268 lines
5.8 KiB
Markdown
268 lines
5.8 KiB
Markdown
# 执行 GitOps 独立 Worktree 与统一运行身份迁移
|
||
|
||
```yaml
|
||
task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
|
||
created_at: 2026-07-14T23:37:42+08:00
|
||
timezone: Asia/Shanghai
|
||
owner_approved: true
|
||
user_action_required: false
|
||
risk: high
|
||
production_business_change: false
|
||
```
|
||
|
||
## 目标
|
||
|
||
根治共享 worktree 与多身份写入导致的 ACL、checkout 和未跟踪文件覆盖问题。
|
||
|
||
实施：
|
||
|
||
1. 统一 GitOps/OpenClaw 写入身份为 `aiman:gitops`；
|
||
2. 统一 `UMask=0002`；
|
||
3. 为 GitOps 根目录设置 setgid 与默认 ACL；
|
||
4. 建立 bare repo 和每任务独立 worktree；
|
||
5. 启用任务启动前自检；
|
||
6. 验证 OpenClaw 与 ChatGPT 并发任务互不干扰；
|
||
7. 保留原共享 workspace 作为只读回滚源，禁止智能体继续在其中切换分支。
|
||
|
||
## 强制通知
|
||
|
||
收到任务后立即微信通知 Owner：
|
||
|
||
```text
|
||
【任务已接收】GitOps独立worktree与统一运行身份迁移开始。将暂停写入服务、建立独立任务工作树并验证并发执行；生产业务版本不变。
|
||
```
|
||
|
||
任务结束后无论 PASS、BLOCKED 或 ROLLED_BACK，立即微信汇报结果并记录 message_id。
|
||
|
||
## 1. 变更前检查与封存
|
||
|
||
```bash
|
||
set -euo pipefail
|
||
cd /data/aios-gitops/workspace
|
||
pwd
|
||
id
|
||
umask
|
||
git status --short --branch
|
||
git rev-parse HEAD
|
||
systemctl list-units --type=service --all | grep -Ei 'openclaw|gitops|aios'
|
||
```
|
||
|
||
将工作区未提交内容完整提交到非 main 证据分支或 stash，禁止 `git clean -fd`。
|
||
|
||
记录当前运行服务、用户、组、umask、PID、工作区 HEAD 和未跟踪文件清单。
|
||
|
||
## 2. 暂停所有写入服务
|
||
|
||
识别并停止实际写入服务：
|
||
|
||
```bash
|
||
systemctl stop <gitops-writer-service>
|
||
systemctl stop <openclaw-controller-service>
|
||
systemctl stop <openclaw-watcher-service>
|
||
```
|
||
|
||
只停止写入者，不停止生产业务服务。记录每条命令和退出码。
|
||
|
||
## 3. 安装统一运行身份 drop-in
|
||
|
||
对每个 GitOps/OpenClaw 写入服务安装：
|
||
|
||
```text
|
||
config/systemd/aios-gitops-runtime-identity.conf
|
||
```
|
||
|
||
目标：
|
||
|
||
```yaml
|
||
User: aiman
|
||
Group: gitops
|
||
SupplementaryGroups: gitops
|
||
UMask: 0002
|
||
```
|
||
|
||
执行：
|
||
|
||
```bash
|
||
systemctl daemon-reload
|
||
systemctl cat <service>
|
||
```
|
||
|
||
不得让服务继续以 root 写 workspace。
|
||
|
||
## 4. 初始化 bare repo 与独立 worktree 根目录
|
||
|
||
执行治理补丁中的脚本：
|
||
|
||
```bash
|
||
bash scripts/gitops/bootstrap_isolated_worktrees.sh
|
||
```
|
||
|
||
验收：
|
||
|
||
```yaml
|
||
bare_repo: /data/aios-gitops/repo.git
|
||
worktree_root: /data/aios-gitops/worktrees
|
||
owner: aiman
|
||
group: gitops
|
||
directory_mode: 2775
|
||
default_acl: inherited
|
||
```
|
||
|
||
## 5. 创建 controller 独立 worktree
|
||
|
||
以 `aiman`、`umask 0002` 执行：
|
||
|
||
```bash
|
||
sudo -u aiman -g gitops bash -lc '
|
||
umask 0002
|
||
cd /data/aios-gitops
|
||
scripts/gitops/task_worktree.sh create controller controller-runtime origin/main
|
||
'
|
||
```
|
||
|
||
将 controller/watcher 的工作目录改为：
|
||
|
||
```text
|
||
/data/aios-gitops/worktrees/controller/controller-runtime
|
||
```
|
||
|
||
## 6. 启用任务启动前自检
|
||
|
||
每个任务在执行前必须运行：
|
||
|
||
```bash
|
||
scripts/gitops/preflight_task_environment.sh
