release: add V1R4C5 acceptance evidence

docs/releases/V1R4C5-acceptance-evidence.md

@@ -0,0 +1,212 @@
+# V1R4C5 Acceptance Evidence
+
+Date: 2026-07-11
+
+Status: release candidate evidence in progress
+
+Current active baseline: V1R4C3
+
+V1R4C5 has not been promoted yet.
+
+## Owner Decision
+
+Owner approved continued V1R4C5 work under the following constraints:
+
+```text
+允许无 force-push 的分支 reconcile
+memory search 保持关闭
+先完成 SR-01/SR-02/数据隔离验收
+再进入 merge/deploy/tag owner gate
+```
+
+## Scope
+
+V1R4C5 release candidate scope:
+
+1. SR-01 Gitea reliability and branch consistency guardrails.
+2. SR-02 watcher/stuck command cleanup.
+3. User data isolation redline and enforcement gates.
+4. SR-04 admin workbench read-only visibility preparation only.
+
+Explicitly excluded from V1R4C5 activation:
+
+- memory search activation;
+- full SR-04 portal production rollout;
+- bulk merge of old test/smoke/auth branches;
+- force push reconciliation;
+- Gitea DB mutation without owner/admin approval.
+
+## Runtime Acceptance Evidence
+
+### Runtime status
+
+Observed:
+
+```json
+{
+  "service": "aios-gitops-model-api",
+  "status": "active",
+  "workspace_branch": "patch/v1r4c5-runtime-acceptance-clean-20260711-01"
+}
+```
+
+### Baseline
+
+Observed:
+
+```json
+{
+  "current_baseline": "V1R4C3",
+  "previous_baseline": "V1R3C1",
+  "promoted_by": "openclaw"
+}
+```
+
+### Clean createBranch acceptance
+
+Branch:
+
+```text
+test/v1r4c5-runtime-acceptance-clean-20260711-01
+```
+
+Result:
+
+```text
+status: ok
+commit: 6ae7058
+sync: synced
+```
+
+### Clean createPatch acceptance
+
+Patch:
+
+```text
+patch/v1r4c5-runtime-acceptance-clean-20260711-01
+```
+
+Patch id:
+
+```text
+patch-1783706123789-f5ca8b69
+```
+
+Commit:
+
+```text
+ba0391e
+```
+
+Result:
+
+```text
+synced
+```
+
+## SR-01 Evidence
+
+Known accepted evidence:
+
+- Gitea branch consistency sentinel deployed.
+- Sentinel reports:
+
+```json
+{
+  "status": "healthy",
+  "unhealthy_checks": []
+}
+```
+
+- systemd timer runs every 5 minutes.
+- service runs with:
+
+```text
+--emit-safe-mode --json
+```
+
+- broken symlink issue resolved by replacing the external reliability symlink with workspace-local files.
+
+Required before final promotion:
+
+- confirm latest sentinel report remains healthy after acceptance writes.
+
+## SR-02 Evidence
+
+Known accepted evidence:
+
+```text
+11 / 11 tests pass
+```
+
+Fix summary:
+
+- stuck command detection reads parsed timestamps through `data.get('ts', 0)`;
+- `.md` fixture mtime is aligned with stored stuck timestamp via `os.utime(path, (ts, ts))`;
+- behavior is consistent across `.json` and `.md` state formats.
+
+Required before final promotion:
+
+- re-run SR-02 tests on the final integration candidate.
+
+## User Data Isolation Evidence
+
+Implemented controls:
+
+- user data isolation redline;
+- memory scope guard;
+- provider gate;
+- activation gate;
+- audit service/timer;
+- CI acceptance scripts;
+- memory search activation check.
+
+Required safety state:
+
+```text
+AIOS_MEMORY_ENABLED=false
+```
+
+Required before memory/search activation:
+
+- isolation audit healthy;
+- no denied records;
+- no invalid records;
+- provider filters by scope before ranking;
+- provenance required;
+- global index disabled;
+- activation gate returns allowed;
+- explicit owner approval.
+
+V1R4C5 does not approve memory search activation.
+
+## SR-04 Admin Workbench Evidence
+
+Current user-visible gap is confirmed:
+
+- administrator cannot yet see task progress;
+- administrator cannot yet see flow/process diagrams;
+- SR-04 remains activation-ready but gated.
+
+V1R4C5 scope allows only read-only visibility preparation and acceptance design, not full production rollout.
+
+Required before SR-04 deployment:
+
+- SR-01 green;
+- SR-02 green;
+- user data isolation gate accepted;
+- admin RBAC read-only check green.
+
+## Remaining Required Gates Before Promotion
+
+- [ ] Latest Gitea sentinel report remains healthy.
+- [ ] SR-02 watcher tests pass on final candidate.
+- [ ] User data isolation acceptance passes.
+- [ ] Admin workbench read-only RBAC acceptance passes or remains explicitly deferred.
+- [ ] No force-push was used.
+- [ ] Memory search remains disabled.
+- [ ] Owner approves merge/deploy/tag/promotion.
+
+## Promotion Rule
+
+V1R4C5 may not be promoted until all required gates are green or explicitly deferred with owner approval.

