aios/docs/autonomous-release/V2R1C4_AGENT_FINAL_EXECUTION.md

AIOS V2R1C4 Dormant Release — Final Agent Execution Contract

1. Purpose

This document is the machine/operator execution contract for completing the governed V2R1C4 dormant release after Candidate development is frozen.

It does not grant production authority. Every consequential action remains subject to the exact approval, Git reference, artifact, tag, Registry and Baseline gates defined below.

2. Release mode

The only permitted deployment mode for V2R1C4 is:

deployment_mode=dormant_shadow_only

The following values are mandatory before, during and after deployment:

AIOS_GITOPS_WRITES_ENABLED=false
AIOS_TASK_PLANE_EXECUTION_ENABLED=false
AIOS_SILENT_RELEASE_EXECUTION_ENABLED=false
AIOS_PRODUCTION_DEPLOYMENT_ENABLED=false
production_side_effects=false
native_openclaw_enabled=false
native_codex_enabled=false
automatic_release_enabled=false
activation_deferred=true
protectedDispatchTransport=sandbox

Any deviation is a hard stop.

3. Authoritative branches

candidate_branch=patch/chatgpt-autonomous-completion-contract-20260726
integration_branch=integration/chatgpt-autonomous-completion-20260726
production_branch=main
version=V2R1C4
pull_request=20

Never infer a target OID from workspace HEAD. Always read and record full 40-character OIDs.

4. Phase A — Candidate freeze and verification

1. Read the current Candidate OID and tree OID.
2. Verify the Candidate worktree is clean.
3. Verify four-way Candidate reference closure:
   • local branch ref;
   • authoritative bare ref;
   • git ls-remote ref;
   • Gitea API branch ref.
4. Run the complete test and static validation suite defined in V2R1C4_TEST_AND_RELEASE_CHECKLIST.md.
5. Build the deterministic Candidate artifact and manifest from the exact Candidate OID.
6. Record:
   • artifact SHA-256;
   • manifest SHA-256;
   • package closure SHA-256;
   • test evidence SHA-256;
   • rollback artifact SHA-256;
   • production configuration SHA-256.
7. Do not reuse any digest generated from an older Candidate OID.

Failure state:

CANDIDATE_ACCEPTANCE_BLOCKED

5. Phase B — Integration refresh

1. Refresh the Integration branch from the latest Candidate using a governed non-fast-forward merge.
2. Use:

merge --no-ff

3. Do not squash, rebase, force push or rewrite Candidate history.
4. Verify the Candidate OID is reachable from the new Integration OID.
5. Verify four-way Integration reference closure.
6. Run the full Candidate test suite again from the Integration worktree.
7. Rebuild Integration evidence and Candidate package metadata if any tracked file changed during the merge.

Failure state:

INTEGRATION_ACCEPTANCE_BLOCKED

6. Phase C — Candidate acceptance

Create Candidate acceptance evidence and execute:

python scripts/autonomous-release/run_acceptance.py \
  --phase candidate \
  --input <candidate-evidence.json> \
  --output <candidate-acceptance.json>

The result must contain:

phase=candidate
status=READY
production_action_authorized=false

The Candidate gate must verify:

candidate_four_way_ref_closure=true
integration_four_way_ref_closure=true
candidate_reachable_from_integration=true
worktree_clean=true
tests_failed=0
tests_passed>0

It must also verify all dormant runtime flags remain disabled.

READY authorizes review only. It does not authorize merge, deployment, tagging, Registry writes or Baseline writes.

7. Phase D — Pre-merge owner approval

Obtain a governed Owner approval plan for the exact Integration package.

The approval subject must bind at least:

version
pull_request
candidate_oid
candidate_tree_oid
integration_oid
integration_tree_oid
candidate_acceptance_digest
candidate_release_digest
artifact_sha256
manifest_sha256
package_closure_sha256
evidence_closure_oid
rollback_artifact_sha256
production_config_sha256
deployment_mode=dormant_shadow_only
all execution flags=false

The approval must not predeclare the final production target OID.

Without an Owner-approved plan, stop with:

BLOCKED_EXTERNAL_OWNER_SIGNATURE

8. Phase E — Governed merge

1. Merge PR #20 only through the governed merge path.
2. Do not push directly to main.
3. After merge, read the exact resulting main merge OID and tree OID.
4. Verify four-way main reference closure.
5. Verify the merged Integration OID is reachable from the final main merge OID.
6. Never use the Integration OID as the production target OID.

Failure state:

MAIN_RECONCILIATION_REQUIRED

9. Phase F — Production artifact rebuild

Rebuild all production artifacts from the exact final main merge OID.

Record new values for:

artifact_sha256
manifest_sha256
package_closure_sha256
evidence_closure_oid
rollback_artifact_sha256
production_config_sha256

Candidate or Integration artifacts may not be promoted by renaming or metadata substitution. The final artifact must be demonstrably rebuilt from the final production target.

