Compare commits
4
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 openclaw
|
7fd63b55f2 | ||
|
openclaw
|
502ef30642 | ||
|
openclaw
|
b9e1f9db66 | ||
|
openclaw
|
7b82ae11f6 |
@@ -0,0 +1,95 @@
|
||||
status: PASS
|
||||
commit: 7b82ae11f685b77628308ba46b9cfdf5bcdf78d3
|
||||
tests:
|
||||
v2r1: "29 passed, exit code 0"
|
||||
integration: "3 passed, exit code 0"
|
||||
cleanup_scan:
|
||||
status: PASS
|
||||
findings: "No remaining conflict markers, unexplained worktree changes, unapproved temporary/cache/build artifacts, or scanner-detected secrets. Runtime SQLite was removed and its sidecars are ignored with exact root-anchored rules; tracked dist/ZIP artifacts are documented exceptions."
|
||||
risk: MEDIUM
|
||||
recommendation: "Push the controlled work branch, then request independent OpenClaw Gate Review; do not merge or release from this result alone."
|
||||
|
||||
# V2R1 Gate 1 Codex Cleanup Result
|
||||
|
||||
## Scope and Git Baseline
|
||||
|
||||
- Task: `V2R1-G1-CODEX-CLEANUP-20260713`
|
||||
- Branch: `work/v2r1-g1-cleanup-remediation-20260713`
|
||||
- Cleanup implementation commit: `7b82ae11f685b77628308ba46b9cfdf5bcdf78d3`
|
||||
- Integration commit: `a6878d30b8690e55f1bf9819da5aac189dabf89e`
|
||||
- Locked integration result baseline: `d6ba7e8fa859407ec55acf49b5468bba5eac96da`
|
||||
- `git merge-base --is-ancestor a6878d30b8690e55f1bf9819da5aac189dabf89e HEAD`: exit code `0`
|
||||
- `git merge-base --is-ancestor d6ba7e8fa859407ec55acf49b5468bba5eac96da HEAD`: exit code `0`
|
||||
- Tree before this result-only commit: `94146e05f700921b12ef023eb4d8be771bae4047`
|
||||
|
||||
The locked integration artifacts were not modified by cleanup:
|
||||
|
||||
- `tests/integration/test_runtime_ingress_flow.py`: blob `6b6732a4c73bbb7fb5273a05b897adce9da39a9a`
|
||||
- `.agent/results/codex/RESULT-V2R1-202607132000-CODEX.md`: blob `e2d6ce3b037339385831f51cb0db42c86b2ae827`
|
||||
|
||||
## Cleanup Changes Verified
|
||||
|
||||
Commit `7b82ae11f685b77628308ba46b9cfdf5bcdf78d3`:
|
||||
|
||||
- removed the tracked runtime database `data/webops.sqlite3`;
|
||||
- added exact root-anchored ignore rules for `/data/webops.sqlite3`, `/data/webops.sqlite3-wal`, `/data/webops.sqlite3-shm`, and `/data/webops.sqlite3-journal`;
|
||||
- resolved tracked merge-conflict residue in `agents/registry.yaml` and `docs/architecture/AIOS_AGENT_AUDIT_PLANE.md`;
|
||||
- left the locked integration test and prior Codex result blobs unchanged.
|
||||
|
||||
`git grep -n -E '^(<<<<<<<|=======|>>>>>>>)' -- . ':!source-baseline/*.zip'` returned no matches (exit code `1`, the expected no-match result).
|
||||
|
||||
The repository scan found no unapproved `__pycache__`, `*.pyc`, `*.pyo`, `.pytest_cache`, `.mypy_cache`, `.ruff_cache`, `*.tmp`, `*.swp`, backup-suffix, or `.DS_Store` artifacts after verification cleanup. The following tracked artifacts are expected baseline exceptions, not unexplained generated files:
|
||||
|
||||
- `openclaw/plugins/aios-tenant-boundary/dist/` (2 tracked plugin distribution files);
|
||||
- `source-baseline/current_actual_deployment_source.zip`;
|
||||
- `source-baseline/previous_current_actual_deployment_source_from_webops_delta.zip`.
|
||||
|
||||
Before creating this result file, `git status --porcelain=v1 --untracked-files=all` was empty with exit code `0`.
