{"schemaVersion":"developer.reits.tech/implementation-transition/v1","programAuthority":{"profile":"D01_D36_ARCHIVE_ONLY","currentProgramAuthority":false,"archive":"/development-plan/archive","currentTaskLedger":"/api/real-task-ledger"},"status":"ARCHITECTURE_SEQUENCE_CLOSED_IMPLEMENTATION_D05_ACTIVE_FAIL_CLOSED","evaluatedAt":"2026-09-28T12:06:47.514Z","transitionComplete":true,"boundary":"This closes the architecture-to-implementation handoff only. It does not accept D05, create paid resources, authorize production changes or advance the implementation counter.","architecture":{"current":104,"total":104,"remaining":0,"complete":true},"implementation":{"accepted":4,"total":36,"current":5,"currentKnife":"D05","currentStatus":"ACTIVE","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31,"programComplete":false},"d05":{"title":"发布身份、配置、Secret 与制品标准","owner":"Platform Engineering","gatesSatisfied":0,"gatesTotal":11,"gatesDenied":11,"accepted":false,"firstFailure":{"id":"D05-G01","name":"ORGANIZATION_LINUX_RUNNER_CAPACITY","owner":"PLATFORM_SRE","target":"2 organization-scoped Linux runners; concurrency one; single-use ephemeral boundary","observed":"1 台 Linux 候选、1 台在线；组织级 0、ephemeral 0、合格 0","positiveReceiptsObserved":0,"decision":"DENIED_NO_ORGANIZATION_EPHEMERAL_CAPACITY","group":"CAPACITY","groupLabel":"Runner capacity","source":"/api/runner-capacity/evidence","observedAt":"2026-07-29T04:47:01Z","evidenceStatus":"G01_G02_DENIED_NO_ELIGIBLE_LANES","satisfied":false},"repositoryTasksCompleted":8,"repositorySequenceComplete":true,"nextExecutableTask":{"ordinal":2,"id":"D05-T02","owner":"Cloud Account Owner","title":"恢复独立 AWS 验证身份","evidence":"仓库已交付一小时临时角色、最小权限边界、精确身份检查、ValidateTemplate 和 deny probe；Cloud Owner 尚未创建角色，AWS 仍未在线接受。","state":"REPOSITORY_IMPLEMENTED_LIVE_IDENTITY_REQUIRED","authority":"CLOUD_OWNER_ACTIVATION_REQUIRED"},"nextPlannedTask":{"ordinal":3,"id":"D05-T03","owner":"Product Owner + FinOps","title":"批准两台隔离 Linux Runner 成本","evidence":"官方 Sydney SKU 报价、精确模板摘要、Product Owner + FinOps Ed25519 双签名、USD 250 上限和非续期 ASG 归零租约已实现；真实签名仍为 0/2。","state":"REPOSITORY_IMPLEMENTED_DUAL_APPROVAL_REQUIRED","authority":"OWNER_APPROVAL_REQUIRED"},"nextRepositoryTask":null},"runtimeSnapshot":{"observedAt":"2026-07-24T10:32:32Z","developerPortalRelease":"8ae9d1b4511f1e1fc5a902cd41eef248a81fd743","portalServiceActive":true,"portalListener8100":1,"controllerListener8110":0,"controllerServiceUnits":0,"controllerInstallationRoots":0,"localAwsCliAvailable":false,"currentHostQualifiedAsDedicatedController":false},"credentialFirebreak":{"schemaVersion":"developer.reits.tech/runner-credential-boundary/v1","status":"T01_REPOSITORY_IMPLEMENTED_LIVE_QUALIFICATION_REQUIRED","evaluatedAt":"2026-07-24T16:10:00Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T01","title":"Runner credential and task isolation firebreak","repositoryImplementationComplete":true,"liveQualified":false,"productionAccepted":false,"nextTask":"D05-T02","nextTaskTitle":"Restore an independent AWS validation identity"},"topology":{"organization":"reits","linuxRunners":2,"availabilityZones":2,"vpc":"dedicated-ci-only","ingressRules":0,"concurrencyPerRunner":1,"runnerMode":"ephemeral-single-job","taskMode":"docker-container","replacementMode":"power-off-then-asg-replace"},"controls":[{"id":"CRED-01","title":"Ephemeral runner credential","state":"REPOSITORY_BOUND","mechanism":"register --ephemeral; Gitea revokes the exposed runner credential before untrusted code starts"},{"id":"TASK-01","title":"Task container boundary","state":"REPOSITORY_BOUND","mechanism":"digest-pinned docker:// labels, privileged=false, valid_volumes=[], docker_host=\"-\" and no host socket mount"},{"id":"CLOUD-01","title":"Zero cloud authority at execution","state":"REPOSITORY_BOUND","mechanism":"IMDS disabled and instance profile detached before the daemon starts"},{"id":"NET-01","title":"Proxy-only task egress","state":"REPOSITORY_BOUND","mechanism":"reits-ci0 may reach only 172.30.0.1:3128; task DNS points to empty container loopback; Docker image pulls use loopback Squid; other host and forwarded sockets are rejected"},{"id":"LIFE-01","title":"Whole-machine retirement","state":"REPOSITORY_BOUND","mechanism":"daemon exits after one job; credential and task roots are wiped; VM powers off; ASG replaces it"}],"lifecycle":[{"ordinal":1,"state":"BOOTSTRAP","detail":"New encrypted Ubuntu VM starts in the isolated CI VPC with a temporary bootstrap profile."},{"ordinal":2,"state":"REGISTER","detail":"Root retrieves the SSM registration token and creates one ephemeral organization runner credential while the daemon is offline."},{"ordinal":3,"state":"QUARANTINE","detail":"The node disables IMDS, detaches its profile, signals CloudFormation, erases temporary AWS values and writes the activation marker."},{"ordinal":4,"state":"EXECUTE","detail":"The unprivileged daemon accepts one job; untrusted steps execute in a bounded Docker container without the host socket or runner credential."},{"ordinal":5,"state":"EGRESS","detail":"Task traffic is forced through the dedicated bridge to the root-managed CONNECT allowlist; private and direct destinations are denied."},{"ordinal":6,"state":"RETIRE","detail":"After the one job or any daemon failure, the host deletes containers, workspace, temp data and .runner, then powers off for ASG replacement."}],"repositoryEvidence":{"template":"ops/gitea-runner/cloudformation.yaml","deploy":"ops/gitea-runner/deploy.sh","liveVerifier":"ops/gitea-runner/finalize.sh","service":"ops/gitea-runner/reits-gitea-runner.service","egressGuard":"ops/gitea-runner/install-egress-guard.sh","retirement":"ops/gitea-runner/retire-instance.sh","preflight":"ops/gitea-runner/preflight.mjs","staticVerification":"npm run runner-credential-boundary:verify"},"liveEvidence":{"stackStatus":"NOT_DEPLOYED","organizationRunnersOnline":0,"adversarialJobsExecuted":0,"credentialReadAttemptsDenied":0,"metadataAttemptsDenied":0,"productionNetworkAttemptsDenied":0,"retirementReceiptsObserved":0,"replacementReceiptsObserved":0,"gateG01Satisfied":false},"invariants":{"paidResourcesCreated":0,"productionChangesAuthorized":0,"organizationRunnerCredentialInRepository":false,"hostDockerSocketMountedIntoTask":false,"taskCanReadRunnerCredential":false,"taskCanReachImds":false,"runnerReusableAcrossJobs":false,"d05Accepted":false,"programAdvanced":false},"officialReference":"https://docs.gitea.com/usage/actions/act-runner#ephemeral-runners","boundary":"Repository implementation is complete for D05-T01, but no paid cloud resource was created and no live adversarial receipt exists. This artifact does not satisfy G01 or accept D05."},"awsValidationIdentity":{"schemaVersion":"developer.reits.tech/aws-validation-identity/v1","status":"T02_REPOSITORY_IMPLEMENTED_LIVE_IDENTITY_REQUIRED","evaluatedAt":"2026-07-24T07:38:32Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T02","title":"Independent AWS validation identity","repositoryImplementationComplete":true,"cloudOwnerProvisioningRequired":true,"liveIdentityObserved":false,"awsTemplateValidated":false,"productionAccepted":false,"nextTask":"D05-T03","nextTaskBlocked":true,"nextTaskTitle":"Approve two isolated Linux runner costs"},"observation":{"workspace":"developer-portal-local","awsCli":"ABSENT","profilesDiscovered":0,"awsEnvironmentCredentialVariables":0,"callerIdentityExecuted":false,"currentPrincipal":null,"priorPrincipal":"iam-user/cc","priorObservation":"2026-07-20T11:40:44Z","priorObservationFreshness":"STALE_SUPERSEDED","productionHostAwsCli":"PRESENT_INELIGIBLE_NOT_INVOKED","productionHostEligible":false,"reason":"No AWS CLI or AWS credential environment is present in the current workspace. The shared production EC2 host is never an eligible validation identity source."},"roleContract":{"roleName":"reits-cloudformation-validator","sessionType":"ASSUMED_ROLE_TEMPORARY","maximumSessionSeconds":3600,"trustedPrincipal":"CLOUD_OWNER_SUPPLIED_EXACT_IAM_PRINCIPAL_ARN","externalIdRequired":true,"sessionNamePattern":"reits-validator-*","permissionsBoundaryRequired":true,"allowedActions":["cloudformation:ValidateTemplate","sts:GetCallerIdentity"],"explicitDenyEveryOtherAction":true,"deploymentActionsAllowed":false,"longLivedAccessKeysAllowed":false,"instanceMetadataCredentialsAllowed":false,"containerCredentialsAllowed":false,"targetTemplate":"ops/gitea-runner/cloudformation.yaml","targetRegion":"ap-southeast-2"},"verificationFlow":[{"ordinal":1,"id":"OWNER_INSTALL","owner":"Cloud Account Owner","state":"OWNER_ACTION_REQUIRED","detail":"Install the role template with an exact trusted IAM principal and out-of-band external ID."},{"ordinal":2,"id":"FEDERATE","owner":"Independent Validator","state":"BLOCKED_IDENTITY_ABSENT","detail":"Use an explicit AWS CLI role profile backed by federated or otherwise temporary source credentials."},{"ordinal":3,"id":"IDENTIFY","owner":"Validation Script","state":"BLOCKED_AWS_CLI_ABSENT","detail":"Call STS GetCallerIdentity and require the exact assumed-role ARN and expected account."},{"ordinal":4,"id":"VALIDATE","owner":"AWS CloudFormation","state":"BLOCKED_IDENTITY_ABSENT","detail":"Validate only the pinned runner template body in ap-southeast-2; do not create a change set or stack."},{"ordinal":5,"id":"PROVE_DENY","owner":"Validation Script","state":"BLOCKED_IDENTITY_ABSENT","detail":"Require a read-only EC2 DescribeInstances probe to fail with AccessDenied, proving the role is not a general cloud identity."},{"ordinal":6,"id":"SEAL_RECEIPT","owner":"Independent Validator","state":"BLOCKED_PREDECESSOR","detail":"Write a secret-free local receipt binding account, principal, template SHA-256, region and validation response."