Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 openclaw
|
d54112aa47 |
@@ -0,0 +1,172 @@
|
||||
---
|
||||
authorization_id: TASK-V2R1-RUNTIME-INTEGRATION-P1-20260714
|
||||
task_id: TASK-V2R1-RUNTIME-INTEGRATION-P1-20260714
|
||||
executor: GPT_CODEX
|
||||
status: PASS
|
||||
started_at: 2026-07-14T02:24:00+08:00
|
||||
finished_at: 2026-07-14T02:27:46+08:00
|
||||
repository: /data/aios-gitops/workspace
|
||||
review_branch: review/codex/v2r1-runtime-integration-discovery-20260714
|
||||
review_worktree: /data/aios-gitops/worktrees/v2r1-runtime-integration-discovery-20260714
|
||||
result_commit: SELF
|
||||
result_commit_resolution: The containing commit is resolved by Git from the review branch because embedding its object ID would change the commit identity.
|
||||
parent_commit: 3cf9958cb94614449e093639cbf902216d73447f
|
||||
source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
|
||||
gate1_commit: 7f5d5d90b3111c35fb00044f385358f528e3344e
|
||||
merge_base: 1a9cb9095e6e76c548c967e03cb7a3e47b85134b
|
||||
main_graph_commits: 21
|
||||
source_graph_commits: 44
|
||||
main_changed_paths: 16
|
||||
source_changed_paths: 42
|
||||
approved_replay_paths: 38
|
||||
excluded_source_paths: 4
|
||||
changed_path_overlap: 0
|
||||
workspace_clean_after_commit: true
|
||||
rollback_target: 3cf9958cb94614449e093639cbf902216d73447f
|
||||
runtime_modified: false
|
||||
tests_modified: false
|
||||
main_modified: false
|
||||
tag_created: false
|
||||
baseline_modified: false
|
||||
service_modified: false
|
||||
deployment_performed: false
|
||||
force_push_used: false
|
||||
risk: HIGH
|
||||
recommendation: Proceed to a separately authorized P2 allowlist replay from exact main; keep tag, baseline, staging and deployment blocked until P4/P5 close every listed blocker.
|
||||
---
|
||||
|
||||
# V2R1 Runtime Integration P1 Discovery Result
|
||||
|
||||
## Decision
|
||||
|
||||
**PASS for discovery only.** The repository graph, path classifications, preservation boundary, exclusion boundary, and safe integration strategy are now explicit. This result does not authorize runtime integration or release activity.
|
||||
|
||||
## Authoritative identities
|
||||
|
||||
| Item | Verified value |
|
||||
|---|---|
|
||||
| Current main | `3cf9958cb94614449e093639cbf902216d73447f` |
|
||||
| V2R1 source | `502ef30642597fb0b70b90ae2e8a0b6af217d80e` |
|
||||
| Gate1 PASS commit | `7f5d5d90b3111c35fb00044f385358f528e3344e` |
|
||||
| Merge base | `1a9cb9095e6e76c548c967e03cb7a3e47b85134b` |
|
||||
| Main graph | `21` commits / `16` changed paths |
|
||||
| Source graph | `44` commits / `42` changed paths |
|
||||
| Changed-path overlap | `0` |
|
||||
|
||||
Gate1 commit is a direct child of source and adds one OpenClaw report. Main already contains the identical accepted report blob `ff31f7ab603d7a7cd07319e6f8422ae464916179`. The Gate1 commit must not be merged again.
|
||||
|
||||
## Exact classification
|
||||
|
||||
### Preserve from main — 16 paths
|
||||
|
||||
```text
|
||||
.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md
|
||||
deployments/V1R4C6/backup-result.md
|
||||
deployments/V1R4C6/deployment-result.md
|
||||
deployments/V1R4C6/preflight-result.md
|
||||
deployments/V1R4C6/rollback-result.md
|
||||
deployments/V1R4C6/verification-result.md
|
||||
docs/incidents/WEIXIN_TEXT_IMAGE_CACHE_ISOLATION_20260711.md
|
||||
docs/superpowers/plans/2026-07-12-weixin-quoted-text-failclosed.md
|
||||
docs/superpowers/specs/2026-07-12-weixin-quoted-text-failclosed-design.md
|
||||
fixes/patch_openclaw_weixin_bigint.py
|
||||
fixes/patch_openclaw_weixin_hermes.py
|
||||
fixes/patch_openclaw_weixin_outbound_quotes.py
|
||||
patches/deploy_v1r4c6-production-20260711.branch.json
|
||||
tests/test_weixin_bigint_parser.py
|
||||
tests/test_weixin_image_followup_intent.py
|
||||
tests/test_weixin_outbound_quote_timestamp.py
|
||||
```
|
||||
|
||||
### Replay from source — 38 paths
|
||||
|
||||
```text
|
||||
.gitignore
|
||||
active-runtime/app/aios_v2r1/audit.py
|
||||
active-runtime/app/aios_v2r1/cell_manager.py
|
||||
active-runtime/app/aios_v2r1/channel_adapter.py
|
||||
active-runtime/app/aios_v2r1/cli.py
|
||||
active-runtime/app/aios_v2r1/fleet.py
|
||||
active-runtime/app/aios_v2r1/hermes_fabric.py
|
||||
active-runtime/app/aios_v2r1/hermes_profile.py
|
||||
active-runtime/app/aios_v2r1/identity.py
|
||||
active-runtime/app/aios_v2r1/memory_scope.py
|
||||
active-runtime/app/aios_v2r1/message_ledger.py
|
||||
active-runtime/app/aios_v2r1/router.py
|
||||
active-runtime/app/aios_v2r1/runtime.py
|
||||
active-runtime/app/aios_v2r1/secret_scope.py
|
||||
active-runtime/app/aios_v2r1/session_pool.py
|
||||
active-runtime/app/aios_v2r1/tenant_context.py
|
||||
agents/registry.yaml
|
||||
data/webops.sqlite3 [delete]
|
||||
deploy/v2r1/healthcheck.sh
|
||||
deploy/v2r1/install.sh
|
||||
deploy/v2r1/validate.sh
|
||||
docs/architecture/AIOS_AGENT_AUDIT_PLANE.md
|
||||
docs/architecture/AIOS_V1R5_to_V2R1_Migration_Plan.md
|
||||
docs/architecture/AIOS_V2R1_OpenClaw_Tenant_Cell_Hermes_Shared_Agent_Fabric_Architecture.md
|
||||
openclaw/plugins/aios-tenant-boundary/dist/index.js
|
||||
openclaw/plugins/aios-tenant-boundary/dist/policy.js
|
||||
openclaw/plugins/aios-tenant-boundary/openclaw.plugin.json
|
||||
openclaw/plugins/aios-tenant-boundary/package.json
|
||||
release/v2r1c0-rc1/RELEASE.md
|
||||
tests/integration/test_runtime_ingress_flow.py
|
||||
tests/v2r1/test_acceptance_manifest.md
|
||||
tests/v2r1/test_hermes_contract.md
|
||||
tests/v2r1/test_hermes_fabric.py
|
||||
tests/v2r1/test_message_ledger_append.py
|
||||
tests/v2r1/test_router_isolation.py
|
||||
tests/v2r1/test_runtime_identity_binding.py
|
||||
tests/v2r1/test_runtime_wiring.py
|
||||
tests/v2r1/test_tenant_context.py
|
||||
```
|
||||
|
||||
### Exclude from source — 4 paths
|
||||
|
||||
```text
|
||||
.agent/results/codex/RESULT-V2R1-202607132000-CODEX.md
|
||||
.agent/results/codex/RESULT-V2R1-G1-CODEX-CLEANUP-20260713.md
|
||||
patches/release_v2r1c0-tenant-cell-fabric-20260712.branch.json
|
||||
release/v2r1c0-rc1/STATUS.md
|
||||
```
|
||||
|
||||
The task record contains the category-level counts, exact commit exclusions, and reason for every excluded class.
