raise CoordinatorError("SUPERVISOR_COORDINATOR_ENVELOPE_INVALID")
-    return dict(execution)
-
-
-def heartbeat_progress(
-    sequence: int,
-    gate: Mapping[str, Any] | None = None,
-) -> dict[str, Any]:
-    progress = {
-        "stage": "supervisor_coordinator_active",
-        "phase": "external_caller_projection",
-        "state": "PENDING_ACTOR_AWARE_ADMISSION",
-        "sequence": sequence,
-        "control_plane_access_granted": True,
-        "external_planner_role": "UNPRIVILEGED_PLANNER",
-        "credential_forwarded_to_planner": False,
-        "main_write": False,
-        "production_write": False,
-        "owner_approval_submitted": False,
-    }
-    if gate is not None:
-        progress.update({
-            "state": str(gate.get("decision") or "DENY"),
-            "actor_type": gate.get("actor_type"),
-            "external_ack_required": gate.get("external_ack_required"),
-            "durable_owner_governed_task_project": gate.get("durable_owner_governed_task_project"),
-            "builder_task_id": gate.get("builder_task_id"),
-            "builder_binding_verified": gate.get("builder_binding_verified", False),
-            "gate_amendment_sha256": gate.get("gate_amendment_sha256"),
-        })
-    return progress
-
-
-def coordinate_claim(
-    claim: Mapping[str, Any],
-    token: str,
-    *,
-    max_heartbeats: int | None = None,
-) -> int:
-    lease_token = claim.get("lease_token")
-    if not isinstance(lease_token, str) or len(lease_token) < 24:
-        raise CoordinatorError("COORDINATOR_LEASE_TOKEN_MISSING")
-    sequence = 0
-    gate: dict[str, Any] | None = None
-    while max_heartbeats is None or sequence < max_heartbeats:
-        sequence += 1
-        if gate is None:
-            try:
-                gate = ensure_builder_projection()
-                audit("SUPERVISOR_ACTOR_AWARE_GATE_ALLOWED", **gate)
-            except CoordinatorError as exc:
-                audit(
-                    "SUPERVISOR_ACTOR_AWARE_GATE_DENIED",
-                    actor_type="credentialed_host_coordinator",
-                    decision="DENY",
-                    error=exc.code,
-                )
-        status, response = api_call(
-            "POST",
-            f"/v1/tasks/{TASK_ID}/heartbeat",
-            token,
-            {
-                "lease_token": lease_token,
-                "lease_seconds": LEASE_SECONDS,
-                "progress": heartbeat_progress(sequence, gate),
-            },
-        )
-        if status != 200:
-            raise CoordinatorError(
-                "COORDINATOR_HEARTBEAT_FAILED_" + str(response.get("error") or status)
-            )
-        audit(
-            "SUPERVISOR_COORDINATOR_HEARTBEAT",
-            sequence=sequence,
-            task_status=response.get("status"),
-            lease_expires_at=response.get("lease_expires_at"),
-            control_plane_access_granted=True,
-            external_planner_role="UNPRIVILEGED_PLANNER",
-        )
-        if max_heartbeats is None or sequence < max_heartbeats:
-            time.sleep(HEARTBEAT_SECONDS)
-    return sequence
-
-
-def worker_once(token: str) -> bool:
-    status, poll = api_call("POST", "/v1/tasks/poll", token, {"limit": 100})
-    if status != 200:
-        audit("SUPERVISOR_COORDINATOR_POLL_FAILED", error=poll.get("error") or status)
-        return False
-    task = next(
-        (
-            item
-            for item in poll.get("tasks", [])
-            if isinstance(item, Mapping) and item.get("task_id") == TASK_ID
-        ),
-        None,
-    )
-    if task is None:
-        audit("SUPERVISOR_COORDINATOR_WAITING_FOR_TASK")
-        return False
-    validate_task(task)
-    status, claim = api_call(
-        "POST", f"/v1/tasks/{TASK_ID}/claim", token, {"lease_seconds": LEASE_SECONDS}
-    )
-    if status != 200:
-        audit("SUPERVISOR_COORDINATOR_CLAIM_FAILED", error=claim.get("error") or status)
-        return False
-    audit(
-        "SUPERVISOR_COORDINATOR_CLAIMED",
-        attempt=claim.get("attempt"),
-        revision=claim.get("revision"),
-        claim_mode="server_atomic",
-        control_plane_access_granted=True,
-    )
-    coordinate_claim(claim, token)
-    return True
-
-
-def main() -> int:
-    if not EXPECTED_EXECUTION_DIGEST or len(EXPECTED_EXECUTION_DIGEST) != 64:
-        raise CoordinatorError("SUPERVISOR_EXECUTION_DIGEST_CONFIG_INVALID")
-    token = load_agent_token()
-    audit(
-        "SUPERVISOR_COORDINATOR_READY",
-        required_capabilities=REQUIRED_CAPABILITIES,
-        control_plane_access_granted=True,
-        external_planner_role="UNPRIVILEGED_PLANNER",
-    )
-    while True:
-        try:
-            worker_once(token)
-        except Exception as exc:
-            audit(
-                "SUPERVISOR_COORDINATOR_LOOP_ERROR",
-                error=exc.code if isinstance(exc, CoordinatorError) else type(exc).__name__,
-            )
-        time.sleep(POLL_SECONDS)
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,160 +0,0 @@
-#!/usr/bin/env python3
-"""Loopback-only HTTP API for the task identity overlay.
-
-Endpoints:
-  GET  /healthz
-  POST /api/governance/owner-authorizations
-
-The API authenticates only the short-lived overlay credential. It does not read
-or modify the global bearer-token registry.
-"""
-from __future__ import annotations
-
-import json
-import os
-import urllib.parse
-from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
-from typing import Any
-
-from authorized_task_writer_provisioning import ProvisioningError
-from owner_authorization_broker import OwnerAuthorizationError
-from task_identity_overlay import (
-    MAX_BODY_BYTES,
-    IdentityOverlayConfig,
-    IdentityOverlayError,
-    TaskIdentityOverlayService,
-)
-
-
-_ENDPOINT = "/api/governance/owner-authorizations"
-
-
-def _enabled() -> bool:
-    return os.getenv(
-        "AIOS_GITOPS_IDENTITY_OVERLAY_ENABLED", ""
-    ).strip().lower() in {"1", "true", "yes", "on"}
-
-
-def _bearer(header: str) -> str:
-    prefix = "Bearer "
-    if not header.startswith(prefix):
-        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-    token = header[len(prefix):].strip()
-    if not token or len(token) > 4096:
-        raise IdentityOverlayError("OVERLAY_AUTHENTICATION_REQUIRED", 401)
-    return token
-
-
-class OverlayHandler(BaseHTTPRequestHandler):
-    server_version = "aios-task-identity-overlay/1"
-    sys_version = ""
-
-    @property
-    def overlay(self) -> TaskIdentityOverlayService:
-        return self.server.overlay  # type: ignore[attr-defined]
-
-    def log_message(self, format: str, *args: Any) -> None:
-        # Never log Authorization or request bodies.
-        return
-
-    def _send(self, status: int, value: dict[str, Any]) -> None:
-        payload = (
-            json.dumps(
-                value,
-                ensure_ascii=False,
-                sort_keys=True,
-                separators=(",", ":"),
-            )
-            + "\n"
-        ).encode("utf-8")
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Cache-Control", "no-store")
-        self.send_header("Content-Length", str(len(payload)))
-        self.end_headers()
-        self.wfile.write(payload)
-
-    def _body(self) -> dict[str, Any]:
-        try:
-            length = int(self.headers.get("Content-Length", "0"))
-        except ValueError:
-            raise IdentityOverlayError("OVERLAY_CONTENT_LENGTH_INVALID") from None
-        if length <= 0 or length > MAX_BODY_BYTES:
-            raise IdentityOverlayError("OVERLAY_BODY_SIZE_REJECTED", 413)
-        raw = self.rfile.read(length)
-        try:
-            value = json.loads(raw)
-        except (UnicodeDecodeError, json.JSONDecodeError):
-            raise IdentityOverlayError("OVERLAY_BODY_JSON_INVALID") from None
-        if not isinstance(value, dict):
-            raise IdentityOverlayError("OVERLAY_BODY_OBJECT_REQUIRED")
-        return value
-
-    def do_GET(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != "/healthz":
-            self._send(404, {"error": "NOT_FOUND"})
-            return
-        self._send(
-            200,
-            {
-                "service": "aios-task-identity-overlay",
-                "status": "active" if _enabled() else "disabled",
-                "global_token_registry_used": False,
-                "loopback_only": True,
-            },
-        )
-
-    def do_POST(self) -> None:
-        path = urllib.parse.urlparse(self.path).path.rstrip("/") or "/"
-        if path != _ENDPOINT:
-            self._send(404, {"error": "NOT_FOUND"})
-            return
-        if not _enabled():
-            self._send(503, {"error": "IDENTITY_OVERLAY_DISABLED"})
-            return
-        try:
-            token = _bearer(self.headers.get("Authorization", ""))
-            result = self.overlay.provision(self._body(), token)
-            self._send(200, result)
-        except (IdentityOverlayError, OwnerAuthorizationError, ProvisioningError) as exc:
-            body: dict[str, Any] = {"error": exc.code}
-            if getattr(exc, "details", None):
-                body["details"] = exc.details
-            self._send(exc.status, body)
-        except Exception:
-            self._send(500, {"error": "IDENTITY_OVERLAY_API_INTERNAL_ERROR"})
-
-
-class OverlayServer(ThreadingHTTPServer):
-    allow_reuse_address = True
-
-    def __init__(
-        self,
-        address: tuple[str, int],
-        overlay: TaskIdentityOverlayService,
-    ) -> None:
-        super().__init__(address, OverlayHandler)
-        self.overlay = overlay
-
-
-def main() -> None:
-    host = os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_HOST", "127.0.0.1")
-    if host not in {"127.0.0.1", "::1", "localhost"}:
-        raise SystemExit("identity overlay must listen on loopback")
-    try:
-        port = int(os.getenv("AIOS_GITOPS_IDENTITY_OVERLAY_PORT", "19864"))
-    except ValueError:
-        raise SystemExit("invalid overlay port") from None
-    if not 1024 <= port <= 65535:
-        raise SystemExit("invalid overlay port")
-    config = IdentityOverlayConfig.from_environment()
-    server = OverlayServer(
-        (host, port),
-        TaskIdentityOverlayService(config),
-    )
-    server.serve_forever(poll_interval=0.25)
-
-
-if __name__ == "__main__":
-    main()
@@ -1,92 +0,0 @@
-#!/usr/bin/env python3
-"""Root-governed CLI for issuing and revoking task identity overlays.
-
-The CLI never prints the bearer token. It returns only the root-owned secret
-reference and non-secret metadata.
-"""
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-
-from task_identity_overlay import (
-    IdentityOverlayConfig,
-    IdentityOverlayError,
-    TaskIdentityOverlayStore,
-)
-
-
-def _write_result(path: str, value: dict) -> None:
-    data = json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n"
-    if path == "-":
-        sys.stdout.write(data)
-        return
-    target = Path(path)
-    target.parent.mkdir(parents=True, exist_ok=True)
-    target.write_text(data, encoding="utf-8")
-    os.chmod(target, 0o600)
-
-
-def parser() -> argparse.ArgumentParser:
-    value = argparse.ArgumentParser(
-        description="Issue/status/revoke a task-scoped identity overlay"
-    )
-    sub = value.add_subparsers(dest="command", required=True)
-
-    issue = sub.add_parser("issue")
-    issue.add_argument("--ttl-seconds", type=int, default=900)
-    issue.add_argument("--authorization-assertion-ref", required=True)
-    issue.add_argument(
-        "--operator-identity",
-        default=os.getenv("SUDO_USER") or os.getenv("USER") or "root",
-    )
-    issue.add_argument("--result-json", default="-")
-
-    status = sub.add_parser("status")
-    status.add_argument("--overlay-id", required=True)
-    status.add_argument("--result-json", default="-")
-
-    revoke = sub.add_parser("revoke")
-    revoke.add_argument("--overlay-id", required=True)
-    revoke.add_argument("--reason", required=True)
-    revoke.add_argument("--result-json", default="-")
-    return value
-
-
-def main() -> int:
-    args = parser().parse_args()
-    try:
-        store = TaskIdentityOverlayStore(
-            IdentityOverlayConfig.from_environment()
-        )
-        if args.command == "issue":
-            result = store.issue(
-                ttl_seconds=args.ttl_seconds,
-                authorization_assertion_ref=args.authorization_assertion_ref,
-                operator_identity=args.operator_identity,
-            )
-        elif args.command == "status":
-            result = store.status(args.overlay_id)
-        else:
-            result = store.revoke(args.overlay_id, reason=args.reason)
-        _write_result(args.result_json, result)
-        return 0
-    except IdentityOverlayError as exc:
-        body = {"status": "BLOCKED", "error": exc.code}
-        if exc.details:
-            body["details"] = exc.details
-        _write_result(getattr(args, "result_json", "-"), body)
-        return 2
-    except Exception:
-        _write_result(
-            getattr(args, "result_json", "-"),
-            {"status": "FAILED", "error": "IDENTITY_OVERLAY_CLI_INTERNAL_ERROR"},
-        )
-        return 1
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,462 +0,0 @@
-"""Self-healing availability guard for persistent Online Agent workers.
-
-The guard never claims Tasks and never writes Task/Job/Git databases. It only:
- ensures required worker/executor systemd units are enabled + active;
- checks worker-owned liveness JSON written by the real poll/heartbeat loop;
- restarts an active worker only when its liveness is stale;
- honors an explicit maintenance inhibit file;
- writes a bounded status JSON under /run for observability.
-
-Idle liveness is the successful poll loop itself. Busy liveness is refreshed by the
-Task lease-heartbeat thread, so long-running Tasks are not mistaken for hung workers.