}],"repositoryEvidence":{"roleTemplate":"ops/aws-validation-identity/cloudformation.yaml","permissionsPolicy":"ops/aws-validation-identity/validator-policy.json","profileExample":"ops/aws-validation-identity/config.example","liveVerifier":"ops/aws-validation-identity/validate-template.sh","runbook":"ops/aws-validation-identity/README.md","staticVerification":"npm run aws-validation-identity:verify"},"liveEvidence":{"roleCreated":false,"assumedRoleObserved":false,"expectedAccountMatched":false,"validateTemplateSucceeded":false,"denyProbeSucceeded":false,"receiptObserved":false,"paidResourcesCreated":0,"productionChangesAuthorized":0,"gateG01Satisfied":false},"invariants":{"validationIdentityDistinctFromDeploymentIdentity":true,"validationIdentityDistinctFromProductionHostIdentity":true,"staticAccessKeysAccepted":false,"instanceRoleCredentialsAccepted":false,"arbitraryTemplateAccepted":false,"cloudFormationMutationAllowed":false,"runnerProvisioningAllowed":false,"d05Accepted":false,"programAdvanced":false},"officialReferences":{"iamBestPractices":"https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html","cliRoleProfiles":"https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html","validateTemplate":"https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ValidateTemplate.html","getCallerIdentity":"https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html","notAction":"https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html"},"boundary":"D05-T02 repository engineering is complete, but the Cloud Account Owner has not installed the role and no independent assumed-role session or AWS ValidateTemplate receipt exists. D05-T03 remains blocked, G01 remains false, D05 remains 0/11 and implementation remains 4/36."},"runnerCostApproval":{"schemaVersion":"developer.reits.tech/runner-cost-approval/v1","status":"T03_REPOSITORY_IMPLEMENTED_DUAL_APPROVAL_REQUIRED","observedAt":"2026-07-24T07:58:32Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T03","title":"Approve two isolated Linux runner costs","owners":["Product Owner","FinOps"],"repositoryImplementationComplete":true,"currentExecutablePrerequisite":"D05-T02","currentExecutablePrerequisiteSatisfied":false,"liveDualApprovalObserved":false,"deploymentAdmitted":false,"productionAccepted":false,"nextTask":"D05-T04","nextTaskTitle":"Deploy and complete 18-repository isolation qualification","nextTaskBlocked":true},"quote":{"region":"ap-southeast-2","location":"Asia Pacific (Sydney)","currency":"USD","billingModel":"ON_DEMAND","hoursAssumption":730,"priceListRetrievedAt":"2026-07-24T07:58:32Z","components":[{"id":"COMPUTE","label":"2 × t3.large Linux","quantity":1460,"unit":"instance-hours","rateUsd":0.1056,"monthlyUsd":154.176,"sku":"B7WDU84CV8BAGNYW"},{"id":"ROOT_STORAGE","label":"2 × 80 GB gp3","quantity":160,"unit":"GB-month","rateUsd":0.096,"monthlyUsd":15.36,"sku":"QR74UAP3E9WUYT9B"},{"id":"PUBLIC_IPV4","label":"2 × in-use public IPv4","quantity":1460,"unit":"address-hours","rateUsd":0.005,"monthlyUsd":7.3,"sku":"JZP2PURP9VVQ96GH"}],"fixedBaseUsd":176.836,"fixedBaseRoundedUsd":176.84,"proposedMonthlyAuthorizationCeilingUsd":250,"variableAllowanceUsd":73.164,"variableAllowancePercentOfBase":41.373,"notFixed":["Internet and regional data transfer","Single-job replacement overlap","Taxes, credits, discounts and currency conversion","Any resource or performance setting outside the exact template"]},"infrastructureBinding":{"requestId":"D05-T03-LINUX-RUNNERS-V1","requestPath":"ops/runner-cost-approval/request.json","requestDigest":"sha256:55467056b51a687287e0aba44dd7f7dafcba223110e384a9bc54ad7ab8c8fcbe","templatePath":"ops/gitea-runner/cloudformation.yaml","templateSha256":"62d847f115feab4d01dd6d58fdb211a3d1b94c8ed5e3580de5c5b1463116cadb","priceSnapshotPath":"ops/runner-cost-approval/price-snapshot.json","priceSnapshotSha256":"13f3e40f3030f05b1264758faa085b78d68ce7bb2d4f8c0c39e1cfa449b72526","availabilityZones":2,"instanceType":"t3.large","desiredCapacity":2,"maximumCapacity":2,"concurrencyPerRunner":1,"rootVolumeType":"gp3","rootVolumeGiBEach":80,"cpuCreditMode":"standard","paidDetailedMonitoring":false,"natGateways":0,"inboundRules":0,"productionVpcRoutes":0},"approvalContract":{"requiredRoles":["PRODUCT_OWNER","FINOPS"],"requiredSignatures":2,"observedSignatures":0,"distinctPrincipalsRequired":true,"signatureAlgorithm":"Ed25519","maximumValidityDays":31,"approvalIsNonRenewing":true,"templateChangeInvalidatesApproval":true,"priceSnapshotChangeRequiresRequote":true,"maximumMonthlyAuthorizationUsd":250,"verificationCommand":"node ops/runner-cost-approval/verify-receipt.mjs","deploymentWithoutValidReceipt":"DENY"},"approvalSeats":[{"role":"PRODUCT_OWNER","decision":"PENDING","principal":null,"keyId":null,"signedAt":null,"scope":"Approve business need, two-runner scope and non-renewing lease."},{"role":"FINOPS","decision":"PENDING","principal":null,"keyId":null,"signedAt":null,"scope":"Approve current quote, USD ceiling, exclusions and account budget ownership."}],"costControls":[{"id":"C01","title":"Exact source binding","state":"IMPLEMENTED","mechanism":"Receipt binds the request digest, runner template SHA-256, region and approved ceiling."},{"id":"C02","title":"Dual-owner signature","state":"IMPLEMENTED_PENDING_KEYS","mechanism":"Ed25519 signatures from distinct trusted Product Owner and FinOps principals are mandatory."},{"id":"C03","title":"Bounded compute rate","state":"IMPLEMENTED","mechanism":"T3 CPU credits use standard mode and paid one-minute detailed monitoring is disabled."},{"id":"C04","title":"No hidden network appliance","state":"IMPLEMENTED","mechanism":"The stack contains no NAT Gateway or load balancer; two charged public IPv4 addresses are explicit."},{"id":"C05","title":"Non-renewing lease","state":"IMPLEMENTED","mechanism":"A CloudFormation scheduled action sets ASG min, desired and max capacity to zero at receipt expiry."},{"id":"C06","title":"Fail-closed deploy","state":"IMPLEMENTED","mechanism":"The deploy path rejects absent, stale, over-cap, wrong-region, wrong-template or invalid signatures before mutation."}],"liveEvidence":{"productOwnerSignaturesObserved":0,"finOpsSignaturesObserved":0,"validReceiptsObserved":0,"awsBudgetsObserved":0,"paidResourcesCreated":0,"runnerStacksCreated":0,"organizationRunnersOnline":0,"d05GateG01Satisfied":false},"sources":[{"label":"AWS Price List documentation","url":"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/price-changes.html"},{"label":"Amazon EC2 Sydney price list v20260723171241","url":"https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/20260723171241/ap-southeast-2/index.csv"},{"label":"Amazon VPC Sydney price list v20260713171339","url":"https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonVPC/20260713171339/ap-southeast-2/index.csv"}],"invariants":{"priceSnapshotIsApproval":false,"repositoryPacketIsOwnerApproval":false,"environmentLatchAloneAuthorizesSpend":false,"unpricedResourcesAuthorized":false,"paidResourcesCreated":0,"productionChangesAuthorized":0,"d05Accepted":false,"programAdvanced":false},"boundary":"D05-T03 repository engineering is complete: the official price snapshot, exact quote, dual-signature receipt verifier, deploy admission and lease expiry are implemented. Product Owner and FinOps have not signed, no cost receipt is valid, D05-T02 live AWS identity remains the current executable prerequisite, D05-T04 remains blocked, G01 remains false, D05 remains 0/11 and implementation remains 4/36."},"runnerIsolationQualification":{"schemaVersion":"developer.reits.tech/runner-isolation-qualification/v1","status":"T04_REPOSITORY_IMPLEMENTED_LIVE_EXECUTION_BLOCKED","observedAt":"2026-07-24T08:28:35Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T04","title":"Deploy and qualify isolated Linux runners across the 18-repository gate set","owner":"Platform SRE + Security + QA","repositoryImplementationComplete":true,"liveExecutionStarted":false,"liveExecutionAdmitted":false,"productionAccepted":false,"nextTask":"D05-T05","nextTaskTitle":"Restore an independent native Mac runner","nextTaskBlocked":true},"planBinding":{"planId":"D05-T04-18-REPOSITORY-ISOLATION-V1","path":"ops/gitea-runner/qualification-plan.json","sha256":"e498834da01c4011411c75f2aa2c4ec4ca8b80bae166e80957a9d6ce88cec25a","registry":"data/ci-registry.json","workflowPath":".gitea/workflows/reits-minimum-ci.yml","gateContext":"REITS Minimum CI / gate (push)","exactRevisionRequired":true},"preconditions":[{"id":"T01","label":"Runner credential firebreak","repositoryState":"IMPLEMENTED","liveState":"NOT_QUALIFIED","satisfied":false},{"id":"T02","label":"Independent AWS validation identity","repositoryState":"IMPLEMENTED","liveState":"ROLE_ABSENT","satisfied":false},{"id":"T03","label":"Product Owner + FinOps cost approval","repositoryState":"IMPLEMENTED","liveState":"0_OF_2_SIGNATURES","satisfied":false},{"id":"SCOPE","label":"Shared repository runner scope","repositoryState":"GAP_EXPOSED_AND_FAIL_CLOSED","liveState":"OWNER_DECISION_REQUIRED","satisfied":false}],"scopeModel":{"coreRepositories":18,"reitsOrganizationRepositories":17,"sharedExternalRepositories":1,"reitsOrganization":{"scope":"organization:reits","targetLanes":2,"targetRepositories":17,"onlineLanesObserved":0},"sharedExternal":{"repository":"jx-im/im-media-send-kit","nativeMinimumRunner":"macos-latest","linuxGateRunner":"ubuntu-latest","currentTemplateCoverage":false,"decision":"OWNER_RESOLUTION_REQUIRED","allowedResolutions":[{"id":"MOVE","label":"Transfer repository to reits","impact":"Existing two reits organization lanes can cover the Linux gate."},{"id":"ADD","label":"Approve separate jx-im ephemeral lane","impact":"Requires a new cost quote, authority receipt and isolated scope."},{"id":"REMOVE","label":"Remove from the core-18 contract","impact":"Requires Product and QA approval plus D04 registry and branch-protection revision."