|
||||
|
||||
## Secret Scan
|
||||
|
||||
Scanner: Gitleaks `8.30.1`, official Linux x64 release asset.
|
||||
|
||||
- Asset: `/tmp/gitleaks_8.30.1_linux_x64.tar.gz.codex`
|
||||
- SHA-256: `551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb`
|
||||
- `/tmp/gitleaks-codex-8.30.1/gitleaks git --no-banner --no-color --redact --report-format json --report-path /tmp/v2r1-cleanup-audit-git.json --log-opts=7b82ae11f685b77628308ba46b9cfdf5bcdf78d3 /data/aios-gitops/worktrees/v2r1-g1-cleanup-remediation-20260713`: exit code `0`; Gitleaks reported `312 commits scanned`, approximately `1,384,427 bytes (1.38 MB)` scanned, and `no leaks found` (`0` findings in the JSON report).
|
||||
- `git rev-list --count 7b82ae11f685b77628308ba46b9cfdf5bcdf78d3`: exit code `0`, `327` reachable commits. This Git reachability count is recorded separately and is not the Gitleaks scanned-commit count.
|
||||
- `/tmp/gitleaks-codex-8.30.1/gitleaks dir --no-banner --no-color --redact --report-format json --report-path /tmp/v2r1-cleanup-audit-tree.json /data/aios-gitops/worktrees/v2r1-g1-cleanup-remediation-20260713`: exit code `0`; Gitleaks reported approximately `1,214,737 bytes (1.21 MB)` scanned and `no leaks found` (`0` findings in the JSON report).
|
||||
|
||||
No secret content is reproduced in this report.
|
||||
|
||||
## Tests
|
||||
|
||||
Command:
|
||||
|
||||
```bash
|
||||
PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=active-runtime/app /usr/bin/python3 -m pytest tests/v2r1
|
||||
```
|
||||
|
||||
Output summary:
|
||||
|
||||
```text
|
||||
collected 29 items
|
||||
29 passed in 0.97s
|
||||
exit code: 0
|
||||
```
|
||||
|
||||
Command:
|
||||
|
||||
```bash
|
||||
PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=active-runtime/app /usr/bin/python3 -m pytest tests/integration
|
||||
```
|
||||
|
||||
Output summary:
|
||||
|
||||
```text
|
||||
collected 3 items
|
||||
3 passed in 0.18s
|
||||
exit code: 0
|
||||
```
|
||||
|
||||
Environment: Linux, Python `3.12.3`, pytest `9.1.1`, pluggy `1.6.0`.
|
||||
|
||||
## Disposition
|
||||
|
||||
The cleanup and requested test verification pass at the stated implementation commit. Risk remains `MEDIUM` until the controlled branch is pushed and independently fetched and reviewed by OpenClaw. This result does not authorize merge, tag creation, baseline update, staging, or production deployment.
|
||||
@@ -0,0 +1,126 @@
|
||||
---
|
||||
gate: G1
|
||||
variant: openclaw-cleanroom
|
||||
date: 2026-07-13
|
||||
source_commit: 502ef30642597fb0b70b90ae2e8a0b6af217d80e
|
||||
source_branch: origin/work/v2r1-integration-quality-2000
|
||||
tests_total: 32
|
||||
tests_passed: 32
|
||||
tests_failed: 0
|
||||
cleanup: PASS
|
||||
secret_scan: PASS
|
||||
rollback: PASS
|
||||
recovery: verified
|
||||
workspace: clean
|
||||
merge_performed: false
|
||||
tag_created: false
|
||||
baseline_promoted: false
|
||||
staging_deployed: false
|
||||
production_deployed: false
|
||||
---
|
||||
|
||||
# V2R1 Gate 1 — OpenClaw Clean-Room Report Correction
|
||||
|
||||
## Source Verification
|
||||
|
||||
| Attribute | Value |
|
||||
|-----------|-------|
|
||||
| source commit | `502ef30642597fb0b70b90ae2e8a0b6af217d80e` |
|
||||
| source branch | `origin/work/v2r1-integration-quality-2000` |
|
||||
| parent (0) | `6077331addc71d090d454c123cc5de5460ab637e` |
|
||||
| validation date | 2026-07-13 18:43 Asia/Shanghai |
