{"schemaVersion":"developer.reits.tech/d05-r47-external-execution-readiness-plane/v1","status":"D05_R47_EXTERNAL_EXECUTION_READINESS_IMPLEMENTED_DEDICATED_TARGET_AND_AUTHORIZATIONS_REQUIRED","generatedAt":"2026-07-28T12:02:20Z","knife":{"id":"D05-R47","title":"D05-R47 专用目标选择、外部授权包与停止态安装执行准备","predecessor":"D05-R46","next":"D05-R48","nextTitle":"D05-R48 外部授权回执导入、专用主机锁定与一次性执行窗口准入","implementationComplete":true,"countsAsProgramAcceptance":false},"formalProgress":{"acceptedKnives":4,"totalKnives":36,"acceptedThrough":"D04","currentKnife":"D05","currentOrdinal":5,"remainingIncludingCurrent":32,"d05GatesSatisfied":0,"d05GatesRequired":11,"d04AcceptedAt":"2026-07-20T16:23:57+08:00","stalledDurationAtAudit":"8 天 3 小时 38 分 23 秒","stalledSecondsAtAudit":704303},"engineeringProgress":{"completedSubphasesBeforeR47":46,"currentSubphase":"D05-R47","completedSubphasesIncludingR47":47,"completedRange":"D05-R01..D05-R47"},"summary":{"gatesSatisfied":0,"gatesRequired":11,"entryGates":6,"entryGatesClosed":0,"currentHostChecks":12,"currentHostChecksPassed":5,"currentHostChecksFailed":7,"authorizationLanes":6,"sourceKitArtifacts":10,"operatorStages":7,"controlSurfaces":20,"validationCasesPassed":168,"validationCasesTotal":168,"productionEffects":0},"currentHostObservation":{"observedAt":"2026-07-28T12:02:20Z","host":"ip-172-31-19-46.ap-southeast-2.compute.internal","os":"Amazon Linux 2023","kernel":"6.1.159-182.297.amzn2023.x86_64","role":"SHARED_PRODUCTION_DEVELOPER_PORTAL_HOST","productionMarker":"/etc/reits-production-host","portalService":"active","portalPort8100Listeners":1,"controllerPort8110Listeners":0,"uid991Owner":"redis6","gid991Owner":"nginx","controllerUnit":"not-found","controllerIdentity":"absent","controllerManifest":"absent","controllerInstallRoot":"absent","controllerProcesses":0,"passwordlessSudoTechnicalCapability":true,"passwordlessSudoCountsAsAuthorization":false,"targetDecision":"DENY_SHARED_PRODUCTION_PORTAL_HOST","mutationCount":0},"currentHostChecks":[{"id":"HOST-01","label":"主机类别","required":"DEDICATED_NON_PRODUCTION_CONTROL_PLANE","observed":"SHARED_PRODUCTION_PORTAL_HOST","verdict":"FAIL"},{"id":"HOST-02","label":"环境","required":"staging","observed":"production","verdict":"FAIL"},{"id":"HOST-03","label":"生产标记","required":"ABSENT","observed":"/etc/reits-production-host PRESENT","verdict":"FAIL"},{"id":"HOST-04","label":"Portal 服务","required":"ABSENT","observed":"reits-developer-portal active","verdict":"FAIL"},{"id":"HOST-05","label":"端口 8100","required":"0 listeners","observed":"1 listener","verdict":"FAIL"},{"id":"HOST-06","label":"端口 8110","required":"0 listeners before activation","observed":"0 listeners","verdict":"PASS"},{"id":"HOST-07","label":"UID 991","required":"FREE","observed":"redis6","verdict":"FAIL"},{"id":"HOST-08","label":"GID 991","required":"FREE","observed":"nginx","verdict":"FAIL"},{"id":"HOST-09","label":"Controller identity","required":"ABSENT before installation","observed":"ABSENT","verdict":"PASS"},{"id":"HOST-10","label":"运行清单","required":"ABSENT before installation","observed":"ABSENT","verdict":"PASS"},{"id":"HOST-11","label":"安装根目录","required":"ABSENT before installation","observed":"ABSENT","verdict":"PASS"},{"id":"HOST-12","label":"Unit / process","required":"ABSENT / 0","observed":"ABSENT / 