|
||||
|
||||
## Strategy and invariants
|
||||
|
||||
The approved future strategy is allowlist final-blob replay from source onto exact main. It intentionally avoids merging or cherry-picking historical evidence ancestry. Thirty-seven present paths are restored from source and the tracked `data/webops.sqlite3` path is explicitly deleted.
|
||||
|
||||
The future integration must preserve:
|
||||
|
||||
- exact first parent and rollback target `3cf9958cb94614449e093639cbf902216d73447f`;
|
||||
- all 16 main-only paths above;
|
||||
- Gate1 evidence blob `ff31f7ab603d7a7cd07319e6f8422ae464916179`;
|
||||
- `VERSION` blob `dd4988511ee5957d599098408c89de0c8b758df9` (`V1R4C6`);
|
||||
- baseline registry blob `81b5bbe59397e01d7fff048a5a91c9636ee85696`;
|
||||
- no tag, baseline, service, deployment, or force-push mutation.
|
||||
|
||||
## Baseline and tag evidence
|
||||
|
||||
`V1R4C6` is annotated tag object `356a8a8c1860b94b7d61a456c29228c88e57d963`, peeled release commit `d8cf6058e99f5c7f2dfd2b45a406c0a7edf955b2`. The baseline registry pointer is `e204a90398bf646d46245b3088226749fa056edd`, while the current registry-containing commit is `031215916826f1f0700147242a77878b8514b719`. They are distinct identities. No `V2*` tag exists and P1 creates none.
|
||||
|
||||
## Conflict and workspace evidence
|
||||
|
||||
Current main contains six tracked conflict-marker lines in two files. Source contains zero, and the two corrected source blobs are in the replay allowlist. Final verification must still prove zero markers.
|
||||
|
||||
The canonical workspace had two unrelated untracked controller audit records during discovery. They were not cleaned or included. The P1 review branch uses a separate worktree created from exact main.
|
||||
|
||||
## Blockers
|
||||
|
||||
- Attachment-composition regression is not closed by candidate-bound evidence.
|
||||
- Node plugin tests are missing even though `npm test` references `test/*.test.js`.
|
||||
- Plugin versions differ: `2.1.0-rc.1` and `2.1.0-rc1`.
|
||||
- V2R1 install tooling hardcodes an old release branch.
|
||||
- RC1 `STATUS.md` is stale and excluded.
|
||||
- Static scripts do not prove a real OpenClaw runtime probe or rollback recovery.
|
||||
- Existing release automation masks failures and does not safely update the current baseline schema.
|
||||
|
||||
These blockers prevent release, tagging, baseline promotion, staging, and deployment. They do not invalidate the P1 discovery result.
|
||||
|
||||
## Disposition
|
||||
|
||||
P1 produces evidence only. A separately authorized P2 may implement the exact allowlist replay. P4/P5 must bind tests, security scans, attachment regression, Node plugin verification, real runtime inspection, and rollback evidence to the resulting immutable integration commit before any release action.
|
||||
@@ -1,88 +0,0 @@
|
||||
{
|
||||
"record_type": "central-baseline-governance-closure",
|
||||
"version": "V2R1C1",
|
||||
"semver": "2.1.0-rc.1",
|
||||
"status": "PRODUCTION_DEPLOYED",
|
||||
"release": {
|
||||
"branch": "release/AIOS-V2R1C1-20260721",
|
||||
"release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
|
||||
"tag": "V2R1C1",
|
||||
"tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
|
||||
"previous_baseline": "V1R4C6",
|
||||
"previous_runtime_release": "b158041b8633e658c34ce182f3c8aa97b4bf5f9a"
|
||||
},
|
||||
"openclaw_companion": {
|
||||
"version": "2.1.0-rc.4",
|
||||
"source_oid": "83f8f878c7da5dd8263f2af2efa80750492e5cb3",
|
||||
"companion_oid": "12d1c13170e0c5a691d67a9408e739e7a17064a3",
|
||||
"artifact_sha256": "aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671",
|
||||
"contract_version": "aios.openclaw.command.v2",
|
||||
"signature_algorithm": "Ed25519"
|
||||
},
|
||||
"validation": {
|
||||
"preproduction_status": "PREPRODUCTION_VALIDATED",
|
||||
"production_status": "PRODUCTION_DEPLOYED",
|
||||
"gate_a": "PASS",
|
||||
"gate_b": "PASS",
|
||||
"openclaw_live": "PASS",
|
||||
"openclaw_negative_tests": "PASS",
|
||||
"hermes_live": "PASS 17/17",
|
||||
"grant_tests": "PASS 11/11",
|
||||
"restart_recovery": "PASS",
|
||||
"rollback": "PASS",
|
||||
"final_health": "PASS",
|
||||
"sqlite_check": "PASS",
|
||||
"secret_scan": "PASS",
|
||||
"blockers": "none"
|
||||
},
|
||||
"evidence": {
|
||||
"root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z",
|
||||
"final_audit_manifest_sha256": "2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55",
|
||||
"governance_root": "/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z"
|
||||
},
|
||||
"governance": {
|
||||
"branch": "patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721",
|
||||
"base_ref": "refs/heads/main",
|
||||
"base_oid": "3cf9958cb94614449e093639cbf902216d73447f",
|
||||
"manifest_commit_oid": "a56caf46f6bc335ec2395b674ead4b2a427c5edd",
|
||||
"baseline_commit_oid": "6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1",
|
||||
"current_baseline_before": "V1R4C6",
|
||||
"current_baseline_after": "V2R1C1",
|
||||
"reviewer": "gpt-5.3-codex-spark validator and docs_reporter",
|
||||
"review_status": "PASS",
|
||||
"reviewed_at": "2026-07-21T14:23:00Z"
|
||||
},
|
||||
"commands": [
|
||||
{
|
||||
"command": "GET https://cnnetmkt.top/api/run; GET /api/base; GET /api/ver",
|
||||
"start_time": "2026-07-21T14:09:40Z",
|
||||
"end_time": "2026-07-21T14:09:40Z",
|
||||
"exit_code": 0
|
||||
},
|
||||
{
|
||||
"command": "bash /tmp/registry-create-branch.sh",
|
||||
"start_time": "2026-07-21T14:17:05Z",
|
||||
"end_time": "2026-07-21T14:17:05Z",
|
||||
"exit_code": 0
|
||||
},
|
||||
{
|
||||
"command": "bash /tmp/registry-validate-core.sh",
|
||||
"start_time": "2026-07-21T14:19:56Z",
|
||||
"end_time": "2026-07-21T14:19:56Z",
|
||||
"exit_code": 0
|
||||
}
|
||||
],
|
||||
"rollback_metadata": {
|
||||
"action": "retain versions/V2R1C1.json and restore only baseline/current.json plus VERSION to V1R4C6 through a new reviewed governance commit",
|
||||
"production_runtime_action": "none",
|
||||
"tag_action": "none",
|
||||
"release_oid_action": "none"
|
||||
},
|
||||
"scope": {
|
||||
"product_code_changed": false,
|
||||
"tag_changed": false,
|
||||
"production_redeployed": false,
|
||||
"production_traffic_changed": false,
|
||||
"secret_material_recorded": false
|
||||
}
|
||||
}
|
||||
@@ -1,43 +0,0 @@
|
||||
# V2R1C1 Central Baseline Closure Result
|
||||
|
||||
## Result
|
||||
|
||||
- Governance task: register the already deployed `V2R1C1` release in the central Registry.
