fix(ci): make MCP audit writeback repeatable

docs/LOGBOOK.md

@@ -10,16 +10,19 @@
 
 **source/test evidence**：
 - controller/verifier 本機真實雙 replay 皆通過：MCP `Playwright@1.62.0-alpha-1783623505000`、protocol `2025-06-18`、24 tools、tool-name hash `12d23fea9d8d1a1de3f44863dc00cf393f0a2165323838cf93fed30a6a4cc237`、schema hash `c3737ced21147d0512b0400df5885c95a545bc915892b5c8f928cee78428ac99`，兩次均 clean exit/container removed。
-- 新 replay tests `37 passed`；artifact + replay supply-chain tests與 MCP control-plane/federation/version lifecycle/runner-health 聚焦回歸合計 `89 passed`。Ruff、py_compile、JSON/YAML parse、source-control owner guard與 `git diff --check` 通過。
+- artifact/replay controller + independent verifier `61 passed`、MCP control-plane/federation/version lifecycle/runner-health API `27 passed`、shared audit writeback `4 passed`，本輪聚焦回歸合計 `92 passed`。Ruff、py_compile、JSON/YAML parse、source-control owner guard與 `git diff --check` 通過。
+- Gitea replay `#5183` 已在 source `387f841...` 完成 controller + independent verifier，run `d3b8d15e-e5c6-43c0-b657-f9f23089677c`，audit commit `281d6e0058721dfbf84235d85c2f894a004ceea1`；24 tools、offline clean exit、container removal與所有 runtime/write boundary false 均有 durable receipt。
+- 後續 replay `#5186` 在 source `5eb46f9...` 的 controller/verifier 仍成功，但 final writeback 因 shallow main 與 audit branch `unrelated histories` 失敗；scheduled artifact `#5178` 有相同 terminal。根因不是 MCP replay 或 artifact verification，而是舊 workflow 把 audit branch merge 回 depth-1 main checkout。
+- 新增共用 fail-closed audit writeback：直接 checkout audit branch tip、只 stage兩個 allowlisted receipt、同 run identity與 branch/path/schema 綁定、最多 3 次 normal fast-forward push，無 merge、無 force。真實 temporary bare-Git functional tests涵蓋連續第二/第三次線性 push與拒絕 branch/path/identity mismatch，`4 passed`。
 - global security mirror guard另抓到 latest main 既有 `apps/web/src/app/[locale]/iwooos/page.tsx` 的 `raw_blocked_waiting_state` 敏感字樣；本 work item未修改該檔，保留為獨立 drift blocker，不以 replay source 綠燈覆蓋。
 
 **尚未完成 / 不誤報**：
-- 目前是 source + 本機真實 replay證據；Gitea replay workflow、audit branch receipt、main CD/deploy marker與 production runtime/UI readback尚未產生，因此 production compatibility仍不得標 completed。
+- `#5183` 證明 protocol/schema replay本身與 durable receipt可成立，但最新 source `5eb46f9...` 的 repeatability writeback修正尚未 normal push / Gitea workflow terminal；artifact/replay recurring lanes仍要各取得一筆新的 success terminal，production catalog也尚未讀取該 receipt，因此不得把 compatibility或週期升級 loop標 completed。
 - Browser binary/runtime immutable supply chain、public-origin egress proxy與 private-network denial、prompt-injection replay、accessibility/latency shadow、canary、Gateway adapter registration、rollback execution與正式 KM/RAG learning acknowledgement仍是 promotion blocker。
 - 未讀 secret value、`.env`、raw session、SQLite/auth；未連線或下載 GitHub/Actions/hosted artifact，未使用 `npx -y`、`@latest`、`:latest`、force push、外部 RAG write或 production mutation。
 
 **下一步**：
-- normal push Gitea main並取得 replay workflow controller + standalone verifier audit receipts；再更新 MCP production read model/UI為 compatibility verified但 promotion disabled，之後才建立 immutable browser runtime與隔離 public-origin shadow/canary/rollback lane。
+- normal push shared writeback修正到 Gitea main，要求 artifact與 replay recurring workflow各自取得線性 audit commit；再更新 MCP production read model/UI為 compatibility verified但 promotion disabled，之後才建立 immutable browser runtime與隔離 public-origin shadow/canary/rollback lane。
 
 ## 2026-07-15 — P0 MCP Playwright immutable mirror 與獨立供應鏈 verifier
 

docs/evaluations/gitea_workflow_runner_health_2026-06-05.json

@@ -30,6 +30,7 @@
     "docs/evaluations/ai_agent_version_lifecycle_update_proposal_2026-07-10.json",
     "scripts/ci/check-gitea-step-env-secrets.js",
     "scripts/ci/cleanup-host-runner-workspace.sh",
+    "scripts/ci/write-gitea-audit-receipts.sh",
     "scripts/ci/wait-host-web-build-pressure.sh",
     "scripts/ci/notify-awoooi-cicd.sh",
     "scripts/setup-runner-watchdog.sh",
@@ -367,6 +368,7 @@
         "config/mcp/playwright-mcp-artifact-policy.json",
         "scripts/security/external_mcp_artifact_controller.py",
         "scripts/security/verify_external_mcp_artifact_receipt.py",
+        "scripts/ci/write-gitea-audit-receipts.sh",
         "scripts/ci/wait-host-web-build-pressure.sh"
       ],
       "next_action": "維持 bounded capacity wait、獨立 verifier 與 mcp-artifact-receipts audit branch；不得啟動 artifact、寫 RAG、切 production route 或推回 deploy main。"
@@ -397,6 +399,7 @@
         "config/mcp/playwright-mcp-replay-policy.json",
         "scripts/security/external_mcp_replay_controller.py",
         "scripts/security/verify_external_mcp_replay_receipt.py",
+        "scripts/ci/write-gitea-audit-receipts.sh",
         "scripts/ci/wait-host-web-build-pressure.sh"
       ],
       "next_action": "先取得 mcp-replay-receipts 獨立 verifier receipt；browser runtime、public-origin egress proxy、shadow、canary、Gateway adapter registration、RAG 與 production route 仍保持停用。"