feat(agentrun): 声明 nc01-release 与 agentrun-release namespace 隔离

为 #2154 落地 R1：YAML 双 lane、MDTODO 与 reference；NC01 已创建 agentrun-release Namespace（manager/PaC/DB 留后续阶段）。
2026-07-15 09:31:19 +02:00
parent 880abd78b8
commit e44ff59454
8 changed files with 662 additions and 4 deletions
@@ -496,6 +496,523 @@ controlPlane:
        gitopsBranch: nc01-v0.2-gitops
        gitopsPath: deploy/gitops/node/nc01/runtime-v02
        argoApplication: agentrun-nc01-v02
+    nc01-release:
+      deployment:
+        format: unidesk-yaml-only
+        gitopsRoot: deploy/gitops/node/nc01
+        runtimeRenderDir: runtime-release
+        artifactCatalogPath: deploy/artifact-catalog.nc01-release.json
+        argocd:
+          project: agentrun-nc01-release
+          applicationFile: application-release.yaml
+        manager:
+          serviceAccount: agentrun-nc01-release-mgr
+          apiKeySecretRef:
+            name: agentrun-release-api-key
+            key: HWLAB_API_KEY
+          env:
+            AGENTRUN_POSTGRES_POOL_MAX: '4'
+            AGENTRUN_MANAGER_RECONCILER_BATCH_SIZE: '20'
+            AGENTRUN_MANAGER_RECONCILER_ENABLED: 'true'
+            AGENTRUN_MANAGER_RECONCILER_INTERVAL_MS: '30000'
+            AGENTRUN_RUNNER_DISPATCHER_ENABLED: 'true'
+            AGENTRUN_RUNNER_DISPATCHER_INTERVAL_MS: '1000'
+            AGENTRUN_RUNNER_DISPATCHER_BATCH_SIZE: '10'
+            AGENTRUN_RUNNER_DISPATCHER_LEASE_MS: '120000'
+            AGENTRUN_RUNNER_DISPATCHER_ATTEMPT_TIMEOUT_MS: '90000'
+            AGENTRUN_RUNNER_DISPATCHER_MAX_ATTEMPTS: '5'
+            AGENTRUN_RUNNER_DISPATCHER_RETRY_BACKOFF_MS: '5000'
+            AGENTRUN_KAFKA_ENABLED: 'true'
+            AGENTRUN_KAFKA_OUTBOX_INTERVAL_MS: '500'
+            AGENTRUN_KAFKA_OUTBOX_BATCH_SIZE: '100'
+            AGENTRUN_KAFKA_OUTBOX_LEASE_MS: '60000'
+            AGENTRUN_KAFKA_OUTBOX_RETRY_BACKOFF_MS: '5000'
+            AGENTRUN_KAFKA_STDIO_PRODUCE_ENABLED: 'true'
+            AGENTRUN_KAFKA_BOOTSTRAP_SERVERS: platform-infra-kafka-kafka-bootstrap.platform-infra.svc.cluster.local:9092
+            AGENTRUN_KAFKA_EVENT_TOPIC: agentrun.event.v1
+            AGENTRUN_KAFKA_STDIO_TOPIC: codex-stdio.raw.v1
+            AGENTRUN_KAFKA_CLIENT_ID: agentrun-release-manager
+            AGENTRUN_KAFKA_STDIO_CLIENT_ID: agentrun-release-runner
+            OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces
+            OTEL_SERVICE_NAME: agentrun-manager
+            UNIDESK_NODE_ID: NC01
+            HWLAB_RUNTIME_LANE: release
+          unideskSshEndpointEnv:
+            name: UNIDESK_MAIN_SERVER_IP
+            value: 152.53.229.148
+          bootRepoUrl: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
+          imageBuild:
+            context: .