|
||||
- Baseline: `V1R4C6` -> `V2R1C1`.
|
||||
- Release OID and tag OID: `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`.
|
||||
- Companion OID: `12d1c13170e0c5a691d67a9408e739e7a17064a3`.
|
||||
- Artifact SHA256: `aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`.
|
||||
- Production evidence root: `/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`.
|
||||
- Final audit manifest SHA256: `2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`.
|
||||
- Production status: `PRODUCTION_DEPLOYED`.
|
||||
|
||||
## Governance Branch
|
||||
|
||||
- Branch: `patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`.
|
||||
- Base ref: `refs/heads/main`.
|
||||
- Base OID: `3cf9958cb94614449e093639cbf902216d73447f`.
|
||||
- Manifest commit: `a56caf46f6bc335ec2395b674ead4b2a427c5edd`.
|
||||
- Baseline commit: `6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`.
|
||||
- Review: `PASS` at `2026-07-21T14:23:00Z` by `gpt-5.3-codex-spark` validator and docs reporter.
|
||||
|
||||
## Commands and Evidence
|
||||
|
||||
| Command | Start UTC | End UTC | Exit code |
|
||||
| --- | --- | --- | ---: |
|
||||
| `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
|
||||
| `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
|
||||
| `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
|
||||
|
||||
The machine-readable record is `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`. The external governance evidence root is `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`.
|
||||
|
||||
## Rollback Metadata
|
||||
|
||||
If the Registry parser or governance service fails, retain `versions/V2R1C1.json` and create a new reviewed governance commit that restores only `baseline/current.json` and `VERSION` to `V1R4C6`. Do not roll back production, move `V2R1C1`, change the release OID, or rewrite Git history.
|
||||
|
||||
## Scope Protection
|
||||
|
||||
- `product_code_changed=false`
|
||||
- `tag_changed=false`
|
||||
- `production_redeployed=false`
|
||||
- `production_traffic_changed=false`
|
||||
- `secret_material_recorded=false`
|
||||
@@ -0,0 +1,185 @@
|
||||
---
|
||||
authorization_id: TASK-V2R1-RUNTIME-INTEGRATION-P1-20260714
|
||||
task_id: TASK-V2R1-RUNTIME-INTEGRATION-P1-20260714
|
||||
executor: GPT_CODEX
|
||||
status: DISCOVERY_COMPLETE
|
||||
started_at: 2026-07-14T02:24:00+08:00
|
||||
finished_at: 2026-07-14T02:27:46+08:00
|
||||
repository: /data/aios-gitops/workspace
|
||||
review_branch: review/codex/v2r1-runtime-integration-discovery-20260714
|
||||
review_worktree: /data/aios-gitops/worktrees/v2r1-runtime-integration-discovery-20260714
|
||||
main_commit: 3cf9958cb94614449e093639cbf902216d73447f
|
||||
source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
|
||||
gate1_commit: 7f5d5d90b3111c35fb00044f385358f528e3344e
|
||||
merge_base: 1a9cb9095e6e76c548c967e03cb7a3e47b85134b
|
||||
result_path: .agent/results/codex/RESULT-V2R1-RUNTIME-INTEGRATION-P1-20260714.md
|
||||
write_scope:
|
||||
- .agent/tasks/codex/TASK-V2R1-RUNTIME-INTEGRATION-P1-20260714.md
|
||||
- .agent/results/codex/RESULT-V2R1-RUNTIME-INTEGRATION-P1-20260714.md
|
||||
forbidden_actions:
|
||||
- modify_runtime_or_tests
|
||||
- merge_or_push_main
|
||||
- create_or_move_tag
|
||||
- update_baseline
|
||||
- change_service_or_deploy
|
||||
---
|
||||
|
||||
# V2R1 Runtime Integration P1 Discovery Task
|
||||
|
||||
## Objective
|
||||
|
||||
Produce a reproducible, evidence-only discovery record for integrating the approved V2R1 source tree onto current main without importing divergent historical evidence ancestry. P1 does not implement the integration.
|
||||
|
||||
## Locked graph
|
||||
|
||||
- Authoritative main: `3cf9958cb94614449e093639cbf902216d73447f`.
|
||||
- Approved V2R1 source: `502ef30642597fb0b70b90ae2e8a0b6af217d80e`.
|
||||
- Accepted Gate1 evidence commit: `7f5d5d90b3111c35fb00044f385358f528e3344e`.
|
||||
- Merge base: `1a9cb9095e6e76c548c967e03cb7a3e47b85134b`.
|
||||
- Main-only graph: `21` commits and `16` changed paths.
|
||||
- Source-only graph: `44` commits and `42` changed paths.
|
||||
- Main/source changed-path overlap: `0` paths.
|
||||
|
||||
## Main paths that must be preserved exactly — 16
|
||||
|
||||
1. `.agent/results/openclaw/RESULT-V2R1-G1-OPENCLAW-FINAL-EVIDENCE-20260714.md`
|
||||
2. `deployments/V1R4C6/backup-result.md`
|
||||
3. `deployments/V1R4C6/deployment-result.md`
|
||||
4. `deployments/V1R4C6/preflight-result.md`
|
||||
5. `deployments/V1R4C6/rollback-result.md`
|
||||
6. `deployments/V1R4C6/verification-result.md`
|
||||
7. `docs/incidents/WEIXIN_TEXT_IMAGE_CACHE_ISOLATION_20260711.md`
|
||||
8. `docs/superpowers/plans/2026-07-12-weixin-quoted-text-failclosed.md`
|
||||
9. `docs/superpowers/specs/2026-07-12-weixin-quoted-text-failclosed-design.md`
|
||||
10. `fixes/patch_openclaw_weixin_bigint.py`
|
||||
11. `fixes/patch_openclaw_weixin_hermes.py`
|
||||
12. `fixes/patch_openclaw_weixin_outbound_quotes.py`
|
||||
13. `patches/deploy_v1r4c6-production-20260711.branch.json`
|
||||
14. `tests/test_weixin_bigint_parser.py`
|
||||
15. `tests/test_weixin_image_followup_intent.py`
|
||||
16. `tests/test_weixin_outbound_quote_timestamp.py`
|
||||
|
||||
Additional immutable main invariants:
|
||||
|
||||
- `VERSION` remains `V1R4C6`, blob `dd4988511ee5957d599098408c89de0c8b758df9`.
|
||||
- `baseline/current.json` remains blob `81b5bbe59397e01d7fff048a5a91c9636ee85696`.