}]}},"liveSummary":{"repositoriesObserved":18,"rawGateSuccess":9,"rawGateCancelled":9,"qualifiedIsolationReceipts":0,"reitsOrganizationRunnersOnline":0,"jxImOrganizationRunnersOnline":0,"adversarialProbeReceipts":0,"retirementReplacementReceipts":0,"trustedSignatures":0},"repositoryMatrix":[{"ordinal":1,"repository":"reits/data-sources","revision":"8987dc1ef058a6d7e8b9ceaa866ba4395ab08a40","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:50Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":2,"repository":"reits/im-core","revision":"4c4ce6e17b91c7c2a97a7e07ebc2cc322b0a61f6","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 6s","rawGateObservedAt":"2026-07-23T16:41:38Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":3,"repository":"jx-im/im-media-send-kit","revision":"d5f0e3e5d65886c0ad9654f4ef30468a0e7b089f","nativeMinimumRunner":"macos-latest","scope":"SHARED_EXTERNAL_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-21T09:15:49Z","qualificationState":"CANCELLED_SCOPE_UNRESOLVED","qualifiedReceipt":false},{"ordinal":4,"repository":"reits/im-ui","revision":"ebee6f3a4e9747c90f1d5c6a8d4b892220ac2a0d","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 1m25s","rawGateObservedAt":"2026-07-20T20:29:23Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":5,"repository":"reits/matrix-quant-im-ios","revision":"e4813fd23765df41b56efd23e61750738c6dd420","nativeMinimumRunner":"macos-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 8s","rawGateObservedAt":"2026-07-23T19:02:15Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":6,"repository":"reits/matrix-x-chat-ios","revision":"ad40fafbc804a5aa3dbb5298d2d9b66a735e6bba","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:50Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":7,"repository":"reits/matrixantai-backtest","revision":"6257ce04cb4612502a3e1ce8cc1bd1d479a7e5f7","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 5s","rawGateObservedAt":"2026-07-20T20:19:08Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":8,"repository":"reits/matrixantai-sim","revision":"b238cb6b2c6de5a33006622287386242225abde0","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 7s","rawGateObservedAt":"2026-07-20T20:19:00Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":9,"repository":"reits/miniapp-open-platform","revision":"41d67048b745fe224dac673268d8b712d2ef2a4f","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 5s","rawGateObservedAt":"2026-07-23T11:51:45Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":10,"repository":"reits/opensdk","revision":"40d9219d607c60482c1ab11c4951296d29b22f22","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-21T09:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":11,"repository":"reits/public-booking-platform","revision":"6a38c3df682ea225d296ec9ec50a1407f26ac7d8","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:50Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":12,"repository":"reits/quant-platform","revision":"cbb20515d59db8a456da8c2030b0c4090051195a","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 6s","rawGateObservedAt":"2026-07-23T17:14:48Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":13,"repository":"reits/reits-auth","revision":"ca7694128287621adcbf1637fbaf720831d42624","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":14,"repository":"reits/reits-bbs","revision":"9c6b70599b66b526c341ef90d4aa53c4e77e8774","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":15,"repository":"reits/reits-info-portal","revision":"6d175fbdedf8c1c156d63aec8b7b6f829f5b794a","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":16,"repository":"reits/reits-knowledge","revision":"7577d3d64699fccc1316a9345ae2ffa097e1be4c","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 6s","rawGateObservedAt":"2026-07-23T19:40:02Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":17,"repository":"reits/reits-media","revision":"4e76349c14e155a55d059bdb2bff0c2d8c886a7e","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-21T09:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":18,"repository":"reits/trading-data-source","revision":"70b8242facafe95773cfc6f2ce108bfa5bdcdf04","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 7s","rawGateObservedAt":"2026-07-20T20:18:34Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false}],"adversarialProbes":[{"id":"P01","title":"Runner credential unreadable","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P02","title":"Host Docker socket absent","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P03","title":"IMDS and task credentials unreachable","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P04","title":"Production network unreachable","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P05","title":"Direct and unlisted egress denied","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P06","title":"Cloud authority absent","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P07","title":"Previous job residue absent on replacement","target":"PASS","observed":"NOT_RUN","receipt":false}],"acceptanceContract":{"requiredExactGateReceipts":18,"observedExactGateReceipts":0,"requiredQualifiedRunnerIdentities":2,"observedQualifiedRunnerIdentities":0,"requiredAdversarialProbeReceipts":7,"observedAdversarialProbeReceipts":0,"requiredRetirementReplacementReceipts":2,"observedRetirementReplacementReceipts":0,"requiredSignatureRoles":["PLATFORM_SRE","SECURITY","QA"],"observedSignatures":0,"maximumReceiptAgeHours":24,"exactPlanDigestRequired":true,"rawCiSuccessIsQualification":false,"allConditionsRequired":true},"controls":[{"id":"Q01","title":"Exact 18-repository revision binding","state":"IMPLEMENTED","mechanism":"Every gate receipt must match the owner, repository, revision and gate context in the immutable plan."},{"id":"Q02","title":"Runner identity provenance","state":"IMPLEMENTED_PENDING_LIVE_EVIDENCE","mechanism":"A green CI status is rejected unless it binds the job to an admitted ephemeral runner and instance."},{"id":"Q03","title":"Seven hostile probes","state":"IMPLEMENTED_PENDING_EXECUTION","mechanism":"Credential, socket, metadata, production route, egress, cloud authority and residue boundaries all need operator-trusted receipts."},{"id":"Q04","title":"One job, one machine","state":"IMPLEMENTED_PENDING_REPLACEMENT","mechanism":"Two old-to-new instance transitions must prove retirement, local destruction and clean replacement."},{"id":"Q05","title":"17 + 1 scope partition","state":"FAIL_CLOSED_OWNER_DECISION_REQUIRED","mechanism":"The current reits organization token cannot authorize jx-im/im-media-send-kit; the verifier refuses 18/18 until its scope is resolved."},{"id":"Q06","title":"Independent three-role acceptance","state":"IMPLEMENTED_PENDING_KEYS","mechanism":"Platform SRE, Security and QA must sign the same receipt using distinct Ed25519 keys."}],"liveEvidence":{"planVerified":true,"repositoriesFetched":18,"giteaReadOnlyRequests":20,"giteaMutationCalls":0,"awsMutationCalls":0,"paidResourcesCreated":0,"runnerStacksCreated":0,"organizationRunnersOnline":0,"qualificationReceiptsAccepted":0,"scopeResolutionReceipts":0,"d05GateG01Satisfied":false},"invariants":{"rawGateSuccessPromotesG01":false,"repositoryPlanAuthorizesSpend":false,"repositoryPlanAuthorizesGiteaMutation":false,"sharedRepositorySilentlyExcluded":false,"d05Accepted":false,"programAdvanced":false},"sources":[{"label":"Gitea Actions runner isolation documentation","url":"https://docs.gitea.com/usage/actions/act-runner"},{"label":"Gitea Actions execution design","url":"https://docs.gitea.com/usage/actions/design"},{"label":"REITs CI registry","path":"data/ci-registry.json"}],"boundary":"D05-T04 repository engineering is complete, including the exact 18-repository matrix, seven hostile probes, one-job replacement contract, signed receipt verifier and the newly exposed 17+1 scope gap. Live execution is not admitted: T02 is absent, T03 is unsigned, both organizations have zero online organization runners, the shared jx-im repository has no approved lane, qualified receipts remain 0/18, G01 remains false, D05 remains 0/11 and implementation remains 4/36."},"nativeMacRunnerQualification":{"schemaVersion":"developer.reits.tech/native-mac-runner-qualification/v1","status":"T05_REPOSITORY_IMPLEMENTED_LIVE_DEVICE_QUALIFICATION_BLOCKED","observedAt":"2026-07-24T09:06:33Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T05","title":"Restore and qualify an independent native Mac runner","owner":"Mobile Platform + Security + QA","repositoryImplementationComplete":true,"liveDeviceExecutionObserved":true,"liveExecutionAdmitted":false,"productionAccepted":false,"nextTask":"D05-T06","nextTaskTitle":"Deploy the independent Controller and loopback port 8110","nextTaskBlocked":true},"planBinding":{"planId":"D05-T05-NATIVE-MAC-RUNNER-V1","path":"ops/gitea-runner/macos/native-qualification-plan.json","sha256":"59296b4c996ea00ad092e21ba1852a942bb241838bfc45477cd906ffc1d99f1c","exactRevisionRequired":true,"maximumReceiptAgeHours":24},"preconditions":[{"id":"DEVICE","label":"Dedicated Mac and Device Owner approval","repositoryState":"IMPLEMENTED","liveState":"DEVICE_NOT_BOUND_TO_QUALIFICATION","satisfied":false},{"id":"REITS_SCOPE","label":"reits organization ephemeral registration authority","repositoryState":"IMPLEMENTED","liveState":"0_ORGANIZATION_RUNNERS","satisfied":false},{"id":"JXIM_SCOPE","label":"jx-im/im-media-send-kit repository registration authority","repositoryState":"IMPLEMENTED","liveState":"NO_TARGET_REPOSITORY_RUNNER","satisfied":false},{"id":"TRUST","label":"Mobile Platform, Security and QA signing keys","repositoryState":"IMPLEMENTED","liveState":"0_OF_3_KEYS","satisfied":false}],"hostCandidateObservation":{"source":"LOCAL_DEVELOPER_WORKSTATION_READ_ONLY_UNBOUND","architecture":"arm64","macosVersion":"26.3.1","macosBuild":"25D2128","xcodeVersion":"26.3","xcodeBuild":"17C529","swiftVersion":"6.2.4","developerDirectory":"/Applications/Xcode.app/Contents/Developer","actRunnerBinaryObserved":false,"runnerProcessObserved":false,"boundRunnerId":null,"qualificationState":"TOOLCHAIN_PRESENT_HOST_IDENTITY_AND_ISOLATION_UNBOUND"},"liveSummary":{"giteaVersion":"1.25.4","adminRunnersRegistered":3,"runnersOnline":2,"macRunnersRegistered":2,"macRunnersOnline":1,"organizationMacRunnersOnline":0,"ephemeralMacRunnersOnline":0,"eligibleMacRunners":0,"exactNativeJobsRequired":2,"historicalNativeSuccesses":1,"historicalNativeCancellations":1,"qualifiedNativeJobReceipts":0,"cleanupReceipts":0,"trustedSignatures":0},"runnerCandidates":[{"id":27,"name":"pp-mac-ios-runner-codex","platform":"macos","status":"online","busy":false,"ephemeral":false,"scope":"repository:jx-im/im-client-ios-swift","labels":["macos-latest","self-hosted","macOS"],"admission":"DENIED_WRONG_REPOSITORY_SCOPE_AND_REUSABLE","reason":"Online is not enough: this runner belongs to an unrelated repository, is reusable and has no signed host or cleanup receipt."