{"schemaVersion":"developer.reits.tech/controller-release-rollback-qualification/v1","status":"T07_REPOSITORY_IMPLEMENTED_LIVE_CONTROLLER_RELEASE_AND_ROLLBACK_BLOCKED","observedAt":"2026-07-24T10:10:20Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T07","title":"Sign exact Controller release identity and execute intentional rollback","owner":"Supply Chain + Release Engineering + SRE + Independent QA","repositoryImplementationComplete":true,"liveT06QualificationObserved":false,"liveControllerReleaseObserved":false,"intentionalRollbackExecuted":false,"productionAccepted":false,"nextTask":"D05-T08","nextTaskTitle":"Obtain independent four-owner D05 acceptance","nextTaskBlocked":true},"trustCorrection":{"decision":"PORTAL_AND_SITES_RELEASES_ARE_DOCUMENTATION_TARGETS_NOT_CONTROLLER_RELEASE_TARGETS","historicalEvidencePath":"data/runner-controller-release-evidence.json","historicalEvidenceStatus":"POINT_IN_TIME_RETAINED_NOT_CURRENT_T07_QUALIFICATION","developerPortalEligibleForG09G10":false,"sitesEligibleForG09G10":false,"onlyEligibleSubject":"reits-runner-factory-controller on a dedicated control-plane host"},"planBinding":{"planId":"D05-T07-CONTROLLER-RELEASE-ROLLBACK-V1","path":"ops/runner-factory/release/controller-release-rollback-plan.json","sha256":"0ea818d485685aa91c83342740de7d8cb7e2bdc5f295f0a754c4d9c94f4ada32","maximumReceiptAgeHours":2,"exactRevisionRequired":true},"repositoryPacket":{"planPresent":true,"preflightPresent":true,"collectorPresent":true,"verifierPresent":true,"pendingReceiptPresent":true,"keyringTemplatePresent":true,"identityFieldContracts":6,"attestationContracts":4,"rollbackStepContracts":8,"requiredIndependentSignatures":4},"currentObservation":{"source":"EC2_READ_ONLY_AND_SITES_DEPLOYMENT_OBSERVATION","portal":{"releaseId":"developer-portal@b054fafa3f83-2a8ba8c119ab","sourceRevision":"b054fafa3f83bd90b58858527abae955a1257015","rollbackReleaseId":"developer-portal@0d22b6098f92-7015f86fa477","provenanceSigned":false,"listener8100":1,"eligibleControllerEvidence":false},"sites":{"version":258,"sourceRevision":"b054fafa3f83bd90b58858527abae955a1257015","deploymentStatus":"succeeded","access":"OWNER_ONLY_CUSTOM","eligibleControllerEvidence":false},"controller":{"unitLoadState":"not-found","unitActiveState":"inactive","releaseRoots":0,"listener8110":0,"healthHttp":0,"readyHttp":0,"dedicatedHostMarkerPresent":false,"qualifiedT06Receipts":0,"releaseIdentityReceipts":0,"rollbackReceipts":0}},"identityFields":[{"id":"sourceRevision","label":"SOURCE","requirement":"exact 40-character Controller source revision","controllerObserved":null,"state":"MISSING"},{"id":"artifactDigest","label":"ARTIFACT","requirement":"immutable Controller artifact sha256","controllerObserved":null,"state":"MISSING"},{"id":"sbomDigest","label":"SBOM","requirement":"CycloneDX SBOM digest bound to the artifact","controllerObserved":null,"state":"MISSING"},{"id":"configurationDigest","label":"CONFIG","requirement":"root-owned production configuration digest","controllerObserved":null,"state":"MISSING"},{"id":"migrationDigest","label":"MIGRATION","requirement":"explicit migration-set digest including an empty set","controllerObserved":null,"state":"MISSING"},{"id":"runtimeReleaseId","label":"RUNTIME","requirement":"live runner-controller@source-artifact identity","controllerObserved":null,"state":"MISSING"}],"attestations":[{"id":"SIGNED_BUILD_PROVENANCE","owner":"SUPPLY_CHAIN","observed":false,"state":"MISSING"},{"id":"IMMUTABLE_ROOT_OWNED_MATERIALIZATION","owner":"SRE","observed":false,"state":"MISSING"},{"id":"LIVE_CONTROLLER_RUNTIME_IDENTITY","owner":"RUNTIME","observed":false,"state":"MISSING"},{"id":"ORDERED_ROLLBACK_RECOVERY_CHAIN","owner":"INDEPENDENT_QA","observed":false,"state":"MISSING"}],"topology":{"current":{"label":"EXACT CURRENT","release":"runner-controller@source-artifact","materialization":"/opt/reits-runner-factory/releases/<source>","state":"ABSENT"},"predecessor":{"label":"NAMED PREDECESSOR","release":"distinct production-qualified runner-controller release","materialization":"/opt/reits-runner-factory/releases/<predecessor-source>","state":"ABSENT"},"final":{"label":"RECOVERED CURRENT","release":"same exact original current identity","observation":"at least 60 seconds","state":"NOT_EXECUTED"}},"rollbackSteps":[{"ordinal":1,"id":"RB-01","title":"Maintenance authorization and automatic recovery guard","owner":"Release Engineering + SRE","state":"NOT_AUTHORIZED"},{"ordinal":2,"id":"RB-02","title":"Freeze exact