{"schemaVersion":"developer.reits.tech/native-mac-runner-qualification/v1","status":"T05_REPOSITORY_IMPLEMENTED_LIVE_DEVICE_QUALIFICATION_BLOCKED","observedAt":"2026-07-24T09:06:33Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T05","title":"Restore and qualify an independent native Mac runner","owner":"Mobile Platform + Security + QA","repositoryImplementationComplete":true,"liveDeviceExecutionObserved":true,"liveExecutionAdmitted":false,"productionAccepted":false,"nextTask":"D05-T06","nextTaskTitle":"Deploy the independent Controller and loopback port 8110","nextTaskBlocked":true},"planBinding":{"planId":"D05-T05-NATIVE-MAC-RUNNER-V1","path":"ops/gitea-runner/macos/native-qualification-plan.json","sha256":"59296b4c996ea00ad092e21ba1852a942bb241838bfc45477cd906ffc1d99f1c","exactRevisionRequired":true,"maximumReceiptAgeHours":24},"preconditions":[{"id":"DEVICE","label":"Dedicated Mac and Device Owner approval","repositoryState":"IMPLEMENTED","liveState":"DEVICE_NOT_BOUND_TO_QUALIFICATION","satisfied":false},{"id":"REITS_SCOPE","label":"reits organization ephemeral registration authority","repositoryState":"IMPLEMENTED","liveState":"0_ORGANIZATION_RUNNERS","satisfied":false},{"id":"JXIM_SCOPE","label":"jx-im/im-media-send-kit repository registration authority","repositoryState":"IMPLEMENTED","liveState":"NO_TARGET_REPOSITORY_RUNNER","satisfied":false},{"id":"TRUST","label":"Mobile Platform, Security and QA signing keys","repositoryState":"IMPLEMENTED","liveState":"0_OF_3_KEYS","satisfied":false}],"hostCandidateObservation":{"source":"LOCAL_DEVELOPER_WORKSTATION_READ_ONLY_UNBOUND","architecture":"arm64","macosVersion":"26.3.1","macosBuild":"25D2128","xcodeVersion":"26.3","xcodeBuild":"17C529","swiftVersion":"6.2.4","developerDirectory":"/Applications/Xcode.app/Contents/Developer","actRunnerBinaryObserved":false,"runnerProcessObserved":false,"boundRunnerId":null,"qualificationState":"TOOLCHAIN_PRESENT_HOST_IDENTITY_AND_ISOLATION_UNBOUND"},"liveSummary":{"giteaVersion":"1.25.4","adminRunnersRegistered":3,"runnersOnline":2,"macRunnersRegistered":2,"macRunnersOnline":1,"organizationMacRunnersOnline":0,"ephemeralMacRunnersOnline":0,"eligibleMacRunners":0,"exactNativeJobsRequired":2,"historicalNativeSuccesses":1,"historicalNativeCancellations":1,"qualifiedNativeJobReceipts":0,"cleanupReceipts":0,"trustedSignatures":0},"runnerCandidates":[{"id":27,"name":"pp-mac-ios-runner-codex","platform":"macos","status":"online","busy":false,"ephemeral":false,"scope":"repository:jx-im/im-client-ios-swift","labels":["macos-latest","self-hosted","macOS"],"admission":"DENIED_WRONG_REPOSITORY_SCOPE_AND_REUSABLE","reason":"Online is not enough: this runner belongs to an unrelated repository, is reusable and has no signed host or cleanup receipt."},{"id":1,"name":"pp-mac-ios-runner","platform":"macos","status":"offline","busy":false,"ephemeral":false,"scope":"repository:jx-im/im-client-ios-swift","labels":["macos-latest","self-hosted","macOS","ubuntu-latest","ubuntu-24.04","ubuntu-22.04"],"admission":"DENIED_OFFLINE_REUSABLE_AND_LABEL_COLLISION","reason":"The offline registration is reusable and mixes macOS and Ubuntu labels."