-"""
-from __future__ import annotations
-
-from dataclasses import asdict, dataclass
-import argparse
-import json
-import os
-from pathlib import Path
-import shlex
-import subprocess
-import tempfile
-import time
-from typing import Any, Callable, Mapping, Sequence
-
-SCHEMA = "aios.worker-availability.status.v1"
-DEFAULT_WORKER_UNITS = (
-    "aios-online-agent-worker-20260815.service",
-    "aios-hermes-online-agent-worker.service",
-    "aios-openclaw-online-agent-worker.service",
-)
-DEFAULT_DEPENDENCY_UNITS = (
-    "aios-external-agent-executor.service",
-)
-DEFAULT_RUN_ROOT = Path("/run/aios-worker-availability")
-DEFAULT_STATUS = DEFAULT_RUN_ROOT / "status.json"
-DEFAULT_RECOVERY = DEFAULT_RUN_ROOT / "recovery.json"
-DEFAULT_INHIBIT = DEFAULT_RUN_ROOT / "maintenance.lock"
-DEFAULT_MAX_STALE_SECONDS = 90
-DEFAULT_RESTART_COOLDOWN_SECONDS = 60
-DEFAULT_STARTUP_WAIT_SECONDS = 10
-ACCEPTED_ENABLED_STATES = frozenset({"enabled", "enabled-runtime", "static", "indirect", "generated"})
-
-
-class AvailabilityGuardError(RuntimeError):
-    pass
-
-
-@dataclass(frozen=True)
-class UnitSnapshot:
-    unit: str
-    role: str
-    load_state: str
-    active_state: str
-    unit_file_state: str
-    enabled_ok: bool
-    liveness_path: str | None = None
-    liveness_state: str | None = None
-    last_seen_epoch: float | None = None
-    liveness_age_seconds: float | None = None
-    fresh: bool | None = None
-    action: str = "NONE"
-    detail: str | None = None
-
-
-class Systemd:
-    def __init__(
-        self,
-        runner: Callable[..., subprocess.CompletedProcess[str]] | None = None,
-    ) -> None:
-        self.runner = runner or subprocess.run
-
-    def _run(self, args: Sequence[str], *, check: bool = False) -> subprocess.CompletedProcess[str]:
-        result = self.runner(
-            ["/usr/bin/systemctl", *args],
-            text=True,
-            capture_output=True,
-            check=False,
-            timeout=20,
-        )
-        if check and result.returncode != 0:
-            raise AvailabilityGuardError(
-                "SYSTEMD_COMMAND_FAILED:"
-                + ":".join(args)
-                + ":"
-                + str(result.returncode)
-            )
-        return result
-
-    def property(self, unit: str, name: str) -> str:
-        result = self._run(["show", unit, f"--property={name}", "--value"])
-        if result.returncode != 0:
-            return ""
-        return result.stdout.strip()
-
-    def environment(self, unit: str) -> dict[str, str]:
-        text = self.property(unit, "Environment")
-        result: dict[str, str] = {}
-        for item in shlex.split(text):
-            if "=" not in item:
-                continue
-            key, value = item.split("=", 1)
-            result[key] = value
-        return result
-
-    def enable(self, unit: str) -> None:
-        self._run(["enable", unit], check=True)
-
-    def start(self, unit: str) -> None:
-        self._run(["start", unit], check=True)
-
-    def restart(self, unit: str) -> None:
-        self._run(["restart", unit], check=True)
-
-
-def _atomic_json(path: Path, value: Mapping[str, Any]) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True, mode=0o755)
-    if path.parent.is_symlink() or path.is_symlink():
-        raise AvailabilityGuardError("STATUS_PATH_SYMLINK_REJECTED")
-    fd, temporary = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
-    try:
-        os.fchmod(fd, 0o644)
-        with os.fdopen(fd, "w", encoding="utf-8") as handle:
-            json.dump(value, handle, ensure_ascii=False, sort_keys=True, indent=2)
-            handle.write("\n")
-            handle.flush()
-            os.fsync(handle.fileno())
-        os.replace(temporary, path)
-        os.chmod(path, 0o644)
-    finally:
-        if os.path.exists(temporary):
-            os.unlink(temporary)
-
-
-def _load_json(path: Path) -> dict[str, Any] | None:
-    if path.is_symlink() or not path.is_file():
-        return None
-    try:
-        value = json.loads(path.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
-        return None
-    return dict(value) if isinstance(value, Mapping) else None
-
-
-def _state_root(environment: Mapping[str, str], unit: str) -> Path:
-    explicit = environment.get("AIOS_WORKER_STATE_ROOT")
-    if explicit:
-        return Path(explicit)
-    fallbacks = {
-        "aios-online-agent-worker-20260815.service": Path(
-            "/var/lib/aios-online-agent-worker-20260815"
-        ),
-        "aios-hermes-online-agent-worker.service": Path(
-            "/var/lib/aios-online-agent-hermes"
-        ),
-        "aios-openclaw-online-agent-worker.service": Path(
-            "/var/lib/aios-online-agent-openclaw"
-        ),
-    }
-    if unit not in fallbacks:
-        raise AvailabilityGuardError("WORKER_STATE_ROOT_UNAVAILABLE:" + unit)
-    return fallbacks[unit]
-
-
-def _liveness_path(environment: Mapping[str, str], unit: str) -> Path:
-    explicit = environment.get("AIOS_WORKER_LIVENESS_PATH")
-    if explicit:
-        return Path(explicit)
-    return _state_root(environment, unit) / "worker-liveness.json"
-
-
-class AvailabilityGuard:
-    def __init__(
-        self,
-        *,
-        systemd: Systemd | None = None,
-        worker_units: Sequence[str] = DEFAULT_WORKER_UNITS,
-        dependency_units: Sequence[str] = DEFAULT_DEPENDENCY_UNITS,
-        status_path: Path = DEFAULT_STATUS,
-        recovery_path: Path = DEFAULT_RECOVERY,
-        inhibit_path: Path = DEFAULT_INHIBIT,
-        max_stale_seconds: int = DEFAULT_MAX_STALE_SECONDS,
-        restart_cooldown_seconds: int = DEFAULT_RESTART_COOLDOWN_SECONDS,
-        startup_wait_seconds: int = DEFAULT_STARTUP_WAIT_SECONDS,
-        now_fn: Callable[[], float] = time.time,
-        sleep_fn: Callable[[float], None] = time.sleep,
-    ) -> None:
-        self.systemd = systemd or Systemd()
-        self.worker_units = tuple(worker_units)
-        self.dependency_units = tuple(dependency_units)
-        self.status_path = Path(status_path)
-        self.recovery_path = Path(recovery_path)
-        self.inhibit_path = Path(inhibit_path)
-        self.max_stale_seconds = int(max_stale_seconds)
-        self.restart_cooldown_seconds = int(restart_cooldown_seconds)
-        self.startup_wait_seconds = int(startup_wait_seconds)
-        self.now_fn = now_fn
-        self.sleep_fn = sleep_fn
-        if self.max_stale_seconds < 15:
-            raise AvailabilityGuardError("MAX_STALE_SECONDS_TOO_SMALL")
-        if self.restart_cooldown_seconds < 15:
-            raise AvailabilityGuardError("RESTART_COOLDOWN_TOO_SMALL")
-        if self.startup_wait_seconds < 0 or self.startup_wait_seconds > 60:
-            raise AvailabilityGuardError("STARTUP_WAIT_INVALID")
-
-    def _recovery_state(self) -> dict[str, float]:
-        value = _load_json(self.recovery_path) or {}
-        raw = value.get("last_restart_epoch")
-        if not isinstance(raw, Mapping):
-            return {}
-        result: dict[str, float] = {}
-        for unit, epoch in raw.items():
-            try:
-                result[str(unit)] = float(epoch)
-            except (TypeError, ValueError):
-                continue
-        return result
-
-    def _save_recovery_state(self, state: Mapping[str, float]) -> None:
-        _atomic_json(
-            self.recovery_path,
-            {
-                "schema": "aios.worker-availability.recovery.v1",
-                "last_restart_epoch": dict(state),
-            },
-        )
-
-    def _basic_snapshot(self, unit: str, role: str) -> tuple[str, str, str, bool]:
-        load = self.systemd.property(unit, "LoadState")
-        active = self.systemd.property(unit, "ActiveState")
-        enabled = self.systemd.property(unit, "UnitFileState")
-        return load, active, enabled, enabled in ACCEPTED_ENABLED_STATES
-
-    def _ensure_enabled_active(self, unit: str, role: str) -> tuple[str, bool]:
-        load, active, enabled, enabled_ok = self._basic_snapshot(unit, role)
-        if load != "loaded":
-            raise AvailabilityGuardError("REQUIRED_UNIT_NOT_LOADED:" + unit)
-        action = "NONE"
-        if not enabled_ok:
-            self.systemd.enable(unit)
-            action = "ENABLE"
-        if active != "active":
-            self.systemd.start(unit)
-            action = "START" if action == "NONE" else "ENABLE_START"
-        return action, active == "active"
-
-    def _wait_for_liveness(self, path: Path) -> dict[str, Any] | None:
-        deadline = self.now_fn() + self.startup_wait_seconds
-        while True:
-            value = _load_json(path)
-            if value is not None:
-                try:
-                    epoch = float(value.get("last_seen_epoch"))
-                except (TypeError, ValueError):
-                    epoch = 0.0
-                if epoch > 0 and self.now_fn() - epoch <= self.max_stale_seconds:
-                    return value
-            if self.now_fn() >= deadline:
-                return value
-            self.sleep_fn(0.5)
-
-    def run(self, *, heal: bool) -> dict[str, Any]:
-        now = self.now_fn()
-        if self.inhibit_path.exists():
-            result = {
-                "schema": SCHEMA,
-                "status": "MAINTENANCE_INHIBITED",
-                "generated_at_epoch": now,
-                "maintenance_inhibit": str(self.inhibit_path),
-                "workers": [],
-                "dependencies": [],
-                "all_fresh": False,
-                "actions": [],
-            }
-            _atomic_json(self.status_path, result)
-            return result
-
-        actions: list[dict[str, str]] = []
-        dependencies: list[UnitSnapshot] = []
-        for unit in self.dependency_units:
-            load, active, enabled, enabled_ok = self._basic_snapshot(unit, "dependency")
-            action = "NONE"
-            if heal:
-                if load != "loaded":
-                    raise AvailabilityGuardError("REQUIRED_UNIT_NOT_LOADED:" + unit)
-                if not enabled_ok:
-                    self.systemd.enable(unit)
-                    action = "ENABLE"
-                if active != "active":
-                    self.systemd.start(unit)
-                    action = "START" if action == "NONE" else "ENABLE_START"
-                if action != "NONE":
-                    actions.append({"unit": unit, "action": action})
-                load, active, enabled, enabled_ok = self._basic_snapshot(unit, "dependency")
-            dependencies.append(
-                UnitSnapshot(
-                    unit=unit,
-                    role="dependency",
-                    load_state=load,
-                    active_state=active,
-                    unit_file_state=enabled,
-                    enabled_ok=enabled_ok,
-                    fresh=(active == "active"),
-                    action=action,
-                )
-            )
-
-        recovery = self._recovery_state()
-        workers: list[UnitSnapshot] = []
-        for unit in self.worker_units:
-            load, active, enabled, enabled_ok = self._basic_snapshot(unit, "worker")
-            environment = self.systemd.environment(unit) if load == "loaded" else {}
-            path = _liveness_path(environment, unit) if load == "loaded" else None
-            action = "NONE"
-
-            if heal:
-                if load != "loaded":
-                    raise AvailabilityGuardError("REQUIRED_UNIT_NOT_LOADED:" + unit)
-                if not enabled_ok:
-                    self.systemd.enable(unit)
-                    action = "ENABLE"
-                if active != "active":
-                    self.systemd.start(unit)
-                    action = "START" if action == "NONE" else "ENABLE_START"
-                    actions.append({"unit": unit, "action": action})
-                    if path is not None:
-                        self._wait_for_liveness(path)
-                load, active, enabled, enabled_ok = self._basic_snapshot(unit, "worker")
-
-            live = _load_json(path) if path is not None else None
-            last_seen: float | None = None
-            state: str | None = None
-            age: float | None = None
-            fresh = False
-            detail: str | None = None
-            if live is not None:
-                state = str(live.get("state") or "")
-                try:
-                    last_seen = float(live.get("last_seen_epoch"))
-                except (TypeError, ValueError):
-                    last_seen = None
-                if last_seen is not None:
-                    age = max(0.0, now - last_seen)
-                    fresh = age <= self.max_stale_seconds
-                if live.get("agent_id") in (None, ""):
-                    fresh = False
-                    detail = "LIVENESS_AGENT_ID_MISSING"
-            else:
-                detail = "LIVENESS_MISSING"
-
-            if heal and active == "active" and not fresh:
-                previous = float(recovery.get(unit, 0.0))
-                if now - previous >= self.restart_cooldown_seconds:
-                    self.systemd.restart(unit)
-                    recovery[unit] = now
-                    action = "RESTART_STALE"
-                    actions.append({"unit": unit, "action": action})
-                    if path is not None:
-                        live = self._wait_for_liveness(path)
-                    load, active, enabled, enabled_ok = self._basic_snapshot(unit, "worker")
-                    if live is not None:
-                        state = str(live.get("state") or "")
-                        try:
-                            last_seen = float(live.get("last_seen_epoch"))
-                        except (TypeError, ValueError):
-                            last_seen = None
-                        if last_seen is not None:
-                            age = max(0.0, self.now_fn() - last_seen)
-                            fresh = age <= self.max_stale_seconds
-                            detail = None if fresh else "LIVENESS_STALE_AFTER_RESTART"
-                else:
-                    detail = "RESTART_COOLDOWN_ACTIVE"
-
-            workers.append(
-                UnitSnapshot(
-                    unit=unit,
-                    role="worker",
-                    load_state=load,
-                    active_state=active,
-                    unit_file_state=enabled,
-                    enabled_ok=enabled_ok,
-                    liveness_path=str(path) if path is not None else None,
-                    liveness_state=state,
-                    last_seen_epoch=last_seen,
-                    liveness_age_seconds=age,
-                    fresh=bool(active == "active" and enabled_ok and fresh),
-                    action=action,
-                    detail=detail,
-                )
-            )
-
-        if heal:
-            self._save_recovery_state(recovery)
-
-        all_fresh = (
-            all(item.active_state == "active" and item.enabled_ok and item.fresh for item in workers)
-            and all(item.active_state == "active" for item in dependencies)
-        )
-        result = {
-            "schema": SCHEMA,
-            "status": "HEALTHY" if all_fresh else "DEGRADED",
-            "generated_at_epoch": self.now_fn(),
-            "max_stale_seconds": self.max_stale_seconds,
-            "maintenance_inhibit": str(self.inhibit_path),
-            "workers": [asdict(item) for item in workers],
-            "dependencies": [asdict(item) for item in dependencies],
-            "all_fresh": all_fresh,
-            "actions": actions,
-        }
-        _atomic_json(self.status_path, result)
-        return result
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser()
-    mode = parser.add_mutually_exclusive_group(required=True)
-    mode.add_argument("--heal", action="store_true")
-    mode.add_argument("--check", action="store_true")
-    parser.add_argument("--status-file", default=str(DEFAULT_STATUS))
-    parser.add_argument("--recovery-file", default=str(DEFAULT_RECOVERY))
-    parser.add_argument("--inhibit-file", default=str(DEFAULT_INHIBIT))
-    parser.add_argument(
-        "--max-stale-seconds",
-        type=int,
-        default=int(
-            os.environ.get(
-                "AIOS_WORKER_AVAILABILITY_MAX_STALE_SECONDS",
-                str(DEFAULT_MAX_STALE_SECONDS),
-            )
-        ),
-    )
-    parser.add_argument(
-        "--restart-cooldown-seconds",
-        type=int,
-        default=int(
-            os.environ.get(
-                "AIOS_WORKER_AVAILABILITY_RESTART_COOLDOWN_SECONDS",
-                str(DEFAULT_RESTART_COOLDOWN_SECONDS),
-            )
-        ),
-    )
-    args = parser.parse_args()
-    guard = AvailabilityGuard(
-        status_path=Path(args.status_file),
-        recovery_path=Path(args.recovery_file),
-        inhibit_path=Path(args.inhibit_file),
-        max_stale_seconds=args.max_stale_seconds,
-        restart_cooldown_seconds=args.restart_cooldown_seconds,
-    )
-    try:
-        result = guard.run(heal=args.heal)
-    except AvailabilityGuardError as exc:
-        print(json.dumps({"status": "FAILED", "error": str(exc)}, sort_keys=True))
-        return 20
-    print(json.dumps(result, ensure_ascii=False, sort_keys=True))
-    if args.check and not result.get("all_fresh"):
-        return 10
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,652 +0,0 @@
-#!/usr/bin/env python3
-"""One-shot governed executor for an already approved exact release binding.
-
-This module deliberately does not build release artifacts. The build/staging
-evidence is completed before Owner production approval. Production execution
-consumes that immutable binding, revalidates it, and performs narrow
-side-effects through adapters in a durable fail-closed order.
-
-Adapter protocol:
-  stdin: JSON request with operation = "probe" | "apply" | "rollback"
-  stdout: one JSON object on the final non-empty line
-  shell: never used
-
-The executor never rewrites tags, never writes refs/heads/main, and records
-Baseline last.
-"""
-from __future__ import annotations
-
-import argparse
-import dataclasses
-import fcntl
-import hashlib
-import json
-import os
-import re
-import stat
-import subprocess
-import sys
-import tempfile
-import time
-from pathlib import Path
-from typing import Any, Mapping, Sequence
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA_RE = re.compile(r"^[0-9a-f]{64}$")
-PLAN_RE = re.compile(r"^sha256:[0-9a-f]{64}$")
-
-REQUIRED_V2R1C7_MEMBERS = {
-    "payload/VERSION",
-    "payload/active-runtime/app/deployment_state.py",
-    "payload/active-runtime/app/v2r1c6_privacy_tools.py",
-    "payload/active-runtime/app/v2r1c7_health_service.py",
-    "payload/deploy/aios-v2/systemd/aios-v2r1c7-production.service",
-    "payload/deploy/aios-v2/v2r1c7-runtime-config.json",
-    "payload/deploy/aios-v2/v2r1c7-rollback.json",
-    "payload/scripts/probe_v2r1c7_health.py",
-    "payload/scripts/rollback_v2r1c7_release.sh",
-    "payload/BUILD-METADATA.json",
-    "payload/ARTIFACT-MANIFEST.json",
-    "payload/ROLLBACK-METADATA.json",
-}
-
-class ReleaseBlocked(RuntimeError):
-    pass
-
-class ManualOwnerReviewRequired(ReleaseBlocked):
-    pass
-
-class ReconciliationRequired(ReleaseBlocked):
-    pass
-
-
-@dataclasses.dataclass(frozen=True)
-class Binding:
-    version: str
-    target_oid: str
-    evidence_closure_oid: str
-    artifact_sha256: str
-    approval_plan_id: str
-    artifact_path: str
-    artifact_size: int
-    production_service: str
-    production_port: int
-    repository_identity: str = "aios/aios"
-
-    def __post_init__(self) -> None:
-        if not self.version or not OID_RE.fullmatch(self.target_oid):
-            raise ValueError("invalid release target binding")
-        if not OID_RE.fullmatch(self.evidence_closure_oid):
-            raise ValueError("invalid evidence closure OID")
-        if not SHA_RE.fullmatch(self.artifact_sha256):
-            raise ValueError("invalid artifact SHA-256")
-        if not PLAN_RE.fullmatch(self.approval_plan_id):
-            raise ValueError("invalid approval plan id")
-        if self.artifact_size <= 0:
-            raise ValueError("invalid artifact size")
-        if not self.production_service:
-            raise ValueError("production service is required")
-        if not 1024 <= self.production_port <= 65535:
-            raise ValueError("invalid production port")
-        if self.repository_identity != "aios/aios":
-            raise ValueError("unexpected repository identity")
-
-    @property
-    def tag(self) -> str:
-        return self.version
-
-    @property
-    def fingerprint(self) -> str:
-        payload = {
-            "version": self.version,
-            "target_oid": self.target_oid,
-            "evidence_closure_oid": self.evidence_closure_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "approval_plan_id": self.approval_plan_id,
-            "artifact_size": self.artifact_size,
-            "production_service": self.production_service,
-            "production_port": self.production_port,
-            "repository_identity": self.repository_identity,
-        }
-        return hashlib.sha256(canonical_json(payload)).hexdigest()
-
-    def request(self, operation: str) -> dict[str, Any]:
-        return {
-            "schema": "aios.production-executor-request.v1",
-            "operation": operation,
-            "binding_fingerprint": self.fingerprint,
-            "version": self.version,
-            "tag": self.tag,
-            "target_oid": self.target_oid,
-            "evidence_closure_oid": self.evidence_closure_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "artifact_path": self.artifact_path,
-            "artifact_size": self.artifact_size,
-            "approval_plan_id": self.approval_plan_id,
-            "production_service": self.production_service,
-            "production_port": self.production_port,
-            "repository_identity": self.repository_identity,
-        }
-
-
-def canonical_json(value: object) -> bytes:
-    return (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode("utf-8")
-
-
-def secure_json(path: Path) -> dict[str, Any]:
-    st = path.lstat()
-    if not stat.S_ISREG(st.st_mode) or path.is_symlink():
-        raise ReleaseBlocked(f"non-regular authorization file: {path}")
-    if st.st_uid != 0:
-        raise ReleaseBlocked(f"authorization file must be root-owned: {path}")
-    if st.st_mode & 0o022:
-        raise ReleaseBlocked(f"authorization file is group/world writable: {path}")
-    data = json.loads(path.read_text(encoding="utf-8"))
-    if not isinstance(data, dict):
-        raise ReleaseBlocked("authorization receipt must be a JSON object")
-    return data
-
-
-def sha256_file(path: Path) -> str:
-    if path.is_symlink() or not path.is_file():
-        raise ReleaseBlocked("artifact must be a regular non-symlink file")
-    digest = hashlib.sha256()
-    with path.open("rb") as source:
-        for block in iter(lambda: source.read(1024 * 1024), b""):
-            digest.update(block)
-    return digest.hexdigest()
-
-
-def run_git(git_dir: Path, *args: str, check: bool = True) -> subprocess.CompletedProcess[str]:
-    return subprocess.run(
-        ["git", f"--git-dir={git_dir}", *args],
-        check=check,
-        capture_output=True,
-        text=True,
-        timeout=30,
-        env={"PATH": os.environ.get("PATH", "")},
-    )
-
-
-def verify_git_lineage(git_dir: Path, binding: Binding) -> dict[str, Any]:
-    authority_main = run_git(git_dir, "rev-parse", "refs/heads/main").stdout.strip()
-    if not OID_RE.fullmatch(authority_main):
-        raise ReleaseBlocked("Authority main OID is invalid")
-
-    target_type = run_git(git_dir, "cat-file", "-t", binding.target_oid).stdout.strip()
-    if target_type != "commit":
-        raise ReleaseBlocked("target_oid is not a commit")
-
-    evidence_type = run_git(
-        git_dir, "cat-file", "-t", binding.evidence_closure_oid
-    ).stdout.strip()
-    if evidence_type != "commit":
-        raise ReleaseBlocked("evidence_closure_oid is not a commit")
-
-    # A control-plane-only patch may advance main after release approval.
