AIOS Action contract repair evidence — 2026-08-25

Disposition

Final disposition: NEEDS_REWORK.

The contract repair is deployed to staging and the focused acceptance checks are green. The task is not eligible for SUCCEEDED: runReleaseAcceptance returns structured policy output with accepted=false because the existing publication state for protected tag V2R2C1 is REMOTE_PUSH_PENDING, and the repository-wide suite still has the two pre-existing signer/event-bus failures recorded below. The online Task API row is still QUEUED; it was not changed by direct database manipulation or an unauthorized synthetic claim/result.

No production release, main, release tag, baseline registry, or production service was directly modified.

Scope and pre-change facts

Repository: aios/aios; governed branch: agent/fix-action-contracts-20260825-1407.
Initial task branch HEAD: 35eec9afe1432e8466d60040b2fb1049bb41242a.
Stable reference: V2R2C1; source commit 998d30304787e31e5ae607c0bd86b5edb2b0e5ad; evidence closure a8b906d1bc24088c19647e98de6a679268f6d0a2.
Pre-change refs: authority main=3244f0f17f8845592ac94d585f5ebd65693c9f29, tag V2R2C1=07fc2746b688f5f243f29b39de39f32edc3dd9d2; these remained unchanged.
Staging services run as User=aiman, Group=gitops. The actual staging Gitea API base is https://g.cnnetmkt.top/git/api/v1, supplied by systemd environment rather than business-code host constants.
Pre-change full test baseline: 707 passed, 2 skipped, 154 subtests passed, 2 failed. The failures were the stale /tmp/aios-agent-events-test event-bus fixture and the real signer self-test.

Root causes and repairs

Gitea URL validation occurred at release-operation time while the staging overlay's API environment was not consistently projected into all runtime paths. The canonical HTTP(S) validator is now called during model and Bridge startup; getReleaseConsistency and runReleaseAcceptance use the actual staging environment URL.
silent-release was not consistently writable by the real service identity, and the credential helper parent directory blocked aiman traversal. The persisted staging systemd overlay creates the state directory as aiman:gitops mode 0750 and grants only u:aiman:--x on /usr/local/libexec; no world-writable mode was used. The staging bridge also has the minimum repository write path required by the governed AuthorityGitExecutor/CAS flow.
Release version parsing was split across callers and rejected V2R2C1. A shared canonical parser now accepts ^V[0-9]+R[0-9]+C[0-9]+$ plus the existing bounded suffix form, and is used by capabilities, release candidate, consistency, acceptance, tag publication, and release/tag queries.
The runtime operation contract required files but the published Action schema omitted it. commitFilesGoverned now has one contract source and published schema projection, with parity tests. A real governed two-file commit completed on isolated branch agent/action-contract-integration-20260825-1407; authority, Git remote, and Gitea API all read back OID 0345cd8c70967940bc8e9132dff7d6ea11efa304.
reconcileGitOpsJob reconstructed active lease state before checking terminal state. Terminal COMPLETED, FAILED, and CANCELLED jobs now short-circuit to idempotent read-back; active jobs retain strict lease validation. The two-file job reconciled as COMPLETED and a second reconcile returned the same receipt.
getDiff returned unbounded patch data and could fail the transport. It now returns identities, changed paths, stats, total bytes, bounded patch output, patch limit, and truncated. The large smoke returned total_size_bytes=350222, stdout_bytes=262144, patch_limit_bytes=262144, truncated=true; no ResponseTooLargeError or GIT_OUTPUT_LIMIT_EXCEEDED escaped.

During live integration, two additional staging-only contract defects were found and repaired: CREATE_NEW branch normalization/CAS recovery, and release executor projection of the configured staging baseline plus immutable runtime versions/V2R2C1.json. The latter removed the missing publication-workspace baseline/version errors without writing production state.

Source, test, and operational changes

Source commits on the governed branch include the six contract repairs, focused regression tests, versions/V2R2C1.json, governed CREATE_NEW/reconcile recovery, and final runtime projection commits. The final source before this evidence commit is 2ec49005bde44f6981b14351500847d594e0276c.