},{"id":1,"name":"pp-mac-ios-runner","platform":"macos","status":"offline","busy":false,"ephemeral":false,"scope":"repository:jx-im/im-client-ios-swift","labels":["macos-latest","self-hosted","macOS","ubuntu-latest","ubuntu-24.04","ubuntu-22.04"],"admission":"DENIED_OFFLINE_REUSABLE_AND_LABEL_COLLISION","reason":"The offline registration is reusable and mixes macOS and Ubuntu labels."}],"scopePartitions":[{"id":"REITS_NATIVE_IOS","repository":"reits/matrix-quant-im-ios","revision":"e4813fd23765df41b56efd23e61750738c6dd420","scope":"organization:reits","requiredLabel":"reits-macos-native-v1","workflow":".gitea/workflows/ci.yml","job":"validate-and-test","currentState":"HISTORICAL_SUCCESS_QUALIFICATION_RECEIPT_MISSING"},{"id":"JXIM_SWIFT_PACKAGE","repository":"jx-im/im-media-send-kit","revision":"d5f0e3e5d65886c0ad9654f4ef30468a0e7b089f","scope":"repository:jx-im/im-media-send-kit","requiredLabel":"macos-latest","workflow":".gitea/workflows/reits-minimum-ci.yml","job":"minimum","currentState":"CANCELLED_NO_ELIGIBLE_REPOSITORY_RUNNER"}],"nativeJobObservations":[{"repository":"reits/matrix-quant-im-ios","revision":"e4813fd23765df41b56efd23e61750738c6dd420","runId":"66958","jobId":"87631","runnerId":"41","runnerName":"codex-mx-ios-foundation-v2-20260724","runnerLabel":"mq-ios-foundation-ci-20260724","conclusion":"success","startedAt":"2026-07-23T19:02:06Z","completedAt":"2026-07-23T19:33:55Z","qualificationState":"RAW_NATIVE_SUCCESS_SCOPE_EPHEMERAL_CLEANUP_AND_SIGNATURES_UNPROVEN","qualifiedReceipt":false},{"repository":"jx-im/im-media-send-kit","revision":"d5f0e3e5d65886c0ad9654f4ef30468a0e7b089f","runId":"66045","jobId":"86511","runnerId":null,"runnerName":null,"runnerLabel":"macos-latest","conclusion":"cancelled","startedAt":null,"completedAt":"2026-07-21T09:15:49Z","qualificationState":"NO_NATIVE_EXECUTION","qualifiedReceipt":false}],"lifecycle":[{"ordinal":1,"id":"PREFLIGHT","owner":"Device Owner","title":"Seal host and toolchain profile","state":"REPOSITORY_BOUND_LIVE_RECEIPT_REQUIRED"},{"ordinal":2,"id":"REGISTER_REITS","owner":"REITs Organization Owner","title":"Create one ephemeral organization registration with a dedicated native label","state":"OWNER_ACTION_REQUIRED"},{"ordinal":3,"id":"RUN_IOS","owner":"Mobile Platform","title":"Execute the exact iOS policy job and retain the job identity","state":"BLOCKED_PREDECESSOR"},{"ordinal":4,"id":"DESTROY_REITS","owner":"Device Owner","title":"Destroy runner credential, workspace, DerivedData and simulator state","state":"BLOCKED_PREDECESSOR"},{"ordinal":5,"id":"REGISTER_JXIM","owner":"jx-im Repository Owner","title":"Create one separate ephemeral repository registration","state":"OWNER_ACTION_REQUIRED"},{"ordinal":6,"id":"RUN_SWIFT","owner":"Mobile Platform","title":"Execute the exact Swift package job","state":"BLOCKED_PREDECESSOR"},{"ordinal":7,"id":"DESTROY_JXIM","owner":"Device Owner","title":"Destroy the second runner generation and all job state","state":"BLOCKED_PREDECESSOR"},{"ordinal":8,"id":"SIGN","owner":"Mobile Platform + Security + QA","title":"Sign the same fresh two-job qualification receipt","state":"0_OF_3_SIGNATURES"}],"adversarialProbes":[{"id":"M01","title":"Registration token unreadable by job user","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"M02","title":"Runner credential cannot poll a second job","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"M03","title":"Personal keychain and iCloud identities absent","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"M04","title":"Docker socket, cloud authority and production routes absent","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"M05","title":"Signed native toolchain matches the job host","target":"PASS","observed":"NOT_RUN","receipt":false},{"id":"M06","title":"Workspace and simulator state destroyed before scope switch","target":"PASS","observed":"NOT_RUN","receipt":false}],"acceptanceContract":{"requiredExactNativeJobReceipts":2,"observedExactNativeJobReceipts":0,"requiredEphemeralRunnerRegistrations":2,"observedEphemeralRunnerRegistrations":0,"requiredCleanupReceipts":2,"observedCleanupReceipts":0,"requiredAdversarialProbeReceipts":6,"observedAdversarialProbeReceipts":0,"requiredSignatureRoles":["MOBILE_PLATFORM","SECURITY","QA"],"observedSignatures":0,"maximumConcurrentJobs":1,"maximumReceiptAgeHours":24,"historicalGreenJobIsQualification":false,"onlineReusableRunnerIsQualification":false,"allConditionsRequired":true},"controls":[{"id":"N01","title":"Two explicit scopes","state":"IMPLEMENTED_PENDING_OWNER_AUTHORITY","mechanism":"The reits organization and jx-im repository use separate registration authorities and runner generations."},{"id":"N02","title":"Dedicated physical Mac","state":"IMPLEMENTED_PENDING_HOST_BINDING","mechanism":"The accepted host has no personal session, production route, cloud authority or unrelated runner service."},{"id":"N03","title":"One credential, one job","state":"IMPLEMENTED_PENDING_LIVE_RECEIPT","mechanism":"act_runner 0.2.12+ ephemeral registration revokes the exposed runner credential before untrusted steps."},{"id":"N04","title":"Platform-safe scheduling","state":"IMPLEMENTED_PENDING_LIVE_BINDING","mechanism":"The reits organization lane uses a dedicated label; the generic macos label is allowed only inside the exact jx-im repository scope."},{"id":"N05","title":"Native toolchain identity","state":"IMPLEMENTED_PENDING_SIGNED_PROFILE","mechanism":"Architecture, macOS build, Xcode build, Swift version and developer directory are bound to the receipt."},{"id":"N06","title":"Credential and network firebreak","state":"IMPLEMENTED_PENDING_HOST_PROBES","mechanism":"Root registration material, login keychain, iCloud identity, Docker socket, cloud credentials and production routes are denied."},{"id":"N07","title":"Serial cleanup boundary","state":"IMPLEMENTED_PENDING_TWO_CLEANUPS","mechanism":"Runner state, workspace, DerivedData and simulator data are destroyed before another scope is registered."},{"id":"N08","title":"Independent admission","state":"IMPLEMENTED_PENDING_KEYS","mechanism":"Mobile Platform, Security and QA sign one plan-bound receipt with distinct Ed25519 keys."}],"liveEvidence":{"giteaReadOnlyRequests":62,"repositoriesScanned":50,"giteaMutationCalls":0,"deviceMutationCalls":0,"runnerRegistrationCalls":0,"workflowDispatchCalls":0,"credentialsRecorded":false,"paidResourcesCreated":0,"d05GateG02Satisfied":false},"invariants":{"historicalSuccessPromotesG02":false,"onlineWrongScopeRunnerPromotesG02":false,"repositoryPacketAuthorizesDeviceMutation":false,"repositoryPacketAuthorizesGiteaMutation":false,"crossOrganizationCredentialReuseAllowed":false,"d05Accepted":false,"programAdvanced":false},"sources":[{"label":"Gitea act_runner registration, ephemeral runner and macOS LaunchDaemon documentation","url":"https://docs.gitea.com/usage/actions/act-runner"},{"label":"Gitea Actions trust guidance","url":"https://docs.gitea.com/usage/actions/overview"},{"label":"Gitea 1.25 Actions runner API","url":"https://docs.gitea.com/api/1.25/"}],"boundary":"D05-T05 repository engineering is complete: exact native workloads, two-scope serial registration, dedicated-host profile, six probes, two cleanup receipts and three-party signed admission are executable. Live acceptance remains blocked because the only online Mac runner is reusable and scoped to an unrelated repository, the historical iOS success has no trusted scope or cleanup receipt, the Swift package job is cancelled, accepted receipts remain 0/2, G02 remains false, D05 remains 0/11 and implementation remains 4/36."},"controllerDeploymentQualification":{"schemaVersion":"developer.reits.tech/controller-deployment-qualification/v1","status":"T06_REPOSITORY_IMPLEMENTED_LIVE_DEDICATED_CONTROLLER_BLOCKED","observedAt":"2026-07-24T09:46:42Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T06","title":"Deploy the independent Controller and loopback port 8110","owner":"Security + Runtime + SRE","repositoryImplementationComplete":true,"liveDedicatedHostObserved":false,"liveDeploymentAdmitted":false,"controllerListenerObserved":false,"productionAccepted":false,"nextTask":"D05-T07","nextTaskTitle":"Sign release identity and execute intentional rollback","nextTaskBlocked":true},"planBinding":{"planId":"D05-T06-CONTROLLER-DEPLOYMENT-V1","path":"ops/runner-factory/deployment/controller-deployment-plan.json","sha256":"71407e09e779a163febaf6c1d7e261243eff70d3775e15499645c253a6eedce0","maximumReceiptAgeHours":2,"exactRevisionRequired":true},"dependencyTruth":{"requiredGates":["D05-G01","D05-G02","D05-G03","D05-G04"],"satisfiedGates":0,"requiredBeforeInstallation":4,"repositoryCandidatesAreProductionReceipts":false,"portalHostMayBeReused":false,"decision":"DENIED_G01_G04_AND_DEDICATED_HOST_ABSENT"},"repositoryPacket":{"exactArtifacts":6,"componentCandidates":6,"productionQualifiedComponents":0,"readinessGateContracts":11,"runtimeProbeContracts":8,"requiredIndependentSignatures":3,"observedIndependentSignatures":0,"hardenedUnitPresent":true,"loopbackOnlyConfigurationPresent":true,"negativeWebhookContractPresent":true,"preflightPresent":true,"collectorPresent":true,"verifierPresent":true},"currentHostObservation":{"source":"EC2_READ_ONLY_PRODUCTION_HOST_AUDIT","portalRelease":"developer-portal@0d22b6098f92-7015f86fa477","portalSourceRevision":"0d22b6098f92a6124241cfa803b99d648ba882b7","productionHostMarkerPresent":true,"dedicatedControllerMarkerPresent":false,"runtimeManifestPresent":false,"readinessDirectoryPresent":false,"listenerAuthorizationPresent":false,"runtimeDirectoryPresent":false,"controllerUnitLoadState":"not-found","controllerUnitActiveState":"inactive","controllerProcesses":0,"portal8100Listeners":1,"controller8110Listeners":0,"public8110Routes":0,"runnerServices":0,"healthHttp":0,"readyHttp":0,"qualification":"DENIED_SHARED_PRODUCTION_HOST_AND_REQUIRED_RUNTIME_ABSENT"},"topology":{"current":{"host":"shared