-    # The approved release target remains valid only while it is still on main.
-    target_on_main = run_git(
-        git_dir,
-        "merge-base",
-        "--is-ancestor",
-        binding.target_oid,
-        authority_main,
-        check=False,
-    ).returncode == 0
-    if not target_on_main:
-        raise ManualOwnerReviewRequired(
-            "approved target is no longer an ancestor of Authority main"
-        )
-
-    target_in_evidence = run_git(
-        git_dir,
-        "merge-base",
-        "--is-ancestor",
-        binding.target_oid,
-        binding.evidence_closure_oid,
-        check=False,
-    ).returncode == 0
-    if not target_in_evidence:
-        raise ReleaseBlocked("approved target is not an ancestor of evidence closure")
-
-    return {
-        "authority_main_oid": authority_main,
-        "target_oid": binding.target_oid,
-        "target_is_ancestor_of_main": True,
-        "evidence_closure_oid": binding.evidence_closure_oid,
-        "evidence_object_type": evidence_type,
-        "target_is_ancestor_of_evidence": True,
-    }
-
-
-def verify_artifact(binding: Binding) -> dict[str, Any]:
-    path = Path(binding.artifact_path)
-    if path.stat().st_size != binding.artifact_size:
-        raise ReleaseBlocked("artifact size mismatch")
-    actual = sha256_file(path)
-    if actual != binding.artifact_sha256:
-        raise ReleaseBlocked("artifact SHA-256 mismatch")
-
-    if binding.version == "V2R1C7":
-        # Python tarfile may not have zstd support on the target host, so
-        # decompress into a private temporary tar and inspect it there.
-        with tempfile.TemporaryDirectory(prefix="aios-artifact-verify-") as temp_dir:
-            tar_path = Path(temp_dir) / "release.tar"
-            with tar_path.open("wb") as output:
-                completed = subprocess.run(
-                    ["zstd", "-dc", str(path)],
-                    check=False,
-                    stdout=output,
-                    stderr=subprocess.PIPE,
-                    timeout=60,
-                    env={"PATH": os.environ.get("PATH", "")},
-                )
-            if completed.returncode != 0:
-                raise ReleaseBlocked("artifact zstd decompression failed")
-            import tarfile
-            with tarfile.open(tar_path, "r:") as archive:
-                names: set[str] = set()
-                for member in archive.getmembers():
-                    candidate = Path(member.name)
-                    if (
-                        candidate.is_absolute()
-                        or ".." in candidate.parts
-                        or member.issym()
-                        or member.islnk()
-                        or not (member.isfile() or member.isdir())
-                    ):
-                        raise ReleaseBlocked(f"unsafe artifact member: {member.name}")
-                    names.add(member.name)
-            missing = sorted(REQUIRED_V2R1C7_MEMBERS - names)
-            if missing:
-                raise ReleaseBlocked(
-                    "artifact missing required members: " + ",".join(missing)
-                )
-    return {
-        "artifact_path": str(path),
-        "artifact_sha256": actual,
-        "artifact_size": binding.artifact_size,
-        "verified": True,
-    }
-
-
-def verify_authorization(receipt: Mapping[str, Any], binding: Binding) -> dict[str, Any]:
-    if receipt.get("accepted") is not True:
-        raise ReleaseBlocked("Owner production authorization is not accepted")
-    if receipt.get("binding_replaced") not in (None, False):
-        raise ManualOwnerReviewRequired("Owner binding was replaced")
-    expected = {
-        "version": binding.version,
-        "target_oid": binding.target_oid,
-        "evidence_closure_oid": binding.evidence_closure_oid,
-        "artifact_sha256": binding.artifact_sha256,
-        "approval_plan_id": binding.approval_plan_id,
-    }
-    for key, value in expected.items():
-        if receipt.get(key) != value:
-            raise ManualOwnerReviewRequired(f"Owner authorization mismatch: {key}")
-    return {"accepted": True, **expected}
-
-
-class DurableState:
-    def __init__(self, root: Path, binding: Binding):
-        self.root = root
-        self.root.mkdir(parents=True, exist_ok=True)
-        os.chmod(self.root, 0o700)
-        self.path = self.root / "execution.json"
-        self.binding = binding
-        self.value: dict[str, Any]
-        if self.path.exists():
-            existing = json.loads(self.path.read_text(encoding="utf-8"))
-            if existing.get("binding_fingerprint") != binding.fingerprint:
-                raise ManualOwnerReviewRequired(
-                    "state root contains a different production binding"
-                )
-            self.value = existing
-        else:
-            self.value = {
-                "schema": "aios.production-execution-state.v1",
-                "binding_fingerprint": binding.fingerprint,
-                "version": binding.version,
-                "target_oid": binding.target_oid,
-                "state": "AUTHORIZED",
-                "completed": {},
-                "history": [],
-            }
-            self.save()
-
-    def save(self) -> None:
-        temporary = self.path.with_suffix(".tmp")
-        temporary.write_bytes(canonical_json(self.value))
-        os.chmod(temporary, 0o600)
-        os.replace(temporary, self.path)
-
-    def record(self, state: str, step: str, result: Mapping[str, Any]) -> None:
-        now = time.time()
-        sanitized = json.loads(json.dumps(result))
-        self.value["state"] = state
-        self.value["completed"][step] = sanitized
-        self.value["history"].append(
-            {"at": now, "state": state, "step": step, "result": sanitized}
-        )
-        self.save()
-
-    def fail(self, state: str, reason: str) -> None:
-        self.value["state"] = state
-        self.value["history"].append(
-            {"at": time.time(), "state": state, "reason": reason}
-        )
-        self.save()
-
-
-class FileLock:
-    def __init__(self, path: Path):
-        self.path = path
-        self.handle = None
-
-    def __enter__(self) -> "FileLock":
-        self.path.parent.mkdir(parents=True, exist_ok=True)
-        self.handle = self.path.open("a+", encoding="utf-8")
-        os.chmod(self.path, 0o600)
-        try:
-            fcntl.flock(
-                self.handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB
-            )
-        except BlockingIOError as exc:
-            raise ReleaseBlocked("production executor is already running") from exc
-        return self
-
-    def __exit__(self, exc_type, exc, tb) -> None:
-        if self.handle is not None:
-            fcntl.flock(self.handle.fileno(), fcntl.LOCK_UN)
-            self.handle.close()
-
-
-def parse_command(values: Sequence[str]) -> list[str]:
-    command = [str(x) for x in values if str(x)]
-    if not command:
-        raise ValueError("adapter command is required")
-    if not os.path.isabs(command[0]):
-        raise ValueError("adapter executable must be an absolute path")
-    return command
-
-
-def run_adapter(command: Sequence[str], request: Mapping[str, Any]) -> dict[str, Any]:
-    completed = subprocess.run(
-        list(command),
-        input=canonical_json(request),
-        check=False,
-        capture_output=True,
-        timeout=180,
-        env={"PATH": os.environ.get("PATH", "")},
-    )
-    if completed.returncode != 0:
-        raise ReleaseBlocked(
-            f"adapter failed: {Path(command[0]).name} rc={completed.returncode}"
-        )
-    lines = [line for line in completed.stdout.decode("utf-8").splitlines() if line.strip()]
-    if not lines:
-        raise ReleaseBlocked("adapter returned no JSON result")
-    try:
-        value = json.loads(lines[-1])
-    except ValueError as exc:
-        raise ReleaseBlocked("adapter returned invalid JSON") from exc
-    if not isinstance(value, dict):
-        raise ReleaseBlocked("adapter result must be an object")
-    return value
-
-
-def require_exact_response(result: Mapping[str, Any], binding: Binding) -> None:
-    for key, expected in {
-        "version": binding.version,
-        "target_oid": binding.target_oid,
-        "evidence_closure_oid": binding.evidence_closure_oid,
-        "artifact_sha256": binding.artifact_sha256,
-        "approval_plan_id": binding.approval_plan_id,
-    }.items():
-        if key in result and result[key] != expected:
-            raise ManualOwnerReviewRequired(f"adapter binding mismatch: {key}")
-
-
-def tag_step(command: Sequence[str], binding: Binding) -> dict[str, Any]:
-    request = binding.request("probe")
-    probe = run_adapter(command, request)
-    require_exact_response(probe, binding)
-    state = probe.get("status")
-    if state == "CONFLICT":
-        raise ManualOwnerReviewRequired("same-name tag conflicts with approved binding")
-    if state == "INDETERMINATE":
-        raise ReconciliationRequired("tag publication state is indeterminate")
-    if state not in {"APPLIED_VERIFIED", "NOT_APPLIED", "PARTIAL_LOCAL"}:
-        raise ReleaseBlocked(f"unsupported tag probe status: {state}")
-    if state != "APPLIED_VERIFIED":
-        applied = run_adapter(command, binding.request("apply"))
-        require_exact_response(applied, binding)
-        if applied.get("status") == "CONFLICT":
-            raise ManualOwnerReviewRequired("tag conflict during publication")
-        probe = run_adapter(command, request)
-        require_exact_response(probe, binding)
-    if probe.get("status") != "APPLIED_VERIFIED":
-        raise ReconciliationRequired("tag was not independently verified")
-    if probe.get("peeled_target_oid") != binding.target_oid:
-        raise ManualOwnerReviewRequired("published tag peeled target mismatch")
-    tag_oid = probe.get("tag_oid")
-    if not isinstance(tag_oid, str) or not OID_RE.fullmatch(tag_oid):
-        raise ReleaseBlocked("verified annotated tag object OID missing")
-    return dict(probe)
-
-
-def deploy_step(command: Sequence[str], binding: Binding) -> dict[str, Any]:
-    probe = run_adapter(command, binding.request("probe"))
-    require_exact_response(probe, binding)
-    if probe.get("status") == "ACTIVE_VERIFIED":
-        return dict(probe)
-    if probe.get("status") == "CONFLICT":
-        raise ManualOwnerReviewRequired("production runtime has conflicting binding")
-    applied = run_adapter(command, binding.request("apply"))
-    require_exact_response(applied, binding)
-    probe = run_adapter(command, binding.request("probe"))
-    require_exact_response(probe, binding)
-    if probe.get("status") != "ACTIVE_VERIFIED":
-        try:
-            run_adapter(command, binding.request("rollback"))
-        except Exception:
-            pass
-        raise ReconciliationRequired("production runtime did not verify after apply")
-    if (
-        probe.get("deployment_state") != "ACTIVE"
-        or probe.get("production_deployed") is not True
-    ):
-        raise ReconciliationRequired("production health contract is not ACTIVE")
-    return dict(probe)
-
-
-def finalize_step(
-    command: Sequence[str],
-    binding: Binding,
-    *,
-    name: str,
-    tag_oid: str,
-) -> dict[str, Any]:
-    request = binding.request("probe")
-    request["tag_oid"] = tag_oid
-    probe = run_adapter(command, request)
-    require_exact_response(probe, binding)
-    if probe.get("status") == "CONFLICT":
-        raise ManualOwnerReviewRequired(f"{name} has conflicting release binding")
-    if probe.get("status") != "VERIFIED":
-        apply_request = binding.request("apply")
-        apply_request["tag_oid"] = tag_oid
-        applied = run_adapter(command, apply_request)
-        require_exact_response(applied, binding)
-        probe = run_adapter(command, request)
-        require_exact_response(probe, binding)
-    if probe.get("status") != "VERIFIED":
-        raise ReconciliationRequired(f"{name} did not verify after apply")
-    if probe.get("tag_oid") not in (None, tag_oid):
-        raise ManualOwnerReviewRequired(f"{name} tag object mismatch")
-    return dict(probe)
-
-
-def execute(
-    *,
-    binding: Binding,
-    authorization_path: Path,
-    repository: Path,
-    state_root: Path,
-    tag_command: Sequence[str],
-    deploy_command: Sequence[str],
-    registry_command: Sequence[str],
-    baseline_command: Sequence[str],
-) -> dict[str, Any]:
-    authorization = verify_authorization(secure_json(authorization_path), binding)
-    lineage = verify_git_lineage(repository, binding)
-    artifact = verify_artifact(binding)
-    state = DurableState(state_root, binding)
-    with FileLock(state_root / "executor.lock"):
-        state.record(
-            "PREFLIGHT_VERIFIED",
-            "preflight",
-            {"authorization": authorization, "lineage": lineage, "artifact": artifact},
-        )
-        tag: dict[str, Any] | None = None
-        runtime: dict[str, Any] | None = None
-        try:
-            tag = tag_step(tag_command, binding)
-            state.record("TAG_VERIFIED", "tag", tag)
-
-            runtime = deploy_step(deploy_command, binding)
-            state.record("RUNTIME_VERIFIED", "runtime", runtime)
-
-            registry = finalize_step(
-                registry_command,
-                binding,
-                name="registry",
-                tag_oid=tag["tag_oid"],
-            )
-            state.record("REGISTRY_VERIFIED", "registry", registry)
-
-            baseline = finalize_step(
-                baseline_command,
-                binding,
-                name="baseline",
-                tag_oid=tag["tag_oid"],
-            )
-            state.record("BASELINE_VERIFIED", "baseline", baseline)
-
-            # Final readback: no mutation, all four planes must still agree.
-            final_tag = tag_step(tag_command, binding)
-            final_runtime = run_adapter(deploy_command, binding.request("probe"))
-            final_registry_request = binding.request("probe")
-            final_registry_request["tag_oid"] = tag["tag_oid"]
-            final_registry = run_adapter(registry_command, final_registry_request)
-            final_baseline_request = binding.request("probe")
-            final_baseline_request["tag_oid"] = tag["tag_oid"]
-            final_baseline = run_adapter(baseline_command, final_baseline_request)
-            for value in (final_runtime, final_registry, final_baseline):
-                require_exact_response(value, binding)
-            if final_runtime.get("status") != "ACTIVE_VERIFIED":
-                raise ReconciliationRequired("final runtime readback failed")
-            if final_registry.get("status") != "VERIFIED":
-                raise ReconciliationRequired("final Registry readback failed")
-            if final_baseline.get("status") != "VERIFIED":
-                raise ReconciliationRequired("final Baseline readback failed")
-            final = {
-                "status": "PRODUCTION_ACCEPTED",
-                "version": binding.version,
-                "target_oid": binding.target_oid,
-                "evidence_closure_oid": binding.evidence_closure_oid,
-                "artifact_sha256": binding.artifact_sha256,
-                "approval_plan_id": binding.approval_plan_id,
-                "tag_oid": tag["tag_oid"],
-                "tag": final_tag,
-                "runtime": final_runtime,
-                "registry": final_registry,
-                "baseline": final_baseline,
-                "force_push_used": False,
-                "tag_rewritten": False,
-                "direct_main_push": False,
-                "secrets_committed": False,
-            }
-            state.record("COMPLETED", "final_consistency", final)
-            return final
-        except ManualOwnerReviewRequired as exc:
-            state.fail("MANUAL_OWNER_REVIEW_REQUIRED", str(exc))
-            raise
-        except ReconciliationRequired as exc:
-            state.fail("RECONCILIATION_REQUIRED", str(exc))
-            raise
-        except Exception as exc:
-            # Once a formal tag has been verified, no later error is a clean
-            # pre-side-effect failure. Preserve the tag and require idempotent
-            # reconciliation rather than pretending the release never started.
