release: add V1R4C5 version metadata after tag verification

docs/releases/V1R4C5-final-owner-approval.md

@@ -0,0 +1,54 @@
+# V1R4C5 Final Owner Approval
+
+Date: 2026-07-11
+
+Status: approved for final promotion
+
+## Owner Decision
+
+Owner approved final V1R4C5 promotion.
+
+Memory search must remain disabled.
+
+```text
+允许最终晋升
+继续保持 memory search 关闭
+```
+
+## Promotion Scope
+
+Approved for V1R4C5:
+
+1. SR-01 Gitea reliability and branch consistency guardrails.
+2. SR-02 watcher/stuck command cleanup.
+3. User data isolation redline and enforcement gates.
+4. SR-04 admin workbench read-only visibility preparation only.
+
+## Explicit Non-Activation
+
+The following are not approved by this promotion:
+
+```text
+memory search activation
+full cross-session memory recall
+global vector index
+full SR-04 production portal rollout beyond read-only/admin visibility preparation
+bulk merge of old test/smoke/auth branches
+force-push based reconciliation
+```
+
+## Required Runtime State
+
+Memory remains disabled:
+
+```text
+AIOS_MEMORY_ENABLED=false
+```
+
+If a provider or deployment attempts to enable memory/search, it must be blocked unless a future owner approval explicitly allows it after the user-data isolation activation gate returns allowed.
+
+## Final Promotion Rule
+
+V1R4C5 may proceed to tag/promotion under owner gate.
+
+If any final gate fails, promotion must stop and memory/search must remain disabled.

versions/V1R4C5.json

@@ -0,0 +1,54 @@
+{
+  "version": "V1R4C5",
+  "codename": "C5 reliability-security-admin-readonly",
+  "status": "tagged-promotion-pending",
+  "tag": "V1R4C5",
+  "tag_commit": "d457ac396147043ed5d0a3fd8b44bcb10f48bceb",
+  "tag_remote_verified": true,
+  "base_baseline": "V1R4C3",
+  "previous_baseline": "V1R4C3",
+  "created_at": "2026-07-11",
+  "created_by": "chatgpt-gitops-bot",
+  "release_type": "controlled-integration",
+  "promotion_policy": "owner-gated",
+  "owner_approval": {
+    "final_promotion_approved": true,
+    "memory_search_enabled": false,
+    "force_push_allowed": false
+  },
+  "scope": {
+    "included": [
+      "SR-01 Gitea reliability and branch consistency guardrails",
+      "SR-02 watcher/stuck command cleanup",
+      "User data isolation redline and enforcement gates",
+      "SR-04 admin workbench read-only visibility preparation"
+    ],
+    "excluded": [
+      "memory search activation",
+      "full cross-session memory recall",
+      "global vector index",
+      "full SR-04 production portal rollout",
+      "bulk merge of old test/smoke/auth branches",
+      "force-push based reconciliation"
+    ]
+  },
+  "acceptance": {
+    "runtime_status": "active",
+    "runtime_write_acceptance": "passed-clean-branch",
+    "gitea_sentinel": "healthy-before-final-promotion-check-required",
+    "sr02_tests": "11/11 pass; rerun on final integration candidate required",
+    "user_data_isolation": "gate implemented; memory remains disabled",
+    "admin_workbench": "read-only visibility preparation only"
+  },
+  "deployment_constraints": {
+    "AIOS_MEMORY_ENABLED": false,
+    "memory_search_activation_requires_future_owner_approval": true,
+    "gitea_db_mutation_requires_owner_admin_approval": true,
+    "sr04_full_rollout_deferred": true
+  },
+  "rollback_policy": {
+    "memory_search": "remain disabled",
+    "sr04": "disable read-only visibility slice if RBAC or isolation check fails",
+    "gitea": "enter autonomous safe mode if branch consistency drift detected"
+  }
+}