Merge pull request #2157 from pikasTech/fix/363-agentrun-lane-isolation

fix(cicd): 跳过过期 AgentRun 交付覆盖

docs/MDTODO/agentrun-runtime-reliability.md

@@ -124,6 +124,10 @@
 ### R5.9 [in_progress]
 
 解决 [AgentRun #356](https://github.com/pikasTech/agentrun/issues/356)：修复 runner Job 已不存在且 lease 过期后，非终态 active turn admission 仍以 `session-turn-admission-active` 阻塞同 session `send`；按既有 SPEC 在 memory/PostgreSQL authority 内原子终结或隔离陈旧 admission 并创建新 run/turn/runner，保留 fresh active steer/并发拒绝，不新增第二 session authority、租约、围栏或客户端 retry，并与 PikaOA MVP 并行且不作为业务门禁，完成任务后将详细报告写入[任务报告](./details/agentrun-runtime-reliability/R5.9_Task_Report.md)。
+### R5.10 [in_progress]
+
+解决 [AgentRun #363](https://github.com/pikasTech/agentrun/issues/363)：旧 PipelineRun 在新 revision 已发布后才解除 admission 排队并把 `nc01-v0.2-gitops` 回退到旧 sourceCommit，导致 Artificer 重新加载已删除的 `sub2api` AipodSpec；PaC promote 必须以 source branch 最新 revision 为 authority，把过期运行处理为 `warning=true`、`blocking=false`、成功 no-op，禁止覆盖更新 GitOps，并通过自动 PaC 恢复 pika/grok AipodSpec。禁止手工 PipelineRun、Argo sync、runtime patch、数据库修改、第二 authority或 fallback，完成任务后将详细报告写入[任务报告](./details/agentrun-runtime-reliability/R5.10_Task_Report.md)。
+
 ## R6 [completed]
 
 将“先恢复运行面再工程化”固化为 unidesk-subagent 的泛化主线规则：运行面恢复关键路径由主代理控制，低耦合工程化任务及时并行，恢复后继续完成工程化交付；将单 PR 收口、复用 guarded merge 内建 preflight、避免仅补 merge SHA 的重复 PR 和减少碎片化 GitHub 查询固化到 unidesk-gh 及相关 reference，并让 merge 默认摘要直接披露 merge commit 与 mergedAt，完成任务后将详细报告写入[任务报告](./details/agentrun-runtime-reliability/R6_Task_Report.md)。

scripts/src/agentrun-manifests.ts

@@ -441,6 +441,24 @@ function agentRunTektonGitopsPublishScript(spec: AgentRunLaneSpec): string {
     "cd \"$root/gitops\"",
     "git fetch origin \"$(params.gitops-branch)\" || true",
     "if git rev-parse --verify \"refs/remotes/origin/$(params.gitops-branch)^{commit}\" >/dev/null 2>&1; then git checkout -B \"$(params.gitops-branch)\" \"refs/remotes/origin/$(params.gitops-branch)\"; else git checkout --orphan \"$(params.gitops-branch)\"; git rm -rf . >/dev/null 2>&1 || true; fi",
+    "incoming_source_commit='$(params.revision)'",
+    "source_branch='$(params.source-branch)'",
+    "branch_source_commit=$(git -C \"$root/repo\" rev-parse --verify \"refs/remotes/origin/${source_branch}^{commit}\")",
+    "gitops_source_commit=$(node -e 'try { const value = JSON.parse(require(\"node:fs\").readFileSync(\"source.json\", \"utf8\")).sourceCommit; if (typeof value === \"string\") process.stdout.write(value); } catch {}')",
+    "stale_reason=''",
+    "if [ \"$incoming_source_commit\" != \"$branch_source_commit\" ]; then stale_reason='stale-source-revision'; fi",
+    "if [ -z \"$stale_reason\" ] && [ -n \"$gitops_source_commit\" ] && [ \"$incoming_source_commit\" != \"$gitops_source_commit\" ]; then",
+    "  if ! git -C \"$root/repo\" cat-file -e \"${gitops_source_commit}^{commit}\" 2>/dev/null; then stale_reason='gitops-source-order-unverifiable';",
+    "  elif git -C \"$root/repo\" merge-base --is-ancestor \"$incoming_source_commit\" \"$gitops_source_commit\"; then stale_reason='stale-gitops-source-revision';",
+    "  elif ! git -C \"$root/repo\" merge-base --is-ancestor \"$gitops_source_commit\" \"$incoming_source_commit\"; then stale_reason='divergent-gitops-source-revision'; fi",
+    "fi",
+    "if [ -n \"$stale_reason\" ]; then",
+    "  gitops_commit=$(git rev-parse HEAD)",
+    "  INCOMING_SOURCE_COMMIT=\"$incoming_source_commit\" CURRENT_SOURCE_COMMIT=\"$branch_source_commit\" GITOPS_SOURCE_COMMIT=\"$gitops_source_commit\" GITOPS_COMMIT=\"$gitops_commit\" STALE_REASON=\"$stale_reason\" node <<'NODE'",
+    "console.log(JSON.stringify({ ok: true, status: 'succeeded', phase: 'gitops-publish', reason: process.env.STALE_REASON, warning: true, blocking: false, changed: false, stale: true, gitopsCommit: process.env.GITOPS_COMMIT, sourceCommit: process.env.INCOMING_SOURCE_COMMIT, currentSourceCommit: process.env.CURRENT_SOURCE_COMMIT, gitopsSourceCommit: process.env.GITOPS_SOURCE_COMMIT || null, valuesPrinted: false }));",
+    "NODE",
+    "  exit 0",
+    "fi",
     "git rm -rf --ignore-unmatch \"$(params.gitops-root)\" \"$(params.artifact-catalog)\" source.json >/dev/null 2>&1 || true",
     "rm -rf \"$(params.gitops-root)\" \"$(params.artifact-catalog)\" source.json",
     "TEMPLATES_B64=\"$templates_b64\" BUILD_RESULT=\"$build_result\" node <<'NODE'",