|
||||
- Accepted Gate1 evidence remains blob `ff31f7ab603d7a7cd07319e6f8422ae464916179`.
|
||||
- The future integration commit must have `3cf9958cb94614449e093639cbf902216d73447f` as its first-parent/rollback target.
|
||||
|
||||
## Approved source-tree allowlist — 38 paths
|
||||
|
||||
### Python V2R1 runtime — 15
|
||||
|
||||
1. `active-runtime/app/aios_v2r1/audit.py`
|
||||
2. `active-runtime/app/aios_v2r1/cell_manager.py`
|
||||
3. `active-runtime/app/aios_v2r1/channel_adapter.py`
|
||||
4. `active-runtime/app/aios_v2r1/cli.py`
|
||||
5. `active-runtime/app/aios_v2r1/fleet.py`
|
||||
6. `active-runtime/app/aios_v2r1/hermes_fabric.py`
|
||||
7. `active-runtime/app/aios_v2r1/hermes_profile.py`
|
||||
8. `active-runtime/app/aios_v2r1/identity.py`
|
||||
9. `active-runtime/app/aios_v2r1/memory_scope.py`
|
||||
10. `active-runtime/app/aios_v2r1/message_ledger.py`
|
||||
11. `active-runtime/app/aios_v2r1/router.py`
|
||||
12. `active-runtime/app/aios_v2r1/runtime.py`
|
||||
13. `active-runtime/app/aios_v2r1/secret_scope.py`
|
||||
14. `active-runtime/app/aios_v2r1/session_pool.py`
|
||||
15. `active-runtime/app/aios_v2r1/tenant_context.py`
|
||||
|
||||
### OpenClaw plugin — 4
|
||||
|
||||
1. `openclaw/plugins/aios-tenant-boundary/dist/index.js`
|
||||
2. `openclaw/plugins/aios-tenant-boundary/dist/policy.js`
|
||||
3. `openclaw/plugins/aios-tenant-boundary/openclaw.plugin.json`
|
||||
4. `openclaw/plugins/aios-tenant-boundary/package.json`
|
||||
|
||||
### Tests and contracts — 9
|
||||
|
||||
1. `tests/integration/test_runtime_ingress_flow.py`
|
||||
2. `tests/v2r1/test_acceptance_manifest.md`
|
||||
3. `tests/v2r1/test_hermes_contract.md`
|
||||
4. `tests/v2r1/test_hermes_fabric.py`
|
||||
5. `tests/v2r1/test_message_ledger_append.py`
|
||||
6. `tests/v2r1/test_router_isolation.py`
|
||||
7. `tests/v2r1/test_runtime_identity_binding.py`
|
||||
8. `tests/v2r1/test_runtime_wiring.py`
|
||||
9. `tests/v2r1/test_tenant_context.py`
|
||||
|
||||
### Static deployment tooling — 3
|
||||
|
||||
1. `deploy/v2r1/healthcheck.sh`
|
||||
2. `deploy/v2r1/install.sh`
|
||||
3. `deploy/v2r1/validate.sh`
|
||||
|
||||
### Architecture and release documents — 4
|
||||
|
||||
1. `docs/architecture/AIOS_AGENT_AUDIT_PLANE.md`
|
||||
2. `docs/architecture/AIOS_V1R5_to_V2R1_Migration_Plan.md`
|
||||
3. `docs/architecture/AIOS_V2R1_OpenClaw_Tenant_Cell_Hermes_Shared_Agent_Fabric_Architecture.md`
|
||||
4. `release/v2r1c0-rc1/RELEASE.md`
|
||||
|
||||
### Cleanup and governance — 3
|
||||
|
||||
1. `.gitignore`
|
||||
2. `agents/registry.yaml`
|
||||
3. `data/webops.sqlite3` — explicit tracked-file deletion, not a restore operation.
|
||||
|
||||
The replay operation restores the `37` present paths from source and explicitly removes `data/webops.sqlite3`. No directory-wide restore is allowed outside this list.
|
||||
|
||||
## Excluded source paths — 4
|
||||
|
||||
1. `.agent/results/codex/RESULT-V2R1-202607132000-CODEX.md` — historical branch evidence.
|
||||
2. `.agent/results/codex/RESULT-V2R1-G1-CODEX-CLEANUP-20260713.md` — historical branch evidence.
|
||||
3. `patches/release_v2r1c0-tenant-cell-fabric-20260712.branch.json` — stale branch-specific patch metadata.
|
||||
4. `release/v2r1c0-rc1/STATUS.md` — stale status: references tree `6569065` and contradicts later test/rollback evidence.
|
||||
|
||||
## Excluded commit ancestry
|
||||
|
||||
- Do not merge source commit ancestry and do not cherry-pick any of its `44` source-only commits. Replay only the approved final blobs.
|
||||
- Do not merge Gate1 commit `7f5d5d90b3111c35fb00044f385358f528e3344e`; main already contains its accepted evidence blob.
|
||||
- Do not replay result-only source commits `d6ba7e8fa859407ec55acf49b5468bba5eac96da`, `b9e1f9db66eb08282b7b690199e56461d28dd76d`, or `502ef30642597fb0b70b90ae2e8a0b6af217d80e` as commits.
|
||||
- Explicitly exclude rejected OpenClaw candidates `7a2f16ee72e944737a9f6995e511ef176413ae6b`, `b1d3439ee9e66b5eed1c94595a22bc630d893b6e`, `38320044b54c172c28877a81f291478267dd7b9e`, `7fd63b55f27b23658ea26e2a39d949c7b1e91dda`, and `71239b4d187e683e05fd22fc9d5df8ae324e3390`.
|
||||
- Prior Codex final-verification commit `0eebcf0b72f06c02205fdb6e300ceb5b3a5647a7` is not an integration input.
|
||||
|
||||
## Strategy decision
|
||||
|
||||
Use allowlist file replay from the immutable source tree, not a historical merge or commit-range cherry-pick. The two branches diverged for `21` and `44` commits after the merge base. Historical ancestry includes obsolete result reports and branch metadata, while main contains V1R4C6 incident fixes and the already accepted Gate1 evidence. Final-blob replay makes the intended runtime delta explicit and keeps those histories out of the future integration commit.
|
||||
|
||||
P2 must start from exact main, revalidate all refs, restore only the 37 present allowlist paths from source, remove the one tracked SQLite path, and stop if any additional path appears.
|
||||
|
||||
## Conflict preview
|
||||
|
||||
- Current main has `6` tracked conflict-marker lines across `agents/registry.yaml` and `docs/architecture/AIOS_AGENT_AUDIT_PLANE.md`.
|
||||
- Source has `0` tracked conflict-marker lines.
|
||||
- Both corrected source blobs are in the allowlist; the final tree must scan to zero markers.
|
||||
- The changed-path overlap between main and source deltas is zero, but this does not waive blob-preservation checks.
|
||||
|
||||
## Baseline and tag distinction
|
||||
|
||||
- Annotated tag object `356a8a8c1860b94b7d61a456c29228c88e57d963` is `V1R4C6` and peels to release commit `d8cf6058e99f5c7f2dfd2b45a406c0a7edf955b2`.