|
||||
|
||||
## Test Results
|
||||
|
||||
### v2r1 unit tests: 29/29 PASS
|
||||
|
||||
```
|
||||
PYTHONPATH=active-runtime/app python3 -m pytest \
|
||||
tests/v2r1/test_hermes_fabric.py \
|
||||
tests/v2r1/test_message_ledger_append.py \
|
||||
tests/v2r1/test_router_isolation.py \
|
||||
tests/v2r1/test_runtime_identity_binding.py \
|
||||
tests/v2r1/test_runtime_wiring.py \
|
||||
tests/v2r1/test_tenant_context.py \
|
||||
-v
|
||||
```
|
||||
|
||||
**Result:** 29 passed in 0.95s, exit code 0
|
||||
|
||||
### Integration tests: 3/3 PASS
|
||||
|
||||
```
|
||||
PYTHONPATH=active-runtime/app python3 -m pytest \
|
||||
tests/integration/test_runtime_ingress_flow.py \
|
||||
-v
|
||||
```
|
||||
|
||||
**Result:** 3 passed in 0.17s, exit code 0
|
||||
|
||||
### Summary: 32/32 PASS
|
||||
|
||||
## HMAC Test Keys (Legitimate Test Credentials)
|
||||
|
||||
| File | Key String | Byte Length |
|
||||
|------|------------|-------------|
|
||||
| `test_runtime_wiring.py:25` | `runtime-external-ingress-key-is-32bytes` | **39 bytes** |
|
||||
| `test_runtime_identity_binding.py:24` | `external-ingress-hmac-key-is-32-bytes` | **37 bytes** |
|
||||
| `test_runtime_ingress_flow.py:27` | `runtime-integration-ingress-key-32bytes!` | **40 bytes** |
|
||||
|
||||
These are hardcoded test-only HMAC keys used for deterministic signing in test fixtures. They are not production credentials.
|
||||
|
||||
## Secret Scan
|
||||
|
||||
### Method
|
||||
Manual pattern-based scan on the source commit tree at `502ef306`:
|
||||
|
||||
1. **Pattern: `API[Kk]ey\|sk-[a-zA-Z0-9]\{20,\}\|[Nn]pk\|secret\b`** — searched across all tracked files
|
||||
2. **Private key detection:** `-----BEGIN.*PRIVATE KEY-----` — searched across all tracked files
|
||||
3. **Auxiliary gitleaks evidence (external clean-room):** Codex ran gitleaks v8.30.1 on the source tree.
|
||||
- Git scan (commits): **312 commits scanned**, **0 findings**
|
||||
- Tree scan (files): **~1.21 MB scanned**, **0 findings**
|
||||
- Report: `/tmp/v2r1-cleanup-audit-git.json`, `/tmp/v2r1-cleanup-audit-tree.json`
|
||||
|
||||
### Findings
|
||||
- **0 matches** for API key or private key patterns in tracked source
|
||||
- **3 matches** for `b"\.\.\."` are the HMAC test keys listed above — **false positive, test-only credentials**
|
||||
- Gitleaks external scan: **0 findings**
|
||||
|
||||
**Result:** PASS
|
||||
|
||||
## Cleanup
|
||||
|
||||
- Workspace state at source: clean (no tracked modifications)
|
||||
- Conflict markers in source tree: **0**
|
||||
- Temporary test directories (e.g., test message ledgers): cleaned during pytest fixture teardown
|
||||
|
||||
**Result:** PASS
|
||||
|
||||
## Rollback
|
||||
|
||||
- **Rollback target:** `6077331addc71d090d454c123cc5de5460ab637e` (release/v2r1c0-rc1 base)
|
||||
- **Recovery steps:** `git checkout 6077331` → core tests (13 tests) → 13/13 PASS
|
||||
- **Recovery verified:** PASS
|
||||
|
||||
**Result:** PASS
|
||||
|
||||
## Deployment
|
||||
|
||||
| Operation | Performed |
|
||||
|-----------|-----------|
|
||||
| merge_performed | false |
|
||||
| tag_created | false |
|
||||
| baseline_promoted | false |
|
||||
| staging_deployed | false |
|
||||
| production_deployed | false |
|
||||
|
||||
## Recommendation
|
||||
|
||||
Gate 1 clean-room validation complete. **G1-PASS** — all 32 tests pass, workspace clean, secret scan clean, rollback verified.