-            if tag is not None:
-                reason = f"{type(exc).__name__}: {exc}"
-                state.fail("RECONCILIATION_REQUIRED", reason)
-                raise ReconciliationRequired(reason) from exc
-            state.fail("FAIL_CLOSED", f"{type(exc).__name__}: {exc}")
-            raise
-
-
-def parser() -> argparse.ArgumentParser:
-    p = argparse.ArgumentParser()
-    p.add_argument("--authorization", required=True, type=Path)
-    p.add_argument("--repository", required=True, type=Path)
-    p.add_argument("--state-root", required=True, type=Path)
-    p.add_argument("--artifact", required=True, type=Path)
-    p.add_argument("--artifact-size", required=True, type=int)
-    p.add_argument("--version", required=True)
-    p.add_argument("--target-oid", required=True)
-    p.add_argument("--evidence-closure-oid", required=True)
-    p.add_argument("--artifact-sha256", required=True)
-    p.add_argument("--approval-plan-id", required=True)
-    p.add_argument("--production-service", required=True)
-    p.add_argument("--production-port", required=True, type=int)
-    p.add_argument("--repository-identity", default="aios/aios")
-    p.add_argument("--tag-adapter", required=True, nargs="+")
-    p.add_argument("--deploy-adapter", required=True, nargs="+")
-    p.add_argument("--registry-adapter", required=True, nargs="+")
-    p.add_argument("--baseline-adapter", required=True, nargs="+")
-    return p
-
-
-def main() -> int:
-    args = parser().parse_args()
-    binding = Binding(
-        version=args.version,
-        target_oid=args.target_oid,
-        evidence_closure_oid=args.evidence_closure_oid,
-        artifact_sha256=args.artifact_sha256,
-        approval_plan_id=args.approval_plan_id,
-        artifact_path=str(args.artifact),
-        artifact_size=args.artifact_size,
-        production_service=args.production_service,
-        production_port=args.production_port,
-        repository_identity=args.repository_identity,
-    )
-    try:
-        result = execute(
-            binding=binding,
-            authorization_path=args.authorization,
-            repository=args.repository,
-            state_root=args.state_root,
-            tag_command=parse_command(args.tag_adapter),
-            deploy_command=parse_command(args.deploy_adapter),
-            registry_command=parse_command(args.registry_adapter),
-            baseline_command=parse_command(args.baseline_adapter),
-        )
-        print(json.dumps(result, sort_keys=True))
-        return 0
-    except ManualOwnerReviewRequired as exc:
-        print(json.dumps({"status": "MANUAL_OWNER_REVIEW_REQUIRED", "reason": str(exc)}, sort_keys=True))
-        return 20
-    except ReconciliationRequired as exc:
-        print(json.dumps({"status": "RECONCILIATION_REQUIRED", "reason": str(exc)}, sort_keys=True))
-        return 21
-    except Exception as exc:
-        print(json.dumps({"status": "FAIL_CLOSED", "error": type(exc).__name__, "reason": str(exc)}, sort_keys=True))
-        return 22
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -1,355 +0,0 @@
-"""Fail-closed access to the authoritative bare Git repository."""
-from __future__ import annotations
-
-import os
-import re
-import subprocess
-import urllib.parse
-from pathlib import Path
-from typing import Iterable
-
-_ALLOWED_COMMANDS = frozenset(
-    {
-        "cat-file",
-        "config",
-        "diff",
-        "for-each-ref",
-        "ls-remote",
-        "merge-base",
-        "push",
-        "remote",
-        "rev-parse",
-        "show-ref",
-        "tag",
-    }
-)
-_OID_RE = re.compile(r"^[0-9a-f]{40}$")
-_MAX_OUTPUT = 1_048_576
-_TIMEOUT = 8.0
-
-
-class AuthoritativeGitError(RuntimeError):
-    """A fail-closed authoritative repository or ref query error."""
-
-
-class AuthoritativeGitNotFound(AuthoritativeGitError):
-    """A validated revision does not exist in the authoritative repository."""
-
-
-class AuthoritativeGitOutputTooLarge(AuthoritativeGitError):
-    """A controlled Git query exceeded the response-size boundary."""
-
-
-def _redact(text: str) -> str:
-    value = str(text or "")
-    value = re.sub(r"(?i)(authorization\s*[:=]\s*)(?:bearer|token)\s+\S+", r"\1REDACTED", value)
-    value = re.sub(r"(?i)((?:access_)?token\s*[:=]\s*)\S+", r"\1REDACTED", value)
-    value = re.sub(r"(?i)(https?://[^/\s:@]+:)[^@\s/]+@", r"\1REDACTED@", value)
-    return value
-
-
-def _configured_path(git_dir: str | Path | None = None) -> Path:
-    raw = str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
-    if not raw:
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
-    path = Path(raw)
-    if not path.is_absolute() or ".." in path.parts:
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
-    try:
-        resolved = path.resolve(strict=True)
-    except OSError as exc:
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE") from exc
-    if not resolved.is_dir():
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
-    return resolved
-
-
-def _run(
-    git_dir: Path,
-    args: list[str],
-    *,
-    check: bool,
-    timeout: float = _TIMEOUT,
-) -> subprocess.CompletedProcess[str]:
-    if not args or args[0] not in _ALLOWED_COMMANDS:
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-    try:
-        result = subprocess.run(
-            ["git", "--git-dir", str(git_dir), *args],
-            text=True,
-            capture_output=True,
-            timeout=timeout,
-            env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"},
-        )
-    except (OSError, subprocess.TimeoutExpired) as exc:
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED") from exc
-    if len(result.stdout) + len(result.stderr) > _MAX_OUTPUT:
-        raise AuthoritativeGitOutputTooLarge("GIT_OUTPUT_LIMIT_EXCEEDED")
-    if check and result.returncode != 0:
-        detail = _redact(result.stderr.strip() or result.stdout.strip())
-        raise AuthoritativeGitError(
-            "GIT_REF_QUERY_FAILED" + (f": {detail[:160]}" if detail else "")
-        )
-    return result
-
-
-def _repository_identity_from_remote(url: str) -> str:
-    value = str(url or "").strip().split("?", 1)[0].rstrip("/")
-    if not value:
-        return ""
-    if "://" in value:
-        value = urllib.parse.urlparse(value).path
-    elif ":" in value:
-        value = value.rsplit(":", 1)[1]
-    value = value.rsplit("@", 1)[-1].strip("/")
-    value = re.sub(r"\.git$", "", value, flags=re.IGNORECASE)
-    parts = [part for part in value.split("/") if part]
-    if len(parts) >= 2:
-        value = "/".join(parts[-2:])
-    return value.strip("/").lower()
-
-
-def verify_repository(
-    git_dir: str | Path | None = None,
-    repository_identity: str | None = None,
-) -> tuple[Path, str]:
-    path = _configured_path(git_dir)
-    expected = str(
-        repository_identity
-        or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
-    ).strip().strip("/")
-    if not expected or expected.count("/") != 1:
-        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
-    bare = _run(path, ["rev-parse", "--is-bare-repository"], check=True)
-    if bare.stdout.strip().lower() != "true":
-        raise AuthoritativeGitError("AUTHORITATIVE_REPOSITORY_UNAVAILABLE")
-    remote = _run(path, ["config", "--get", "remote.gitea.url"], check=False)
-    actual = _repository_identity_from_remote(remote.stdout)
-    if actual != expected.lower():
-        raise AuthoritativeGitError("REPOSITORY_IDENTITY_MISMATCH")
-    return path, expected
-
-
-def run_authoritative_git(
-    args: list[str],
-    *,
-    check: bool = True,
-    git_dir: str | Path | None = None,
-    timeout: float = _TIMEOUT,
-) -> subprocess.CompletedProcess[str]:
-    path, _ = verify_repository(git_dir=git_dir)
-    return _run(path, list(args), check=check, timeout=timeout)
-
-
-def authoritative_head_oid(
-    *,
-    git_dir: str | Path | None = None,
-) -> str:
-    result = run_authoritative_git(["rev-parse", "--verify", "refs/heads/main"], git_dir=git_dir)
-    oid = result.stdout.strip().lower()
-    if not _OID_RE.fullmatch(oid):
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-    return oid
-
-
-def authoritative_tags(
-    *,
-    git_dir: str | Path | None = None,
-) -> list[dict[str, str | None]]:
-    result = run_authoritative_git(
-        [
-            "for-each-ref",
-            "refs/tags",
-            "--format=%(refname:strip=2)\t%(objectname)\t%(objecttype)",
-        ],
-        git_dir=git_dir,
-    )
-    tags: list[dict[str, str | None]] = []
-    for line in result.stdout.splitlines():
-        name, oid, object_type = (line.split("\t", 2) + ["", ""])[:3]
-        if not name or not _OID_RE.fullmatch(oid.lower()):
-            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-        peeled_result = run_authoritative_git(
-            ["rev-parse", "--verify", f"refs/tags/{name}^{{commit}}"],
-            git_dir=git_dir,
-        )
-        peeled = peeled_result.stdout.strip().lower()
-        if not _OID_RE.fullmatch(peeled):
-            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-        tags.append(
-            {
-                "name": name,
-                "tag_oid": oid.lower(),
-                "object_type": object_type,
-                "peeled_target_oid": peeled,
-            }
-        )
-    return tags
-
-
-def authoritative_branches(
-    *,
-    git_dir: str | Path | None = None,
-) -> list[dict[str, str]]:
-    result = run_authoritative_git(
-        [
-            "for-each-ref",
-            "refs/heads",
-            "--format=%(refname:strip=2)\t%(objectname)",
-        ],
-        git_dir=git_dir,
-    )
-    branches: list[dict[str, str]] = []
-    for line in result.stdout.splitlines():
-        name, oid = (line.split("\t", 1) + [""])[:2]
-        if not name or not _OID_RE.fullmatch(oid.lower()):
-            raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-        branches.append({"name": name, "oid": oid.lower()})
-    return branches
-
-
-def authoritative_commit(
-    oid: str,
-    *,
-    git_dir: str | Path | None = None,
-) -> str:
-    value = str(oid or "").strip().lower()
-    if not _OID_RE.fullmatch(value):
-        raise ValueError("commit OID must be a full 40-character value")
-    result = run_authoritative_git(
-        ["rev-parse", "--verify", f"{value}^{{commit}}"],
-        git_dir=git_dir,
-    )
-    resolved = result.stdout.strip().lower()
-    if resolved != value:
-        raise AuthoritativeGitError("GIT_REF_QUERY_FAILED")
-    return resolved
-
-
-def authoritative_lineage(
-    ancestor: str,
-    descendant: str,
-    *,
-    git_dir: str | Path | None = None,
-) -> None:
-    authoritative_commit(ancestor, git_dir=git_dir)
-    authoritative_commit(descendant, git_dir=git_dir)
-    result = run_authoritative_git(
-        ["merge-base", "--is-ancestor", ancestor, descendant],
-        check=False,
-        git_dir=git_dir,
-    )
-    if result.returncode != 0:
-        raise AuthoritativeGitError("evidence lineage mismatch")
-
-
-_SAFE_REF_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,239}$")
-
-
-def _safe_ref_name(value: str) -> bool:
-    return bool(
-        _SAFE_REF_RE.fullmatch(value)
-        and ".." not in value
-        and "//" not in value
-        and "@{" not in value
-        and not value.endswith(("/", ".", ".lock"))
-        and not any(part in {"", ".", ".."} for part in value.split("/"))
-    )
-
-
-def validate_git_revision(
-    value: str,
-    field: str,
-    *,
-    git_dir: str | Path | None = None,
-) -> str:
-    revision = str(value or "").strip()
-    if not revision or revision != str(value or "") or revision.startswith("-"):
-        raise ValueError(f"invalid {field} revision")
-    if _OID_RE.fullmatch(revision.lower()):
-        try:
-            return authoritative_commit(revision.lower(), git_dir=git_dir)
-        except AuthoritativeGitError as exc:
-            raise AuthoritativeGitNotFound(f"{field} revision not found") from exc
-    if not _safe_ref_name(revision) or any(token in revision for token in ("^", "~", ":", "\\")):
-        raise ValueError(f"invalid {field} revision")
-    if revision.startswith("refs/"):
-        if not revision.startswith(("refs/heads/", "refs/tags/")):
-            raise ValueError(f"invalid {field} revision")
-        candidates = [revision]
-    else:
-        candidates = [f"refs/heads/{revision}", f"refs/tags/{revision}"]
-    matches: list[str] = []
-    for candidate in candidates:
-        result = run_authoritative_git(
-            ["rev-parse", "--verify", f"{candidate}^{{commit}}"],
-            check=False,
-            git_dir=git_dir,
-        )
-        oid = result.stdout.strip().lower()
-        if result.returncode == 0 and _OID_RE.fullmatch(oid):
-            matches.append(oid)
-    if not matches:
-        raise AuthoritativeGitNotFound(f"{field} revision not found")
-    if len(set(matches)) != 1 or len(matches) != 1:
-        raise ValueError(f"ambiguous {field} revision")
-    return matches[0]
-
-
-def authoritative_diff(
-    from_revision: str,
-    to_revision: str,
-    *,
-    git_dir: str | Path | None = None,
-) -> dict[str, object]:
-    path, _ = verify_repository(git_dir=git_dir)
-    from_oid = validate_git_revision(from_revision, "from", git_dir=path)
-    to_oid = validate_git_revision(to_revision, "to", git_dir=path)
-    args = ["diff", "--no-ext-diff", "--no-textconv", from_oid, to_oid]
-    result = run_authoritative_git(args, git_dir=path)
-    return {
-        "code": 0,
-        "stdout": result.stdout,
-        "stderr": "",
-        "cmd": ["git", f"--git-dir={path}", *args],
-        "from_oid": from_oid,
-        "to_oid": to_oid,
-    }
-
-
-def repository_snapshot(
-    *,
-    git_dir: str | Path | None = None,
-    repository_identity: str | None = None,
-) -> dict[str, object]:
-    configured = bool(
-        str(git_dir or os.getenv("AIOS_GITOPS_AUTHORITATIVE_GIT_DIR", "")).strip()
-    )
-    try:
-        path, identity = verify_repository(
-            git_dir=git_dir,
-            repository_identity=repository_identity,
-        )
-        head = authoritative_head_oid(git_dir=path)
-        return {
-            "repository_available": True,
-            "authoritative_git_dir_configured": configured,
-            "authoritative_git_dir_readable": True,
-            "authoritative_git_dir": str(path),
-            "authoritative_head_oid": head,
-            "repository_identity": identity,
-            "query_error": None,
-        }
-    except (AuthoritativeGitError, ValueError) as exc:
-        return {
-            "repository_available": False,
-            "authoritative_git_dir_configured": configured,
-            "authoritative_git_dir_readable": False,
-            "authoritative_git_dir": None,
-            "authoritative_head_oid": None,
-            "repository_identity": str(
-                repository_identity
-                or os.getenv("AIOS_GITOPS_REPOSITORY_IDENTITY", "")
-            ).strip() or None,
-            "query_error": _redact(str(exc)),
-        }
@@ -1,89 +0,0 @@
-"""Durable Owner/GPT notification outbox with retry and acknowledgement."""