The runbook update is in runbooks/agent-fix-action-contracts-20260825.md. This report is the required durable evidence artifact. Existing untracked runtime/agent-observability/ and runtime/task-center/ directories were preserved and were not staged.

Tests run on the final source:

PYTHONPATH=active-runtime/app python3 -m pytest -q tests/test_silent_release_execution_readiness.py tests/test_silent_release_controller.py tests/test_silent_release_hardening.py tests/test_silent_release_production_contract.py tests/test_chatgpt_actions_tag.py tests/test_gitea_tag_publication.py tests/test_authoritative_git_context.py
264 passed, 28 subtests passed in 4.78s

PYTHONPATH=active-runtime/app python3 -m pytest -q tests
717 passed, 2 skipped, 154 subtests passed, 2 failed in 33.98s

The full-suite failures remain the known event-bus fixture failure and the real signer adapter self-test (returncode=42); no new mandatory-suite regression was observed. Focused contract/reconcile tests and the exact mandatory suite passed.

Staging deployment identity

Final deployed source OID at the last completed runtime smoke: 2ec49005bde44f6981b14351500847d594e0276c.
Final deployed artifact: /opt/aios/gitops-model-api/2ec49005bde44f6981b14351500847d594e0276c-action-contract-repair/runtime.
Artifact SHA256: f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf.
Deployment state: STAGING; production-deployed flag: false.
A lexically highest staging-only systemd drop-in was installed for each affected service, followed by daemon-reload and restart. systemctl is-active returned active for both services, and systemctl show confirmed the final OID, artifact SHA, API URL, and baseline authority.

Runtime smoke evidence

Model health returned status=ok, version=V2R2C1, final commit/artifact identity, deployment_state=STAGING, and production_deployed=false.
Bridge/API readback was available; the bridge's /health path is not exposed by this runtime and returned 404, while its governed endpoints were healthy.
getReleaseConsistency("V2R2C1", ...) returned structured status=PASS, with Gitea listing/peeled target and tag object matching the stable reference.
runReleaseAcceptance(...) entered policy evaluation and returned structured accepted=false; it did not fail URL validation. The independent pre-existing tag publication state is REMOTE_PUSH_PENDING, with the remote rejection explicitly reporting protected tag V2R2C1.
getTagPublicationStatus("V2R2C1") returned structured REMOTE_PUSH_PENDING, not invalid release version.
getReleaseSaga for a nonexistent candidate returned HTTP 404 with status=NOT_FOUND, state=NOT_FOUND, execution_enabled=false, and no filesystem permission error.
commitFilesGoverned published schema includes required files, with per-file path and content_base64.
Two-file governed commit: branch agent/action-contract-integration-20260825-1407, OID 0345cd8c70967940bc8e9132dff7d6ea11efa304 at authority/Git remote/API; protected-ref flags remained false.
Terminal reconcile: COMPLETED read-back was idempotent across two calls; focused tests cover FAILED and CANCELLED terminal semantics.
Small diff returned bounded non-truncated output; empty diff returned zero paths and zero bytes; large diff returned bounded/truncated output as recorded above.
Main, protected tag, baseline registry, and production OIDs were re-read after deployment and remained unchanged.

Restart persistence and remaining risk

The final staging services were restarted after deployment and health/runtime identity were re-read. The post-restart systemctl is-active result was active for both services; model health again reported OID 2ec49005bde44f6981b14351500847d594e0276c, artifact SHA f67aed6cc0cce1f08197485c3eea204d3ef4d3989f44dc98e8ea2691e5886cbf, staging mode, and production_deployed=false. Post-restart consistency remained PASS, acceptance remained structured accepted=false for the pre-existing protected-tag publication state, saga remained NOT_FOUND for the nonexistent candidate, and the large diff remained bounded/truncated. The task cannot be promoted to SUCCEEDED until the protected-tag publication state and the two known repository-wide failures are resolved through their respective governed owners. No automatic rollback was performed because the staging services stayed healthy, mandatory tests passed, Gitea readback passed, and protected-ref boundaries remained intact.

Task disposition is NEEDS_REWORK, not SUCCEEDED: the staging contract repair is materially complete, but the deployed acceptance result is not all-green and the task row has not been legitimately claimed/verified by the online task worker.

9.2 KiB Raw Blame History