production application EC2","portal":"127.0.0.1:8100","controller":"ABSENT","admission":"DENIED"},"target":{"host":"dedicated linux-amd64 control plane","portalCoLocated":false,"runnerCoLocated":false,"publicIp":false,"inboundRules":0,"productionRoutes":0,"instanceProfile":false,"imds":false,"controller":"127.0.0.1:8110","reverseProxy":false,"serviceIdentity":"reits-runner-factory","mode":"EVIDENCE_ONLY_UNTIL_ALL_GATES_READY"}},"components":[{"id":"RESERVATION_READER","mode":"READ_ONLY","repositoryCandidate":true,"productionQualified":false,"runtimeBound":false},{"id":"CAPACITY_READER","mode":"READ_ONLY","repositoryCandidate":true,"productionQualified":false,"runtimeBound":false},{"id":"WORKER_READER","mode":"READ_ONLY","repositoryCandidate":true,"productionQualified":false,"runtimeBound":false},{"id":"RUNNER_READER","mode":"READ_ONLY","repositoryCandidate":true,"productionQualified":false,"runtimeBound":false},{"id":"JOURNAL_READER","mode":"READ_ONLY","repositoryCandidate":true,"productionQualified":false,"runtimeBound":false},{"id":"READINESS_VERIFIER","mode":"VERIFY_ONLY","repositoryCandidate":true,"productionQualified":false,"runtimeBound":false}],"readiness":{"required":11,"observed":0,"ready":false,"receiptVerified":false,"gates":[{"code":"RF_READY_DEDICATED_HOST","owner":"PLATFORM_SRE","state":"MISSING"},{"code":"RF_READY_SERVICE_IDENTITY","owner":"SECURITY","state":"MISSING"},{"code":"RF_READY_WEBHOOK_SECRET","owner":"SECURITY","state":"MISSING"},{"code":"RF_READY_RESERVATION_STORE","owner":"DATA_PLATFORM","state":"MISSING"},{"code":"RF_READY_RECEIPT_SIGNER","owner":"SECURITY","state":"MISSING"},{"code":"RF_READY_TOKEN_BROKER","owner":"DEVELOPER_PLATFORM","state":"MISSING"},{"code":"RF_READY_WORKER_PROVIDER","owner":"PLATFORM_SRE","state":"MISSING"},{"code":"RF_READY_GITEA_CONTROL","owner":"DEVELOPER_PLATFORM","state":"MISSING"},{"code":"RF_READY_CAPACITY_CONTROLLER","owner":"PLATFORM_SRE","state":"MISSING"},{"code":"RF_READY_AUDIT_SINK","owner":"QA_ARCHITECTURE","state":"MISSING"},{"code":"RF_READY_OWNER_APPROVAL","owner":"PRODUCT_OWNER","state":"MISSING"}]},"lifecycle":[{"ordinal":1,"id":"DEPENDENCIES","owner":"Gate Owners","title":"Verify fresh positive G01-G04 receipts","state":"0_OF_4"},{"ordinal":2,"id":"HOST","owner":"Platform SRE","title":"Attest a stopped dedicated host","state":"HOST_ABSENT"},{"ordinal":3,"id":"INSTALL","owner":"Security + Runtime","title":"Install exact release, identity, manifest and credential reference","state":"BLOCKED_PREDECESSOR"},{"ordinal":4,"id":"BIND","owner":"Runtime","title":"Bind six production-qualified components","state":"0_OF_6"},{"ordinal":5,"id":"READY","owner":"Gate Owners","title":"Verify all readiness receipts","state":"0_OF_11"},{"ordinal":6,"id":"LISTEN","owner":"Release Owner","title":"Start exactly one loopback listener","state":"0_LISTENERS"},{"ordinal":7,"id":"PROBE","owner":"Security + QA","title":"Run negative webhook, route, restart and stop probes","state":"0_OF_8"},{"ordinal":8,"id":"SIGN","owner":"Security + Runtime + SRE","title":"Sign one fresh exact qualification receipt","state":"0_OF_3"}],"probes":[{"id":"C01","title":"Dedicated host identity","observed":"NOT_RUN","receipt":false},{"id":"C02","title":"Network and cloud authority absence","observed":"NOT_RUN","receipt":false},{"id":"C03","title":"Service identity and systemd sandbox","observed":"NOT_RUN","receipt":false},{"id":"C04","title":"Manifest, credential reference and six components","observed":"NOT_RUN","receipt":false},{"id":"C05","title":"Health plus 11 of 11 readiness","observed":"NOT_RUN","receipt":false},{"id":"C06","title":"Negative webhook rejection","observed":"NOT_RUN","receipt":false},{"id":"C07","title":"No public or reverse-proxy route","observed":"NOT_RUN","receipt":false},{"id":"C08","title":"Restart, stop closure and rollback","observed":"NOT_RUN","receipt":false}],"acceptanceContract":{"requiredDependencyGates":4,"observedDependencyGates":0,"requiredExactArtifacts":6,"observedExactArtifacts":0,"requiredProductionComponents":6,"observedProductionComponents":0,"requiredReadinessReceipts":11,"observedReadinessReceipts":0,"requiredRuntimeProbes":8,"observedRuntimeProbes":0,"requiredSignatures":3,"observedSignatures":0,"requiredControllerListeners":1,"observedControllerListeners":0,"allConditionsRequired":true,"t06ReceiptAcceptsD05":false},"controls":[{"id":"HOST-FIREBREAK","title":"Production host marker blocks co-location","mechanism":"The unit and preflight both reject /etc/reits-production-host; the Portal EC2 is an explicit denial fixture.","state":"REPOSITORY_BOUND"},{"id":"LOOPBACK-ONLY","title":"8110 cannot become a public application route","mechanism":"Exact bind 127.0.0.1, IPAddressDeny=any, IPAddressAllow=localhost and zero reverse proxy routes are required.","state":"REPOSITORY_BOUND"},{"id":"ROOT-MANIFEST","title":"Runtime configuration is not caller supplied","mechanism":"One root-owned 0640 manifest and exact ConfigRef/KeyRef digests must feed the six-component bootstrap.","state":"REPOSITORY_BOUND"},{"id":"CREDENTIAL-REFERENCE","title":"Webhook credential values never enter evidence","mechanism":"systemd LoadCredential and /run/credentials references are permitted; secret-shaped JSON fields are denied.","state":"REPOSITORY_BOUND"},{"id":"READINESS-NO-BOOLEAN","title":"Readiness requires eleven signed receipts","mechanism":"A caller ready=true value, repository fixture or HTTP 200 without the verified receipt chain cannot promote readiness.","state":"REPOSITORY_BOUND"},{"id":"NEGATIVE-WEBHOOK","title":"Bad requests must fail closed","mechanism":"Unsigned, malformed and non-loopback webhook probes are mandatory and cannot create a plan, worker or external write.","state":"REPOSITORY_BOUND"},{"id":"STOP-AND-ROLLBACK","title":"Listener closure and predecessor recovery are evidence","mechanism":"Stop must close 8110, rollback must restore the named predecessor and neither transition may expose a public route.","state":"REPOSITORY_BOUND"},{"id":"THREE-PARTY-SIGNATURE","title":"Runtime cannot self-approve","mechanism":"Distinct Security, Runtime and SRE Ed25519 principals sign the same two-hour receipt.","state":"REPOSITORY_BOUND"}],"liveEvidence":{"ec2ReadOnlyChecks":18,"serviceStarts":0,"systemdMutations":0,"controllerListenerStarts":0,"publicRouteChanges":0,"externalWritesExecuted":0,"credentialsRecorded":false,"paidResourcesCreated":0,"d05G03Satisfied":false,"d05G04Satisfied":false,"d05G05Satisfied":false,"d05G06Satisfied":false},"invariants":{"portalHostUntouched":true,"controllerListener8110":0,"productionComponentsBound":0,"readinessReceiptsVerified":0,"qualifiedReceipts":0,"programAdvanced":false,"d05Accepted":false},"sources":[{"type":"EC2_READ_ONLY","target":"production Developer Portal host","observedAt":"2026-07-24T09:46:42Z","writes":0},{"type":"REPOSITORY","target":"ops/runner-factory service, unit, manifest and six component candidates","revision":"0d22b6098f92a6124241cfa803b99d648ba882b7"}],"boundary":"D05-T06 is repository-complete only. The current EC2 is a shared production application host and is forbidden by both the unit and preflight. Installation requires fresh G01-G04 receipts, a separately authorized dedicated host, six production component qualifications, eleven signed readiness receipts, eight probes and three independent signatures. No service, listener, route, credential, paid resource or D05 acceptance was created."},"controllerReleaseRollbackQualification":{"schemaVersion":"developer.reits.tech/controller-release-rollback-qualification/v1","status":"T07_REPOSITORY_IMPLEMENTED_LIVE_CONTROLLER_RELEASE_AND_ROLLBACK_BLOCKED","observedAt":"2026-07-24T10:10:20Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T07","title":"Sign exact Controller release identity and execute intentional rollback","owner":"Supply Chain + Release Engineering + SRE + Independent QA","repositoryImplementationComplete":true,"liveT06QualificationObserved":false,"liveControllerReleaseObserved":false,"intentionalRollbackExecuted":false,"productionAccepted":false,"nextTask":"D05-T08","nextTaskTitle":"Obtain independent four-owner D05 acceptance","nextTaskBlocked":true},"trustCorrection":{"decision":"PORTAL_AND_SITES_RELEASES_ARE_DOCUMENTATION_TARGETS_NOT_CONTROLLER_RELEASE_TARGETS","historicalEvidencePath":"data/runner-controller-release-evidence.json","historicalEvidenceStatus":"POINT_IN_TIME_RETAINED_NOT_CURRENT_T07_QUALIFICATION","developerPortalEligibleForG09G10":false,"sitesEligibleForG09G10":false,"onlyEligibleSubject":"reits-runner-factory-controller on a dedicated control-plane host"},"planBinding":{"planId":"D05-T07-CONTROLLER-RELEASE-ROLLBACK-V1","path":"ops/runner-factory/release/controller-release-rollback-plan.json","sha256":"0ea818d485685aa91c83342740de7d8cb7e2bdc5f295f0a754c4d9c94f4ada32","maximumReceiptAgeHours":2,"exactRevisionRequired":true},"repositoryPacket":{"planPresent":true,"preflightPresent":true,"collectorPresent":true,"verifierPresent":true,"pendingReceiptPresent":true,"keyringTemplatePresent":true,"identityFieldContracts":6,"attestationContracts":4,"rollbackStepContracts":8,"requiredIndependentSignatures":4},"currentObservation":{"source":"EC2_READ_ONLY_AND_SITES_DEPLOYMENT_OBSERVATION","portal":{"releaseId":"developer-portal@b054fafa3f83-2a8ba8c119ab","sourceRevision":"b054fafa3f83bd90b58858527abae955a1257015","rollbackReleaseId":"developer-portal@0d22b6098f92-7015f86fa477","provenanceSigned":false,"listener8100":1,"eligibleControllerEvidence":false},"sites":{"version":258,"sourceRevision":"b054fafa3f83bd90b58858527abae955a1257015","deploymentStatus":"succeeded","access":"OWNER_ONLY_CUSTOM","eligibleControllerEvidence":false},"controller":{"unitLoadState":"not-found","unitActiveState":"inactive","releaseRoots":0,"listener8110":0,"healthHttp":0,"readyHttp":0,"dedicatedHostMarkerPresent":false,"qualifiedT06Receipts":0,"releaseIdentityReceipts":0,"rollbackReceipts":0}},"identityFields":[{"id":"sourceRevision","label":"SOURCE","requirement":"exact 