release: add V1R4C5 acceptance evidence

docs/proposals/V1R4C4-SR02-watcher-state-cleanup-acceptance.md

@@ -1,95 +0,0 @@
-# V1R4C4 SR-02: Watcher State Cleanup Acceptance
-
-Status: implementation test green
-
-Priority: P1a
-
-Risk: low
-
-Baseline dependency: V1R4C3; should be integrated after SR-01 reliability acceptance or behind SR-01 gate.
-
-## Summary
-
-SR-02 watcher/stuck command cleanup now has a passing test signal:
-
-```text
-11 / 11 tests pass
-```
-
-The fix validates stuck command detection across both `.json` and `.md` command state formats.
-
-## Fix Summary
-
-### 1. Stuck command detection logic
-
-The controller logic in `autonomous_controller.py` was corrected.
-
-Previous failure mode:
-
-- parsed JSON was accessed through `.string('ts')`, which is empty for parsed JSON;
-- stuck threshold comparison against `stale_start` was incorrect;
-- stale/stuck state could be missed even when command metadata was old enough.
-
-Correct behavior:
-
-```python
-ts = data.get('ts', 0)
-```
-
-The command timestamp is now read from parsed data and compared using the correct time-based stale/stuck threshold.
-
-### 2. Test fixture mtime alignment
-
-The test fixture now sets the filesystem modification time of generated `.md` files to match the stored stuck timestamp.
-
-This is required because stuck detection uses both command metadata and file age semantics.
-
-Corrective test fixture behavior:
-
-```python
-os.utime(path, (ts, ts))
-```
-
-This ensures `.md` command files with a timestamp older than the stuck threshold are actually visible to `h_stuck()` as stuck.
-
-## Coverage
-
-Validated formats:
-
-- `.json` command state files;
-- `.md` command state files.
-
-Validated behavior:
-
-- old command timestamps are recognized as stuck;
-- current/non-stale command timestamps are not falsely marked stuck;
-- `.md` fixtures behave consistently with stored `ts` metadata;
-- detection behavior is consistent across file formats.
-
-## Acceptance Result
-
-```text
-all tests: pass
-count: 11
-```
-
-## Integration Guidance
-
-SR-02 is eligible for V1R4C4 integration after SR-01 confirms GitOps/Gitea reliability guardrails are stable.
-
-SR-02 must not bypass SR-01 because watcher cleanup changes autonomous controller behavior. It should be integrated behind the same safe-mode assumptions introduced by SR-01.
-
-## Remaining Checks Before Merge
-
-1. Confirm the exact implementation commit containing `autonomous_controller.py` and test fixture changes.
-2. Run SR-01 runtime acceptance first.
-3. Re-run the SR-02 test suite after rebasing/integrating with V1R4C4 reliability branch.
-4. Run global runtime acceptance:
-
-```text
-getRuntimeStatus -> getBaseline -> createBranch -> createPatch
-```
-
-## Decision
-
-Treat SR-02 as test-green and ready for controlled integration, not as independently deployable before SR-01.