|
||
```
|
||
|
||
任何一项失败时不得开始任务：
|
||
|
||
- 用户不是 aiman；
|
||
- 不在 gitops 组；
|
||
- umask 不是 0002；
|
||
- 使用共享 `/data/aios-gitops/workspace`；
|
||
- worktree 不干净；
|
||
- task/result/git dir 不可写；
|
||
- 存在 Git lock。
|
||
|
||
## 7. 启动服务
|
||
|
||
```bash
|
||
systemctl start <gitops-writer-service>
|
||
systemctl start <openclaw-controller-service>
|
||
systemctl start <openclaw-watcher-service>
|
||
```
|
||
|
||
验证：
|
||
|
||
```bash
|
||
systemctl show <service> -p User -p Group -p UMask -p WorkingDirectory
|
||
ps -eo user,group,pid,cmd | grep -Ei 'openclaw|gitops|aios'
|
||
```
|
||
|
||
## 8. 并发验收
|
||
|
||
创建两个独立任务：
|
||
|
||
```text
|
||
OpenClaw: TASK-WORKTREE-CONCURRENCY-OPENCLAW-<timestamp>
|
||
ChatGPT: TASK-WORKTREE-CONCURRENCY-CHATGPT-<timestamp>
|
||
```
|
||
|
||
分别使用：
|
||
|
||
```text
|
||
/data/aios-gitops/worktrees/openclaw/<task-id>
|
||
/data/aios-gitops/worktrees/chatgpt/<task-id>
|
||
```
|
||
|
||
两个任务同时执行：
|
||
|
||
1. 写各自 `.agent/tasks/<agent>/`；
|
||
2. 写各自 `.agent/results/<agent>/`；
|
||
3. 创建深层子目录，验证默认 ACL；
|
||
4. commit；
|
||
5. push；
|
||
6. 不切换共享 workspace 分支。
|
||
|
||
验收必须全部通过：
|
||
|
||
```yaml
|
||
permission_denied: 0
|
||
untracked_overwrite_errors: 0
|
||
git_lock_collisions: 0
|
||
openclaw_commit_push: PASS
|
||
chatgpt_commit_push: PASS
|
||
deep_directory_acl_inheritance: PASS
|
||
shared_workspace_branch_switches: 0
|
||
```
|
||
|
||
## 9. 回滚
|
||
|
||
若迁移失败：
|
||
|
||
1. 停止新服务；
|
||
2. 保留失败 worktree 供审计；
|
||
3. 恢复 systemd drop-in 备份；
|
||
4. `daemon-reload`；
|
||
5. 恢复原服务状态；
|
||
6. 不删除 `/data/aios-gitops/workspace`；
|
||
7. 生产业务保持不变。
|
||
|
||
## 10. 结果文件
|
||
|
||
提交：
|
||
|
||
```text
|
||
.agent/results/openclaw/RESULT-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8.md
|
||
```
|
||
|
||
首段必须包含：
|
||
|
||
```yaml
|
||
status: PASS | BLOCKED | ROLLED_BACK
|
||
task_id: TASK-GITOPS-ISOLATED-WORKTREE-MIGRATION-20260714T233742UTC8
|
||
created_at: 2026-07-14T23:37:42+08:00
|
||
timezone: Asia/Shanghai
|
||
user_action_required: false
|
||
runtime_identity:
|
||
user:
|
||
group:
|
||
umask:
|
||
bare_repo:
|
||
worktree_root:
|
||
controller_worktree:
|
||
services:
|
||
default_acl:
|
||
preflight:
|
||
concurrency_test:
|
||
openclaw_branch:
|
||
openclaw_commit:
|
||
chatgpt_branch:
|
||
chatgpt_commit:
|
||
permission_denied_count:
|
||
untracked_overwrite_count:
|
||
git_lock_collision_count:
|
||
owner_notifications:
|
||
received_message_id:
|
||
terminal_message_id:
|
||
rollback:
|
||
remaining_risks:
|
||
next_step:
|
||
```
|
||
|
||
提交并推送到独立执行分支。禁止直接推 main。
|
||
|
||
## 完成微信模板
|
||
|
||
PASS：
|
||
|
||
```text
|
||
【任务完成】GitOps独立worktree迁移已通过。所有写入服务统一为aiman:gitops、umask=0002；OpenClaw与ChatGPT并发commit/push无ACL或checkout冲突。生产业务版本未变化。
|
||
```
|
||
|
||
阻塞：
|
||
|
||
```text
|
||
【任务阻塞】GitOps独立worktree迁移未通过。原因=<具体服务/权限/并发验收>；已保留原workspace和回滚能力，生产业务未变化。
|
||
```
|