40-character Controller source revision","controllerObserved":null,"state":"MISSING"},{"id":"artifactDigest","label":"ARTIFACT","requirement":"immutable Controller artifact sha256","controllerObserved":null,"state":"MISSING"},{"id":"sbomDigest","label":"SBOM","requirement":"CycloneDX SBOM digest bound to the artifact","controllerObserved":null,"state":"MISSING"},{"id":"configurationDigest","label":"CONFIG","requirement":"root-owned production configuration digest","controllerObserved":null,"state":"MISSING"},{"id":"migrationDigest","label":"MIGRATION","requirement":"explicit migration-set digest including an empty set","controllerObserved":null,"state":"MISSING"},{"id":"runtimeReleaseId","label":"RUNTIME","requirement":"live runner-controller@source-artifact identity","controllerObserved":null,"state":"MISSING"}],"attestations":[{"id":"SIGNED_BUILD_PROVENANCE","owner":"SUPPLY_CHAIN","observed":false,"state":"MISSING"},{"id":"IMMUTABLE_ROOT_OWNED_MATERIALIZATION","owner":"SRE","observed":false,"state":"MISSING"},{"id":"LIVE_CONTROLLER_RUNTIME_IDENTITY","owner":"RUNTIME","observed":false,"state":"MISSING"},{"id":"ORDERED_ROLLBACK_RECOVERY_CHAIN","owner":"INDEPENDENT_QA","observed":false,"state":"MISSING"}],"topology":{"current":{"label":"EXACT CURRENT","release":"runner-controller@source-artifact","materialization":"/opt/reits-runner-factory/releases/<source>","state":"ABSENT"},"predecessor":{"label":"NAMED PREDECESSOR","release":"distinct production-qualified runner-controller release","materialization":"/opt/reits-runner-factory/releases/<predecessor-source>","state":"ABSENT"},"final":{"label":"RECOVERED CURRENT","release":"same exact original current identity","observation":"at least 60 seconds","state":"NOT_EXECUTED"}},"rollbackSteps":[{"ordinal":1,"id":"RB-01","title":"Maintenance authorization and automatic recovery guard","owner":"Release Engineering + SRE","state":"NOT_AUTHORIZED"},{"ordinal":2,"id":"RB-02","title":"Freeze exact current identity and runtime state","owner":"Independent QA","state":"NOT_EXECUTED"},{"ordinal":3,"id":"RB-03","title":"Atomic predecessor switch","owner":"Release Engineering","state":"NOT_EXECUTED"},{"ordinal":4,"id":"RB-04","title":"Predecessor identity and readiness verification","owner":"SRE + QA","state":"NOT_EXECUTED"},{"ordinal":5,"id":"RB-05","title":"Atomic recovery to exact original current","owner":"Release Engineering","state":"NOT_EXECUTED"},{"ordinal":6,"id":"RB-06","title":"Recovered current verification","owner":"SRE + QA","state":"NOT_EXECUTED"},{"ordinal":7,"id":"RB-07","title":"Bounded timing, zero loss and zero route proof","owner":"Independent QA","state":"NOT_EXECUTED"},{"ordinal":8,"id":"RB-08","title":"Four-party signed qualification receipt","owner":"All four roles","state":"0_OF_4"}],"signatures":[{"role":"SUPPLY_CHAIN","responsibility":"signed provenance and six-field release identity","observed":false},{"role":"RELEASE_ENGINEERING","responsibility":"ordered atomic switch and recovery transaction","observed":false},{"role":"SRE","responsibility":"host, unit, listener and materialization observation","observed":false},{"role":"INDEPENDENT_QA","responsibility":"timing, readiness, loss and final-state adjudication","observed":false}],"acceptanceContract":{"requiredLiveT06Receipts":1,"observedLiveT06Receipts":0,"requiredIdentityFields":6,"observedIdentityFields":0,"requiredAttestations":4,"observedAttestations":0,"requiredRollbackSteps":8,"observedRollbackSteps":0,"requiredSignatures":4,"observedSignatures":0,"requiredFinalControllerListeners":1,"observedFinalControllerListeners":0,"g09Satisfied":false,"g10Satisfied":false,"t07ReceiptAcceptsD05":false},"controls":[{"id":"SUBJECT-FENCE","title":"Portal release cannot impersonate Controller","mechanism":"Service, host class, release prefix and endpoint are exact; developer-portal@ and Sites versions are always ineligible.","state":"REPOSITORY_BOUND"},{"id":"T06-PREDECESSOR","title":"Live T06 qualification is mandatory","mechanism":"The receipt must bind the same dedicated host, 11/11 readiness and one loopback listener.","state":"REPOSITORY_BOUND"},{"id":"SIX-FIELD-IDENTITY","title":"Source through runtime remain one subject","mechanism":"Source, artifact, SBOM, configuration, migration and runtime release ID are independently signed.","state":"REPOSITORY_BOUND"},{"id":"IMMUTABLE-ROOTS","title":"Both releases are immutable materializations","mechanism":"Current and predecessor roots are root-owned, exact-digest verified and not writable by the service identity.","state":"REPOSITORY_BOUND"},{"id":"ORDERED-ROLLBACK","title":"Eight events form one monotonic chain","mechanism":"Missing, duplicate, reordered or cross-host events deny the receipt.","state":"REPOSITORY_BOUND"},{"id":"AUTO-RECOVERY","title":"The drill cannot strand the predecessor","mechanism":"A recovery guard is armed before the switch; the final release must equal the exact original current.","state":"REPOSITORY_BOUND"},{"id":"LOOPBACK-INVARIANT","title":"8110 remains private throughout","mechanism":"Before, predecessor and after observations each require one 127.0.0.1 listener and zero public routes.","state":"REPOSITORY_BOUND"},{"id":"FOUR-PARTY-SEAL","title":"Publisher cannot approve its own drill","mechanism":"Supply Chain, Release Engineering, SRE and Independent QA use distinct principals and Ed25519 keys.","state":"REPOSITORY_BOUND"}],"liveEvidence":{"readOnlyAuditPerformed":true,"controllerReleaseSwitches":0,"controllerRecoverySwitches":0,"controllerServiceRestarts":0,"controllerListenerStarts":0,"publicRouteChanges":0,"externalWritesExecuted":0,"credentialsRecorded":false,"paidResourcesCreated":0},"invariants":{"portalReleaseExcluded":true,"sitesReleaseExcluded":true,"controllerListener8110":0,"qualifiedReceipts":0,"programAdvanced":false,"d05Accepted":false},"sources":[{"id":"EC2","kind":"READ_ONLY","observedAt":"2026-07-24T10:10:20Z"},{"id":"SITES","kind":"DEPLOYMENT_RECORD","version":258},{"id":"REPOSITORY","kind":"EXACT_BYTES","plan":"ops/runner-factory/release/controller-release-rollback-plan.json"}],"boundary":"D05-T07 repository contracts are complete, but no eligible Controller release, live T06 receipt, signed provenance, immutable Controller materialization, rollback event or independent signature exists. The running Developer Portal and owner-only Sites version document the architecture only; neither can satisfy Controller G09 or G10. D05 remains 0/11 and 4/36."},"d05FinalAcceptanceQualification":{"schemaVersion":"developer.reits.tech/d05-final-acceptance-qualification/v1","status":"T08_REPOSITORY_IMPLEMENTED_LIVE_G01_G11_AND_FOUR_OWNER_ACCEPTANCE_BLOCKED","observedAt":"2026-07-24T10:32:32Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31,"candidateAfterAcceptance":"D06"},"task":{"id":"D05-T08","title":"Obtain independent four-owner D05 final acceptance","owner":"FinOps + Runtime Owner + Security Owner + Product Owner","repositoryImplementationComplete":true,"repositorySequenceComplete":true,"liveGatesSatisfied":0,"liveGatesRequired":11,"liveT07QualificationObserved":false,"finalApprovalsObserved":0,"finalApprovalsRequired":4,"productionAccepted":false,"nextRepositoryTask":null,"currentExecutionTask":"D05-T02","nextProgramKnife":"D06","nextProgramKnifeBlocked":true},"trustCorrection":{"decision":"CURRENT_T07_AND_T08_PACKETS_REPLACE_HISTORICAL_PORTAL_RELEASE_AND_THREE_LANE_OWNER_EVIDENCE","historicalReleaseEvidence":"data/runner-controller-release-evidence.json","canonicalReleaseEvidence":"data/controller-release-rollback-qualification.json","historicalOwnerEvidence":"data/runner-controller-owner-approval-evidence.json","canonicalFinalAcceptanceEvidence":"data/d05-final-acceptance-qualification.json","developerPortalEligibleForFinalAcceptance":false,"sitesEligibleForFinalAcceptance":false,"onlyEligibleSubject":"the exact production-qualified runner-controller release on the dedicated control-plane host"},"planBinding":{"planId":"D05-T08-FOUR-OWNER-FINAL-ACCEPTANCE-V1","path":"ops/runner-factory/acceptance/d05-final-acceptance-plan.json","sha256":"f02a9fb91a93bdaefacfc93d8764cb45c968c4f9cd6f442b7ea21d4b9f930d3e","maximumReceiptAgeMinutes":30,"maximumGateEvidenceAgeMinutes":120,"compareAndSwapRequired":true},"repositoryPacket":{"planPresent":true,"baselineCollectorPresent":true,"verifierPresent":true,"pendingReceiptPresent":true,"publicKeyringTemplatePresent":true,"gateContracts":11,"finalApprovalContracts":4,"hostileCases":18},"currentObservation":{"source":"EC2_READ_ONLY_AND_SITES_DEPLOYMENT_OBSERVATION","portal":{"releaseId":"developer-portal@8ae9d1b4511f-0d1595ec4569","sourceRevision":"8ae9d1b4511f1e1fc5a902cd41eef248a81fd743","artifactDigest":"sha256:0d1595ec4569cbe5a4cacc6a0b543c27d4c453086cba6b657fff61614b0c15e3","serviceActive":true,"listener8100":1,"eligibleControllerEvidence":false},"sites":{"version":259,"sourceRevision":"8ae9d1b4511f1e1fc5a902cd41eef248a81fd743","deploymentStatus":"succeeded","access":"OWNER_ONLY_CUSTOM","eligibleControllerEvidence":false},"controller":{"unitLoadState":"not-found","unitActiveState":"inactive","listener8110":0,"publicRoutes":0,"dedicatedHostMarkerPresent":false,"qualifiedT07Receipts":0,"positiveGateReceipts":0,"closureDossiers":0,"finalApprovalSignatures":0}},"gateSummary":{"required":11,"satisfied":0,"denied":11,"allExactReleaseBound":false,"allFresh":false,"allIndependentlySigned":false},"gates":[{"id":"D05-G01","group":"CAPACITY","title":"Linux organization Runner capacity","owner":"Platform SRE","sourceTask":"D05-T04","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G02","group":"CAPACITY","title":"Native Mac Runner capacity","owner":"Mobile Platform","sourceTask":"D05-T05","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G03","group":"READINESS","title":"Credential and network isolation","owner":"Security","sourceTask":"D05-T06","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G04","group":"READINESS","title":"Controller production