+            containerfile: deploy/container/Containerfile
+            repository: agentrun-mgr-env
+            network: host
+            buildArgs:
+              BUN_IMAGE: oven/bun:1-alpine
+            httpProxy: http://127.0.0.1:10808
+            httpsProxy: http://127.0.0.1:10808
+            noProxy:
+              - localhost
+              - 127.0.0.1
+              - ::1
+              - 127.0.0.1:5000
+              - localhost:5000
+              - .svc
+              - .svc.cluster.local
+              - .cluster.local
+              - hyueapi.com
+              - .hyueapi.com
+            buildContainerProxy:
+              httpProxy: http://127.0.0.1:10808
+              httpsProxy: http://127.0.0.1:10808
+              noProxy:
+                - localhost
+                - 127.0.0.1
+                - ::1
+                - 127.0.0.1:5000
+                - localhost:5000
+                - .svc
+                - .svc.cluster.local
+                - .cluster.local
+                - hyueapi.com
+                - .hyueapi.com
+            envIdentityFiles:
+              - deploy/container/Containerfile
+              - deploy/runtime/boot/agentrun-boot.sh
+              - deploy/runtime/boot/agentrun-mgr.sh
+              - deploy/runtime/boot/agentrun-runner.sh
+              - src
+              - scripts
+              - package.json
+              - bun.lock
+              - tsconfig.json
+            timeoutSeconds: 1800
+            pollSeconds: 15
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 800m
+              memory: 1Gi
+        runner:
+          serviceAccount: agentrun-nc01-release-runner
+          jobNamePrefix: agentrun-nc01-release-runner
+          idleTimeoutMs: 600000
+          backendRetry:
+            maxAttempts: 5
+            initialBackoffMs: 1000
+            maxBackoffMs: 30000
+          apiKeySecretRef:
+            name: agentrun-release-api-key
+            key: HWLAB_API_KEY
+          egressProxyUrl: http://10.42.0.1:10808
+          noProxyExtra:
+            - localhost
+            - 127.0.0.1
+            - ::1
+            - .svc
+            - .svc.cluster.local
+            - .cluster.local
+            - hyueapi.com
+            - .hyueapi.com
+            - api.pikapython.com
+            - .pikapython.com
+          retention:
+            maxRunners: 10
+            cleanupOrder: oldest-inactive-last-active-first
+            activeHeartbeatMaxAgeMs: 900000
+            stalePendingMaxAgeMs: 900000
+            selectors:
+              matchLabels:
+                app.kubernetes.io/part-of: agentrun
+                app.kubernetes.io/name: agentrun-runner
+                app.kubernetes.io/component: runner
+              jobNamePrefixes:
+                - agentrun-nc01-release-runner
+                - agentrun-release-runner
+            ageBasedCleanup:
+              enabled: false
+              maxAgeHours: 48
+            sessionPvcRetention:
+              enabled: true
+              prefixes:
+                - agentrun-release-session-
+                - agentrun-nc01-release-session-
+              maxDeletePerRun: 1000
+          cancelLifecycle:
+            deliveryMode: manager-epoch
+            gracefulAbortMs: 15000
+            killEscalationMs: 30000
+            staleHeartbeatFencingMs: 900000
+            lateWriteFencing:
+              enabled: true
+            eventStages:
+              - accepted
+              - persisted
+              - delivered
+              - aborting
+              - terminalized
+              - fenced
+              - late-write-rejected
+        localPostgres:
+          enabled: false
+          serviceName: agentrun-release-postgres
+          image: postgres:16-alpine
+          storage: 5Gi
+          port: 5432
+          database: agentrun_release
+          user: agentrun_release
+          passwordSourceRef: agentrun/nc01-release-local-postgres.env
+          passwordSourceKey: POSTGRES_PASSWORD
+      gitMirror:
+        namespace: devops-infra
+        readService: git-mirror-http
+        readDeployment: git-mirror-http
+        writeService: git-mirror-write
+        writeDeployment: git-mirror-write
+        resourceBundleBaseUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080
+        readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
+        writeUrl: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git
+        cachePvc: hwlab-git-mirror-cache
+        cacheHostPath: null
+        sshSecretName: git-mirror-github-ssh
+        githubProxy:
+          host: 127.0.0.1
+          port: 10808
+        toolsImage: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
+        syncJobPrefix: git-mirror-agentrun-nc01-release-sync-manual
+        flushJobPrefix: git-mirror-agentrun-nc01-release-flush-manual
+        repositoryReconciler:
+          enabled: true
+          deploymentName: agentrun-nc01-release-managed-repository-reconciler
+          configMapName: agentrun-nc01-release-managed-repository-reconciler
+          serviceAccountName: agentrun-nc01-release-managed-repository-reconciler
+          remoteAuth:
+            configRef: config/platform-infra/gitea.yaml#sourceAuthority.credentials.github.gitFetchCredential
+          hostNetwork: true
+          dnsPolicy: ClusterFirstWithHostNet
+          imagePullPolicy: IfNotPresent
+          cacheMountPath: /cache
+          stateDirectory: .agentrun-managed-repositories/nc01-release
+          reconcileIntervalMs: 30000
+          fetchTimeoutMs: 240000
+          shutdownGraceMs: 30000
+          maxConcurrentRepositories: 2
+          retry:
+            maxAttempts: 4
+            initialDelayMs: 1000
+            maxDelayMs: 15000
+          freshness:
+            maxAgeMs: 180000
+          readiness:
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 6
+          status:
+            defaultRepositoryLimit: 8
+          lifecycle:
+            undeclaredRepositoryPolicy: retain
+            managedRefs: source-branch-only
+          resources:
+            requests:
+              cpu: 50m
+              memory: 96Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+        repositories:
+          - key: agentrun
+            repository: pikasTech/agentrun
+            remote: https://github.com/pikasTech/agentrun.git
+            sourceBranch: release
+            gitopsBranch: nc01-release-gitops
+          - key: unidesk
+            repository: pikasTech/unidesk
+            remote: https://github.com/pikasTech/unidesk.git
+            sourceBranch: master
+          - key: agent_skills
+            repository: pikasTech/agent_skills
+            remote: https://github.com/pikasTech/agent_skills.git
+            sourceBranch: master
+      database:
+        mode: external-postgres
+        provider: NC01
+        configRef: config/platform-db/postgres-nc01.yaml
+        database: agentrun_release
+        user: agentrun_release
+        sslmode: require
+        secretSourceRef: agentrun/nc01-release-mgr-db.env
+        secretRef:
+          name: agentrun-release-mgr-db
+          key: DATABASE_URL
+        localPostgresExpectedAbsent: true
+      toolCredentials:
+        - id: github-pr
+          tool: github
+          purpose: github-pr
+          secretRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-github-pr
+            keys:
+              - GH_TOKEN
+          projection:
+            kind: env
+            envName: GH_TOKEN
+            secretKey: GH_TOKEN
+        - id: github-repository-override-pikaoa
+          tool: github
+          purpose: repository-override-pikainc-pikaoa
+          secretRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-github-repository-overrides
+            keys:
+              - PIKAINC_PIKAOA_GH_TOKEN
+          projection:
+            kind: env
+            envName: UNIDESK_GH_TOKEN_PIKAINC_PIKAOA
+            secretKey: PIKAINC_PIKAOA_GH_TOKEN
+        - id: unidesk-ssh
+          tool: unidesk-ssh
+          purpose: ssh-passthrough
+          secretRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-unidesk-ssh
+            keys:
+              - UNIDESK_SSH_CLIENT_TOKEN
+          projection:
+            kind: env
+            envName: UNIDESK_SSH_CLIENT_TOKEN
+            secretKey: UNIDESK_SSH_CLIENT_TOKEN
+        - id: github-ssh
+          tool: github
+          purpose: github-ssh
+          secretRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-github-ssh
+            keys:
+              - id_ed25519
+              - known_hosts
+          projection:
+            kind: volume
+            mountPath: /home/agentrun/.ssh
+      secrets:
+        - id: manager-api-key
+          sourceRef: hwlab/nc01-v03-admin.env
+          sourceKey: HWLAB_API_KEY
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-api-key
+            key: HWLAB_API_KEY
+        - id: provider-codex-auth-json
+          sourceMode: file
+          sourceRef: /root/.codex/auth.json
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-codex
+            key: auth.json
+          providerCredential:
+            profile: codex