0","verdict":"PASS"}],"targetContract":{"profileId":"runner-controller-dedicated-staging-control-plane-v1","environment":"staging","hostClass":"DEDICATED_NON_PRODUCTION_CONTROL_PLANE","productionMarkerRequiredAbsent":true,"portalServiceRequiredAbsent":true,"requiredClosedPorts":[8100,8110],"requiredFreeIds":{"uid":991,"gid":991},"expectedPriorState":"ABSENT","executorMode":"EXECVE_ARGV_ONLY_NO_SHELL","independentWitnessRequired":true,"rollbackRehearsalRequired":true,"serviceStartAuthorized":false,"listenerStartAuthorized":false},"giteaObservation":{"observedAt":"2026-07-28T12:01:54Z","version":"1.25.4","reachable":true,"unauthenticatedOrganizationRepositoryCount":0,"unauthenticatedCommitApiStatus":404,"interpretation":"AUTHORIZATION_REQUIRED_NOT_ZERO_REPOSITORIES","runnerInventoryFresh":false,"portalRepositoryRemoteVerifiedByGit":true},"entryGates":[{"id":"D05-G01","state":"OPEN_EXTERNAL","countsAsSatisfied":false,"productionEffectCount":0},{"id":"D05-G02","state":"OPEN_EXTERNAL","countsAsSatisfied":false,"productionEffectCount":0},{"id":"D05-G03","state":"OPEN_EXTERNAL","countsAsSatisfied":false,"productionEffectCount":0},{"id":"D05-G04","state":"OPEN_EXTERNAL","countsAsSatisfied":false,"productionEffectCount":0},{"id":"D05-G07","state":"OPEN_EXTERNAL","countsAsSatisfied":false,"productionEffectCount":0},{"id":"D05-G09","state":"OPEN_EXTERNAL","countsAsSatisfied":false,"productionEffectCount":0}],"authorizationLanes":[{"ordinal":1,"id":"AUTH-PLATFORM","owner":"Platform SRE","gates":["D05-G01","D05-G07"],"task":"选择并创建专用非生产控制面主机，提供两台组织级一次性 Linux Runner 容量，并执行停止态安装。","requiredReceipt":"目标主机、成本中心、变更窗口、停止态安装和回滚回执","state":"MISSING_EXTERNAL_AUTHORIZATION","portalCanSign":false,"productionEffectCount":0,"idempotencyKey":"d05-r47-auth-platform-v1"},{"ordinal":2,"id":"AUTH-MOBILE","owner":"Mobile Platform","gates":["D05-G02"],"task":"提供组织级独立 Mac Runner，完成原生任务、隔离和销毁回读。","requiredReceipt":"Mac 主机范围、标签、Keychain/网络隔离、原生任务和销毁回执","state":"MISSING_EXTERNAL_AUTHORIZATION","portalCanSign":false,"productionEffectCount":0,"idempotencyKey":"d05-r47-auth-mobile-v1"},{"ordinal":3,"id":"AUTH-SECURITY","owner":"Security","gates":["D05-G03"],"task":"批准 root-owned 配置、SecretRef 可见性、verify-only KeyRef 与硬化边界。","requiredReceipt":"精确配置摘要、文件元数据、SecretRef 边界和安全签名","state":"MISSING_EXTERNAL_AUTHORIZATION","portalCanSign":false,"productionEffectCount":0,"idempotencyKey":"d05-r47-auth-security-v1"},{"ordinal":4,"id":"AUTH-ARCH","owner":"Global Architecture","gates":["D05-G04"],"task":"审查六个生产 Factory、五个只读数据源和独立证明验证器。","requiredReceipt":"Factory 源码、权限、ConfigRef、逆序清理和架构签署","state":"MISSING_EXTERNAL_AUTHORIZATION","portalCanSign":false,"productionEffectCount":0,"idempotencyKey":"d05-r47-auth-arch-v1"},{"ordinal":5,"id":"AUTH-SUPPLY","owner":"Supply Chain + Release","gates":["D05-G09"],"task":"签署 source、artifact、SBOM、config、migration 与 runtime identity 同源链。","requiredReceipt":"独立构建者、不可变制品、六值摘要和签名来源证明","state":"MISSING_EXTERNAL_AUTHORIZATION","portalCanSign":false,"productionEffectCount":0,"idempotencyKey":"d05-r47-auth-supply-v1"},{"ordinal":6,"id":"AUTH-FINOPS","owner":"FinOps","gates":["D05-G01","D05-G02","D05-G07"],"task":"批准专用主机与一次性 Runner 的预算、TTL、区域和销毁责任。","requiredReceipt":"成本中心、最高预算、最长存活、报警与强制销毁回执","state":"MISSING_EXTERNAL_AUTHORIZATION","portalCanSign":false,"productionEffectCount":0,"idempotencyKey":"d05-r47-auth-finops-v1"}],"sourceKit":[{"id":"KIT-01","path":"ops/runner-factory/reits-runner-factory-controller.service","bytes":1184,"digest":"sha256:015d894f77654ce168e6ffad0f0d7bf67d84b5284cb57ad1a99321f7e4366645","state":"REPOSITORY_CANDIDATE"},{"id":"KIT-02","path":"ops/runner-factory/controller-runtime-manifest-candidate.json","bytes":2462,"digest":"sha256:197dd96afb46008c351931fd27c046283780f10b8ec5f842d99334f2281a19ca","state":"REPOSITORY_CANDIDATE"},{"id":"KIT-03","path":"ops/runner-factory/controller-root-installation-identity-candidate.json","bytes":474,"digest