-from __future__ import annotations
-
-import json
-import sqlite3
-import time
-import uuid
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Callable, Mapping
-
-
-@dataclass(frozen=True)
-class OutboxEvent:
-    event_id: str
-    recipient: str
-    kind: str
-    payload: Mapping[str, Any]
-    attempts: int
-    available_at: float
-    acknowledged: bool
-
-
-class DurableOutbox:
-    RECIPIENTS = ("owner", "gpt")
-
-    def __init__(self, path: str | Path) -> None:
-        self.path = str(path)
-        self.db = sqlite3.connect(self.path)
-        self.db.execute("PRAGMA journal_mode=WAL")
-        self.db.execute("CREATE TABLE IF NOT EXISTS outbox (event_id TEXT PRIMARY KEY, recipient TEXT NOT NULL, kind TEXT NOT NULL, payload TEXT NOT NULL, attempts INTEGER NOT NULL DEFAULT 0, available_at REAL NOT NULL, delivered_at REAL, acknowledged INTEGER NOT NULL DEFAULT 0, last_error TEXT)")
-        self.db.commit()
-
-    def enqueue(self, kind: str, payload: Mapping[str, Any], *, event_id: str | None = None, recipients: tuple[str, ...] = RECIPIENTS) -> list[str]:
-        ids: list[str] = []
-        for recipient in recipients:
-            if recipient not in self.RECIPIENTS:
-                raise ValueError("recipient is outside the governed notification plane")
-            eid = event_id or str(uuid.uuid4())
-            if event_id is not None and len(recipients) > 1:
-                eid = f"{event_id}:{recipient}"
-            self.db.execute("INSERT OR IGNORE INTO outbox(event_id,recipient,kind,payload,available_at) VALUES(?,?,?,?,?)", (eid, recipient, kind, json.dumps(dict(payload), sort_keys=True), time.time()))
-            ids.append(eid)
-        self.db.commit()
-        return ids
-
-    def due(self, *, now: float | None = None, limit: int = 20) -> list[OutboxEvent]:
-        now = time.time() if now is None else now
-        rows = self.db.execute("SELECT event_id,recipient,kind,payload,attempts,available_at,acknowledged FROM outbox WHERE delivered_at IS NULL AND available_at<=? ORDER BY available_at,event_id LIMIT ?", (now, limit)).fetchall()
-        return [OutboxEvent(r[0], r[1], r[2], json.loads(r[3]), r[4], r[5], bool(r[6])) for r in rows]
-
-    def delivered(self, event_id: str, *, now: float | None = None) -> None:
-        self.db.execute("UPDATE outbox SET delivered_at=? WHERE event_id=?", (time.time() if now is None else now, event_id))
-        self.db.commit()
-
-    def failed(self, event_id: str, error: str, *, now: float | None = None, max_backoff: float = 300.0) -> None:
-        now = time.time() if now is None else now
-        row = self.db.execute("SELECT attempts FROM outbox WHERE event_id=?", (event_id,)).fetchone()
-        attempts = int(row[0]) + 1 if row else 1
-        delay = min(max_backoff, 2 ** min(attempts, 8))
-        self.db.execute("UPDATE outbox SET attempts=?,available_at=?,last_error=? WHERE event_id=?", (attempts, now + delay, error[:200], event_id))
-        self.db.commit()
-
-    def acknowledge(self, event_id: str) -> None:
-        self.db.execute("UPDATE outbox SET acknowledged=1 WHERE event_id=?", (event_id,))
-        self.db.commit()
-
-    def close(self) -> None:
-        self.db.close()
-
-
-class NotificationPlane:
-    def __init__(self, outbox: DurableOutbox) -> None:
-        self.outbox = outbox
-
-    def emit(self, kind: str, payload: Mapping[str, Any], *, event_id: str | None = None) -> list[str]:
-        return self.outbox.enqueue(kind, payload, event_id=event_id)
-
-    def deliver_once(self, send: Callable[[OutboxEvent], None], *, now: float | None = None) -> list[str]:
-        delivered: list[str] = []
-        for event in self.outbox.due(now=now):
-            try:
-                send(event)
-            except Exception as exc:
-                self.outbox.failed(event.event_id, type(exc).__name__, now=now)
-            else:
-                self.outbox.delivered(event.event_id, now=now)
-                delivered.append(event.event_id)
-        return delivered
@@ -1,84 +0,0 @@
-#!/usr/bin/env python3
-"""Single canonical Production Baseline authority for the GitOps reader.
-
-The API and the one-shot writer import this module.  Workspace and release
-copies are projections only; they are never selected as a fallback source.
-"""
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-from pathlib import Path
-from typing import Any
-
-
-AUTHORITY_PATH = Path(os.getenv(
-    "AIOS_GITOPS_BASELINE_AUTHORITY",
-    "/var/lib/aios-gitops-runtime-anchor/baseline/current.json",
-))
-AUTHORITY_SHA_PATH = AUTHORITY_PATH.with_suffix(".sha256")
-
-
-class BaselineAuthorityError(RuntimeError):
-    """Fail-closed error raised for an unavailable or inconsistent authority."""
-
-
-class BaselineAuthority:
-    def __init__(self, path: Path | str = AUTHORITY_PATH):
-        self.path = Path(path)
-        self.sha_path = self.path.with_suffix(".sha256")
-
-    def _raw(self) -> bytes:
-        try:
-            raw = self.path.read_bytes()
-        except OSError as exc:
-            raise BaselineAuthorityError(f"authority_unavailable:{exc}") from exc
-        if not raw:
-            raise BaselineAuthorityError("authority_empty")
-        return raw
-
-    def read(self) -> dict[str, Any]:
-        raw = self._raw()
-        digest = hashlib.sha256(raw).hexdigest()
-        try:
-            value = json.loads(raw.decode("utf-8"))
-        except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-            raise BaselineAuthorityError("authority_invalid_json") from exc
-        if not isinstance(value, dict):
-            raise BaselineAuthorityError("authority_not_object")
-        expected = str(value.get("authority_sha256", ""))
-        if expected and expected != digest:
-            raise BaselineAuthorityError("authority_embedded_digest_mismatch")
-        if self.sha_path.exists():
-            sidecar = self.sha_path.read_text(encoding="utf-8").strip().split()[0]
-            if sidecar != digest:
-                raise BaselineAuthorityError("authority_sidecar_digest_mismatch")
-        required = {
-            "current_baseline", "previous_baseline", "target_oid", "tag_oid",
-            "evidence_closure_oid", "approval_plan_id", "status", "generation",
-            "source_identity",
-        }
-        missing = sorted(required.difference(value))
-        if missing:
-            raise BaselineAuthorityError("authority_missing:" + ",".join(missing))
-        value = dict(value)
-        value["authority_sha256"] = digest
-        value["authority_path"] = str(self.path)
-        return value
-
-    def read_consistent(self, policy: dict[str, Any] | None = None) -> dict[str, Any]:
-        value = self.read()
-        if policy:
-            expected = policy.get("release_binding", policy)
-            for key, field in (("version", "current_baseline"),
-                               ("previous_version", "previous_baseline"),
-                               ("target_oid", "target_oid"),
-                               ("tag_oid", "tag_oid"),
-                               ("evidence_closure_oid", "evidence_closure_oid"),
-                               ("approval_plan_id", "approval_plan_id")):
-                wanted = expected.get(key)
-                if wanted is not None and value.get(field) != wanted:
-                    raise BaselineAuthorityError(f"authority_binding_mismatch:{field}")
-        return value
-
@@ -1,491 +0,0 @@
-"""Fail-closed, branch-bound repair leases for governed AIOS GitOps work."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import posixpath
-import re
-import secrets
-import subprocess
-import tempfile
-import uuid
-from dataclasses import asdict, dataclass, field
-from datetime import datetime, timedelta, timezone
-from pathlib import Path
-from typing import Any, Iterable, Mapping, Protocol, Sequence
-
-
-TASK_ID = "V2R1C6_GOVERNED_LOCAL_BOOTSTRAP"
-MAX_LEASE_SECONDS = 86_400
-OID_RE = re.compile(r"^[0-9a-fA-F]{40}$")
-DENIED_BRANCHES = {"main", "master", "HEAD"}
-PROTECTED_PREFIXES = (
-    ".git",
-    "VERSION",
-    "versions/V2R1C5.json",
-    "artifacts/V2R1C5",
-    "baseline",
-    "config/gitops.tokens",
-    "gitops.tokens",
-    "secrets",
-    "credentials",
-)
-SECRET_PATTERNS = (
-    re.compile(r"(?i)-----BEGIN [A-Z ]*PRIVATE KEY-----"),
-    re.compile(r"(?i)(?:api[_-]?key|secret|password|token)\s*[:=]\s*\S+"),
-    re.compile(r"\b(?:sk|HPUA|SDC)-[A-Za-z0-9_-]{16,}\b"),
-)
-
-
-class LeaseError(Exception):
-    """Raised for any invalid, stale, expired, or prohibited lease action."""
-
-
-class GitProbeProtocol(Protocol):
-    """Read-only Git seam used by the lease manager."""
-
-    def branch_head(self, branch: str) -> str: ...
-
-    def parent(self, commit: str) -> str: ...
-
-    def is_ancestor(self, older: str, newer: str) -> bool: ...
-
-    def changed_paths(self, commit: str) -> tuple[str, ...]: ...
-
-    def commits_between(self, older: str, newer: str) -> tuple[str, ...]: ...
-
-
-def _now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def _ts(value: datetime) -> str:
-    return value.astimezone(timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
-
-
-def _parse_ts(value: str) -> datetime:
-    if value.endswith("Z"):
-        value = value[:-1] + "+00:00"
-    parsed = datetime.fromisoformat(value)
-    return parsed if parsed.tzinfo else parsed.replace(tzinfo=timezone.utc)
-
-
-def _oid(value: str, field: str = "oid") -> str:
-    if not isinstance(value, str) or not OID_RE.fullmatch(value):
-        raise LeaseError(f"{field} must be a full commit OID")
-    return value.lower()
-
-
-def normalize_path(path: str) -> str:
-    """Normalize a repository-relative path without resolving through the FS."""
-    if not isinstance(path, str) or not path.strip():
-        raise LeaseError("path must be a non-empty string")
-    value = path.replace("\\", "/").strip()
-    if value.startswith("/") or "\x00" in value:
-        raise LeaseError("path must be relative")
-    parts = value.split("/")
-    if any(part in {"", ".", ".."} for part in parts):
-        raise LeaseError("path contains a prohibited component")
-    normalized = posixpath.normpath(value)
-    if normalized == "." or normalized.startswith("../"):
-        raise LeaseError("path is not normalized")
-    return normalized
-
-
-def path_is_protected(path: str) -> bool:
-    normalized = normalize_path(path)
-    lower = normalized.lower()
-    return any(
-        lower == prefix.lower() or lower.startswith(prefix.lower().rstrip("/") + "/")
-        for prefix in PROTECTED_PREFIXES
-    ) or lower.startswith("refs/")
-
-
-def contains_secret_like_content(content: str) -> bool:
-    return any(pattern.search(content or "") for pattern in SECRET_PATTERNS)
-
-
-def validate_paths(paths: Iterable[str], allowed_paths: Sequence[str]) -> tuple[str, ...]:
-    allowed = tuple(normalize_path(path) for path in allowed_paths)
-    if not allowed:
-        raise LeaseError("allowed_paths must not be empty")
-    result: list[str] = []
-    for raw in paths:
-        path = normalize_path(raw)
-        if path_is_protected(path):
-            raise LeaseError("protected path is not lease-writable")
-        if not any(path == prefix or path.startswith(prefix + "/") for prefix in allowed):
-            raise LeaseError("path is outside the lease allowlist")
-        if path not in result:
-            result.append(path)
-    if not result:
-        raise LeaseError("at least one changed path is required")
-    return tuple(result)
-
-
-@dataclass
-class CommitEntry:
-    commit_oid: str
-    parent_oid: str
-    paths: tuple[str, ...]
-    recorded_at: str
-
-
-@dataclass
-class RepairLease:
-    lease_id: str
-    task_id: str
-    owner_identity: str
-    branch: str
-    description: str
-    allowed_paths: tuple[str, ...]
-    initial_head_oid: str
-    current_head_oid: str
-    created_at: str
-    expires_at: str
-    max_expires_at: str
-    state: str = "ACTIVE"
-    revision: int = 0
-    commits: list[CommitEntry] = field(default_factory=list)
-    attached: bool = False
-
-    def to_json(self) -> dict[str, Any]:
-        payload = asdict(self)
-        payload["allowed_paths"] = list(self.allowed_paths)
-        payload["commits"] = [asdict(entry) for entry in self.commits]
-        return payload
-
-    @classmethod
-    def from_json(cls, raw: dict[str, Any]) -> "RepairLease":
-        commits = tuple(
-            CommitEntry(
-                commit_oid=_oid(item["commit_oid"], "commit_oid"),
-                parent_oid=_oid(item["parent_oid"], "parent_oid"),
-                paths=tuple(normalize_path(path) for path in item["paths"]),
-                recorded_at=str(item["recorded_at"]),
-            )
-            for item in raw.get("commits", [])
-        )
-        return cls(
-            lease_id=str(raw["lease_id"]),
-            task_id=str(raw["task_id"]),
-            owner_identity=str(raw["owner_identity"]),
-            branch=str(raw["branch"]),
-            description=str(raw["description"]),
-            allowed_paths=tuple(normalize_path(path) for path in raw["allowed_paths"]),
-            initial_head_oid=_oid(raw["initial_head_oid"], "initial_head_oid"),
-            current_head_oid=_oid(raw["current_head_oid"], "current_head_oid"),
-            created_at=str(raw["created_at"]),
-            expires_at=str(raw["expires_at"]),
-            max_expires_at=str(raw["max_expires_at"]),
-            state=str(raw.get("state", "ACTIVE")),
-            revision=int(raw.get("revision", 0)),
-            commits=list(commits),
-            attached=bool(raw.get("attached", False)),
-        )
-
-
-class LeaseStore:
-    """Atomic JSON store for restart-recoverable lease state."""
-
-    def __init__(self, directory: str | os.PathLike[str]) -> None:
-        self.directory = Path(directory)
-        self.directory.mkdir(parents=True, exist_ok=True)
-        if self.directory.is_symlink():
-            raise LeaseError("lease store must not be a symlink")
-        os.chmod(self.directory, 0o700)
-
-    def _path(self, lease_id: str) -> Path:
-        if not re.fullmatch(r"lease-[0-9a-f]{32}", lease_id):
-            raise LeaseError("invalid lease id")
-        return self.directory / f"{lease_id}.json"
-
-    def create(self, lease: RepairLease) -> None:
-        path = self._path(lease.lease_id)
-        if path.exists() or path.is_symlink():
-            raise LeaseError("lease already exists")
-        self._write(path, lease.to_json(), exclusive=True)
-
-    def load(self, lease_id: str) -> RepairLease:
-        path = self._path(lease_id)
-        try:
-            raw = json.loads(path.read_text(encoding="utf-8"))
-        except (OSError, json.JSONDecodeError, TypeError) as exc:
-            raise LeaseError("lease state is unavailable or invalid") from exc
-        if not isinstance(raw, dict):
-            raise LeaseError("lease state must be an object")
-        return RepairLease.from_json(raw)
-
-    def save(self, lease: RepairLease) -> None:
-        self._write(self._path(lease.lease_id), lease.to_json())
-
-    @staticmethod
-    def _write(path: Path, payload: dict[str, Any], *, exclusive: bool = False) -> None:
-        flags = os.O_WRONLY | os.O_CREAT | (os.O_EXCL if exclusive else 0)
-        fd, temp_name = tempfile.mkstemp(prefix=".lease-", dir=path.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, "w", encoding="utf-8") as stream:
-                json.dump(payload, stream, ensure_ascii=True, sort_keys=True, separators=(",", ":"))
-                stream.write("\n")
-            if exclusive:
-                os.link(temp_name, path)
-                os.unlink(temp_name)
-            else:
-                os.replace(temp_name, path)
-            os.chmod(path, 0o600)
-        except Exception:
-            try:
-                os.unlink(temp_name)
-            except FileNotFoundError:
-                pass
-            raise
-
-
-class GitProbe:
-    """Read-only Git implementation; it never changes a ref or working tree."""
-
-    def __init__(self, bare_repo: str | os.PathLike[str]) -> None:
-        self.bare_repo = Path(bare_repo)
-
-    def _run(self, args: list[str]) -> str:
-        result = subprocess.run(
-            ["git", "--git-dir", str(self.bare_repo), *args],
-            text=True,
-            capture_output=True,
-            check=False,
-        )
-        if result.returncode != 0:
-            raise LeaseError("read-only Git probe failed")
-        return result.stdout.strip()
-
-    def branch_head(self, branch: str) -> str:
-        return _oid(self._run(["rev-parse", f"refs/heads/{branch}"]), "branch_head")
-
-    def parent(self, commit: str) -> str:
-        return _oid(self._run(["rev-parse", f"{_oid(commit)}^1"]), "parent")
-
-    def is_ancestor(self, older: str, newer: str) -> bool:
-        old, new = _oid(older), _oid(newer)
-        result = subprocess.run(
-            ["git", "--git-dir", str(self.bare_repo), "merge-base", "--is-ancestor", old, new],
-            check=False,
-        )
-        return result.returncode == 0
-
-    def changed_paths(self, commit: str) -> tuple[str, ...]:
-        raw = self._run(["diff-tree", "--no-commit-id", "--name-only", "-r", _oid(commit)])
-        return tuple(normalize_path(line) for line in raw.splitlines() if line.strip())
-
-    def commits_between(self, older: str, newer: str) -> tuple[str, ...]:
-        raw = self._run(["rev-list", "--reverse", f"{_oid(older)}..{_oid(newer)}"])
-        return tuple(_oid(line, "commit") for line in raw.splitlines() if line.strip())
-
-
-class RepairLeaseManager:
-    """Issue, recover, renew, and close branch-bound repair leases."""