assembly","owner":"Architecture","sourceTask":"D05-T06","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G05","group":"ACTIVATION","title":"Eleven readiness checks","owner":"Controller Owner","sourceTask":"D05-T06","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G06","group":"ACTIVATION","title":"Single loopback listener on 8110","owner":"Runtime Owner","sourceTask":"D05-T06","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G07","group":"INSTALLATION","title":"Hardened dedicated-host installation","owner":"Platform SRE","sourceTask":"D05-T06","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G08","group":"INSTALLATION","title":"Live negative and recovery probes","owner":"Independent QA","sourceTask":"D05-T06","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G09","group":"RELEASE","title":"Exact signed Controller release identity","owner":"Supply Chain","sourceTask":"D05-T07","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G10","group":"RELEASE","title":"Intentional rollback and exact recovery","owner":"Release Engineering","sourceTask":"D05-T07","positiveReceiptsObserved":0,"state":"DENIED"},{"id":"D05-G11","group":"FINAL","title":"Four-owner final acceptance","owner":"Product Owner","sourceTask":"D05-T08","positiveReceiptsObserved":0,"state":"DENIED"}],"dossier":{"required":1,"observed":0,"content":["exact source, artifact, SBOM, configuration, migration and runtime release identity","eleven ordered fresh independently signed gate receipts","live T07 rollback qualification bound to the same host and release","bounded budget and one private 8110 listener with zero public routes","four distinct final principals and public keys"],"state":"ABSENT"},"approvalSeats":[{"ordinal":1,"role":"FINOPS","responsibility":"budget ceiling, hold and expiry","observed":false,"state":"MISSING"},{"ordinal":2,"role":"RUNTIME_OWNER","responsibility":"11/11 readiness, listener, rollback and final runtime","observed":false,"state":"MISSING"},{"ordinal":3,"role":"SECURITY_OWNER","responsibility":"subject, signatures, freshness, isolation and zero public route","observed":false,"state":"MISSING"},{"ordinal":4,"role":"PRODUCT_OWNER","responsibility":"final business acceptance after all independent reviews","observed":false,"state":"MISSING"}],"decisionPath":[{"ordinal":1,"id":"GATES","requirement":"G01-G11 are satisfied for one exact release","observed":"0/11","state":"BLOCKED"},{"ordinal":2,"id":"DOSSIER","requirement":"seal the exact fresh closure dossier","observed":"0/1","state":"BLOCKED"},{"ordinal":3,"id":"INDEPENDENT_REVIEWS","requirement":"FinOps, Runtime and Security sign independently","observed":"0/3","state":"BLOCKED"},{"ordinal":4,"id":"PRODUCT_DECISION","requirement":"Product signs after all independent reviewers","observed":"0/1","state":"BLOCKED"},{"ordinal":5,"id":"CAS","requirement":"external ledger authority compares 4/36 D05 then advances to 5/36 D06","observed":"0/1","state":"BLOCKED"}],"acceptanceContract":{"requiredGateReceipts":11,"observedGateReceipts":0,"requiredClosureDossiers":1,"observedClosureDossiers":0,"requiredLiveT07Receipts":1,"observedLiveT07Receipts":0,"requiredFinalApprovals":4,"observedFinalApprovals":0,"requiredLedgerCompareAndSwap":1,"observedLedgerCompareAndSwap":0,"d05Accepted":false},"controls":[{"id":"EXACT-SUBJECT","title":"One Controller release only","mechanism":"Every receipt binds the same service, host, source, artifact, configuration and runtime identity.","state":"REPOSITORY_BOUND"},{"id":"ELEVEN-OF-ELEVEN","title":"No partial gate closure","mechanism":"Missing, duplicate, reordered, cross-release or unsigned G01-G11 evidence denies final acceptance.","state":"REPOSITORY_BOUND"},{"id":"FRESHNESS","title":"Point-in-time truth","mechanism":"Final receipt lasts at most 30 minutes and no gate evidence may exceed 120 minutes.","state":"REPOSITORY_BOUND"},{"id":"DOSSIER-SEAL","title":"Exact byte closure","mechanism":"A canonical SHA-256 dossier binds release identity, receipts and runtime outcome.","state":"REPOSITORY_BOUND"},{"id":"SEPARATION-OF-DUTIES","title":"Four independent principals","mechanism":"FinOps, Runtime, Security and Product use distinct principals and Ed25519 public keys.","state":"REPOSITORY_BOUND"},{"id":"PRODUCT-LAST","title":"Product cannot pre-approve","mechanism":"Product acceptance must be signed strictly after all three independent reviews.","state":"REPOSITORY_BOUND"},{"id":"ZERO-EFFECT-VERIFIER","title":"Verification does not mutate","mechanism":"The verifier authorizes a candidate transition but executes zero ledger, runtime or cloud writes.","state":"REPOSITORY_BOUND"},{"id":"LEDGER-CAS","title":"No stale program advance","mechanism":"A separate authority must compare current 4/36 D05 before advancing exactly once to 5/36 D06.","state":"REPOSITORY_BOUND"}],"liveEvidence":{"readOnlyAuditPerformed":true,"controllerServiceRestarts":0,"controllerListenerStarts":0,"controllerRollbackDrills":0,"finalApprovalsIssued":0,"ledgerMutationsExecuted":0,"publicRouteChanges":0,"externalWritesExecuted":0,"credentialsRecorded":false,"paidResourcesCreated":0},"invariants":{"repositorySequenceComplete":true,"nextRepositoryTask":null,"currentExecutionTask":"D05-T02","portalReleaseExcluded":true,"sitesReleaseExcluded":true,"controllerListener8110":0,"programAdvanced":false,"d05Accepted":false},"sources":[{"id":"EC2","kind":"READ_ONLY","observedAt":"2026-07-24T10:32:32Z"},{"id":"SITES","kind":"DEPLOYMENT_RECORD","version":259},{"id":"T07","kind":"CANONICAL_QUALIFICATION","path":"data/controller-release-rollback-qualification.json"},{"id":"REPOSITORY","kind":"EXACT_BYTES","plan":"ops/runner-factory/acceptance/d05-final-acceptance-plan.json"}],"boundary":"D05-T08 completes the eighth and final repository task, not the production acceptance. The eligible subject is only an exact production-qualified Controller release on its dedicated host. With G01-G11 at 0/11, no closure dossier, no live T07 receipt, no four-owner signatures and no ledger compare-and-swap, D05 remains unaccepted at 4/36. Repository work has no successor task; live execution returns to D05-T02 and D06 remains blocked."},"gateMatrix":[{"id":"D05-G01","name":"ORGANIZATION_LINUX_RUNNER_CAPACITY","owner":"PLATFORM_SRE","target":"2 organization-scoped Linux runners; concurrency one; single-use ephemeral boundary","observed":"1 台 Linux 候选、1 台在线；组织级 0、ephemeral 0、合格 0","positiveReceiptsObserved":0,"decision":"DENIED_NO_ORGANIZATION_EPHEMERAL_CAPACITY","group":"CAPACITY","groupLabel":"Runner capacity","source":"/api/runner-capacity/evidence","observedAt":"2026-07-29T04:47:01Z","evidenceStatus":"G01_G02_DENIED_NO_ELIGIBLE_LANES","satisfied":false},{"id":"D05-G02","name":"INDEPENDENT_MAC_RUNNER_LANE","owner":"MOBILE_PLATFORM","target":"1 online organization-scoped Mac runner with platform-safe labels and signed native job receipt","observed":"8 台 Mac 候选、6 台在线；全部仓库级可复用，部分标签混用；合格 0","positiveReceiptsObserved":0,"decision":"DENIED_NO_INDEPENDENT_MAC_LANE","group":"CAPACITY","groupLabel":"Runner capacity","source":"/api/runner-capacity/evidence","observedAt":"2026-07-29T04:47:01Z","evidenceStatus":"G01_G02_DENIED_NO_ELIGIBLE_LANES","satisfied":false},{"id":"D05-G03","name":"ROOT_OWNED_RUNTIME_CONFIGURATION","owner":"SECURITY","target":"root-owned canonical manifest, eleven typed ConfigRefs, one verify-only KeyRef and a least-visible SecretRef boundary","observed":"manifest, service identity and resolved production references are absent on the production host","positiveReceiptsObserved":0,"decision":"DENIED_CONFIGURATION_NOT_INSTALLED","group":"READINESS","groupLabel":"Configuration + factories","source":"/api/runner-controller/readiness-evidence","observedAt":"2026-07-21T08:48:05Z","evidenceStatus":"G03_G04_DENIED_NO_PRODUCTION_CONFIGURATION_OR_FACTORIES","satisfied":false},{"id":"D05-G04","name":"REVIEWED_PRODUCTION_FACTORIES","owner":"GLOBAL_ARCHITECTURE","target":"six reviewed production factories, five authority-pinned read sources and one verify-only attestation verifier","observed":"closed source implementations and fixture proofs exist, but every factory remains TEST_ONLY with zero production bindings","positiveReceiptsObserved":0,"decision":"DENIED_FACTORIES_NOT_PRODUCTION_BOUND","group":"READINESS","groupLabel":"Configuration + factories","source":"/api/runner-controller/readiness-evidence","observedAt":"2026-07-21T08:48:05Z","evidenceStatus":"G03_G04_DENIED_NO_PRODUCTION_CONFIGURATION_OR_FACTORIES","satisfied":false},{"id":"D05-G05","name":"ELEVEN_LIVE_READINESS_RECEIPTS","owner":"CONTROLLER_OWNER","target":"eleven fresh signature-verified readiness receipts bound to one Controller release, manifest, configuration and runtime identity","observed":"zero readiness directory, zero receipt files, zero configured Gates and no Controller runtime identity on the production host","positiveReceiptsObserved":0,"decision":"DENIED_NO_LIVE_READINESS_RECEIPTS","group":"ACTIVATION","groupLabel":"Readiness + listener","source":"/api/runner-controller/activation-evidence","observedAt":"2026-07-21T09:05:20Z","evidenceStatus":"G05_G06_DENIED_NO_LIVE_READINESS_OR_LISTENER_AUTHORIZATION","satisfied":false},{"id":"D05-G06","name":"INDEPENDENT_LISTENER_AUTHORIZATION","owner":"RELEASE_OWNER","target":"one independent expiring authorization bound to exact host, release, config, unit, endpoint, rollback, negative webhook proof and four approvals","observed":"authorization file, systemd unit, loopback listener and reverse proxy route are all absent","positiveReceiptsObserved":0,"decision":"DENIED_NO_LISTENER_AUTHORIZATION","group":"ACTIVATION","groupLabel":"Readiness + listener","source":"/api/runner-controller/activation-evidence","observedAt":"2026-07-21T09:05:20Z","evidenceStatus":"G05_G06_DENIED_NO_LIVE_READINESS_OR_LISTENER_AUTHORIZATION","satisfied":false},{"id":"D05-G07","name":"HARDENED_CONTROLLER_INSTALLATION","owner":"PLATFORM_SRE","target":"non-login identity, root-owned unit, exact digest, filesystem ownership, credential references, hardening profile, loopback-only network policy and signed installation receipt","observed":"service user, group, unit, installation