|
||||
- `baseline/current.json` records baseline registry pointer `e204a90398bf646d46245b3088226749fa056edd`; its latest modifying commit is `031215916826f1f0700147242a77878b8514b719`.
|
||||
- The tag object, peeled release commit, registry pointer, and registry-containing commit are separate audit identities.
|
||||
- No V2 tag exists. Future approved namespace is `refs/tags/V2R1C0`; P1 does not create it.
|
||||
|
||||
## Current workspace pollution
|
||||
|
||||
At discovery time, canonical workspace `/data/aios-gitops/workspace` contained two unrelated untracked controller records:
|
||||
|
||||
- `audit/controller-runs/c-1783966122.json`
|
||||
- `audit/controller-runs/c-1783966722.json`
|
||||
|
||||
They are excluded. All P1 writes occur in the isolated worktree, and no canonical workspace cleanup is authorized.
|
||||
|
||||
## Known blockers
|
||||
|
||||
1. Attachment-composition regression lacks a closed, candidate-bound regression result.
|
||||
2. Plugin `npm test` targets `test/*.test.js`, but source tracks no Node test files.
|
||||
3. Plugin package version `2.1.0-rc.1` differs from manifest version `2.1.0-rc1`.
|
||||
4. `deploy/v2r1/install.sh` hardcodes release branch `release/v2r1c0-tenant-cell-fabric-20260712`.
|
||||
5. `release/v2r1c0-rc1/STATUS.md` is stale and is excluded rather than silently rewritten.
|
||||
6. `validate.sh --install/--rollback` and `healthcheck.sh` do not prove a real OpenClaw runtime or rollback path.
|
||||
7. `scripts/release_version.sh` masks failures and does not match the active baseline registry schema; it must not be used.
|
||||
|
||||
## Exit criteria
|
||||
|
||||
P1 passes when the two evidence files are the only commit delta, the commit parent is exact main, the isolated worktree is clean after commit, and the review branch is pushed without force. Runtime integration, main update, tag, baseline promotion, and deployment remain separate blocked phases.
|
||||
@@ -7,7 +7,6 @@ from typing import Any
|
||||
|
||||
sys.path.insert(0, str(Path(os.getenv('AIOS_GITOPS_WORKSPACE', '/data/aios-gitops/workspace')) / 'runtime' / 'agent-os'))
|
||||
from orchestrator.action_monitor import ActionMonitor
|
||||
import threading
|
||||
|
||||
ROOT = Path(os.getenv('AIOS_GITOPS_ROOT', '/data/aios-gitops'))
|
||||
WS = Path(os.getenv('AIOS_GITOPS_WORKSPACE', str(ROOT / 'workspace')))
|
||||
@@ -18,7 +17,6 @@ PORT = int(os.getenv('AIOS_GITOPS_PORT', '18890'))
|
||||
OPENAPI = WS / 'docs' / 'gitops' / 'openapi-chatgpt-actions.yaml'
|
||||
BARE_REPO = Path(os.getenv('AIOS_GITOPS_BARE_REPO', str(ROOT / 'runtime' / 'gitea-bin' / 'data' / 'repositories' / 'aios' / 'aios.git')))
|
||||
monitor = ActionMonitor()
|
||||
WRITE_LOCK = threading.RLock()
|
||||
|
||||
BASE_MODELS = [
|
||||
{'id':'base.deepseekv4-flash','provider':'one-api','model':'deepseekv4-flash','display_name':'DeepSeek V4 Flash','scope':'global'},
|
||||
@@ -119,211 +117,28 @@ def write_file(path, content):
|
||||
if content_has_secret(content): raise ValueError('secret_rejected: use secret_ref; plaintext API keys must not enter Git')
|
||||
r=relpath(path); t=WS/r; t.parent.mkdir(parents=True, exist_ok=True); t.write_text(content, encoding='utf-8'); return r
|
||||
def write_json(path, data): return write_file(path, json.dumps(data, ensure_ascii=False, indent=2) + '\n')
|
||||
def controller_status() -> dict:
|
||||
branch = sh(
|
||||
['branch', '--show-current']
|
||||
)['stdout'] or None
|
||||
|
||||
head = sh(
|
||||
['rev-parse', 'HEAD'],
|
||||
True,
|
||||
)['stdout']
|
||||
|
||||
dirty = bool(
|
||||
sh(
|
||||
['status', '--porcelain']
|
||||
)['stdout']
|
||||
)
|
||||
|
||||
return {
|
||||
'workspace_mode': (
|
||||
'branch'
|
||||
if branch
|
||||
else 'detached'
|
||||
),
|
||||
'workspace_branch': branch,
|
||||
'workspace_ref': head,
|
||||
'workspace_dirty': dirty,
|
||||
}
|
||||
|
||||
|
||||
def detach_controller() -> dict:
|
||||
state = controller_status()
|
||||
|
||||
if state['workspace_branch']:
|
||||
sh(
|
||||
[
|
||||
'switch',
|
||||
'--detach',
|
||||
'HEAD',
|
||||
],
|
||||
True,
|
||||
)
|
||||
|
||||
return controller_status()
|
||||
|
||||
|
||||
def sync_branch(branch: str) -> dict:
|
||||
if (
|
||||
not branch
|
||||
or branch in ('main', 'master')
|
||||
or branch.startswith('main/')
|
||||
or branch.startswith('master/')
|
||||
):
|
||||
return {
|
||||
'status': 'skipped',
|
||||
'reason': 'protected_branch',
|
||||
'branch': branch,
|
||||
}
|
||||
|
||||
state = detach_controller()
|
||||
|
||||
common_git_dir = Path(
|
||||
sh(
|
||||
[
|
||||
'rev-parse',
|
||||
'--path-format=absolute',
|
||||
'--git-common-dir',
|
||||
],
|
||||
True,
|
||||
)['stdout']
|
||||
).resolve()
|
||||
|
||||
if not branch or branch in ('main','master') or branch.startswith('main/') or branch.startswith('master/'):
|
||||
return {'status':'skipped','reason':'protected_branch','branch':branch}
|
||||
if BARE_REPO.exists():
|
||||
target = BARE_REPO.resolve()
|
||||
|
||||
if target == common_git_dir:
|
||||
return {
|
||||
'status': 'synced',
|
||||
'target': 'common_git_dir',
|
||||
'branch': branch,
|
||||
**state,
|
||||
}
|
||||
|
||||
proc = subprocess.run(
|
||||
[
|
||||
'git',
|
||||
'push',
|
||||
'--porcelain',
|
||||
str(target),
|
||||
f'HEAD:refs/heads/{branch}',
|
||||
],
|
||||
cwd=str(WS),
|
||||
text=True,
|
||||
capture_output=True,
|
||||
)
|
||||
else:
|
||||
proc = subprocess.run(
|
||||
[
|
||||
'git',
|
||||
'push',
|
||||
'--porcelain',
|
||||
'origin',
|
||||
f'HEAD:refs/heads/{branch}',
|
||||
],
|
||||
cwd=str(WS),
|
||||
text=True,
|
||||