+        - id: provider-codex-config
+          sourceMode: file
+          sourceRef: /root/.codex/config.toml
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-codex
+            key: config.toml
+          providerCredential:
+            profile: codex
+        - id: provider-gpt-pika-auth-json
+          sourceMode: file
+          sourceRef: /root/.codex/auth.json.pika
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-gpt-pika
+            key: auth.json
+          providerCredential:
+            profile: gpt-pika
+        - id: provider-gpt-pika-config
+          sourceMode: file
+          sourceRef: /root/.codex/config.toml.pika
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-gpt-pika
+            key: config.toml
+          providerCredential:
+            profile: gpt-pika
+        - id: provider-grok-auth-json
+          sourceMode: file
+          sourceRef: /root/.codex/auth.json.grok
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-grok
+            key: auth.json
+          providerCredential:
+            profile: grok
+        - id: provider-grok-config
+          sourceMode: file
+          sourceRef: /root/.codex/config.toml.grok
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-grok
+            key: config.toml
+          providerCredential:
+            profile: grok
+        - id: provider-dsflash-go-auth-json
+          sourceMode: env
+          sourceRef: hwlab/nc01-v03-code-agent-provider.env
+          sourceKey: OPENCODE_API_KEY
+          transform: codex-auth-json-openai-api-key
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-dsflash-go
+            key: auth.json
+          providerCredential:
+            profile: dsflash-go
+        - id: provider-dsflash-go-config
+          sourceMode: codex-config
+          sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-release.secrets.provider-dsflash-go-config.codexConfig
+          codexConfig:
+            modelProvider: opencode
+            model: deepseek-v4-flash
+            reviewModel: deepseek-v4-flash
+            modelReasoningEffort: xhigh
+            disableResponseStorage: true
+            networkAccess: enabled
+            modelContextWindow: 1000000
+            modelAutoCompactTokenLimit: 900000
+            modelCatalogJson: /home/agentrun/.codex-dsflash-go/model-catalog.json
+            approvalsReviewer: user
+            modelProviders:
+              opencode:
+                name: Moon Bridge OpenCode Zen Go Flash
+                baseUrl: http://hwlab-deepseek-proxy.hwlab-v03.svc.cluster.local:4000/v1
+                wireApi: responses
+                requiresOpenaiAuth: true
+            projects:
+              /root:
+                trustLevel: trusted
+              /home/agentrun/workspaces:
+                trustLevel: trusted
+            tuiModelAvailabilityNux:
+              deepseek-v4-flash: 4
+            noticeHideFullAccessWarning: true
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-dsflash-go
+            key: config.toml
+          providerCredential:
+            profile: dsflash-go
+        - id: provider-dsflash-go-model-catalog
+          sourceMode: json
+          sourceRef: config/agentrun.yaml#controlPlane.lanes.nc01-release.secrets.provider-dsflash-go-model-catalog.jsonValue
+          jsonValue:
+            models:
+              - slug: deepseek-v4-flash
+                display_name: DeepSeek V4 Flash via OpenCode Zen Go
+                description: DeepSeek V4 Flash exposed to Codex through OpenCode Zen Go and a Responses-compatible Moon Bridge profile.
+                default_reasoning_level: xhigh
+                supported_reasoning_levels:
+                  - effort: low
+                    description: Fast responses with lighter reasoning
+                  - effort: medium
+                    description: Balanced reasoning
+                  - effort: high
+                    description: Deep reasoning
+                  - effort: xhigh
+                    description: Maximum reasoning
+                shell_type: shell_command
+                visibility: list
+                supported_in_api: true
+                priority: 0
+                additional_speed_tiers: []
+                service_tiers: []
+                availability_nux: null
+                upgrade: null
+                base_instructions: You are Codex, a coding agent based on DeepSeek V4 Flash. You and the user share one workspace, and your job is
+                  to collaborate with them until their goal is genuinely handled.
