59 lines
2.9 KiB
JSON
59 lines
2.9 KiB
JSON
{
|
||
"schema": "aios.v2.agent-blockers.v1",
|
||
"task_id": "AIOS-V2R1-PRODUCTION-DEPLOY-20260720",
|
||
"updated_at": "2026-07-20T10:17:49Z",
|
||
"evidence_writer": "windows-chatgpt-owner",
|
||
"blockers": [
|
||
{
|
||
"blocker_id": "BLK-OPENCLAW-PLAINTEXT-SECRETS",
|
||
"severity": "high",
|
||
"status": "resolved",
|
||
"root_cause": "OpenClaw managed config、auth profile store 与 models.json 存在三处明文凭据。",
|
||
"fix": "使用 OpenClaw 原生 secrets apply 迁移为单一 file Secret Provider；Gateway Token 已轮换，OneAPI 使用单一 auth-profile SecretRef。",
|
||
"verification": "audit plaintext/unresolved/shadowed/legacy 全部为 0，实际 OneAPI agent 调用通过。",
|
||
"commit": "bf01a13f3aaf42a386232ed2f5409feb0f79fcf6",
|
||
"resolved_at": "2026-07-20T10:17:49Z"
|
||
},
|
||
{
|
||
"blocker_id": "BLK-AIOS-V2-SIGNING-MATERIAL-MISSING",
|
||
"severity": "high",
|
||
"status": "resolved",
|
||
"root_cause": "Key ID 标称 Ed25519，但代码实际使用 HMAC 且材料文件缺失。",
|
||
"fix": "签名合同改为真实 Ed25519，并由 Owner 在受保护边界生成运行材料。",
|
||
"verification": "aios:aios 0600；resolver sign/verify 与篡改拒绝通过。",
|
||
"commit": "8a36f7832bc105e4b9d32ffbe018abed2ff1b1ab",
|
||
"resolved_at": "2026-07-20T10:17:49Z"
|
||
},
|
||
{
|
||
"blocker_id": "BLK-CANDIDATE-NOT-MERGED",
|
||
"severity": "high",
|
||
"status": "resolved",
|
||
"root_cause": "OpenClaw 任务未包含最新 Candidate。",
|
||
"fix": "保护 Evidence 后以 --no-ff 合并 Candidate ba7669c。",
|
||
"verification": "Candidate 为任务分支祖先，普通 Push 后 local_oid 等于 gitea_oid。",
|
||
"commit": "f55dfd975e9d716b690c7693742e7cf2beaa55e7",
|
||
"resolved_at": "2026-07-20T10:17:49Z"
|
||
},
|
||
{
|
||
"blocker_id": "BLK-OPENCLAW-RUN-PROVENANCE-MISSING",
|
||
"severity": "high",
|
||
"status": "blocked",
|
||
"root_cause": "现有插件只有进程内 runId/sender trust Map，没有 Owner-signed task provenance schema、持久 Store 或受限 Evidence 写工具。",
|
||
"fix": "禁止用 run-key fallback 绕过；等待经审查的 issuer/store/writer 或外部同等受信系统。",
|
||
"verification": "当前无法完成 7 路径写测试与越权拒绝审计。",
|
||
"commit": "bf01a13f3aaf42a386232ed2f5409feb0f79fcf6",
|
||
"resolved_at": null
|
||
},
|
||
{
|
||
"blocker_id": "BLK-CONTROLLER-LEGACY-GITEA-CHECK",
|
||
"severity": "high",
|
||
"status": "resolved",
|
||
"root_cause": "Controller 硬编码旧 aios-v23 仓库与 API，无法区分本地和 Gitea OID。",
|
||
"fix": "配置化 V2R1 仓库/分支，使用只读 systemd Credential，部署到 detached clean 工作树。",
|
||
"verification": "12 项测试通过；gitea/branch_sync/oid_match 为 true，sync_status=fully_synced。",
|
||
"commit": "6188da26453505dacde9d6d298191437164c8d27",
|
||
"resolved_at": "2026-07-20T10:17:49Z"
|
||
}
|
||
]
|
||
}
|