capture_output=True,
|
||||
)
|
||||
|
||||
if proc.returncode != 0:
|
||||
raise RuntimeError(
|
||||
proc.stderr
|
||||
or proc.stdout
|
||||
or (
|
||||
'git push failed for branch '
|
||||
+ branch
|
||||
)
|
||||
)
|
||||
|
||||
return {
|
||||
'status': 'synced',
|
||||
'target': (
|
||||
str(BARE_REPO.resolve())
|
||||
if BARE_REPO.exists()
|
||||
else 'origin'
|
||||
),
|
||||
'branch': branch,
|
||||
'stdout': proc.stdout.strip(),
|
||||
'stderr': proc.stderr.strip(),
|
||||
**state,
|
||||
}
|
||||
ref=f'refs/heads/{branch}:refs/heads/{branch}'
|
||||
p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
|
||||
if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git sync failed for {branch}')
|
||||
return {'status':'synced','target':'bare','branch':branch,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
|
||||
p=subprocess.run(['git','push','origin',f'HEAD:refs/heads/{branch}'], cwd=str(WS), text=True, capture_output=True)
|
||||
if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git push failed for {branch}')
|
||||
return {'status':'synced','target':'origin','branch':branch,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
|
||||
|
||||
def sync_tag(tag: str) -> dict:
|
||||
state = detach_controller()
|
||||
|
||||
common_git_dir = Path(
|
||||
sh(
|
||||
[
|
||||
'rev-parse',
|
||||
'--path-format=absolute',
|
||||
'--git-common-dir',
|
||||
],
|
||||
True,
|
||||
)['stdout']
|
||||
).resolve()
|
||||
|
||||
tag_ref = f'refs/tags/{tag}'
|
||||
|
||||
if not tag: return {'status':'skipped','reason':'empty_tag'}
|
||||
if BARE_REPO.exists():
|
||||
target = BARE_REPO.resolve()
|
||||
|
||||
if target == common_git_dir:
|
||||
return {
|
||||
'status': 'synced',
|
||||
'target': 'common_git_dir',
|
||||
'tag': tag,
|
||||
**state,
|
||||
}
|
||||
|
||||
proc = subprocess.run(
|
||||
[
|
||||
'git',
|
||||
'push',
|
||||
'--porcelain',
|
||||
str(target),
|
||||
f'{tag_ref}:{tag_ref}',
|
||||
],
|
||||
cwd=str(WS),
|
||||
text=True,
|
||||
capture_output=True,
|
||||
)
|
||||
else:
|
||||
proc = subprocess.run(
|
||||
[
|
||||
'git',
|
||||
'push',
|
||||
'--porcelain',
|
||||
'origin',
|
||||
f'{tag_ref}:{tag_ref}',
|
||||
],
|
||||
cwd=str(WS),
|
||||
text=True,
|
||||
capture_output=True,
|
||||
)
|
||||
|
||||
if proc.returncode != 0:
|
||||
raise RuntimeError(
|
||||
proc.stderr
|
||||
or proc.stdout
|
||||
or (
|
||||
'git push failed for tag '
|
||||
+ tag
|
||||
)
|
||||
)
|
||||
|
||||
return {
|
||||
'status': 'synced',
|
||||
'target': (
|
||||
str(BARE_REPO.resolve())
|
||||
if BARE_REPO.exists()
|
||||
else 'origin'
|
||||
),
|
||||
'tag': tag,
|
||||
'stdout': proc.stdout.strip(),
|
||||
'stderr': proc.stderr.strip(),
|
||||
**state,
|
||||
}
|
||||
ref=f'refs/tags/{tag}:refs/tags/{tag}'
|
||||
p=subprocess.run(['git','--git-dir',str(BARE_REPO),'fetch',str(WS),ref], text=True, capture_output=True)
|
||||
if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag sync failed for {tag}')
|
||||
return {'status':'synced','target':'bare','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
|
||||
p=subprocess.run(['git','push','origin',tag], cwd=str(WS), text=True, capture_output=True)
|
||||
if p.returncode != 0: raise RuntimeError(p.stderr or p.stdout or f'git tag push failed for {tag}')
|
||||
return {'status':'synced','target':'origin','tag':tag,'stdout':p.stdout.strip(),'stderr':p.stderr.strip()}
|
||||
|
||||
def commit(paths, msg):
|
||||
ensure_git(); paths = [relpath(p) for p in paths] if paths else ['.']; sh(['add'] + paths, True)
|
||||
@@ -395,123 +210,25 @@ class H(BaseHTTPRequestHandler):
|
||||
monitor.record_failure('do_GET', str(e), {'path':path})
|
||||
return self.sendj({'error':str(e)},500)
|
||||
def do_PUT(self):
|
||||
path = urllib.parse.urlparse(
|
||||
self.path
|
||||
).path.rstrip('/')
|
||||
|
||||
data = self.body()
|
||||
|
||||
try:
|
||||
with WRITE_LOCK:
|
||||
if path == '/api/model-priority':
|
||||
return self.model_priority(data)
|
||||
|
||||
return self.sendj(
|
||||
{
|
||||
'error': 'not_found',
|
||||
'path': path,
|
||||
},
|
||||
404,
|
||||
)
|
||||
except Exception as exc:
|
||||
monitor.record_failure(
|
||||
'do_PUT',
|
||||
str(exc),
|
||||
{'path': path},
|
||||
)
|
||||
return self.sendj(
|
||||
{'error': str(exc)},
|
||||
500,
|
||||
)
|
||||
finally:
|
||||
try:
|
||||
detach_controller()
|
||||
except Exception as detach_error:
|
||||
monitor.record_failure(
|
||||
'detach_controller',
|
||||
str(detach_error),
|
||||
{
|
||||
'path': path,
|
||||
'method': 'PUT',
|
||||
},
|
||||
)
|
||||
path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
|
||||
if path == '/api/model-priority': return self.model_priority(data)
|
||||
return self.sendj({'error':'not_found','path':path},404)
|
||||
def do_POST(self):
|
||||
path = urllib.parse.urlparse(
|
||||
self.path
|
||||
).path.rstrip('/')
|
||||
|
||||
data = self.body()
|
||||
|
||||
path=urllib.parse.urlparse(self.path).path.rstrip('/'); data=self.body()
|
||||
try:
|
||||
with WRITE_LOCK:
|
||||
if path in (
|
||||
'/api/branch',
|
||||
'/api/create-branch',
|
||||
):
|
||||
return self.branch(data)
|
||||
|
||||
if path in (
|
||||
'/api/file',
|
||||
'/api/commit-file',
|
||||
):
|
||||
return self.file(data)
|
||||
|
||||
if path == '/api/commit':
|
||||
return self.commit(data)
|
||||
|
||||
if path in (
|
||||
'/api/patch',
|
||||
'/api/create-patch',
|
||||
):
|
||||
return self.patch(data)
|
||||
|
||||
if path in (
|
||||
'/api/tag',
|
||||
'/api/create-tag',
|
||||
):
|
||||
return self.tag(data)
|
||||
|
||||
if path == '/api/rollback':
|
||||
return self.rollback(data)