+                model_messages: {}
+                supports_reasoning_summaries: true
+                default_reasoning_summary: auto
+                support_verbosity: false
+                apply_patch_tool_type: freeform
+                web_search_tool_type: text_and_image
+                truncation_policy:
+                  mode: tokens
+                  limit: 10000
+                supports_parallel_tool_calls: true
+                supports_image_detail_original: false
+                context_window: 1000000
+                max_context_window: 1000000
+                auto_compact_token_limit: 900000
+                effective_context_window_percent: 95
+                experimental_supported_tools: []
+                input_modalities:
+                  - text
+                supports_search_tool: false
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-provider-dsflash-go
+            key: model-catalog.json
+          providerCredential:
+            profile: dsflash-go
+        - extends: controlPlane.templates.secrets.githubPrRawToken
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-github-pr
+            key: GH_TOKEN
+        - extends: controlPlane.templates.secrets.githubRepositoryOverridePikaoaToken
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-github-repository-overrides
+            key: PIKAINC_PIKAOA_GH_TOKEN
+        - extends: controlPlane.templates.secrets.unideskSshToken
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-unidesk-ssh
+            key: UNIDESK_SSH_CLIENT_TOKEN
+        - extends: controlPlane.templates.secrets.githubSshPrivateKey
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-github-ssh
+            key: id_ed25519
+        - extends: controlPlane.templates.secrets.githubSshKnownHosts
+          targetRef:
+            namespace: agentrun-release
+            name: agentrun-release-tool-github-ssh
+            key: known_hosts
+      extends: controlPlane.templates.agentrunV02Lane
+      variables:
+        NODE: NC01
+        remote: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git
+        workspace: /root/agentrun-release
+        pipeline: agentrun-nc01-release-ci-image-publish
+        pipelineRunPrefix: agentrun-nc01-release-ci
+        serviceAccountName: agentrun-nc01-release-tekton-runner
+        gitopsBranch: nc01-release-gitops
+        gitopsPath: deploy/gitops/node/nc01/runtime-release
+        argoApplication: agentrun-nc01-release
+      overrides:
+        version: release
+        source:
+          branch: release
+          bootstrapFromBranch: v0.2
+          workspace: /root/agentrun-release
+        runtime:
+          namespace: agentrun-release
+          managerDeployment: agentrun-mgr
+          managerService: agentrun-mgr
+          managerPort: 8080
+          internalBaseUrl: http://agentrun-mgr.agentrun-release.svc.cluster.local:8080
+        ci:
+          pipeline: agentrun-nc01-release-ci-image-publish
+          pipelineRunPrefix: agentrun-nc01-release-ci
+          serviceAccountName: agentrun-nc01-release-tekton-runner
+        gitops:
+          branch: nc01-release-gitops
+          path: deploy/gitops/node/nc01/runtime-release
+          argoApplication: agentrun-nc01-release
+
  templates:
    agentrunV02Lane:
      version: v0.2
@@ -0,0 +1,46 @@
+# AgentRun 开发/生产双环境
+
