[Unit]
Description=AIOS manifest-driven release controller (validation only)
ConditionPathExists=/var/lib/aios-release/release-source-manifest.json
ConditionPathExists=/var/lib/aios-release/release-request.json
After=network-online.target

[Service]
Type=oneshot
User=aios-release
Group=aios-release
Environment=PYTHONPATH=/opt/aios/release-controller
Environment=AIOS_GITOPS_WRITES_ENABLED=false
Environment=AIOS_PRODUCTION_DEPLOYMENT_AUTHORIZED=false
ExecStart=/usr/bin/python3 -m aios_release_controller.cli validate-release /var/lib/aios-release/release-source-manifest.json /var/lib/aios-release/release-request.json
NoNewPrivileges=yes
PrivateTmp=yes
ProtectSystem=strict
ProtectHome=yes
ReadWritePaths=/var/lib/aios-release
CapabilityBoundingSet=
RestrictAddressFamilies=AF_UNIX

[Install]
WantedBy=multi-user.target