|
||||
|
||||
if path == '/api/model':
|
||||
return self.model(data)
|
||||
|
||||
if path == '/api/model-priority':
|
||||
return self.model_priority(data)
|
||||
|
||||
if path == '/api/nl':
|
||||
return self.nl(data)
|
||||
|
||||
return self.sendj(
|
||||
{
|
||||
'error': 'not_found',
|
||||
'path': path,
|
||||
},
|
||||
404,
|
||||
)
|
||||
except Exception as exc:
|
||||
monitor.record_failure(
|
||||
'do_POST',
|
||||
str(exc),
|
||||
{'path': path},
|
||||
)
|
||||
return self.sendj(
|
||||
{'error': str(exc)},
|
||||
500,
|
||||
)
|
||||
finally:
|
||||
try:
|
||||
detach_controller()
|
||||
except Exception as detach_error:
|
||||
monitor.record_failure(
|
||||
'detach_controller',
|
||||
str(detach_error),
|
||||
{
|
||||
'path': path,
|
||||
'method': 'POST',
|
||||
},
|
||||
)
|
||||
if path in ('/api/branch','/api/create-branch'): return self.branch(data)
|
||||
if path in ('/api/file','/api/commit-file'): return self.file(data)
|
||||
if path == '/api/commit': return self.commit(data)
|
||||
if path in ('/api/patch','/api/create-patch'): return self.patch(data)
|
||||
if path in ('/api/tag','/api/create-tag'): return self.tag(data)
|
||||
if path == '/api/rollback': return self.rollback(data)
|
||||
if path == '/api/model': return self.model(data)
|
||||
if path == '/api/model-priority': return self.model_priority(data)
|
||||
if path == '/api/nl': return self.nl(data)
|
||||
return self.sendj({'error':'not_found','path':path},404)
|
||||
except Exception as e:
|
||||
monitor.record_failure('do_POST', str(e), {'path':path})
|
||||
return self.sendj({'error':str(e)},500)
|
||||
def branch(self,data):
|
||||
a=self.need('branch:create');
|
||||
if not a: return
|
||||
@@ -676,25 +393,6 @@ def api_spec():
|
||||
return {'version':'V1R1C0-chatgpt-actions','openapi':'/api/openapi.yaml','read':['GET /api/base','GET /api/ver','GET /api/diff','GET /api/patch','GET /api/model','GET /api/run','GET /admin/ai-evolution'],'write':['POST /api/branch','POST /api/file','POST /api/commit','POST /api/patch','POST /api/tag','POST /api/rollback','POST /api/model','PUT /api/model-priority','POST /api/nl'],'policy':{'bearer_required_for_write':True,'direct_main_push':False,'delete_tag':False,'owner_approval_required_for_v_level':True,'api_keys_in_git':False,'git_secret_field':'secret_ref','online_git_sync':True}}
|
||||
|
||||
def main():
|
||||
state = controller_status()
|
||||
|
||||
if state['workspace_dirty']:
|
||||
raise RuntimeError(
|
||||
'controller workspace is dirty; '
|
||||
'refusing to start GitOps writes'
|
||||
)
|
||||
|
||||
state = detach_controller()
|
||||
|
||||
print(
|
||||
'AIOS ChatGPT GitOps adapter listening '
|
||||
f'on {HOST}:{PORT}; '
|
||||
f'workspace_mode={state["workspace_mode"]}; '
|
||||
f'workspace_ref={state["workspace_ref"]}'
|
||||
)
|
||||
|
||||
ThreadingHTTPServer(
|
||||
(HOST, PORT),
|
||||
H,
|
||||
).serve_forever()
|
||||
print(f'AIOS ChatGPT GitOps adapter listening on {HOST}:{PORT}')
|
||||
ThreadingHTTPServer((HOST,PORT), H).serve_forever()
|
||||
if __name__ == '__main__': main()
|
||||
@@ -1,58 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
WT="${AIOS_GITOPS_WORKSPACE:-/data/aios-gitops/worktrees/controller}"
|
||||
BRANCH="${AIOS_GITOPS_CONTROLLER_BRANCH:-main}"
|
||||
|
||||
git -C "$WT" rev-parse \
|
||||
--is-inside-work-tree >/dev/null
|
||||
|
||||
DIRTY="$(
|
||||
git -C "$WT" status --porcelain=v1
|
||||
)"
|
||||
|
||||
if [[ -n "$DIRTY" ]]; then
|
||||
echo "controller workspace is dirty" >&2
|
||||
echo "$DIRTY" >&2
|
||||
exit 73
|
||||
fi
|
||||
|
||||
git -C "$WT" fetch --prune origin \
|
||||
"+refs/heads/${BRANCH}:refs/remotes/origin/${BRANCH}"
|
||||
|
||||
git -C "$WT" switch --detach \
|
||||
"refs/remotes/origin/${BRANCH}"
|
||||
|
||||
COMMON="$(
|
||||
git -C "$WT" \
|
||||
rev-parse \
|
||||
--path-format=absolute \
|
||||
--git-common-dir
|
||||
)"
|
||||
|
||||
git --git-dir="$COMMON" \
|
||||
worktree prune --expire now
|
||||
|
||||
CURRENT_BRANCH="$(
|
||||
git -C "$WT" branch --show-current
|
||||
)"
|
||||
|
||||
if [[ -n "$CURRENT_BRANCH" ]]; then
|
||||
echo "controller remains attached: $CURRENT_BRANCH" >&2
|
||||
exit 74
|
||||
fi
|
||||
|
||||
DIRTY_AFTER="$(
|
||||
git -C "$WT" status --porcelain=v1
|
||||
)"
|
||||
|
||||
if [[ -n "$DIRTY_AFTER" ]]; then
|
||||
echo "controller became dirty" >&2
|
||||
echo "$DIRTY_AFTER" >&2
|
||||
exit 75
|
||||
fi
|
||||
|
||||
echo "workspace_mode=detached"
|
||||
echo "workspace_branch=null"
|
||||
echo "workspace_dirty=false"
|
||||
echo "workspace_ref=$(git -C "$WT" rev-parse --short HEAD)"
|
||||
+12
-19
@@ -1,20 +1,13 @@
|
||||
{
|
||||
"current_baseline": "V2R1C1",
|
||||
"previous_baseline": "V1R4C6",
|
||||
"promoted_at": "2026-07-21T14:17:05Z",
|
||||
"git": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
|
||||
"promoted_by": "chatgpt/owner-approved-governance",
|
||||
"promotion_reason": "Register the already validated and deployed V2R1C1 production release in the central GitOps baseline Registry.",
|
||||
"version": "V2R1C1",
|
||||
"release_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
|
||||
"tag_oid": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
|
||||
"status": "PRODUCTION_DEPLOYED",
|
||||
"constraints": {
|
||||
"product_code_changed": false,
|
||||
"tag_changed": false,
|
||||
"production_redeployed": false,
|
||||
"production_traffic_changed": false,
|
||||
"force_push_allowed": false,
|
||||
"gitea_db_mutation_requires_owner_approval": true
|
||||
}
|
||||
}
|
||||
"current_baseline": "V1R4C6",
|
||||
"previous_baseline": "V1R4C5",