":"sha256:e3a583f5eb3bd42cd8255718af2bbf20a7442832344f5917e3f923caa531858e","state":"REPOSITORY_CANDIDATE"},{"id":"KIT-04","path":"ops/runner-factory/controller-privileged-installation-target-profile-candidate.json","bytes":915,"digest":"sha256:5da98039e2347e2fe74c00e8f685ff8fc9181c9612f505678b41477ff610a033","state":"REPOSITORY_CANDIDATE"},{"id":"KIT-05","path":"ops/runner-factory/controller-privileged-installation-change-envelope-candidate.json","bytes":896,"digest":"sha256:fbfa99a7c4501aef2f4ace6c13d26050b698f239c7eb2fbde3ebb77337f2e8b9","state":"REPOSITORY_CANDIDATE"},{"id":"KIT-06","path":"ops/runner-factory/controller-stopped-state-installation-authorization-admission-candidate.mjs","bytes":15825,"digest":"sha256:7e1926cf9ef8b9fa2231ea16ee94aec84ee6c9163e2ea92198576b480444ccd3","state":"VERIFIED_FIXTURE_ONLY"},{"id":"KIT-07","path":"ops/runner-factory/controller-detached-stopped-state-installation-execution-package-candidate.mjs","bytes":23813,"digest":"sha256:3f944df71fac0260e7a6687fbaaa14db23a68a29210efc1c9b412765ba756793","state":"VERIFIED_FIXTURE_ONLY"},{"id":"KIT-08","path":"ops/runner-factory/controller-stopped-state-posix-installation-transaction-candidate.mjs","bytes":16429,"digest":"sha256:aeea516bb5eee51b087289fb65b7908c84f882f0ad44c34a56c7c79f89c0d4bc","state":"VERIFIED_FIXTURE_ONLY"},{"id":"KIT-09","path":"ops/runner-factory/controller-privileged-installation-execution-witness-candidate.mjs","bytes":22225,"digest":"sha256:ce3acec728582946f0f50e85f4647e6f7388619c021698fce85222e1dedbd2ad","state":"VERIFIED_FIXTURE_ONLY"},{"id":"KIT-10","path":"ops/runner-factory/controller-root-manifest-client-identity-installation-candidate.mjs","bytes":21316,"digest":"sha256:0a129863daaa709c96c2fb2ecfa3deb8ad41f12a380b4654b754fd1e338eac32","state":"VERIFIED_FIXTURE_ONLY"}],"operatorStages":[{"id":"STAGE-01","title":"专用目标选择","state":"BLOCKED","owner":"Platform SRE + FinOps","exit":"锁定 staging、专用、无生产标记、UID/GID 无冲突的目标主机"},{"id":"STAGE-02","title":"Runner 容量准备","state":"BLOCKED","owner":"Platform SRE + Mobile Platform","exit":"补齐 G01/G02 的组织级 Linux 与独立 Mac lane"},{"id":"STAGE-03","title":"精确来源包冻结","state":"READY_SOURCE_ONLY","owner":"Supply Chain + Release","exit":"冻结 10 项来源并签署 source/artifact/config 身份"},{"id":"STAGE-04","title":"配置与 Factory 审查","state":"BLOCKED","owner":"Security + Global Architecture","exit":"安装前完成 G03/G04 的真实配置与最小权限评审"},{"id":"STAGE-05","title":"停止态安装","state":"WAITING_PREDECESSOR","owner":"Platform SRE","exit":"只写 identity、manifest 和 client modules；不得安装 unit、启动服务或监听端口"},{"id":"STAGE-06","title":"独立读回与回滚演练","state":"WAITING_PREDECESSOR","owner":"QA + Independent Witness","exit":"逐文件摘要/元数据回读后逆序回滚至空状态"},{"id":"STAGE-07","title":"一次性执行窗口准入","state":"HELD_FOR_R48","owner":"Release Authority","exit":"导入六席外部回执并锁定不超过 30 分钟的执行窗口"}],"controlSurfaces":[{"id":"R47-UI01","title":"R47 双轨进度与正式 Gate 真值","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI02","title":"当前主机目标适配裁决","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI03","title":"生产标记与共享服务冲突","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI04","title":"UID/GID 991 冲突","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI05","title":"端口 8100/8110 边界","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI06","title":"专用 staging 目标合同","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI07","title":"Gitea 可达性与授权可见度","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI08","title":"G01 Linux Runner 容量派发","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI09","title":"G02 Mac Runner lane 派发","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI10","title":"G03 