-
-    def __init__(self, store: LeaseStore, git: GitProbeProtocol, *, clock=_now) -> None:
-        self.store = store
-        self.git = git
-        self.clock = clock
-
-    def _require_owner(self, lease: RepairLease, owner_identity: str) -> None:
-        if owner_identity != lease.owner_identity:
-            raise LeaseError("lease identity mismatch")
-
-    def _active(self, lease: RepairLease) -> RepairLease:
-        now = self.clock()
-        if lease.state != "ACTIVE":
-            raise LeaseError(f"lease is {lease.state.lower()}")
-        if now >= _parse_ts(lease.expires_at):
-            lease.state = "EXPIRED"
-            self.store.save(lease)
-            raise LeaseError("lease expired")
-        return lease
-
-    def issue(
-        self,
-        *,
-        task_id: str,
-        owner_identity: str,
-        branch: str,
-        description: str,
-        allowed_paths: Sequence[str],
-        ttl_seconds: int = 3600,
-    ) -> RepairLease:
-        if task_id != TASK_ID:
-            raise LeaseError("unexpected task id")
-        if not owner_identity or not description or len(description) > 240:
-            raise LeaseError("owner identity and description are required")
-        if "\n" in description or "\r" in description:
-            raise LeaseError("description must be a single line")
-        if branch in DENIED_BRANCHES or branch.startswith(("main/", "refs/", "tags/")):
-            raise LeaseError("protected branch cannot receive a repair lease")
-        if not isinstance(ttl_seconds, int) or not 0 < ttl_seconds <= MAX_LEASE_SECONDS:
-            raise LeaseError("lease TTL exceeds the maximum")
-        allowed = tuple(normalize_path(path) for path in allowed_paths)
-        if any(path_is_protected(path) for path in allowed):
-            raise LeaseError("protected path in lease allowlist")
-        head = self.git.branch_head(branch)
-        created = self.clock()
-        expires = created + timedelta(seconds=ttl_seconds)
-        max_expires = created + timedelta(seconds=MAX_LEASE_SECONDS)
-        lease_id = "lease-" + secrets.token_hex(16)
-        lease = RepairLease(
-            lease_id=lease_id,
-            task_id=task_id,
-            owner_identity=owner_identity,
-            branch=branch,
-            description=description,
-            allowed_paths=allowed,
-            initial_head_oid=head,
-            current_head_oid=head,
-            created_at=_ts(created),
-            expires_at=_ts(expires),
-            max_expires_at=_ts(max_expires),
-        )
-        self.store.create(lease)
-        return lease
-
-    def attach_existing_branch(
-        self, lease_id: str, *, owner_identity: str, expected_head_oid: str
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        current = self.git.branch_head(lease.branch)
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        if current != expected or current != lease.current_head_oid:
-            raise LeaseError("branch head does not match the lease")
-        lease.attached = True
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def authorize_commit(
-        self,
-        lease_id: str,
-        *,
-        owner_identity: str,
-        expected_head_oid: str,
-        paths: Sequence[str],
-        content: Mapping[str, str] | None = None,
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        current = self.git.branch_head(lease.branch)
-        if current != expected or current != lease.current_head_oid:
-            raise LeaseError("stale or externally advanced branch head")
-        if not lease.attached:
-            raise LeaseError("lease is not attached")
-        validate_paths(paths, lease.allowed_paths)
-        if content and any(contains_secret_like_content(value) for value in content.values()):
-            raise LeaseError("secret-like content rejected")
-        return lease
-
-    def record_commit(
-        self,
-        lease_id: str,
-        *,
-        owner_identity: str,
-        expected_head_oid: str,
-        new_head_oid: str,
-        paths: Sequence[str],
-    ) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        new_head = _oid(new_head_oid, "new_head_oid")
-        expected = _oid(expected_head_oid, "expected_head_oid")
-        if not lease.attached or lease.current_head_oid != expected:
-            raise LeaseError("stale lease head")
-        if self.git.branch_head(lease.branch) != new_head:
-            raise LeaseError("branch head does not match committed head")
-        validate_paths(paths, lease.allowed_paths)
-        if self.git.parent(new_head) != expected or not self.git.is_ancestor(expected, new_head):
-            raise LeaseError("commit is not a fast-forward child of the expected head")
-        actual_paths = self.git.changed_paths(new_head)
-        allowed = validate_paths(actual_paths, lease.allowed_paths)
-        requested = set(validate_paths(paths, lease.allowed_paths))
-        if not set(allowed).issubset(requested):
-            raise LeaseError("commit changed an unrequested path")
-        lease.current_head_oid = new_head
-        lease.revision += 1
-        lease.commits.append(
-            CommitEntry(
-                commit_oid=new_head,
-                parent_oid=expected,
-                paths=allowed,
-                recorded_at=_ts(self.clock()),
-            )
-        )
-        self.store.save(lease)
-        return lease
-
-    def recover(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        current = self.git.branch_head(lease.branch)
-        if current == lease.current_head_oid:
-            return lease
-        if not self.git.is_ancestor(lease.current_head_oid, current):
-            raise LeaseError("branch moved non-fast-forward")
-        commits = self.git.commits_between(lease.current_head_oid, current)
-        for commit in commits:
-            actual = self.git.changed_paths(commit)
-            validate_paths(actual, lease.allowed_paths)
-        lease.current_head_oid = current
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def renew(self, lease_id: str, *, owner_identity: str, ttl_seconds: int) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        if not isinstance(ttl_seconds, int) or ttl_seconds <= 0:
-            raise LeaseError("renewal TTL must be positive")
-        candidate = self.clock() + timedelta(seconds=ttl_seconds)
-        maximum = _parse_ts(lease.max_expires_at)
-        if candidate > maximum:
-            raise LeaseError("renewal exceeds maximum lease lifetime")
-        lease.expires_at = _ts(candidate)
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def complete(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        lease.state = "COMPLETED"
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-    def revoke(self, lease_id: str, *, owner_identity: str) -> RepairLease:
-        lease = self._active(self.store.load(lease_id))
-        self._require_owner(lease, owner_identity)
-        lease.state = "REVOKED"
-        lease.revision += 1
-        self.store.save(lease)
-        return lease
-
-
-def sanitized_lease_view(lease: RepairLease) -> dict[str, Any]:
-    """Return lease metadata only; no content, token, or credential values."""
-    return {
-        "lease_id": lease.lease_id,
-        "task_id": lease.task_id,
-        "owner_identity": lease.owner_identity,
-        "branch": lease.branch,
-        "description": lease.description,
-        "initial_head_oid": lease.initial_head_oid,
-        "current_head_oid": lease.current_head_oid,
-        "created_at": lease.created_at,
-        "expires_at": lease.expires_at,
-        "state": lease.state,
-        "revision": lease.revision,
-        "commit_count": len(lease.commits),
-        "attached": lease.attached,
-    }
@@ -1,108 +0,0 @@
-"""Atomic, predicate-bound activation of the durable release campaign."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import tempfile
-from typing import Any, Mapping
-
-from release_campaign_authorization import CampaignError, validate_policy
-
-OID_RE = re.compile(r"^[0-9a-f]{40}$")
-CAMPAIGN_ID = "AIOS-AUTONOMOUS-RELEASE-CAMPAIGN-20260807"
-
-
-class CampaignActivationError(CampaignError):
-    pass
-
-
-def canonical_json(value: Any) -> bytes:
-    return (json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n").encode("utf-8")
-
-
-def digest_bytes(value: bytes) -> str:
-    return hashlib.sha256(value).hexdigest()
-
-
-def build_active_policy(current: Mapping[str, Any], facts: Mapping[str, Any]) -> dict[str, Any]:
-    policy = validate_policy(dict(current))
-    required = {
-        "campaign_id",
-        "repository",
-        "source_main_oid",
-        "gitea_main_oid",
-        "authority_main_oid",
-        "runtime_source_oid",
-        "durable_job_state",
-        "writer_ready",
-        "gitea_machine_authenticated",
-        "governance_executor_ready",
-        "preapproval_publisher_ready",
-        "runtime_exact_main",
-        "main_lineage_verified",
-        "campaign_revoked",
-    }
-    if set(facts) != required:
-        raise CampaignActivationError("ACTIVATION_FACTS_SCHEMA_INVALID")
-    if policy["activation_state"] != "PENDING_CONTROL_PLANE_MERGE" or policy["active"] is not False:
-        raise CampaignActivationError("CAMPAIGN_NOT_PENDING")
-    if policy["campaign_id"] != CAMPAIGN_ID or facts["campaign_id"] != CAMPAIGN_ID:
-        raise CampaignActivationError("CAMPAIGN_ID_MISMATCH")
-    if facts["repository"] != "aios/aios" or policy["repository"] != facts["repository"]:
-        raise CampaignActivationError("REPOSITORY_MISMATCH")
-    for name in ("source_main_oid", "gitea_main_oid", "authority_main_oid", "runtime_source_oid"):
-        if not isinstance(facts[name], str) or not OID_RE.fullmatch(facts[name]):
-            raise CampaignActivationError("ACTIVATION_OID_INVALID")
-    if not (
-        facts["source_main_oid"]
-        == facts["gitea_main_oid"]
-        == facts["authority_main_oid"]
-        == facts["runtime_source_oid"]
-    ):
-        raise CampaignActivationError("ACTIVATION_MAIN_DIVERGENCE")
-    if facts["durable_job_state"] != "COMPLETED":
-        raise CampaignActivationError("DURABLE_JOB_NOT_COMPLETED")
-    boolean_fields = (
-        "writer_ready",
-        "gitea_machine_authenticated",
-        "governance_executor_ready",
-        "preapproval_publisher_ready",
-        "runtime_exact_main",
-        "main_lineage_verified",
-    )
-    if any(facts[name] is not True for name in boolean_fields) or facts["campaign_revoked"] is not False:
-        raise CampaignActivationError("ACTIVATION_PREDICATE_FAILED")
-    activated = dict(policy)
-    activated["activation_state"] = "ACTIVE"
-    activated["active"] = True
-    return validate_policy(activated)
-
-
-def atomic_write_policy(path: Path, sidecar: Path, receipt_path: Path, policy: Mapping[str, Any], receipt: Mapping[str, Any]) -> str:
-    if path.is_symlink() or sidecar.is_symlink() or receipt_path.exists() or receipt_path.is_symlink():
-        raise CampaignActivationError("ACTIVATION_PATH_INVALID")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    raw = canonical_json(dict(policy))
-    digest = digest_bytes(raw)
-    for target, data, mode in (
-        (path, raw, "wb"),
-        (sidecar, f"{digest}  {path.name}\n".encode("ascii"), "wb"),
-        (receipt_path, canonical_json(dict(receipt)), "wb"),
-    ):
-        fd, temporary = tempfile.mkstemp(prefix=f".{target.name}.", dir=target.parent)
-        try:
-            os.fchmod(fd, 0o600)
-            with os.fdopen(fd, mode) as stream:
-                stream.write(data)
-                stream.flush()
-                os.fsync(stream.fileno())
-            os.replace(temporary, target)
-            os.chmod(target, 0o600)
-        finally:
-            if os.path.exists(temporary):
-                os.unlink(temporary)
-    return digest
@@ -1,106 +0,0 @@
-#!/usr/bin/env python3
-"""Machine campaign approval gate for protected engineering PRs."""
-from __future__ import annotations
-
-import argparse
-import json
-from pathlib import Path
-import subprocess
-from typing import Any, Mapping
-
-from release_campaign_authorization import CampaignAuthorization, CampaignError
-
-
-class GateError(RuntimeError):
-    pass
-
-
-def git_is_ancestor(repository: Path, ancestor: str, descendant: str) -> bool:
-    result = subprocess.run(
-        [
-            "git",
-            f"--git-dir={repository}",
-            "merge-base",
-            "--is-ancestor",
-            ancestor,
-            descendant,
-        ],
-        check=False,
-        capture_output=True,
-    )
-    if result.returncode == 0:
-        return True
-    if result.returncode == 1:
-        return False
-    raise GateError("git_ancestor_check_failed")
-
-
-def evaluate(
-    campaign: CampaignAuthorization,
-    facts: Mapping[str, Any],
-    repository: Path,
-) -> dict[str, Any]:
-    required = {
-        "repository",
-        "pr_number",
-        "base_ref",
-        "base_oid",
-        "head_oid",
-        "required_checks_all_success",
-        "required_checks_same_head",
-        "unresolved_conversations",
-        "mergeable",
-        "protected_target",
-    }
-    if set(facts) != required:
-        raise GateError("pr_facts_fields_invalid")
-    if facts["repository"] != "aios/aios":
-        raise GateError("repository_mismatch")
-    if facts["base_ref"] != "refs/heads/main" or facts["protected_target"] != "main":
-        raise GateError("protected_main_required")
-    if facts["required_checks_all_success"] is not True:
-        raise GateError("required_checks_not_success")
-    if facts["required_checks_same_head"] is not True:
-        raise GateError("required_checks_stale")
-    if facts["unresolved_conversations"] != 0:
-        raise GateError("unresolved_conversations")
-    if facts["mergeable"] is not True:
-        raise GateError("pr_not_mergeable")
-    if not git_is_ancestor(repository, campaign.anchor_oid, str(facts["base_oid"])):
-        raise GateError("base_outside_campaign_lineage")
-    if not git_is_ancestor(repository, str(facts["base_oid"]), str(facts["head_oid"])):
-        raise GateError("head_outside_pr_lineage")
-    campaign.assert_operation("protected_merge")
-    return {
-        "schema": "aios.campaign-approval-gate-result.v1",
-        "status": "SUCCESS",
-        "campaign_id": campaign.campaign_id,
-        "pr_number": facts["pr_number"],
-        "head_oid": facts["head_oid"],
-        "owner_ui_interaction_required": False,
-    }
-
-
-def main() -> int:
-    p = argparse.ArgumentParser()
-    p.add_argument("--campaign", type=Path, required=True)
-    p.add_argument("--revocation", type=Path)
-    p.add_argument("--pr-facts", type=Path, required=True)
-    p.add_argument("--repository", type=Path, required=True)
-    a = p.parse_args()
-    campaign = CampaignAuthorization.load(
-        a.campaign,
-        revocation=a.revocation,
-        require_active=True,
-    )
-    facts = json.loads(a.pr_facts.read_text(encoding="utf-8"))
-    print(json.dumps(evaluate(campaign, facts, a.repository), sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(main())
-    except (CampaignError, GateError) as exc:
-        print(json.dumps({"status": "FAILURE", "reason": str(exc)}, sort_keys=True))
-        raise SystemExit(2)
@@ -1,150 +0,0 @@
-#!/usr/bin/env python3
-"""Automatically accept an exact release binding under an ACTIVE campaign."""
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-import os
-from pathlib import Path
-import stat
-import tempfile
-from typing import Any, Mapping
-
-from release_campaign_authorization import CampaignAuthorization, CampaignError
-
-
-class AcceptanceError(RuntimeError):
-    pass
-
-
-def secure_json(path: Path) -> dict[str, Any]:
-    if path.is_symlink() or not path.is_file():
-        raise AcceptanceError(f"invalid_file:{path}")
-    st = path.lstat()
-    if st.st_uid != 0 or stat.S_IMODE(st.st_mode) & 0o022:
-        raise AcceptanceError(f"unsafe_file:{path}")
-    value = json.loads(path.read_text(encoding="utf-8"))
-    if not isinstance(value, dict):
-        raise AcceptanceError(f"json_object_required:{path}")
-    return value
-
-
-def atomic_new(path: Path, value: Mapping[str, Any]) -> None:
-    if path.exists() or path.is_symlink():
-        raise AcceptanceError("acceptance_receipt_exists")
-    path.parent.mkdir(parents=True, exist_ok=True)
-    fd, name = tempfile.mkstemp(prefix=f".{path.name}.", dir=path.parent)
-    try:
-        os.fchmod(fd, 0o600)
-        if os.geteuid() == 0:
-            os.fchown(fd, 0, 0)
-        with os.fdopen(fd, "w", encoding="utf-8", closefd=True) as stream:
-            json.dump(dict(value), stream, sort_keys=True, indent=2)
-            stream.write("\n")
-            stream.flush()
-            os.fsync(stream.fileno())
-        os.replace(name, path)
-        os.chmod(path, 0o600)
-    finally:
-        try:
-            os.unlink(name)
-        except FileNotFoundError:
-            pass
-
-
-def evaluate(
-    campaign: CampaignAuthorization,
-    binding: Mapping[str, Any],
-    evidence: Mapping[str, Any],
-    artifact: Mapping[str, Any],
-    staging: Mapping[str, Any],
-    main: Mapping[str, Any],
-    tag: Mapping[str, Any],
-) -> dict[str, Any]:
-    required_binding = {
-        "version",
-        "target_oid",
-        "evidence_closure_oid",
-        "artifact_sha256",
-        "artifact_size",
-        "approval_plan_id",
-    }
-    if set(binding) != required_binding:
-        raise AcceptanceError("binding_fields_invalid")
-    if main.get("repository") != "aios/aios":
-        raise AcceptanceError("repository_identity_mismatch")
-    if main.get("target_in_main_lineage") is not True:
-        raise AcceptanceError("target_outside_main_lineage")
-    if evidence.get("object_type") != "commit":
-        raise AcceptanceError("evidence_not_commit")
-    if evidence.get("target_is_ancestor") is not True:
-        raise AcceptanceError("target_not_evidence_ancestor")
-    if evidence.get("closure_oid") != binding["evidence_closure_oid"]:
-        raise AcceptanceError("evidence_oid_mismatch")
-    if artifact.get("sha256") != binding["artifact_sha256"]:
-        raise AcceptanceError("artifact_digest_mismatch")
-    if artifact.get("size") != binding["artifact_size"]:
-        raise AcceptanceError("artifact_size_mismatch")
-    if artifact.get("retained") is not True:
-        raise AcceptanceError("artifact_not_retained")
-    if staging.get("install") != "PASS":
-        raise AcceptanceError("staging_install_failed")
-    if staging.get("health") != "PASS":
-        raise AcceptanceError("staging_health_failed")
-    if staging.get("restart") != "PASS":
-        raise AcceptanceError("staging_restart_failed")
-    if staging.get("rollback_readiness") != "PASS":
-        raise AcceptanceError("rollback_readiness_failed")
-    if tag.get("conflict") is not False:
-        raise AcceptanceError("tag_conflict")
-    campaign.assert_operation("derive_campaign_acceptance")
-    return {
-        "schema": "aios.campaign-release-acceptance.v1",
-        "accepted": True,
-        "binding_replaced": False,
-        "campaign_id": campaign.campaign_id,
-        "campaign_generation": campaign.data["generation"],
-        **dict(binding),
-        "owner_interaction_required": False,
-    }
-
-
-def main() -> int:
-    p = argparse.ArgumentParser()
-    p.add_argument("--campaign", type=Path, required=True)
-    p.add_argument("--revocation", type=Path)
-    p.add_argument("--binding", type=Path, required=True)
-    p.add_argument("--evidence", type=Path, required=True)
-    p.add_argument("--artifact", type=Path, required=True)
-    p.add_argument("--staging", type=Path, required=True)
-    p.add_argument("--main-facts", type=Path, required=True)
-    p.add_argument("--tag-facts", type=Path, required=True)
-    p.add_argument("--output", type=Path, required=True)
-    a = p.parse_args()
-
-    campaign = CampaignAuthorization.load(
-        a.campaign,
-        revocation=a.revocation,
-        require_active=True,
-    )
-    receipt = evaluate(
-        campaign,
-        secure_json(a.binding),
-        secure_json(a.evidence),
-        secure_json(a.artifact),
-        secure_json(a.staging),
-        secure_json(a.main_facts),
-        secure_json(a.tag_facts),
-    )
-    atomic_new(a.output, receipt)
-    print(json.dumps(receipt, sort_keys=True))
-    return 0
-
-
-if __name__ == "__main__":
-    try:
-        raise SystemExit(main())
-    except (CampaignError, AcceptanceError) as exc:
-        print(json.dumps({"status": "BLOCKED", "reason": str(exc)}, sort_keys=True))
-        raise SystemExit(2)
@@ -1,67 +0,0 @@
-"""Runtime deployment-state provider for governed health contracts."""