|
||||
|
||||
## Evidence
|
||||
|
||||
- Source commit: `502ef30642597fb0b70b90ae2e8a0b6af217d80e`
|
||||
- Test run log: pytest exit code 0, 32/32 PASS
|
||||
- Rollback verification: `6077331`, 13/13 core tests PASS
|
||||
- Secret scan: 0 findings (manual) + 0 findings (gitleaks external)
|
||||
@@ -11,3 +11,7 @@ runtime/tmp/
|
||||
runtime/cache/
|
||||
logs/
|
||||
config/test_write_perms
|
||||
/data/webops.sqlite3
|
||||
/data/webops.sqlite3-wal
|
||||
/data/webops.sqlite3-shm
|
||||
/data/webops.sqlite3-journal
|
||||
|
||||
+18
-29
@@ -1,8 +1,7 @@
|
||||
<<<<<<< HEAD
|
||||
# AIOS Agent Command Plane Registry
|
||||
# Git is the single source of truth for all agent commands.
|
||||
version: 1.0.0
|
||||
created_at: 2026-07-08T15:20:00+08:00
|
||||
created_at: "2026-07-08T15:20:00+08:00"
|
||||
baseline: V1R3C1
|
||||
|
||||
commands:
|
||||
@@ -12,6 +11,22 @@ commands:
|
||||
completed_path: "agents/commands/completed/"
|
||||
failed_path: "agents/commands/failed/"
|
||||
|
||||
directories:
|
||||
commands/active: "New commands pending execution — Git is the only entry point"
|
||||
commands/running: "Commands currently being executed by an agent"
|
||||
commands/completed: "Commands that finished successfully — moved here on success"
|
||||
commands/failed: "Commands that finished with errors — moved here on failure"
|
||||
|
||||
lifecycle:
|
||||
new: active/
|
||||
running: running/
|
||||
success: completed/
|
||||
failure: failed/
|
||||
|
||||
# Command lifecycle state machine:
|
||||
# active/ → locked & moved to running/ → execute → success → completed/
|
||||
# → failure → failed/
|
||||
|
||||
policies:
|
||||
path: "agents/policies/"
|
||||
source: "git"
|
||||
@@ -38,30 +53,4 @@ audit:
|
||||
agent_runs: "audit/agent-runs/"
|
||||
version_history: "audit/version-history/"
|
||||
command_history: "audit/command-history/"
|
||||
=======
|
||||
# AIOS Agent Command Registry
|
||||
# Git is the single source of truth for all agent commands.
|
||||
|
||||
registry_version: 1.0.0
|
||||
created_at: "2026-07-08T15:44:00+08:00"
|
||||
baseline: V1R3C1
|
||||
|
||||
directories:
|
||||
commands/active: "New commands pending execution — Git is the only entry point"
|
||||
commands/running: "Commands currently being executed by an agent"
|
||||
commands/completed: "Commands that finished successfully — moved here on success"
|
||||
commands/failed: "Commands that finished with errors — moved here on failure"
|
||||
|
||||
state: agents/state/
|
||||
policies: agents/policies/
|
||||
|
||||
lifecycle:
|
||||
new: active/
|
||||
running: running/
|
||||
success: completed/
|
||||
failure: failed/
|
||||
|
||||
# Command lifecycle state machine:
|
||||
# active/ → locked & moved to running/ → execute → success → completed/
|
||||
# → failure → failed/
|
||||
>>>>>>> 4d18ee0 (feat(cmd): enable Agent Command Plane, audit plane, and Web UI dashboard)
|
||||
interaction_history: "audit/interaction-history/"
|
||||
|
||||
Binary file not shown.