|
||||
"promoted_at": "2026-07-11T21:00:00+08:00",
|
||||
"git": "e204a90398bf646d46245b3088226749fa056edd",
|
||||
"promoted_by": "openclaw/admin",
|
||||
"promotion_reason": "V1R4C6 admin search agent integration, search gateway, agent platform, VERSION bump, merge tests deploy pipeline — not yet deployed to production",
|
||||
"constraints": {
|
||||
"memory_search_enabled": false,
|
||||
"force_push_allowed": false,
|
||||
"gitea_db_mutation_requires_owner_approval": true
|
||||
}
|
||||
}
|
||||
@@ -1,56 +0,0 @@
|
||||
# V2R1C1 中央 Baseline 治理收口
|
||||
|
||||
## 收口范围
|
||||
|
||||
本次变更只登记已经完成生产验证并上线的 `V2R1C1`。它新增中央版本 Manifest、把中央 Baseline Pointer 从 `V1R4C6` 切换为 `V2R1C1`，并建立 Release、Companion、Artifact 与最终生产 Evidence 的追溯关系。
|
||||
|
||||
本次不修改产品实现，不移动或重建 `V2R1C1` Tag，不改变 Release OID，不重新部署生产，不切换生产流量，也不重写历史证据。
|
||||
|
||||
## 权威标识
|
||||
|
||||
- Release：`release/AIOS-V2R1C1-20260721`
|
||||
- Release OID：`4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`
|
||||
- Tag / Tag OID：`V2R1C1` / `4e0e6dcb90e6732aa9838fe9d0af0b34746829b0`
|
||||
- SemVer：`2.1.0-rc.1`
|
||||
- OpenClaw Companion：`2.1.0-rc.4`
|
||||
- Companion Source OID：`83f8f878c7da5dd8263f2af2efa80750492e5cb3`
|
||||
- Companion OID：`12d1c13170e0c5a691d67a9408e739e7a17064a3`
|
||||
- Artifact SHA256：`aadd5f3cfa0d8e796a21f6368f5c95e8c60e9063d6e9fcd9c4947cfa0c013671`
|
||||
- Contract：`aios.openclaw.command.v2` / `Ed25519`
|
||||
- Evidence Root：`/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z`
|
||||
- Final Audit Manifest SHA256：`2cdb884abf195969de3cdaa44c76aaac52a9165fb4918436855291e46b2f8d55`
|
||||
- Production Status：`PRODUCTION_DEPLOYED`
|
||||
|
||||
## 治理路径
|
||||
|
||||
- Governance Branch：`patch/chatgpt/AIOS-V2R1C1-BASELINE-REGISTRY-20260721`
|
||||
- Base Ref：`refs/heads/main`
|
||||
- Base OID：`3cf9958cb94614449e093639cbf902216d73447f`
|
||||
- Manifest Commit：`a56caf46f6bc335ec2395b674ead4b2a427c5edd`
|
||||
- Baseline Commit：`6dbd5cbe07d2960ca653049fefbcf3a3e18f9ab1`
|
||||
- Reviewer：`gpt-5.3-codex-spark validator and docs_reporter`
|
||||
- Review：`PASS`（`2026-07-21T14:23:00Z`）
|
||||
|
||||
## 命令与退出码
|
||||
|
||||
| 阶段 | 命令 | 开始 UTC | 结束 UTC | Exit Code |
|
||||
| --- | --- | --- | --- | ---: |
|
||||
| 中央只读核对 | `GET /api/run; GET /api/base; GET /api/ver` | 2026-07-21T14:09:40Z | 2026-07-21T14:09:40Z | 0 |
|
||||
| 创建治理分支 | `bash /tmp/registry-create-branch.sh` | 2026-07-21T14:17:05Z | 2026-07-21T14:17:05Z | 0 |
|
||||
| 核心元数据验证 | `bash /tmp/registry-validate-core.sh` | 2026-07-21T14:19:56Z | 2026-07-21T14:19:56Z | 0 |
|
||||
|
||||
完整机读记录位于 `.agent/results/releases/V2R1C1-BASELINE-CLOSURE.json`，治理运行证据位于 `/var/lib/aios-gitops/acceptance/aios-v2r1c1-baseline-registry-20260721T141705Z`。
|
||||
|
||||
## 元数据回滚
|
||||
|
||||
若中央 Registry 解析或治理服务异常，保留 `versions/V2R1C1.json`，通过新的受审治理提交把 `baseline/current.json` 和 `VERSION` 临时恢复到 `V1R4C6`。该操作不得回滚生产系统、移动 Tag、修改 Release OID 或重写历史。
|
||||
|
||||
## 范围证明
|
||||
|
||||
```text
|
||||
product_code_changed=false
|
||||
tag_changed=false
|
||||
production_redeployed=false
|
||||
production_traffic_changed=false
|
||||
secret_material_recorded=false
|
||||
```
|
||||
@@ -1,55 +0,0 @@
|
||||
{
|
||||
"version": "V2R1C1",
|
||||
"codename": "openclaw-command-v2-production-baseline",
|
||||
"status": "PRODUCTION_DEPLOYED",
|
||||
"tag": "V2R1C1",
|
||||
"tag_ref": "refs/tags/V2R1C1",
|
||||
"tag_object": "4e0e6dcb90e6732aa9838fe9d0af0b34746829b0",
|
||||
"previous_version": "V1R4C6",
|
||||
"rollback_version": "V1R4C6",
|
||||
"baseline": "V1R4C6",
|
||||
"release_reason": "Register the already deployed AIOS V2R1C1 release, immutable tag, OpenClaw Command v2 companion, and final production evidence in the central GitOps Registry.",
|
||||
"purpose": "Close the central version-governance gap without changing product implementation, the V2R1C1 tag, production release, deployment, or traffic.",
|
||||
"changes": [
|
||||
"governance: add the canonical V2R1C1 version manifest",
|
||||
"governance: advance the central baseline pointer from V1R4C6 to V2R1C1",
|
||||
"governance: link release, companion, artifact, validation, and final audit evidence"
|
||||
],
|
||||
"artifacts": [
|
||||
"docs/releases/V2R1C1-BASELINE-CLOSURE.md",
|
||||
".agent/results/releases/V2R1C1-BASELINE-CLOSURE.json",
|
||||
".agent/results/releases/V2R1C1-BASELINE-CLOSURE.md",
|
||||
"/var/lib/aios-gitops/acceptance/aios-v2r1c1-openclaw-v2-companion-20260721T094442Z"
|
||||
],
|
||||
"validated_actions": [
|
||||
"release and tag OID equality",
|
||||
"local and Gitea ref synchronization",
|
||||
"OpenClaw Command v2 positive and negative validation",
|
||||
"Gate A and Gate B",
|
||||
"Hermes lifecycle 17/17",
|
||||
"grant isolation 11/11",
|
||||
"restart recovery",
|
||||
"rollback and forward recovery",
|
||||
"SQLite quick_check",
|
||||
"secret scan with zero violations",
|
||||
"final production healthcheck"
|
||||
],
|
||||
"secret_plaintext_written": false,
|
||||
"owner_approval_required": true,
|
||||
"owner_notification_channels": [
|
||||
"codex_owner_instruction",
|
||||
"gitops_audit"
|
||||
],
|
||||
"constraints_original": {
|
||||
"product_code_changed": false,
|
||||
"tag_changed": false,
|
||||
"production_redeployed": false,
|
||||
"production_traffic_changed": false,
|
||||
"force_push_allowed": false,
|
||||
"incubator_in_release_graph": false
|
||||
},
|
||||
"promoted_at": "2026-07-21T14:17:05Z",
|
||||
"promoted_by": "chatgpt/owner-approved-governance",
|
||||
"created_at": "2026-07-21T14:17:05Z",
|
||||
"author": "chatgpt"
|
||||
}
|
||||
Reference in New Issue
Block a user