-from __future__ import annotations
-
-import datetime as dt
-import json
-import os
-import re
-from dataclasses import dataclass
-from pathlib import Path
-from typing import Any, Mapping
-
-_OID = re.compile(r"^[0-9a-f]{40}$")
-_SHA = re.compile(r"^[0-9a-f]{64}$")
-_STATES = {"STAGED", "ACTIVE", "ROLLED_BACK"}
-
-@dataclass(frozen=True)
-class RuntimeDeploymentState:
-    version: str
-    commit_oid: str
-    artifact_sha256: str
-    deployment_state: str
-
-    @property
-    def production_deployed(self) -> bool:
-        return self.deployment_state == "ACTIVE"
-
-    def health_payload(self) -> dict[str, Any]:
-        return {
-            "status": "ok",
-            "version": self.version,
-            "commit_oid": self.commit_oid,
-            "artifact_sha256": self.artifact_sha256,
-            "deployment_state": self.deployment_state,
-            "production_deployed": self.production_deployed,
-            "health_timestamp": dt.datetime.now(dt.timezone.utc).isoformat(),
-        }
-
-    @classmethod
-    def from_environment(cls, environ: Mapping[str, str] | None = None) -> "RuntimeDeploymentState":
-        env = dict(environ or os.environ)
-        values: dict[str, Any] = {}
-        state_file = env.get("DEPLOYMENT_STATE_FILE", "").strip()
-        if state_file:
-            path = Path(state_file)
-            if path.is_file() and not path.is_symlink():
-                loaded = json.loads(path.read_text(encoding="utf-8"))
-                if not isinstance(loaded, dict):
-                    raise ValueError("deployment_state_file_object_required")
-                values.update(loaded)
-        file_deployment_state = values.get("deployment_state")
-        values.update({k: v for k, v in {
-            "version": env.get("RELEASE_VERSION", values.get("version", "")),
-            "commit_oid": env.get("TARGET_OID", values.get("commit_oid", "")),
-            "artifact_sha256": env.get("ARTIFACT_SHA256", values.get("artifact_sha256", "")),
-            "deployment_state": env.get("DEPLOYMENT_STATE", values.get("deployment_state", "")),
-        }.items() if v != ""})
-        if file_deployment_state not in (None, ""):
-            values["deployment_state"] = file_deployment_state
-        version = str(values.get("version", ""))
-        commit_oid = str(values.get("commit_oid", ""))
-        artifact_sha256 = str(values.get("artifact_sha256", ""))
-        deployment_state = str(values.get("deployment_state", ""))
-        if not version or not _OID.fullmatch(commit_oid) or not _SHA.fullmatch(artifact_sha256):
-            raise ValueError("deployment_binding_invalid")
-        if deployment_state not in _STATES:
-            raise ValueError("deployment_state_invalid")
-        return cls(version, commit_oid, artifact_sha256, deployment_state)
@@ -1 +0,0 @@
-"""Permanent AIOS governance source components."""
@@ -1,75 +0,0 @@
-#!/usr/bin/env python3
-import json
-import pathlib
-import socket
-import time
-
-SOCKET = '/run/aios-governance-executor/executor.sock'
-STATE = pathlib.Path('/var/lib/aios-gitops/governance-executor/drift-monitor.json')
-APPROVED = pathlib.Path('/var/lib/aios-gitops/runtime/tasks/AIOS-PROTECTION-SNAPSHOT-DRIFT-FORENSICS-V1/protection-drift/semantic-analysis.json')
-
-
-def call():
-    sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    sock.settimeout(20)
-    sock.connect(SOCKET)
-    request = {'operation': 'GET_BRANCH_PROTECTION', 'payload': {'repository': 'aios/aios', 'branch': 'main'}}
-    sock.sendall((json.dumps(request, separators=(',', ':')) + '\n').encode())
-    chunks = []
-    while True:
-        part = sock.recv(1024 * 1024)
-        if not part:
-            break
-        chunks.append(part)
-        if b'\n' in part:
-            break
-    sock.close()
-    return json.loads(b''.join(chunks).splitlines()[0])
-
-
-def main():
-    try:
-        result = call()
-        if result.get('status') != 'PASS':
-            raise RuntimeError(str(result.get('code') or 'EXECUTOR_GET_FAILED'))
-        approved = json.loads(APPROVED.read_text(encoding='utf-8'))
-        approved_transport = approved['approved_transport_digest_from_evidence']
-        approved_semantic = approved['approved_semantic_digest']
-        transport = result['transport_digest']
-        semantic = result['semantic_digest']
-        if semantic != approved_semantic:
-            state = 'GOVERNANCE_POLICY_DRIFT'
-        elif transport != approved_transport:
-            state = 'GOVERNANCE_TRANSPORT_METADATA_CHANGED'
-        else:
-            state = 'NO_DRIFT'
-        payload = {
-            'schema': 'aios.governance-drift-monitor.v1',
-            'observed_at_unix': int(time.time()),
-            'status': state,
-            'release_blocking': False,
-            'approved_transport_digest': approved_transport,
-            'observed_transport_digest': transport,
-            'approved_semantic_digest': approved_semantic,
-            'observed_semantic_digest': semantic,
-            'semantic_schema': result.get('semantic_schema'),
-            'source': 'Dedicated Governance Executor GET_BRANCH_PROTECTION',
-        }
-    except Exception as exc:
-        payload = {
-            'schema': 'aios.governance-drift-monitor.v1',
-            'observed_at_unix': int(time.time()),
-            'status': 'MONITOR_UNAVAILABLE',
-            'release_blocking': False,
-            'error_code': str(exc),
-        }
-    STATE.parent.mkdir(parents=True, exist_ok=True)
-    temporary = STATE.with_suffix('.tmp')
-    temporary.write_text(json.dumps(payload, sort_keys=True, separators=(',', ':'), ensure_ascii=False) + '\n', encoding='utf-8')
-    temporary.replace(STATE)
-    STATE.chmod(0o640)
-    print(json.dumps(payload, sort_keys=True, separators=(',', ':'), ensure_ascii=False))
-
-
-if __name__ == '__main__':
-    main()
@@ -1,417 +0,0 @@
-#!/usr/bin/env python3
-import base64
-import copy
-import hashlib
-import json
-import os
-import pathlib
-import socket
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-
-SOURCE_GOVERNANCE = "/opt/aios/aios-control-plane/current/active-runtime/app/governance"
-if SOURCE_GOVERNANCE not in __import__("sys").path:
-    __import__("sys").path.insert(0, SOURCE_GOVERNANCE)
-from stage2_gate_migration import (
-    CAMPAIGN_GATE,
-    CAMPAIGN_ID,
-    OWNER_GATE,
-    STAGE1_SEMANTIC_SHA,
-    Stage2GateError,
-    build_target,
-    semantic_digest as stage2_semantic_digest,
-    validate_stage2_facts,
-)
-
-API = "http://127.0.0.1:3000"
-REPO = "aios/aios"
-SOCKET = "/run/aios-governance-executor/executor.sock"
-JOURNAL = pathlib.Path("/var/lib/aios-gitops/governance-executor/executor-journal.jsonl")
-RECONCILIATION_BINDING_PATH = pathlib.Path("/var/lib/aios-gitops/governance-executor/reconciliation-binding.json")
-PR54_HEAD = "015185d7e5191d18c5c1596160807ac228782a0a"
-PR54_REVIEW = 104
-PR54_MANIFEST_SHA = "1b11ee42d53a9f6c1646e5f5ddd8ce5b7ecf301483b9f3d47a068290d541ba4b"
-PR54_PREVIOUS_PROTECTION_SHA = "8b3370add21cd23c2b4f41d8d84d3eaaa09ddf0451549b72c7941bbd92d5d60a"
-SEMANTIC_SCHEMA = "aios.semantic-protection.v1"
-APPROVED_SEMANTIC_SHA = "ba15d512ed8c1f43e5f72c84125a3a71a7347ef59e18000bbfca24d6e69f1b19"
-STAGE1_SEMANTIC_SHA = "d911e856f71de6105b8efa08e13338a448e0b6d37536332decd80c9f409ecf27"
-USER_IDS = {"owner": 2, "aios-autonomy-agent": 153}
-
-
-def canon(value):
-    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
-
-
-def sha(value):
-    return hashlib.sha256(canon(value)).hexdigest()
-
-
-def token():
-    value = (pathlib.Path(os.environ["CREDENTIALS_DIRECTORY"]) / "gitea-governance-executor-token").read_text().strip()
-    if len(value) < 16:
-        raise RuntimeError("EXECUTOR_CREDENTIAL_INVALID")
-    return value
-
-
-def api(method, path, value, body=None, expected=(200,)):
-    raw = None if body is None else json.dumps(body, separators=(",", ":")).encode()
-    req = urllib.request.Request(API + path, data=raw, method=method)
-    req.add_header("Authorization", "token " + value)
-    req.add_header("Accept", "application/json")
-    if raw is not None:
-        req.add_header("Content-Type", "application/json")
-    try:
-        with urllib.request.urlopen(req, timeout=20) as response:
-            status = response.status
-            payload = response.read()
-    except urllib.error.HTTPError as exc:
-        if exc.code in expected:
-            payload = exc.read()
-            return exc.code, json.loads(payload) if payload else None
-        raise RuntimeError("GITEA_HTTP_" + str(exc.code))
-    if status not in expected:
-        raise RuntimeError("GITEA_HTTP_" + str(status))
-    if not payload or not payload.strip():
-        raise RuntimeError("GITEA_EMPTY_JSON:" + path)
-    try:
-        decoded = json.loads(payload)
-    except (UnicodeDecodeError, json.JSONDecodeError) as exc:
-        raise RuntimeError("GITEA_INVALID_JSON:" + path) from exc
-    return status, decoded
-
-
-def journal(event, **fields):
-    JOURNAL.parent.mkdir(parents=True, exist_ok=True)
-    record = {"schema": "aios.governance-executor-journal.v2", "event": event, "unix": int(time.time()), **fields}
-    with JOURNAL.open("a", encoding="utf-8") as stream:
-        stream.write(json.dumps(record, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n")
-        stream.flush()
-        os.fsync(stream.fileno())
-
-
-def typed_json(value):
-    if value in (None, "null"):
-        return []
-    if isinstance(value, str):
-        return json.loads(value)
-    return value
-
-
-def user_ids(names):
-    result = []
-    for name in names or []:
-        if name not in USER_IDS:
-            raise RuntimeError("UNKNOWN_GOVERNANCE_USER:" + str(name))
-        result.append(USER_IDS[name])
-    return sorted(result)
-
-
-def semantic_policy(value):
-    policy = {
-        "schema_version": SEMANTIC_SCHEMA,
-        "repo_id": 1,
-        "protection_id": 2,
-        "branch_name": value.get("branch_name"),
-        "can_push": value.get("enable_push"),
-        "can_force_push": value.get("enable_force_push"),
-        "enable_merge_whitelist": value.get("enable_merge_whitelist"),
-        "merge_whitelist_user_ids": user_ids(value.get("merge_whitelist_usernames")),
-        "merge_whitelist_team_ids": [],
-        "required_approvals": value.get("required_approvals"),
-        "enable_status_check": value.get("enable_status_check"),
-        "status_check_contexts": sorted(value.get("status_check_contexts") or []),
-        "block_admin_merge_override": value.get("block_admin_merge_override"),
-        "block_on_official_review_requests": value.get("block_on_official_review_requests"),
-        "block_on_outdated_branch": value.get("block_on_outdated_branch"),
-        "block_on_rejected_reviews": value.get("block_on_rejected_reviews"),
-        "dismiss_stale_approvals": value.get("dismiss_stale_approvals"),
-        "ignore_stale_approvals": value.get("ignore_stale_approvals"),
-        "enable_approvals_whitelist": value.get("enable_approvals_whitelist"),
-        "approvals_whitelist_user_ids": user_ids(value.get("approvals_whitelist_username")),
-        "approvals_whitelist_team_ids": [],
-        "enable_bypass_allowlist": value.get("enable_bypass_allowlist"),
-        "bypass_allowlist_user_ids": user_ids(value.get("bypass_allowlist_usernames")),
-        "bypass_allowlist_team_ids": [],
-        "enable_force_push_allowlist": value.get("enable_force_push_allowlist"),
-        "force_push_allowlist_user_ids": user_ids(value.get("force_push_allowlist_usernames")),
-        "force_push_allowlist_team_ids": [],
-        "enable_whitelist": value.get("enable_push_whitelist"),
-        "whitelist_user_ids": user_ids(value.get("push_whitelist_usernames")),
-        "whitelist_team_ids": [],
-        "force_push_allowlist_deploy_keys": value.get("force_push_allowlist_deploy_keys"),
-        "whitelist_deploy_keys": value.get("push_whitelist_deploy_keys"),
-        "require_signed_commits": value.get("require_signed_commits"),
-        "priority": value.get("priority"),
-        "protected_file_patterns": value.get("protected_file_patterns"),
-        "unprotected_file_patterns": value.get("unprotected_file_patterns"),
-    }
-    return policy
-
-
-def semantic_sha(value):
-    return sha(semantic_policy(value))
-
-
-def verify_binding(binding, value):
-    required = {
-        "governance_request_PR", "exact_request_head", "Owner_review_id", "Owner_review_exact_head",
-        "manifest_sha256", "expected_previous_snapshot_sha256", "approved_delta",
-        "semantic_reconciliation_request_id", "semantic_reconciliation_head",
-        "semantic_reconciliation_review_id", "semantic_reconciliation_review_head",
-        "approved_semantic_digest",
-    }
-    if set(binding) != required:
-        raise RuntimeError("GOVERNANCE_BINDING_SCHEMA_INVALID")
-    if binding["governance_request_PR"] != 54 or binding["exact_request_head"] != PR54_HEAD:
-        raise RuntimeError("GOVERNANCE_BINDING_PR54_MISMATCH")
-    if binding["Owner_review_id"] != PR54_REVIEW or binding["Owner_review_exact_head"] != PR54_HEAD:
-        raise RuntimeError("GOVERNANCE_BINDING_REVIEW_MISMATCH")
-    if binding["manifest_sha256"] != PR54_MANIFEST_SHA:
-        raise RuntimeError("GOVERNANCE_BINDING_MANIFEST_MISMATCH")
-    if binding["expected_previous_snapshot_sha256"] != PR54_PREVIOUS_PROTECTION_SHA:
-        raise RuntimeError("GOVERNANCE_BINDING_SNAPSHOT_MISMATCH")
-    if binding["approved_delta"] != {"add_merge_whitelist_user_id": 153}:
-        raise RuntimeError("GOVERNANCE_BINDING_DELTA_DENIED")
-    if binding["approved_semantic_digest"] != APPROVED_SEMANTIC_SHA:
-        raise RuntimeError("GOVERNANCE_BINDING_SEMANTIC_DIGEST_MISMATCH")
-    if not RECONCILIATION_BINDING_PATH.is_file():
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_REQUIRED")
-    try:
-        reconciliation = json.loads(RECONCILIATION_BINDING_PATH.read_text(encoding="utf-8"))
-    except (OSError, ValueError):
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_INVALID") from None
-    required_reconciliation = {
-        "schema", "request_id", "pr_number", "request_head", "owner_review_id",
-        "owner_review_head", "approved_semantic_digest", "approved_delta",
-    }
-    if set(reconciliation) != required_reconciliation or reconciliation.get("schema") != "aios.semantic-reconciliation-binding.v1":
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_INVALID")
-    if reconciliation["approved_semantic_digest"] != APPROVED_SEMANTIC_SHA or reconciliation["approved_delta"] != binding["approved_delta"]:
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_MISMATCH")
-    if (
-        reconciliation["request_id"] != binding["semantic_reconciliation_request_id"]
-        or reconciliation["request_head"] != binding["semantic_reconciliation_head"]
-        or reconciliation["owner_review_id"] != binding["semantic_reconciliation_review_id"]
-        or reconciliation["owner_review_head"] != binding["semantic_reconciliation_review_head"]
-    ):
-        raise RuntimeError("SEMANTIC_RECONCILIATION_BINDING_MISMATCH")