+范围：AgentRun development（`nc01-v02` / `agentrun-v02`）与 production（`nc01-release` / `agentrun-release`）双 lane 隔离、自动交付与 HWLAB 绑定。namespace 为隔离边界；不为每个子 issue 新建 MDTODO 文件。
+
+主 issue：[UniDesk #2154](https://github.com/pikasTech/unidesk/issues/2154)。
+
+
+## R1 [completed]
+
+R1 建立 agentrun-release namespace 隔离骨架（#2154），完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R1_Task_Report.md)。
+
+### R1.1 [completed]
+
+创建 GitHub 主 issue 与本 MDTODO 登记，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R1.1_Task_Report.md)。
+### R1.2 [completed]
+
+NC01 k3s 创建 agentrun-release Namespace 与 labels，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R1.2_Task_Report.md)。
+### R1.3 [completed]
+
+config/agentrun.yaml 声明 nc01-release lane（runtime.namespace=agentrun-release），完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R1.3_Task_Report.md)。
+### R1.4 [completed]
+
+验证 ns Active、lane 可解析、nc01-v02 plan 无回归，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R1.4_Task_Report.md)。
+## R2
+
+R2 agentrun.yaml 模板参数化，nc01-v02 行为不变，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R2_Task_Report.md)。
+
+## R3
+
+R3 PaC/Gitea/GitOps 生产链 agentrun-nc01-release，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R3_Task_Report.md)。
+
+## R4
+
+R4 DB/Secret/provider 独立物化到 agentrun-release，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R4_Task_Report.md)。
+
+## R5
+
+R5 release 命名空间上线 manager 与内网 canary，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R5_Task_Report.md)。
+
+## R6
+
+R6 HWLAB 双环境绑定矩阵（dev→v02，prod→release），完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R6_Task_Report.md)。
+
+## R7
+
+R7 文档/CLI help/GC selector 与默认 lane 收敛，完成任务后将详细报告写入[任务报告](./details/agentrun-dev-production-lanes/R7_Task_Report.md)。
@@ -0,0 +1,10 @@
+# R1.1 任务报告
+
+## 结论
+
+已创建主 issue 与 MDTODO 域文件。
+
+## 证据
+
+- Issue: https://github.com/pikasTech/unidesk/issues/2154
+- MDTODO: `docs/MDTODO/agentrun-dev-production-lanes.md`
@@ -0,0 +1,11 @@
+# R1.2 任务报告
+
+## 结论
+
+NC01 k3s 已创建 `agentrun-release` Namespace，status=Active。
+
+## 证据
+
+- labels: `app.kubernetes.io/part-of=agentrun`, `agentrun.pikastech.local/lane=release`, `agentrun.pikastech.local/role=production`, `agentrun.pikastech.local/node=NC01`
+- annotations: `unidesk.ai/lane-id=nc01-release`, owner issue #2154
+- 命令: `trans NC01:k3s kubectl get ns agentrun-release`
@@ -0,0 +1,21 @@
+# R1.3 任务报告
+
+## 结论
+
+`config/agentrun.yaml` 已声明 `controlPlane.lanes.nc01-release`，runtime.namespace=`agentrun-release`。
+
+## 隔离字段
+
+| 字段 | nc01-v02 | nc01-release |
+|------|----------|--------------|
+| namespace | agentrun-v02 | agentrun-release |
+| source.branch | v0.2 | release |
+| workspace | /root/agentrun-v02 | /root/agentrun-release |
+| database | agentrun_v02 | agentrun_release |
+| kafka client-id | agentrun-v02-manager | agentrun-release-manager |
+| secret target ns | agentrun-v02 | agentrun-release |
+| maxRunners | 20 | 10 |
+
+## 非本阶段
+
+未部署 release manager、未创建 PaC consumer、未建独立 DB 实例、未切 HWLAB 流量。
@@ -0,0 +1,19 @@
+# R1.4 任务报告
+
+## 验证
+
+```bash
+bun scripts/cli.ts agentrun control-plane plan --node NC01 --lane nc01-v02
+# NAMESPACE agentrun-v02 SOURCE v0.2 CHECKS 8
+
+bun scripts/cli.ts agentrun control-plane plan --node NC01 --lane nc01-release
+# NAMESPACE agentrun-release SOURCE release CHECKS 8
+
+trans NC01:k3s kubectl get ns agentrun-release
+# Active
+```
+