安全配置授权","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI11","title":"G04 Factory 架构审查","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI12","title":"G07 停止态安装授权","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI13","title":"G09 供应链签名授权","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI14","title":"FinOps 预算与 TTL 授权","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI15","title":"十项来源包摘要","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI16","title":"七阶段执行路径","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI17","title":"停止态能力防火墙","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI18","title":"独立读回与逆序回滚","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI19","title":"R48 一次性窗口准入","state":"IMPLEMENTED_READ_ONLY"},{"id":"R47-UI20","title":"零生产副作用账本","state":"IMPLEMENTED_READ_ONLY"}],"validationMatrix":{"hostChecks":12,"invariants":["正式与工程进度分离","共享生产主机必须拒绝","生产标记存在必须拒绝","Portal 服务活动必须拒绝","UID/GID 冲突必须拒绝","技术 sudo 不等于授权","未认证空仓列表不得当作零项目","外部责任人不可由 Portal 代签","来源候选不得当作生产安装","停止态安装不得启动 unit","8110 不得提前监听","独立读回必须与执行分离","回滚必须恢复先前空状态","R48 必须等待六席回执"],"expectedCases":168,"passedCases":168,"failedCases":0,"result":"PASS_FAIL_CLOSED"},"nextSafeAction":{"id":"D05-R48","title":"D05-R48 外部授权回执导入、专用主机锁定与一次性执行窗口准入","admission":"先取得六席范围绑定回执并选择满足十二项检查的专用 staging 主机；随后才能导入回执、锁定目标和创建一次性执行窗口。","portalAutoStartAllowed":false},"truthRules":["当前生产 Portal 主机带有 /etc/reits-production-host 标记、端口 8100 正在监听且 UID/GID 991 已被占用，因此不是 Controller 合格目标。","拥有技术 sudo 能力不等于取得安装、成本、安全、发布或产品授权。","R47 只完成目标选择、责任派发、来源包验真与停止态执行准备，不创建付费资源、不写 root 配置、不安装或启动 Controller。","未认证 Gitea 组织 API 返回空列表只能解释为缺少组织读取授权，不能解释为 0 个仓库或 0 个 Runner。","只有专用目标、六席外部授权、精确制品、独立见证和回滚窗口全部满足后，R48 才可进入一次性执行窗口准入。","工程子阶段完成不得推进正式 4/36；只有十一道 D05 生产 Gate 的范围绑定回执才能推进 D05。"],"effectsExecuted":{"paid-resource-created":0,"runner-created":0,"controller-configuration-written":0,"controller-identity-created":0,"controller-artifact-installed":0,"systemd-unit-installed":0,"controller-service-started":0,"listener-started":0,"external-authorization-written":0,"d05-gate-advanced":0},"integrity":{"predecessorDigest":"sha256:d1ba673a6f6b4cfa2f99170640867bf5d4dee508d972abb4f133c5b3cbf02f2f","sourceKitDigest":"sha256:4cfcab620a23b1c8eae29e729ce8266e66c2cc3df4204af974126df853017cde","hostChecksDigest":"sha256:ab2fd9d68ba6860988bd74432d1e42b41a86b4a017a061c0e65b34c3205dae68","authorizationDigest":"sha256:cf1dccf4ca5d43a78f8afc378dfedccd75e6b3266d7d069ca995f9e3a6137016","planeSeedDigest":"sha256:c1ae332792dd3ad8a91c8a54148f7764156431f4b4c07834acf503d51842368e"},"runtimeReleaseIdentity":{"schemaVersion":"developer.reits.tech/runtime-release-identity/v1","status":"BOUND","releaseId":"developer-portal@1dfd35b4f388-a84f2486318f","repository":"local/developer-portal","service":"reits-developer-portal","channel":"production","environment":"production","source":{"revision":"1dfd35b4f388738df724e8f588f00a3841976f6b"},"artifact":{"digest":"sha256:a84f2486318fee7337237b2687506d22acf4cd1594cd2b981d6c2176b02f83b2"},"sbom":{"digest":"sha256:9aadc74b40ea49b4fa49020f56eb73c5985a3a9fcc2d8ab0ac1f45cffb24a809"},"configuration":{"digest":"sha256:2acb68789cd717dbd5104c8f4f15d45dc7148be2a1119961cae15838e9c18db8"},"migration":{"digest":"sha256:dc6c9dd2ab96033d9dfd46da240fbf27c35c6cd4a260d96b19ef35c16a0cdfd7"},"secrets":{"referencesOnly":true,"valuesExposed":false},"rollback":{"status":"BOUND","targetReleaseId":"developer-portal@89d2d82fa430-16939846ecc8"},"provenance":{"predicateType":"https://slsa.dev/provenance/v1","builderId":"developer.reits.tech/local-release-builder/v1","signed":false}}}