-    _, reconciliation_pr = api("GET", f"/api/v1/repos/{REPO}/pulls/{reconciliation['pr_number']}", value)
-    if (
-        reconciliation_pr.get("state") != "open"
-        or reconciliation_pr.get("merged")
-        or reconciliation_pr.get("head", {}).get("sha") != reconciliation["request_head"]
-        or reconciliation_pr.get("base", {}).get("ref") != "governance/approvals"
-    ):
-        raise RuntimeError("SEMANTIC_RECONCILIATION_REQUEST_STALE")
-    _, reconciliation_reviews = api("GET", f"/api/v1/repos/{REPO}/pulls/{reconciliation['pr_number']}/reviews", value)
-    reconciliation_review = next((x for x in reconciliation_reviews if x.get("id") == reconciliation["owner_review_id"]), None)
-    if (
-        not reconciliation_review
-        or reconciliation_review.get("user", {}).get("id") != 2
-        or reconciliation_review.get("state") != "APPROVED"
-        or reconciliation_review.get("commit_id") != reconciliation["owner_review_head"]
-        or reconciliation_review.get("dismissed") is not False
-    ):
-        raise RuntimeError("SEMANTIC_RECONCILIATION_OWNER_REVIEW_STALE")
-    _, pr = api("GET", f"/api/v1/repos/{REPO}/pulls/54", value)
-    if pr.get("state") != "open" or pr.get("merged") or pr.get("head", {}).get("sha") != PR54_HEAD:
-        raise RuntimeError("PR54_APPROVAL_STALE")
-    _, reviews = api("GET", f"/api/v1/repos/{REPO}/pulls/54/reviews", value)
-    review = next((x for x in reviews if x.get("id") == PR54_REVIEW), None)
-    if not review or review.get("user", {}).get("id") != 2 or review.get("state") != "APPROVED" or review.get("commit_id") != PR54_HEAD or review.get("dismissed") is not False:
-        raise RuntimeError("PR54_APPROVAL_STALE")
-    manifest_path = "approvals/governance-policy/AIOS-AUTONOMOUS-MERGE-GOVERNANCE-SCOPE-EXTENSION-V1.json"
-    _, content = api("GET", f"/api/v1/repos/{REPO}/contents/{urllib.parse.quote(manifest_path, safe='/')}?ref={PR54_HEAD}", value)
-    raw = base64.b64decode("".join(content.get("content", "").split()))
-    if hashlib.sha256(raw).hexdigest() != PR54_MANIFEST_SHA:
-        raise RuntimeError("PR54_MANIFEST_STALE")
-
-
-def get_protection(value, branch):
-    if branch not in {"main", "governance/approvals"}:
-        raise RuntimeError("BRANCH_DENIED")
-    _, protection = api("GET", f"/api/v1/repos/{REPO}/branch_protections/{urllib.parse.quote(branch, safe='')}", value)
-    return protection
-
-
-def mutation_receipt(before, after, binding, target_semantic):
-    return {
-        "before": {"transport_digest": sha(before), "semantic_digest": semantic_sha(before)},
-        "approved": {
-            "mutation_predicate_digest": sha({"operation": "ADD_MERGE_EXECUTOR", "subject_user_id": 153, "preserve_all_unmodified_security_fields": True}),
-            "Owner_review_id": binding["Owner_review_id"],
-            "semantic_policy_digest": APPROVED_SEMANTIC_SHA,
-        },
-        "after": {"transport_digest": sha(after), "semantic_digest": semantic_sha(after)},
-        "delta": {"add_merge_whitelist_user_id": 153},
-        "target_semantic_digest": sha(target_semantic),
-        "unmodified_security_fields": {"verified": True},
-    }
-
-
-def apply_stage1(binding, value):
-    verify_binding(binding, value)
-    before = get_protection(value, "main")
-    before_semantic = semantic_policy(before)
-    before_semantic_sha = sha(before_semantic)
-    names = list(before.get("merge_whitelist_usernames") or [])
-    name_ids = user_ids(names)
-    if name_ids not in ([2], [2, 153]):
-        raise RuntimeError("PROTECTION_WHITELIST_PRESTATE_INVALID")
-    target_names = ["owner", "aios-autonomy-agent"]
-    target_semantic = copy.deepcopy(before_semantic)
-    target_semantic["merge_whitelist_user_ids"] = [2, 153]
-    if name_ids == [2, 153]:
-        if before_semantic_sha != STAGE1_SEMANTIC_SHA:
-            journal("APPLY_BLOCKED_STAGE1_IDEMPOTENCY_SEMANTIC_CONFLICT", transport_digest=sha(before), semantic_digest=before_semantic_sha, expected_semantic_digest=STAGE1_SEMANTIC_SHA)
-            raise RuntimeError("PROTECTION_STAGE1_SEMANTIC_CONFLICT")
-        receipt = mutation_receipt(before, before, binding, target_semantic)
-        journal("APPLY_APPROVED_PROTECTION_DELTA_IDEMPOTENT_SUCCESS", receipt=receipt)
-        return {"status": "IDEMPOTENT_SUCCESS", "protection": before, "transport_digest": sha(before), "semantic_digest": before_semantic_sha, "target_semantic_digest": sha(target_semantic)}
-    if before_semantic_sha != APPROVED_SEMANTIC_SHA:
-        journal("APPLY_BLOCKED_SEMANTIC_CAS", transport_digest=sha(before), semantic_digest=before_semantic_sha, expected_semantic_digest=APPROVED_SEMANTIC_SHA)
-        raise RuntimeError("PROTECTION_SEMANTIC_CAS_CONFLICT")
-    after_api = api("PATCH", f"/api/v1/repos/{REPO}/branch_protections/main", value, {"merge_whitelist_usernames": target_names})[1]
-    after = get_protection(value, "main")
-    for key in before:
-        if key in {"updated_at", "merge_whitelist_usernames"}:
-            continue
-        if after.get(key) != before.get(key):
-            raise RuntimeError("PROTECTION_UNAPPROVED_FIELD_CHANGED:" + key)
-    if user_ids(after.get("merge_whitelist_usernames")) != [2, 153]:
-        raise RuntimeError("PROTECTION_TARGET_READBACK_FAILED")
-    after_semantic = semantic_policy(after)
-    if after_semantic != target_semantic:
-        raise RuntimeError("PROTECTION_SEMANTIC_TARGET_READBACK_FAILED")
-    receipt = mutation_receipt(before, after, binding, target_semantic)
-    journal("APPLY_APPROVED_PROTECTION_DELTA_COMPLETED", receipt=receipt)
-    return {"status": "APPLIED", "protection": after, "previous_transport_digest": sha(before), "previous_semantic_digest": before_semantic_sha, "transport_digest": sha(after), "semantic_digest": sha(after_semantic), "receipt": receipt}
-
-
-def apply_stage2(binding, facts, value):
-    verify_binding(binding, value)
-    validate_stage2_facts(facts)
-    before = get_protection(value, "main")
-    if OWNER_GATE in (before.get("status_check_contexts") or []) and stage2_semantic_digest(before) != STAGE1_SEMANTIC_SHA:
-        raise RuntimeError("STAGE2_SEMANTIC_PRECONDITION_INVALID")
-    try:
-        status, target = build_target(before)
-    except Stage2GateError as exc:
-        journal("MIGRATE_APPROVED_GATE_BLOCKED", reason=str(exc), semantic_digest=stage2_semantic_digest(before))
-        raise RuntimeError(str(exc)) from exc
-    target_digest = stage2_semantic_digest(target)
-    if status == "IDEMPOTENT_SUCCESS":
-        journal(
-            "MIGRATE_APPROVED_GATE_IDEMPOTENT_SUCCESS",
-            before_semantic_digest=stage2_semantic_digest(before),
-            target_semantic_digest=target_digest,
-            campaign_id=CAMPAIGN_ID,
-        )
-        return {
-            "status": status,
-            "protection": before,
-            "transport_digest": sha(before),
-            "semantic_digest": stage2_semantic_digest(before),
-            "target_semantic_digest": target_digest,
-            "gate_transition": {"removed": OWNER_GATE, "required": CAMPAIGN_GATE},
-        }
-    after_api = api(
-        "PATCH",
-        f"/api/v1/repos/{REPO}/branch_protections/main",
-        value,
-        {"status_check_contexts": target["status_check_contexts"]},
-    )[1]
-    after = get_protection(value, "main")
-    for key in before:
-        if key in {"updated_at", "status_check_contexts"}:
-            continue
-        if after.get(key) != before.get(key):
-            raise RuntimeError("PROTECTION_UNAPPROVED_FIELD_CHANGED:" + key)
-    if after.get("status_check_contexts") != target["status_check_contexts"]:
-        raise RuntimeError("STAGE2_GATE_TARGET_READBACK_FAILED")
-    if stage2_semantic_digest(after) != target_digest:
-        raise RuntimeError("STAGE2_SEMANTIC_TARGET_READBACK_FAILED")
-    receipt = {
-        "before_transport_digest": sha(before),
-        "before_semantic_digest": stage2_semantic_digest(before),
-        "after_transport_digest": sha(after),
-        "after_semantic_digest": stage2_semantic_digest(after),
-        "target_semantic_digest": target_digest,
-        "campaign_id": CAMPAIGN_ID,
-        "gate_transition": {"removed": OWNER_GATE, "required": CAMPAIGN_GATE},
-        "preserved_security_fields": True,
-        "facts_digest": sha(facts),
-    }
-    journal("MIGRATE_APPROVED_GATE_COMPLETED", receipt=receipt)
-    return {
-        "status": "APPLIED",
-        "protection": after,
-        "previous_transport_digest": sha(before),
-        "previous_semantic_digest": stage2_semantic_digest(before),
-        "transport_digest": sha(after),
-        "semantic_digest": stage2_semantic_digest(after),
-        "target_semantic_digest": target_digest,
-        "receipt": receipt,
-    }
-
-
-def handle(request, value):
-    if not isinstance(request, dict) or set(request) != {"operation", "payload"}:
-        raise RuntimeError("REQUEST_SCHEMA_INVALID")
-    operation = request["operation"]
-    payload = request["payload"]
-    if not isinstance(payload, dict) or payload.get("repository") != REPO:
-        raise RuntimeError("REPOSITORY_DENIED")
-    if operation == "GET_BRANCH_PROTECTION":
-        protection = get_protection(value, payload.get("branch"))
-        journal("GET_BRANCH_PROTECTION", branch=payload.get("branch"), transport_digest=sha(protection), semantic_digest=semantic_sha(protection))
-        return {"status": "PASS", "protection": protection, "snapshot_sha256": sha(protection), "transport_digest": sha(protection), "semantic_digest": semantic_sha(protection), "semantic_schema": SEMANTIC_SCHEMA}
-    if operation == "READBACK_BRANCH_PROTECTION":
-        protection = get_protection(value, payload.get("branch"))
-        return {"status": "PASS", "protection": protection, "snapshot_sha256": sha(protection), "transport_digest": sha(protection), "semantic_digest": semantic_sha(protection), "semantic_schema": SEMANTIC_SCHEMA}
-    if operation == "APPLY_APPROVED_PROTECTION_DELTA":
-        binding = payload.get("GovernanceExecutionBinding")
-        if not isinstance(binding, dict):
-            raise RuntimeError("GOVERNANCE_BINDING_REQUIRED")
-        return apply_stage1(binding, value)
-    if operation == "MIGRATE_APPROVED_GATE":
-        binding = payload.get("GovernanceExecutionBinding")
-        facts = payload.get("Stage2Facts")
-        if not isinstance(binding, dict) or not isinstance(facts, dict):
-            raise RuntimeError("STAGE2_BINDING_OR_FACTS_REQUIRED")
-        return apply_stage2(binding, facts, value)
-    raise RuntimeError("OPERATION_DENIED")
-
-
-def main():
-    value = token()
-    sock_path = pathlib.Path(SOCKET)
-    sock_path.unlink(missing_ok=True)
-    server = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    server.bind(SOCKET)
-    os.chmod(SOCKET, 0o660)
-    server.listen(16)
-    journal("EXECUTOR_STARTED", api_surface=["GET_BRANCH_PROTECTION", "APPLY_APPROVED_PROTECTION_DELTA", "MIGRATE_APPROVED_GATE", "READBACK_BRANCH_PROTECTION"], semantic_schema=SEMANTIC_SCHEMA, approved_semantic_digest=APPROVED_SEMANTIC_SHA, stage1_semantic_digest=STAGE1_SEMANTIC_SHA, campaign_gate=CAMPAIGN_GATE)
-    try:
-        while True:
-            conn, _ = server.accept()
-            with conn:
-                data = conn.recv(1024 * 1024 + 1)
-                if len(data) > 1024 * 1024:
-                    result = {"status": "FAIL", "code": "REQUEST_TOO_LARGE"}
-                else:
-                    try:
-                        request = json.loads(data.decode())
-                        result = handle(request, value)
-                    except Exception as exc:
-                        result = {"status": "FAIL", "code": str(exc)}
-                conn.sendall((json.dumps(result, sort_keys=True, separators=(",", ":"), ensure_ascii=False) + "\n").encode())
-    finally:
-        server.close()
-        sock_path.unlink(missing_ok=True)
-
-
-if __name__ == "__main__":
-    main()
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Codex	c679c8394f	fix(codex): make central GPT health probing single-flight	2026-07-18 13:44:06 +08:00
Codex	9ec60c162a	fix(quorum): treat persisted blocked state as healthy cycle	2026-07-18 11:59:27 +08:00
Codex	415d736f88	fix(quorum): read authoritative bare refs in sandbox	2026-07-18 11:57:52 +08:00
Codex	20bfb3e773	fix(quorum): restore controller executable mode	2026-07-18 11:56:31 +08:00
Codex	cf211ac4ac	fix(quorum): validate and trust exact Git ref source	2026-07-18 11:56:18 +08:00
Codex	a76153c637	fix(quorum): make health receipts group-readable	2026-07-18 11:53:50 +08:00
Codex	3ddab59f65	fix(codex): allow read-only probe WAL access	2026-07-18 11:47:02 +08:00
Codex	4b88d90531	fix(codex): preserve watcher access to probe commands	2026-07-18 11:42:37 +08:00
Codex	2a80c8ad7a	fix(codex): bound gateway polling work units	2026-07-18 10:42:51 +08:00
Codex	1e00541e50	fix(codex): bound central health event scheduling	2026-07-18 10:36:22 +08:00
Codex	cb4f13601c	fix(codex): fail over model trigger channel safely	2026-07-18 10:32:12 +08:00
Codex	6170627542	fix(codex): verify existing shared queue without mutation	2026-07-18 10:26:16 +08:00
Codex	56827247f0	fix(codex): align gateway sandbox with durable queue	2026-07-18 10:24:10 +08:00
Codex	84714c712a	fix(codex): recover failed gateway activation safely	2026-07-18 10:20:09 +08:00
Codex	87fe8aea91	fix(codex): make gateway activation transactional	2026-07-18 10:17:41 +08:00
Codex	e850db7437	feat(codex): close GPT plus executor unattended automation loop	2026-07-18 10:15:05 +08:00
Codex	e116146341	merge: integrate GPT plus one-executor governance and quorum	2026-07-18 09:43:06 +08:00
Codex	df78b26437	feat(orchestration): implement GPT plus one-executor quorum controller	2026-07-18 05:40:50 +08:00
Codex	87a5fac40d	chore(governance): adopt GPT plus one-executor automation quorum	2026-07-18 05:01:34 +08:00
Codex	08fe81efee	chore(orchestration): dispatch OpenClaw three-party self-healing and release supervision	2026-07-18 04:54:21 +08:00
Codex	c3984ca2b4	fix(codex): isolate watcher runtime directory ownership	2026-07-18 03:39:45 +08:00
Codex	0c7e2d3b89	feat(codex): add persistent automatic command watcher	2026-07-18 03:36:46 +08:00
Codex	1b3b74fd62	merge(codex): integrate AIOS gateway with baseline remediation	2026-07-18 03:01:30 +08:00
Codex	378cc4d56a	fix(codex): restore hardened WeChat send backend lineage	2026-07-18 03:00:32 +08:00
Codex	95fc4d37f0	feat(codex): add reliable AIOS central orchestration gateway	2026-07-18 02:26:14 +08:00
Codex	9195470ceb	chore(orchestration): dispatch adaptive OpenClaw and Codex work units	2026-07-17 22:13:38 +08:00
Codex	cbe33ecab8	chore(governance): refresh adaptive dual-agent production contract	2026-07-17 22:13:38 +08:00
Codex	e3fc48e5b9	chore(governance): refresh adaptive dual-agent production contract	2026-07-17 22:04:03 +08:00
Codex	ed3bcf76c7	chore(governance): add shared V2R1 production execution contract	2026-07-17 21:24:20 +08:00
				`@@ -1 +0,0 @@`
				`"""Permanent AIOS governance source components."""`