docs/reliability/V1R4C4-SR01-gitea-sentinel-deployment-acceptance-20260710.md

@@ -1,155 +0,0 @@
-# V1R4C4 SR-01 Deployment Acceptance: Gitea Branch Consistency Sentinel
-
-Date: 2026-07-10
-
-Status: healthy
-
-Baseline at validation: V1R4C3
-
-Runtime status at record time: active
-
-## Acceptance Summary
-
-The Gitea branch consistency sentinel is deployed and operating successfully.
-
-Observed service result:
-
-```json
-{
-  "status": "healthy",
-  "unhealthy_checks": []
-}
-```
-
-No unhealthy checks were reported.
-
-## Implemented Components
-
-### 1. Sentinel script
-
-Path:
-
-```text
-/data/aios-gitops/workspace/scripts/reliability/gitea_branch_consistency_sentinel.py
-```
-
-Purpose:
-
-- compare Gitea branch metadata against actual Git branch state;
-- detect branch metadata drift;
-- emit structured JSON result;
-- optionally emit autonomous safe-mode state when unhealthy.
-
-The deployed check compares Gitea branch metadata available through the local Gitea endpoint against the actual git branches in the repository directory.
-
-Endpoint used:
-
-```text
-127.0.0.1:3000
-```
-
-### 2. Safe-mode helper
-
-Path:
-
-```text
-/data/aios-gitops/workspace/scripts/reliability/autonomous_safe_mode.py
-```
-
-Purpose:
-
-- provide safe-mode output/formatting helper;
-- support autonomous controller behavior when drift is detected.
-
-### 3. systemd timer
-
-Unit:
-
-```text
-gitea-branch-consistency-sentinel.timer
-```
-
-Schedule:
-
-```text
-every 5 minutes
-```
-
-Purpose:
-
-- continuously monitor Gitea branch consistency;
-- reduce mean time to detection for branch metadata drift;
-- provide recurring health evidence.
-
-### 4. systemd service
-
-Unit:
-
-```text
-gitea-branch-consistency-sentinel.service
-```
-
-Execution:
-
-```text
-gitea_branch_consistency_sentinel.py --emit-safe-mode --json
-```
-
-Purpose:
-
-- execute consistency sentinel;
-- log structured JSON output;
-- emit safe-mode state when the sentinel becomes unhealthy.
-
-### 5. Workspace symlink fix
-
-A broken `reliability` directory symlink pointing outside the workspace was replaced with actual files.
-
-Reason:
-
-- systemd sandboxing prevents following the prior external symlink safely;
-- deploying actual files inside the workspace makes service execution deterministic.
-
-## Reliability Impact
-
-This closes the core SR-01 monitoring gap:
-
-```text
-Gitea branch metadata drift
-        ↓
-detected within timer interval
-        ↓
-structured JSON health record
-        ↓
-autonomous safe-mode emission if unhealthy
-```
-
-The timer now provides continuous verification every 5 minutes.
-
-## Current Result
-
-```text
-status: healthy
-unhealthy_checks: none
-timer: active every 5 minutes
-service: emits JSON with --emit-safe-mode
-```
-
-## Acceptance Decision
-
-SR-01 deployment guardrail is accepted as healthy for V1R4C4 reliability freeze readiness.
-
-This does not yet promote V1R4C4. It provides one required acceptance input for V1R4C4.
-
-## Remaining Before V1R4C4 Promotion
-
-1. Confirm SR-02 watcher cleanup remains test-green after integration.
-2. Run GitOps runtime acceptance:
-
-```text
-getRuntimeStatus -> getBaseline -> createBranch -> createPatch
-```
-
-3. Confirm no new Gitea branch metadata drift after acceptance writes.
-4. Prepare V1R4C4 reliability baseline proposal.
-5. Keep SR-04 Portal AIOS Integration gated until SR-01 and SR-02 are both accepted.

ops/env/gitea-branch-consistency-sentinel.env.example

@@ -1,17 +0,0 @@
-# Copy to /etc/aios/gitea-branch-consistency-sentinel.env
-# and adjust paths for the deployment host.
-
-AIOS_REPO_ROOT=/data/aios-gitops/workspace
-GITEA_REPO_DIR=/data/aios-gitops/runtime/gitea-bin/data/repositories/aios/aios.git
-GITEA_DB_PATH=/data/aios-gitops/runtime/gitea-bin/data/gitea.db
-GITEA_REPO_ID=1
-GITEA_API_URL=http://127.0.0.1:3000/api/v1/repos/aios/aios/branches
-
-GITEA_SENTINEL_REPORT_FILE=/data/aios-gitops/runtime/state/gitea-branch-consistency-report.json
-AUTONOMOUS_SAFE_MODE_FILE=/data/aios-gitops/runtime/state/autonomous-safe-mode.json
-
-GITEA_SENTINEL_TIMEOUT_SECONDS=10
-GITEA_DOCTOR_REQUIRED=false
-
-# Optional:
-# GITEA_API_TOKEN_FILE=/path/to/token

ops/systemd/gitea-branch-consistency-sentinel.service

@@ -1,24 +0,0 @@
-[Unit]
-Description=Gitea branch metadata consistency sentinel
-Documentation=file:docs/reliability/gitea-controller-guardrails.md
-Wants=network-online.target
-After=network-online.target
-
-# Read-only consistency check. Emits safe mode on detected drift.
-
-[Service]
-Type=oneshot
-Environment="AIOS_REPO_ROOT=/data/aios-gitops/workspace"
-EnvironmentFile=-/etc/aios/gitea-branch-consistency-sentinel.env
-WorkingDirectory=/data/aios-gitops/workspace
-ExecStart=/bin/sh -lc 'cd "$AIOS_REPO_ROOT" && exec /usr/bin/python3 "$AIOS_REPO_ROOT/scripts/reliability/gitea_branch_consistency_sentinel.py" --emit-safe-mode --json'
-TimeoutStartSec=90
-Nice=10
-IOSchedulingClass=best-effort
-IOSchedulingPriority=7
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectHome=true
-ProtectSystem=full
-ReadWritePaths=/data/aios-gitops/runtime/state
-ReadOnlyPaths=/data/aios-gitops/runtime/gitea-bin/data