10. Phase G — Final release digest and Owner approval

1. Construct the FinalDormantRelease object using the final main target and rebuilt artifact evidence.
2. Compute its exact release_digest.
3. Obtain an Owner approval receipt bound to that exact digest.
4. Record:

approval_plan_id
approval_receipt_sha256
approved_release_digest
owner_approval_verified=true

Required equality:

approved_release_digest == FinalDormantRelease.digest()

A generic approval, previous approval, Candidate approval or Integration approval is insufficient.

11. Phase H — Final acceptance

Execute:

python scripts/autonomous-release/run_acceptance.py \
  --phase final \
  --input <final-evidence.json> \
  --output <final-acceptance.json>

The result must contain:

phase=final
status=READY
production_action_authorized=false

Required final evidence:

main_four_way_ref_closure=true
target_is_main_head=true
worktree_clean=true
artifact_rebuilt_from_target=true
rollback_verified=true
runtime_boundary_verified=true
owner_approval_verified=true
approved_release_digest=<exact final release digest>

The acceptance report is evidence, not an execution credential.

12. Phase I — Dormant deployment

Deployment requires a separate production execution approval referencing:

version=V2R1C4
target_oid=<final main merge OID>
evidence_closure_oid=<final evidence closure OID>
approval_plan_id=<approved plan>
final_acceptance_digest=<final acceptance digest>

Deploy only the dormant runtime. Before starting services, verify all disabled flags and the sandbox transport in the rendered production configuration.

After start, verify:

services_active=true
loopback_bindings_only=true
production_side_effects=false
write_endpoints_disabled=true
task_plane_execution_disabled=true
silent_release_execution_disabled=true
native_agent_execution_disabled=true

If any side-effect-capable path is active, stop services and mark:

DORMANT_RUNTIME_BOUNDARY_VIOLATION

13. Phase J — Tag governance

Tagging is permitted only after dormant deployment verification and exact Owner approval.

Every tag request must carry:

version=V2R1C4
target_oid=<full final main merge OID>
evidence_closure_oid=<full final evidence closure OID>
approval_plan_id=<approved plan ID>

When an existing same-name tag is found:

• identical tag OID and peeled target: treat as idempotent and reverify;
• different tag OID or peeled target: stop with MANUAL_OWNER_REVIEW_REQUIRED.

Never force push, delete, move or rewrite a formal tag.

14. Phase K — Remote and Gitea tag acceptance

Before any Registry or Baseline update, verify:

local_tag_exists=true
remote_tag_exists=true
gitea_api_tag_exists=true
local_tag_oid == remote_tag_oid
remote_peeled_target_oid == target_oid
gitea_peeled_target_oid == target_oid
repository_identity=aios/aios

For annotated tags, verify both the tag object and peeled commit.

Failure state:

REMOTE_PUSH_PENDING

or:

RECONCILIATION_REQUIRED

15. Phase L — Registry and Baseline

Only after remote and Gitea tag acceptance:

1. register or update the V2R1C4 Registry entry;
2. reread the Registry and verify the exact target OID;
3. update the Production Baseline to V2R1C4;
4. reread the Baseline;
5. run final release consistency acceptance.

Required equality:

Registry version
= Production Baseline
= local refs/tags/V2R1C4
= remote refs/tags/V2R1C4
= Gitea API tag
= expected final main target

Do not write PRODUCTION_DEPLOYED before this equality is proven.

16. Rollback

If deployment verification fails:

1. disable the V2R1C4 Candidate services;
2. preserve evidence and logs;
3. submit a governed rollback request with the target version and reason;
4. distinguish requested, approved, executed and verified states.

Do not delete tags, rewrite history or independently perform a production rollback.

17. Mandatory stop conditions

Stop without consequential execution when any of the following is missing or false:

four_way_ref_closure
clean_worktree
full_test_closure
artifact_digest_verification
rollback_evidence
runtime_boundary_verification
exact_owner_approval
exact_target_oid
exact_evidence_closure_oid
exact_approval_plan_id
remote_tag_verification
gitea_tag_verification

18. Final report schema

Return:

execution_status=COMPLETED|PARTIALLY_COMPLETED|BLOCKED|FAILED
candidate_oid=<full OID>
integration_oid=<full OID>
main_target_oid=<full OID>
artifact_sha256=<digest>
manifest_sha256=<digest>
package_closure_sha256=<digest>
evidence_closure_oid=<full OID>
candidate_acceptance_status=<status>
final_acceptance_status=<status>
owner_approval_verified=<bool>
dormant_deployment_verified=<bool>
local_tag_verified=<bool>
remote_tag_verified=<bool>
gitea_tag_verified=<bool>
registry_verified=<bool>
baseline_verified=<bool>
release_consistency=<status>

Always include:

force_push_used: false
tag_rewritten: false
direct_main_push: false
secrets_committed: false
owner_approval_respected: true