+## 结论
+
+- release lane 可解析；dev plan 无回归。
+- namespace / DB 名 / kafka client-id / secret target ns 均隔离。
@@ -0,0 +1,24 @@
+# R1 任务报告
+
+## 目标
+
+建立 AgentRun production 的 **namespace 隔离骨架**（#2154 R1）。
+
+## 已完成
+
+1. Issue #2154 + MDTODO `agentrun-dev-production-lanes`
+2. NC01 创建 `agentrun-release` Namespace
+3. YAML 声明 `nc01-release` lane（与 `nc01-v02` 并列）
+4. plan 双 lane 可跑；dev 无回归
+
+## 未做（后续 R2–R7）
+
+模板参数化、PaC/GitOps、独立 DB 物化、manager 上线、HWLAB 绑定、文档全量收敛。
+
+## 关键命令
+
+```bash
+trans NC01:k3s kubectl get ns agentrun-release
+bun scripts/cli.ts agentrun control-plane plan --node NC01 --lane nc01-release
+bun scripts/cli.ts agentrun control-plane plan --node NC01 --lane nc01-v02
+```
@@ -46,26 +46,36 @@ AgentRun 源码仓目标 branch 的任何变更都必须通过 GitHub PR 合并

 ## 部署目标

-AgentRun 废弃旧 `dev/prod` 和非 NC01 node 运行口径。固定部署目标是 NC01 k3s 的 AgentRun namespace：
+AgentRun 固定在 NC01 k3s，按 **namespace 隔离** 拆分 development / production 两条 lane（同集群，非独立物理集群）。身份真相是 `config/agentrun.yaml#controlPlane.lanes`；跟踪见 [UniDesk #2154](https://github.com/pikasTech/unidesk/issues/2154)。
+
+| 角色 | Lane | Namespace | Source branch | Workspace | 默认 |
+|------|------|-----------|---------------|-----------|------|
+| Development | `nc01-v02` | `agentrun-v02` | `v0.2` | `/root/agentrun-v02` | 是（`controlPlane.default.lane`） |
+| Production | `nc01-release` | `agentrun-release` | `release` | `/root/agentrun-release` | 否，必须显式 `--lane nc01-release` |

 ```text
-NC01:k3s namespace agentrun-v02
+NC01:k3s namespace agentrun-v02        # development runtime
+NC01:k3s namespace agentrun-release   # production runtime（R1 已建 ns；manager/DB/PaC 见 #2154 后续阶段）
 ```

 所有 k3s 操作必须使用 UniDesk route 语法：

 ```bash
 trans NC01:k3s kubectl get pods -n agentrun-v02
+trans NC01:k3s kubectl get ns agentrun-release
+bun scripts/cli.ts agentrun control-plane plan --node NC01 --lane nc01-v02
+bun scripts/cli.ts agentrun control-plane plan --node NC01 --lane nc01-release
 ```

 不得把临时 NodePort、host port、pod IP、provider-gateway 业务 HTTP proxy 或一次性 port-forward 固化为 AgentRun 部署路径。任何公网入口、UniDesk/HWLAB 集成入口或跨服务访问路径，都必须先通过 AgentRun 仓库内经过审查的变更引入；UniDesk 只在后续记录对应运维入口。

 ## 受控 CI/CD 入口

-AgentRun 目标必须从 `config/agentrun.yaml` 解析，不得从 service repo 的 `deploy.json` 或 URL 片段推断。Delivery authority 还必须与 `config/platform-infra/gitea.yaml`、`config/platform-infra/pipelines-as-code.yaml` 的 consumer/repository 组合校验。当前默认 `NC01/nc01-v02` 是 PaC migrated consumer；目标 source branch 的 GitHub PR merge 是唯一正式交付触发。
+AgentRun 目标必须从 `config/agentrun.yaml` 解析，不得从 service repo 的 `deploy.json` 或 URL 片段推断。Delivery authority 还必须与 `config/platform-infra/gitea.yaml`、`config/platform-infra/pipelines-as-code.yaml` 的 consumer/repository 组合校验。当前默认 `NC01/nc01-v02` 是 PaC migrated consumer；目标 source branch 的 GitHub PR merge 是唯一正式交付触发。`nc01-release` 的独立 PaC consumer 属于 #2154 后续阶段，R1 仅完成 namespace 与 lane 声明。

 ```bash
-bun scripts/cli.ts agentrun control-plane status
+bun scripts/cli.ts agentrun control-plane status --node NC01 --lane nc01-v02
+bun scripts/cli.ts agentrun control-plane status --node NC01 --lane nc01-release
 bun scripts/cli.ts platform-infra pipelines-as-code status --target NC01 --consumer agentrun-nc01-v02
 bun scripts/cli.ts platform-infra pipelines-as-code history --target NC01 --consumer agentrun-nc01-v02 --limit 10
 bun scripts/cli.ts agentrun control-plane cleanup-runners --node NC01 --lane nc01-v02 --dry-run