}],"scopePartitions":[{"id":"REITS_NATIVE_IOS","repository":"reits/matrix-quant-im-ios","revision":"e4813fd23765df41b56efd23e61750738c6dd420","scope":"organization:reits","requiredLabel":"reits-macos-native-v1","workflow":".gitea/workflows/ci.yml","job":"validate-and-test","currentState":"HISTORICAL_SUCCESS_QUALIFICATION_RECEIPT_MISSING"},{"id":"JXIM_SWIFT_PACKAGE","repository":"jx-im/im-media-send-kit","revision":"d5f0e3e5d65886c0ad9654f4ef30468a0e7b089f","scope":"repository:jx-im/im-media-send-kit","requiredLabel":"macos-latest","workflow":".gitea/workflows/reits-minimum-ci.yml","job":"minimum","currentState":"CANCELLED_NO_ELIGIBLE_REPOSITORY_RUNNER"}],"nativeJobObservations":[{"repository":"reits/matrix-quant-im-ios","revision":"e4813fd23765df41b56efd23e61750738c6dd420","runId":"66958","jobId":"87631","runnerId":"41","runnerName":"codex-mx-ios-foundation-v2-20260724","runnerLabel":"mq-ios-foundation-ci-20260724","conclusion":"success","startedAt":"2026-07-23T19:02:06Z","completedAt":"2026-07-23T19:33:55Z","qualificationState":"RAW_NATIVE_SUCCESS_SCOPE_EPHEMERAL_CLEANUP_AND_SIGNATURES_UNPROVEN","qualifiedReceipt":false},{"repository":"jx-im/im-media-send-kit","revision":"d5f0e3e5d65886c0ad9654f4ef30468a0e7b089f","runId":"66045","jobId":"86511","runnerId":null,"runnerName":null,"runnerLabel":"macos-latest","conclusion":"cancelled","startedAt":null,"completedAt":"2026-07-21T09:15:49Z","qualificationState":"NO_NATIVE_EXECUTION","qualifiedReceipt":false}],"lifecycle":[{"ordinal":1,"id":"PREFLIGHT","owner":"Device Owner","title":"Seal host and toolchain profile","state":"REPOSITORY_BOUND_LIVE_RECEIPT_REQUIRED"},{"ordinal":2,"id":"REGISTER_REITS","owner":"REITs Organization Owner","title":"Create one ephemeral organization registration with a dedicated native label","state":"OWNER_ACTION_REQUIRED"},{"ordinal":3,"id":"RUN_IOS","owner":"Mobile Platform","title":"Execute the exact iOS policy job and retain the job identity","state":"BLOCKED_PREDECESSOR"},{"ordinal":4,"id":"DESTROY_REITS","owner":"Device Owner","title":"Destroy runner credential, workspace, DerivedData and simulator state","state":"BLOCKED_PREDECESSOR"},{"ordinal":5,"id":"REGISTER_JXIM","owner":"jx-im Repository Owner","title":"Create one separate ephemeral repository registration","state":"OWNER_ACTION_REQUIRED"},{"ordinal":6,"id":"RUN_SWIFT","owner":"Mobile Platform","title":"Execute the exact Swift package job","state":"BLOCKED_PREDECESSOR"},{"ordinal":7,"id":"DESTROY_JXIM","owner":"Device Owner","title":"Destroy the second runner generation and all job state","state":"BLOCKED_PREDECESSOR"},{"ordinal":8,"id":"SIGN","owner":"Mobile Platform + Security + QA","title":"Sign the same fresh two-job qualification receipt","state":"0_OF_3_SIGNATURES"}],"adversarialProbes":[{"id":"M01","title":"Registration token unreadable by job user","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"M02","title":"Runner credential cannot poll a second job","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"M03","title":"Personal keychain and iCloud identities absent","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"M04","title":"Docker socket, cloud authority and production routes absent","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"M05","title":"Signed native toolchain matches the job host","target":"PASS","observed":"NOT_RUN","receipt":false},{"id":"M06","title":"Workspace and simulator state destroyed before scope