docs/releases/V1R4C5-acceptance-evidence.md

@@ -0,0 +1,212 @@
+# V1R4C5 Acceptance Evidence
+
+Date: 2026-07-11
+
+Status: release candidate evidence in progress
+
+Current active baseline: V1R4C3
+
+V1R4C5 has not been promoted yet.
+
+## Owner Decision
+
+Owner approved continued V1R4C5 work under the following constraints:
+
+```text
+允许无 force-push 的分支 reconcile
+memory search 保持关闭
+先完成 SR-01/SR-02/数据隔离验收
+再进入 merge/deploy/tag owner gate
+```
+
+## Scope
+
+V1R4C5 release candidate scope:
+
+1. SR-01 Gitea reliability and branch consistency guardrails.
+2. SR-02 watcher/stuck command cleanup.
+3. User data isolation redline and enforcement gates.
+4. SR-04 admin workbench read-only visibility preparation only.
+
+Explicitly excluded from V1R4C5 activation:
+
+- memory search activation;
+- full SR-04 portal production rollout;
+- bulk merge of old test/smoke/auth branches;
+- force push reconciliation;
+- Gitea DB mutation without owner/admin approval.
+
+## Runtime Acceptance Evidence
+
+### Runtime status
+
+Observed:
+
+```json
+{
+  "service": "aios-gitops-model-api",
+  "status": "active",
+  "workspace_branch": "patch/v1r4c5-runtime-acceptance-clean-20260711-01"
+}
+```
+
+### Baseline
+
+Observed:
+
+```json
+{
+  "current_baseline": "V1R4C3",
+  "previous_baseline": "V1R3C1",
+  "promoted_by": "openclaw"
+}
+```
+
+### Clean createBranch acceptance
+
+Branch:
+
+```text
+test/v1r4c5-runtime-acceptance-clean-20260711-01
+```
+
+Result:
+
+```text
+status: ok
+commit: 6ae7058
+sync: synced
+```
+
+### Clean createPatch acceptance
+
+Patch:
+
+```text
+patch/v1r4c5-runtime-acceptance-clean-20260711-01
+```
+
+Patch id:
+
+```text
+patch-1783706123789-f5ca8b69
+```
+
+Commit:
+
+```text
+ba0391e
+```
+
+Result:
+
+```text
+synced
+```
+
+## SR-01 Evidence
+
+Known accepted evidence:
+
+- Gitea branch consistency sentinel deployed.
+- Sentinel reports:
+
+```json
+{
+  "status": "healthy",
+  "unhealthy_checks": []
+}
+```
+
+- systemd timer runs every 5 minutes.
+- service runs with:
+
+```text
+--emit-safe-mode --json
+```
+
+- broken symlink issue resolved by replacing the external reliability symlink with workspace-local files.
+
+Required before final promotion:
+
+- confirm latest sentinel report remains healthy after acceptance writes.
+
+## SR-02 Evidence
+
+Known accepted evidence:
+
+```text
+11 / 11 tests pass
+```
+
+Fix summary:
+
+- stuck command detection reads parsed timestamps through `data.get('ts', 0)`;
+- `.md` fixture mtime is aligned with stored stuck timestamp via `os.utime(path, (ts, ts))`;
+- behavior is consistent across `.json` and `.md` state formats.
+
+Required before final promotion:
+
+- re-run SR-02 tests on the final integration candidate.
+
+## User Data Isolation Evidence
+
+Implemented controls:
+
+- user data isolation redline;
+- memory scope guard;
+- provider gate;
+- activation gate;
+- audit service/timer;
+- CI acceptance scripts;
+- memory search activation check.
+
+Required safety state:
+
+```text
+AIOS_MEMORY_ENABLED=false
+```
+
+Required before memory/search activation:
+
+- isolation audit healthy;
+- no denied records;
+- no invalid records;
+- provider filters by scope before ranking;
+- provenance required;
+- global index disabled;
+- activation gate returns allowed;
+- explicit owner approval.
+
+V1R4C5 does not approve memory search activation.
+
+## SR-04 Admin Workbench Evidence
+
+Current user-visible gap is confirmed:
+
+- administrator cannot yet see task progress;
+- administrator cannot yet see flow/process diagrams;
+- SR-04 remains activation-ready but gated.
+
+V1R4C5 scope allows only read-only visibility preparation and acceptance design, not full production rollout.
+
+Required before SR-04 deployment:
+
+- SR-01 green;
+- SR-02 green;
+- user data isolation gate accepted;
+- admin RBAC read-only check green.
+
+## Remaining Required Gates Before Promotion
+
+- [ ] Latest Gitea sentinel report remains healthy.
+- [ ] SR-02 watcher tests pass on final candidate.
+- [ ] User data isolation acceptance passes.
+- [ ] Admin workbench read-only RBAC acceptance passes or remains explicitly deferred.
+- [ ] No force-push was used.
+- [ ] Memory search remains disabled.
+- [ ] Owner approves merge/deploy/tag/promotion.
+
+## Promotion Rule
+
+V1R4C5 may not be promoted until all required gates are green or explicitly deferred with owner approval.