# Owner-approved GPT HTTPS edge activation and rollback

## Scope

This controller is the final host-side control mechanism before the disabled-by-default GPT HTTPS
edge may bind publicly.

Repository implementation and public activation remain separate states:

```text
IMPLEMENTED
≠
OWNER_APPROVED
≠
ACTIVATED
≠
RUNTIME_VERIFIED
```

The controller never creates owner approval, TLS assets, DNS, firewall rules or ingress bearer
credentials.

## Approval binding

The owner approval file is root-owned mode `0600` and has schema:

```json
{
  "schema": "aios.gpt-https-edge.public-approval.v1",
  "approval_id": "owner-public-edge-...",
  "candidate_oid": "<exact governed edge candidate>",
  "domain": "tasks.example.com",
  "public_bind": true,
  "bind_host": "0.0.0.0",
  "port": 18443,
  "tls_cert_sha256": "<exact certificate sha256>",
  "issued_at": "2026-08-19T00:00:00Z",
  "not_before": "2026-08-19T00:00:00Z",
  "expires_at": "2026-08-20T00:00:00Z",
  "owner": "<owner identity>"
}
```

Approval lifetime is at most seven days. Candidate/domain/bind/port/certificate are immutable within
one approval.

Changing any of those requires a new owner approval.

## Check

```text
aios_gpt_https_edge_activation.py check --candidate <GE>
```

Checks:

- approval ownership/mode/schema/time window;
- exact candidate binding;
- exact certificate hash;
- certificate/private-key pair;
- certificate hostname;
- certificate remaining lifetime;
- loopback GPT ingress service health.

It performs no public network mutation.

## Activate

`activate` additionally:

- writes one exact systemd public-bind drop-in atomically;
- enables/restarts only the HTTPS edge unit;
- verifies effective ExecStart points at the immutable candidate release;
- verifies effective public-bind/domain environment;
- performs a TLS handshake to `127.0.0.1:18443` using the approved public hostname;
- writes a durable activation receipt.

Any failure after drop-in mutation automatically invokes rollback.

Exact replay of an already-active matching approval returns the durable receipt without restarting
or creating duplicate state.

## Rollback

`rollback`:

- stops and disables only the HTTPS edge;
- removes only the controller-owned public-bind drop-in;
- daemon-reloads systemd;
- verifies edge inactive;
- writes a durable rollback receipt.

It does not delete:

- owner approval;
- TLS certificate/private key;
- ingress bearer token;
- internal loopback ingress;
- Task/Job state;
- Git branches.

Rollback is therefore replay-safe and does not require reconstructing secrets.

## Not covered

This controller intentionally does not own:

- DNS records;
- host firewall/NAT/security-group changes;
- certificate issuance/renewal;
- OpenAI Custom GPT domain verification;
- public Internet acceptance from outside the host.

Those remain separate owner/environment gates.