switch","target":"PASS","observed":"NOT_RUN","receipt":false}],"acceptanceContract":{"requiredExactNativeJobReceipts":2,"observedExactNativeJobReceipts":0,"requiredEphemeralRunnerRegistrations":2,"observedEphemeralRunnerRegistrations":0,"requiredCleanupReceipts":2,"observedCleanupReceipts":0,"requiredAdversarialProbeReceipts":6,"observedAdversarialProbeReceipts":0,"requiredSignatureRoles":["MOBILE_PLATFORM","SECURITY","QA"],"observedSignatures":0,"maximumConcurrentJobs":1,"maximumReceiptAgeHours":24,"historicalGreenJobIsQualification":false,"onlineReusableRunnerIsQualification":false,"allConditionsRequired":true},"controls":[{"id":"N01","title":"Two explicit scopes","state":"IMPLEMENTED_PENDING_OWNER_AUTHORITY","mechanism":"The reits organization and jx-im repository use separate registration authorities and runner generations."},{"id":"N02","title":"Dedicated physical Mac","state":"IMPLEMENTED_PENDING_HOST_BINDING","mechanism":"The accepted host has no personal session, production route, cloud authority or unrelated runner service."},{"id":"N03","title":"One credential, one job","state":"IMPLEMENTED_PENDING_LIVE_RECEIPT","mechanism":"act_runner 0.2.12+ ephemeral registration revokes the exposed runner credential before untrusted steps."},{"id":"N04","title":"Platform-safe scheduling","state":"IMPLEMENTED_PENDING_LIVE_BINDING","mechanism":"The reits organization lane uses a dedicated label; the generic macos label is allowed only inside the exact jx-im repository scope."},{"id":"N05","title":"Native toolchain identity","state":"IMPLEMENTED_PENDING_SIGNED_PROFILE","mechanism":"Architecture, macOS build, Xcode build, Swift version and developer directory are bound to the receipt."},{"id":"N06","title":"Credential and network firebreak","state":"IMPLEMENTED_PENDING_HOST_PROBES","mechanism":"Root registration material, login keychain, iCloud identity, Docker socket, cloud credentials and production routes are denied."},{"id":"N07","title":"Serial cleanup boundary","state":"IMPLEMENTED_PENDING_TWO_CLEANUPS","mechanism":"Runner state, workspace, DerivedData and simulator data are destroyed before another scope is registered."},{"id":"N08","title":"Independent admission","state":"IMPLEMENTED_PENDING_KEYS","mechanism":"Mobile Platform, Security and QA sign one plan-bound receipt with distinct Ed25519 keys."}],"liveEvidence":{"giteaReadOnlyRequests":62,"repositoriesScanned":50,"giteaMutationCalls":0,"deviceMutationCalls":0,"runnerRegistrationCalls":0,"workflowDispatchCalls":0,"credentialsRecorded":false,"paidResourcesCreated":0,"d05GateG02Satisfied":false},"invariants":{"historicalSuccessPromotesG02":false,"onlineWrongScopeRunnerPromotesG02":false,"repositoryPacketAuthorizesDeviceMutation":false,"repositoryPacketAuthorizesGiteaMutation":false,"crossOrganizationCredentialReuseAllowed":false,"d05Accepted":false,"programAdvanced":false},"sources":[{"label":"Gitea act_runner registration, ephemeral runner and macOS LaunchDaemon documentation","url":"https://docs.gitea.com/usage/actions/act-runner"},{"label":"Gitea Actions trust guidance","url":"https://docs.gitea.com/usage/actions/overview"},{"label":"Gitea 1.25 Actions runner API","url":"https://docs.gitea.com/api/1.25/"}],"boundary":"D05-T05 repository engineering is complete: exact native workloads, two-scope serial registration, dedicated-host profile, six probes, two cleanup receipts and three-party signed admission are executable. Live acceptance remains blocked because the only online Mac runner is reusable and scoped to an unrelated repository, the historical iOS success has no trusted scope or cleanup receipt, the Swift package job is cancelled, accepted receipts remain 0/2, G02 remains false, D05 remains 0/11 and implementation remains 4/36."}