feat(governed): port Implementation Baseline 1.1 (57 files)
Apply the approved Implementation Baseline 1.1 architecture revisions onto the
current mainline, verified faithful to the delivered change bundle:
- Add aios_baseline: signed owner-delegation-grant.v1 / operational-epoch.v1 /
task-principal.v1 auth chain, runtime contract + deployment-truth evaluator,
declarative operation registry (effect-class + fail-closed dispatch),
lineage ledger, release/recipe/saga ledger, bounded optimization controller,
authenticated HTTP transport, resident worker loop and systemd host probe.
- Extend existing Job authority (aios_gitops_job_controller/executor) with
durable intent/receipt/reconcile and fail-closed admission; harden
task_plane/store heartbeat CAS and terminal-state fencing; make
reconciliation_controller fail-closed on incomplete/drift evidence.
- Add isolated-validation profile templates (deploy/baseline-v1.1, systemd
.example), source change/rollback tooling (tools/baseline_v1_1), the
AT-01..AT-23 acceptance matrix, M0-M5 runbook, installation/rollback docs and
the baseline_v1_1 test suite.
- Keep legacy write authorities untouched; isolated-validation profile only.
Staged blobs verified byte-identical to the delivered source-changes bundle.
Cross-platform baseline tests pass; systemd/fcntl-dependent paths require the
declared Linux x86_64 + CPython 3.12 + systemd runtime (site-bound).
owner
6ffd7fe19c