current identity and runtime state","owner":"Independent QA","state":"NOT_EXECUTED"},{"ordinal":3,"id":"RB-03","title":"Atomic predecessor switch","owner":"Release Engineering","state":"NOT_EXECUTED"},{"ordinal":4,"id":"RB-04","title":"Predecessor identity and readiness verification","owner":"SRE + QA","state":"NOT_EXECUTED"},{"ordinal":5,"id":"RB-05","title":"Atomic recovery to exact original current","owner":"Release Engineering","state":"NOT_EXECUTED"},{"ordinal":6,"id":"RB-06","title":"Recovered current verification","owner":"SRE + QA","state":"NOT_EXECUTED"},{"ordinal":7,"id":"RB-07","title":"Bounded timing, zero loss and zero route proof","owner":"Independent QA","state":"NOT_EXECUTED"},{"ordinal":8,"id":"RB-08","title":"Four-party signed qualification receipt","owner":"All four roles","state":"0_OF_4"}],"signatures":[{"role":"SUPPLY_CHAIN","responsibility":"signed provenance and six-field release identity","observed":false},{"role":"RELEASE_ENGINEERING","responsibility":"ordered atomic switch and recovery transaction","observed":false},{"role":"SRE","responsibility":"host, unit, listener and materialization observation","observed":false},{"role":"INDEPENDENT_QA","responsibility":"timing, readiness, loss and final-state adjudication","observed":false}],"acceptanceContract":{"requiredLiveT06Receipts":1,"observedLiveT06Receipts":0,"requiredIdentityFields":6,"observedIdentityFields":0,"requiredAttestations":4,"observedAttestations":0,"requiredRollbackSteps":8,"observedRollbackSteps":0,"requiredSignatures":4,"observedSignatures":0,"requiredFinalControllerListeners":1,"observedFinalControllerListeners":0,"g09Satisfied":false,"g10Satisfied":false,"t07ReceiptAcceptsD05":false},"controls":[{"id":"SUBJECT-FENCE","title":"Portal release cannot impersonate Controller","mechanism":"Service, host class, release prefix and endpoint are exact; developer-portal@ and Sites versions are always ineligible.","state":"REPOSITORY_BOUND"},{"id":"T06-PREDECESSOR","title":"Live T06 qualification is mandatory","mechanism":"The receipt must bind the same dedicated host, 11/11 readiness and one loopback listener.","state":"REPOSITORY_BOUND"},{"id":"SIX-FIELD-IDENTITY","title":"Source through runtime remain one subject","mechanism":"Source, artifact, SBOM, configuration, migration and runtime release ID are independently signed.","state":"REPOSITORY_BOUND"},{"id":"IMMUTABLE-ROOTS","title":"Both releases are immutable materializations","mechanism":"Current and predecessor roots are root-owned, exact-digest verified and not writable by the service identity.","state":"REPOSITORY_BOUND"},{"id":"ORDERED-ROLLBACK","title":"Eight events form one monotonic chain","mechanism":"Missing, duplicate, reordered or cross-host events deny the receipt.","state":"REPOSITORY_BOUND"},{"id":"AUTO-RECOVERY","title":"The drill cannot strand the predecessor","mechanism":"A recovery guard is armed before the switch; the final release must equal the exact original current.","state":"REPOSITORY_BOUND"},{"id":"LOOPBACK-INVARIANT","title":"8110 remains private throughout","mechanism":"Before, predecessor and after observations each require one 127.0.0.1 listener and zero public routes.","state":"REPOSITORY_BOUND"},{"id":"FOUR-PARTY-SEAL","title":"Publisher cannot approve its own drill","mechanism":"Supply Chain, Release Engineering, SRE and Independent QA use distinct principals and Ed25519 keys.","state":"REPOSITORY_BOUND"}],"liveEvidence":{"readOnlyAuditPerformed":true,"controllerReleaseSwitches":0,"controllerRecoverySwitches":0,"controllerServiceRestarts":0,"controllerListenerStarts":0,"publicRouteChanges":0,"externalWritesExecuted":0,"credentialsRecorded":false,"paidResourcesCreated":0},"invariants":{"portalReleaseExcluded":true,"sitesReleaseExcluded":true,"controllerListener8110":0,"qualifiedReceipts":0,"programAdvanced":false,"d05Accepted":false},"sources":[{"id":"EC2","kind":"READ_ONLY","observedAt":"2026-07-24T10:10:20Z"},{"id":"SITES","kind":"DEPLOYMENT_RECORD","version":258},{"id":"REPOSITORY","kind":"EXACT_BYTES","plan":"ops/runner-factory/release/controller-release-rollback-plan.json"}],"boundary":"D05-T07 repository contracts are complete, but no eligible Controller release, live T06 receipt, signed provenance, immutable Controller materialization, rollback event or independent signature exists. The running Developer Portal and owner-only Sites version document the architecture only; neither can satisfy Controller G09 or G10. D05 remains 0/11 and 4/36."}