root, runtime directories, manifest, process and listener are absent","positiveReceiptsObserved":0,"decision":"DENIED_HARDENED_INSTALLATION_ABSENT","group":"INSTALLATION","groupLabel":"Installation + live probes","source":"/api/runner-controller/installation-evidence","observedAt":"2026-07-21T09:25:19Z","evidenceStatus":"G07_G08_DENIED_NO_HARDENED_INSTALLATION_OR_LIVE_RUNTIME_PROOFS","satisfied":false},{"id":"D05-G08","name":"LIVE_HEALTH_READINESS_NEGATIVE_WEBHOOK","owner":"QA","target":"live health and readiness receipts plus unsigned, invalid-signature, stale, replay, wrong-scope and unready webhook denial receipts","observed":"health, readiness and six webhook probe attempts all returned HTTP 000 because the Controller listener is absent; connection refusal is not application-level denial proof","positiveReceiptsObserved":0,"decision":"DENIED_LIVE_RUNTIME_PROOFS_UNAVAILABLE","group":"INSTALLATION","groupLabel":"Installation + live probes","source":"/api/runner-controller/installation-evidence","observedAt":"2026-07-21T09:25:19Z","evidenceStatus":"G07_G08_DENIED_NO_HARDENED_INSTALLATION_OR_LIVE_RUNTIME_PROOFS","satisfied":false},{"id":"D05-G09","name":"Exact signed Controller release identity","owner":"Supply Chain","target":"exact production-qualified runner-controller release on the dedicated control-plane host","observed":"0 positive receipts · source D05-T07","positiveReceiptsObserved":0,"decision":"DENIED_NO_CURRENT_EXACT_RELEASE_RECEIPT","group":"RELEASE","groupLabel":"Identity + rollback","source":"/api/controller-release-rollback-qualification","observedAt":"2026-07-24T10:10:20Z","evidenceStatus":"T07_REPOSITORY_IMPLEMENTED_LIVE_CONTROLLER_RELEASE_AND_ROLLBACK_BLOCKED","satisfied":false},{"id":"D05-G10","name":"Intentional rollback and exact recovery","owner":"Release Engineering","target":"exact production-qualified runner-controller release on the dedicated control-plane host","observed":"0 positive receipts · source D05-T07","positiveReceiptsObserved":0,"decision":"DENIED_NO_CURRENT_EXACT_RELEASE_RECEIPT","group":"RELEASE","groupLabel":"Identity + rollback","source":"/api/controller-release-rollback-qualification","observedAt":"2026-07-24T10:10:20Z","evidenceStatus":"T07_REPOSITORY_IMPLEMENTED_LIVE_CONTROLLER_RELEASE_AND_ROLLBACK_BLOCKED","satisfied":false},{"id":"D05-G11","name":"Four-owner final acceptance","owner":"Product Owner","target":"exact production-qualified runner-controller release on the dedicated control-plane host","observed":"0 positive receipts · source D05-T08","positiveReceiptsObserved":0,"decision":"DENIED_NO_CURRENT_EXACT_RELEASE_RECEIPT","group":"OWNER","groupLabel":"Four-owner final acceptance","source":"/api/d05-final-acceptance-qualification","observedAt":"2026-07-24T10:32:32Z","evidenceStatus":"T08_REPOSITORY_IMPLEMENTED_LIVE_G01_G11_AND_FOUR_OWNER_ACCEPTANCE_BLOCKED","satisfied":false}],"evidenceGroups":[{"id":"CAPACITY","label":"Runner capacity","source":"/api/runner-capacity/evidence","observedAt":"2026-07-29T04:47:01Z","status":"G01_G02_DENIED_NO_ELIGIBLE_LANES","gates":2},{"id":"READINESS","label":"Configuration + factories","source":"/api/runner-controller/readiness-evidence","observedAt":"2026-07-21T08:48:05Z","status":"G03_G04_DENIED_NO_PRODUCTION_CONFIGURATION_OR_FACTORIES","gates":2},{"id":"ACTIVATION","label":"Readiness + listener","source":"/api/runner-controller/activation-evidence","observedAt":"2026-07-21T09:05:20Z","status":"G05_G06_DENIED_NO_LIVE_READINESS_OR_LISTENER_AUTHORIZATION","gates":2},{"id":"INSTALLATION","label":"Installation + live probes","source":"/api/runner-controller/installation-evidence","observedAt":"2026-07-21T09:25:19Z","status":"G07_G08_DENIED_NO_HARDENED_INSTALLATION_OR_LIVE_RUNTIME_PROOFS","gates":2},{"id":"RELEASE","label":"Identity + rollback","source":"/api/controller-release-rollback-qualification","observedAt":"2026-07-24T10:10:20Z","status":"T07_REPOSITORY_IMPLEMENTED_LIVE_CONTROLLER_RELEASE_AND_ROLLBACK_BLOCKED","gates":2},{"id":"OWNER","label":"Four-owner final acceptance","source":"/api/d05-final-acceptance-qualification","observedAt":"2026-07-24T10:32:32Z","status":"T08_REPOSITORY_IMPLEMENTED_LIVE_G01_G11_AND_FOUR_OWNER_ACCEPTANCE_BLOCKED","gates":1}],"executionSequence":[{"ordinal":1,"id":"D05-T01","owner":"Platform Engineering + Security","title":"修复 Runner 凭据与任务隔离边界","evidence":"组织 Runner 必须 single-use；任务不可读取可复用 daemon credential；不得进入生产 VPC。","state":"REPOSITORY_IMPLEMENTED_LIVE_QUALIFICATION_REQUIRED","authority":"REPOSITORY_CHANGE_ALLOWED"},{"ordinal":2,"id":"D05-T02","owner":"Cloud Account Owner","title":"恢复独立 AWS 验证身份","evidence":"仓库已交付一小时临时角色、最小权限边界、精确身份检查、ValidateTemplate 和 deny probe；Cloud Owner 尚未创建角色，AWS 仍未在线接受。","state":"REPOSITORY_IMPLEMENTED_LIVE_IDENTITY_REQUIRED","authority":"CLOUD_OWNER_ACTIVATION_REQUIRED"},{"ordinal":3,"id":"D05-T03","owner":"Product Owner + FinOps","title":"批准两台隔离 Linux Runner 成本","evidence":"官方 Sydney SKU 报价、精确模板摘要、Product Owner + FinOps Ed25519 双签名、USD 250 上限和非续期 ASG 归零租约已实现；真实签名仍为 0/2。","state":"REPOSITORY_IMPLEMENTED_DUAL_APPROVAL_REQUIRED","authority":"OWNER_APPROVAL_REQUIRED"},{"ordinal":4,"id":"D05-T04","owner":"Platform SRE","title":"部署并完成 18 仓隔离演练","evidence":"精确 18 仓 revision、17+1 scope 分区、7 项恶意探针、两次整机替换与三方签名验证器已完成；在线执行仍等待 T02、T03 和 shared repo owner 决策。","state":"REPOSITORY_IMPLEMENTED_LIVE_DEPENDENCIES_AND_SCOPE_REQUIRED","authority":"PRODUCTION_CHANGE_REQUIRED"},{"ordinal":5,"id":"D05-T05","owner":"Mobile Platform + Security + QA","title":"恢复独立 Mac 原生 Runner","evidence":"两个精确原生 workload、两段串行 ephemeral scope、专用主机与工具链证明、六项恶意探针、两份 cleanup 回执和三方 Ed25519 验证已实现；在线 Mac Runner 仍是错误单仓 scope 且可复用，合格回执为 0/2。","state":"REPOSITORY_IMPLEMENTED_LIVE_DEVICE_QUALIFICATION_REQUIRED","authority":"DEVICE_OWNER_REQUIRED"},{"ordinal":6,"id":"D05-T06","owner":"Security + Runtime + SRE","title":"部署独立 Controller 与 8110","evidence":"dedicated-host preflight、六个 exact artifact、六个 production component receipt、11 项 readiness、8 项 probe 与三方 Ed25519 资格包已实现；G01–G04、独立主机和 8110 在线回执仍为零。","state":"REPOSITORY_IMPLEMENTED_LIVE_DEPENDENCIES_AND_HOST_REQUIRED","authority":"PRODUCTION_CHANGE_REQUIRED"},{"ordinal":7,"id":"D05-T07","owner":"Supply Chain + QA + Release","title":"签署 release identity 并执行 intentional rollback","evidence":"source/artifact/SBOM/config/migration/runtime 六项同源签署；真实回滚和恢复观察窗。","state":"REPOSITORY_IMPLEMENTED_LIVE_RUNTIME_REQUIRED","authority":"PRODUCTION_DRILL_REQUIRED"},{"ordinal":8,"id":"D05-T08","owner":"Cost + Runtime + Security + Product","title":"完成 G11 四方验收","evidence":"11/11 Gate、freshness、独立签名、exact release binding 与 Product Owner 决策缺一不可。","state":"REPOSITORY_IMPLEMENTED_LIVE_G01_G11_REQUIRED","authority":"MULTI_OWNER_APPROVAL_REQUIRED"}],"authorityBoundaries":[{"id":"SAFE_LOCAL","title":"可直接执行","count":1,"items":["Portal、契约、测试、静态基础设施与 fail-closed 安全修复"],"tone":"green"},{"id":"OWNER_INPUT","title":"需要外部身份/设备","count":2,"items":["AWS 验证身份","Mac Runner 主机与设备 Owner"],"tone":"amber"},{"id":"PAID_PRODUCTION","title":"需要成本/生产批准","count":3,"items":["两 AZ Runner 资源","独立 Controller 主机与 8110","Intentional rollback drill"],"tone":"red"}],"downstreamKnives":[{"id":"D06","title":"浏览器认证 SDK / BFF","wave":"W1","owner":"Identity Platform","status":"PLANNED"},{"id":"D07","title":"MFA、恢复与签名密钥 Phase B","wave":"W1","owner":"Identity Security","status":"PLANNED"},{"id":"D12","title":"Media 生产部署与隔离直传","wave":"W2","owner":"Media Platform","status":"PLANNED"},{"id":"D14","title":"关联可观测、状态与事件指挥","wave":"W2","owner":"Site Reliability Engineering","status":"PLANNED"},{"id":"D15","title":"完整备份与隔离恢复","wave":"W2","owner":"Recovery Engineering","status":"PLANNED"},{"id":"D29","title":"Trading 持久任务、SecretRef 与生产部署","wave":"W5","owner":"Market Data","status":"PLANNED"},{"id":"D35","title":"Exact Release、生产 Smoke 与回滚证明","wave":"W6","owner":"Release Engineering + Operations","status":"PLANNED"}],"waves":[{"id":"W0","label":"交付底座","range":"D01–D05","knives":5},{"id":"W1","label":"身份与治理","range":"D06–D11","knives":6},{"id":"W2","label":"平台可靠性","range":"D12–D17","knives":6},{"id":"W3","label":"内容、社区与预约","range":"D18–D22","knives":5},{"id":"W4","label":"开放平台","range":"D23–D27","knives":5},{"id":"W5","label":"数据、实时与量化","range":"D28–D33","knives":6},{"id":"W6","label":"UI、QA 与发布收口","range":"D34–D36","knives":3}],"acceptanceInvariant":{"architectureComplete":true,"implementationProgramComplete":false,"d05Accepted":false,"paidResourcesCreated":0,"productionChangesAuthorized":0,"controllerListener8110":0,"ownerApprovalsIssued":0,"finalApprovalSignatures":0,"ledgerCompareAndSwapExecuted":0},"discovery":{"page":"/implementation-transition","api":"/api/implementation-transition","schema":"/schemas/implementation-transition.v1.schema.json","credentialBoundaryApi":"/api/runner-credential-boundary","credentialBoundarySchema":"/schemas/runner-credential-boundary.v1.schema.json","awsValidationIdentityApi":"/api/aws-validation-identity","awsValidationIdentitySchema":"/schemas/aws-validation-identity.v1.schema.json","runnerCostApprovalApi":"/api/runner-cost-approval","runnerCostApprovalSchema":"/schemas/runner-cost-approval.v1.schema.json","runnerIsolationQualificationApi":"/api/runner-isolation-qualification","runnerIsolationQualificationSchema":"/schemas/runner-isolation-qualification.v1.schema.json","nativeMacRunnerQualificationApi":"/api/native-mac-runner-qualification","nativeMacRunnerQualificationSchema":"/schemas/native-mac-runner-qualification.v1.schema.json","controllerDeploymentQualificationApi":"/api/controller-deployment-qualification","controllerDeploymentQualificationSchema":"/schemas/controller-deployment-qualification.v1.schema.json","controllerReleaseRollbackQualificationApi":"/api/controller-release-rollback-qualification","controllerReleaseRollbackQualificationSchema":"/schemas/controller-release-rollback-qualification.v1.schema.json","d05FinalAcceptanceQualificationApi":"/api/d05-final-acceptance-qualification","d05FinalAcceptanceQualificationSchema":"/schemas/d05-final-acceptance-qualification.v1.schema.json","developmentPlan":"/api/development-plan","releaseFoundation":"/release-foundation"}}