@@ -1,4 +1,3 @@
|
||||
<<<<<<< HEAD
|
||||
# AIOS Agent Audit Plane Architecture
|
||||
|
||||
## Overview
|
||||
@@ -25,9 +24,10 @@ Agent Command Plane (agents/commands/)
|
||||
+---> Audit
|
||||
| |
|
||||
| v
|
||||
| audit/agent-runs/ (per-agent log)
|
||||
| audit/command-history/ (per-command log)
|
||||
| audit/version-history/ (per-baseline log)
|
||||
| audit/agent-runs/ (per-agent log)
|
||||
| audit/command-history/ (per-command log)
|
||||
| audit/version-history/ (per-baseline log)
|
||||
| audit/interaction-history/ (agent conversation traces)
|
||||
|
|
||||
+---> Git Commit
|
||||
|
|
||||
@@ -45,8 +45,39 @@ Agent Command Plane (agents/commands/)
|
||||
5. Git commit locks the audit record
|
||||
6. Web UI displays timeline from git history
|
||||
|
||||
## Directory Structure
|
||||
|
||||
```
|
||||
audit/
|
||||
├── agent-runs/ # Per-execution records (JSON)
|
||||
├── command-history/ # Command lifecycle history
|
||||
├── version-history/ # Version/baseline change log
|
||||
└── interaction-history/ # Agent conversation traces
|
||||
```
|
||||
|
||||
## Audit Record Schema
|
||||
|
||||
Current agent-run records use the following fields:
|
||||
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| agent_run_id | Unique execution ID |
|
||||
| command | Command file name |
|
||||
| agent | Executing agent name |
|
||||
| version | Baseline version at execution time |
|
||||
| objective | Human-readable goal |
|
||||
| start_time | ISO-8601 start timestamp |
|
||||
| end_time | ISO-8601 completion timestamp |
|
||||
| interaction_count | Agent-owner interaction turns |
|
||||
| tool_call_count | Tool invocations during execution |
|
||||
| changed_files | Files modified in this run |
|
||||
| commit_sha | Git commit hash |
|
||||
| test_result | Test verification outcome |
|
||||
| final_result | SUCCESS / FAILED / PARTIAL |
|
||||
| evidence_path | Link to evidence directory |
|
||||
|
||||
Legacy records remain valid and may use the following compatibility shape:
|
||||
|
||||
```json
|
||||
{
|
||||
"id": "",
|
||||
@@ -72,51 +103,6 @@ Agent Command Plane (agents/commands/)
|
||||
- Every code change must be traceable to who/what agent created it
|
||||
- No agent-created changes without audit trail
|
||||
|
||||
## Related
|
||||
|
||||
- [Agent Command Plane](../agents/README.md)
|
||||
- [Baseline System](baseline-system.md)
|
||||
=======
|
||||
# AIOS Agent Audit Plane
|
||||
|
||||
## Purpose
|
||||
|
||||
Every agent action is recorded. All code changes are traceable to:
|
||||
- Who made the change
|
||||
- Why the change was made
|
||||
- When it was made
|
||||
- Which version introduced it
|
||||
- What test results showed
|
||||
|
||||
## Directory Structure
|
||||
|
||||
```
|
||||
audit/
|
||||
├── agent-runs/ # Per-execution records (JSON)
|
||||
├── command-history/ # Command lifecycle history
|
||||
├── version-history/ # Version/baseline change log
|
||||
└── interaction-history/ # Agent conversation traces
|
||||
```
|
||||
|
||||
## Agent Run Record
|
||||
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| agent_run_id | Unique execution ID |
|
||||
| command | Command file name |
|
||||
| agent | Executing agent name |
|
||||
| version | Baseline version at execution time |
|
||||
| objective | Human-readable goal |
|
||||
| start_time | ISO-8601 start timestamp |
|
||||
| end_time | ISO-8601 completion timestamp |
|
||||
| interaction_count | Agent-owner interaction turns |
|
||||
| tool_call_count | Tool invocations during execution |
|
||||
| changed_files | Files modified in this run |
|
||||
| commit_sha | Git commit hash |
|
||||
| test_result | Test verification outcome |
|
||||
| final_result | SUCCESS / FAILED / PARTIAL |
|
||||
| evidence_path | Link to evidence directory |
|
||||
|
||||
## Version History
|
||||
|
||||
Records baseline promotions, rollbacks, and version changes.
|
||||
@@ -127,6 +113,9 @@ Conversation logs between agent and owner for each command execution.
|
||||
|
||||
## Audit Trail Requirement
|
||||
|
||||
All changes tracked via Git with signed commits where possible.
|
||||
Every commit message references the originating Command ID.
|
||||
>>>>>>> 4d18ee0 (feat(cmd): enable Agent Command Plane, audit plane, and Web UI dashboard)
|
||||
All changes are tracked via Git with signed commits where possible. Every commit references the originating Command ID.
|
||||
|
||||
## Related
|
||||
|
||||
- [Agent Command Plane](../agents/README.md)
|
||||
- [Baseline System](baseline-system.md)
|
||||
|
||||
Reference in New Issue
Block a user