{"schemaVersion":"developer.reits.tech/release-unit-registry/v1","generatedAt":"2026-07-20T10:34:32Z","status":"D05_ACTIVE","boundary":"A deployment path, source SHA or HTTP 200 alone is not an accepted release unit. Artifact, SBOM, public configuration, migration, SecretRef, provenance and rollback identities remain independent evidence.","summary":{"units":10,"exactSource":10,"artifactBound":9,"runtimeIdentityBound":3,"sbomBound":1,"configurationBound":1,"migrationBound":1,"secretRefBound":1,"rollbackBound":3,"signedProvenance":0},"candidates":[{"id":"auth-systemd-d05","repository":"reits/reits-auth","service":"reits-auth","state":"BLOCKED_REQUIRED_CHECKS","source":{"revision":"b697a726c1b9f92813293ef49c65924b0b035597","ref":"feat/d05-release-identity","dirty":false},"pullRequest":{"number":6,"url":"https://gitea.reits.tech/reits/reits-auth/pulls/6","mergeable":true,"merged":false},"protection":{"base":"main","directPush":false,"requiredContexts":[{"context":"REITS Minimum CI / gate (pull_request)","state":"QUEUED"},{"context":"reits-auth security CI / verify (pull_request)","state":"QUEUED"}],"dependentContexts":[],"blocker":"No eligible organization runner can claim either required check."},"currentProduction":{"revision":"157b8590e4625ad2fda802410303461a69a74bd3","environment":"production","productionSafe":true,"previewEnabled":false,"serviceActive":true,"deploymentMode":"immutable-release-directory","artifactDigest":"sha256:541d2a4d515d39ecf2b95b616cf29a1aeb96aa4d75e038dfe4d399b9899fabab","observedAt":"2026-07-20T09:54:01Z"},"releaseId":null,"proposedEvidence":{"artifact":"startup sha256 verification","sbom":"CycloneDX 1.6","configuration":"public manifest + SecretRef-only projection","migration":"owned SQL set with per-file sha256","runtime":"/v1/release-unit + health/meta summary","rollback":"named immutable predecessor + intentional drill","provenance":"unsigned EC2 builder; remains OBSERVED"},"promotion":["Required pull-request checks complete on isolated runner.","Protected main contains the exact candidate revision or its merge commit.","Linux artifact and receipt are generated together in an immutable release directory.","Production smoke passes, predecessor rollback is exercised, then the candidate is re-promoted."]},{"id":"data-sources-systemd-d05","repository":"reits/data-sources","service":"reits-data-sources","state":"BLOCKED_REQUIRED_CHECKS","source":{"revision":"fd9b873244d68abeab142318692393d85d5be68f","ref":"feat/d05-release-identity","dirty":false},"pullRequest":{"number":1,"url":"https://gitea.reits.tech/reits/data-sources/pulls/1","mergeable":true,"merged":false},"protection":{"base":"main","directPush":false,"requiredContexts":[{"context":"REITS Minimum CI / gate (pull_request)","state":"QUEUED"}],"dependentContexts":[{"context":"REITS Minimum CI / minimum (pull_request)","state":"BLOCKED_BY_GATE"}],"blocker":"The required gate is waiting because data-sources has no eligible repository or organization Linux runner; the minimum job cannot start before that gate."},"currentProduction":{"revision":"a01a445d0a1052d0ebd3bbec17d0942349684cad","environment":"production","productionSafe":true,"previewEnabled":false,"serviceActive":true,"deploymentMode":"mutable-in-place-binary","artifactDigest":"sha256:eb553e7188da61907b1adfa00a97efe6fa97e50b859be1af0180568d3452a44d","observedAt":"2026-07-20T10:23:00Z"},"releaseId":"reits-data-sources@fd9b873244d6-0eab4831edfe","proposedEvidence":{"artifact":"sha256:0eab4831edfe2cb5af41a9a239c1d145f30e22685b16499fd989a51227b21ae3","sbom":"sha256:c94a3e524437d2102b9758f6820fe3a21265e496331c35446601f44c643a53ec","configuration":"sha256:bd007418937031b37d05593e9ccc2c9e84172336397e0d9fcfc0795fe3d4b85a","migration":"sha256:66178418ff7a69b35871c109858e9671706666a96d36ae36670f8e9546963e52","runtime":"allowlisted /release-unit + exact current executable verification","rollback":"reits-data-sources@legacy-a01a445d0a10-eb553e7188da; drill not yet executed","provenance":"developer.reits.tech/go-release-builder/v1; unsigned OBSERVED"},"promotion":["The protected required gate and dependent minimum job complete on an isolated Linux runner.","Protected main contains the reviewed candidate or its merge commit; rebuild from that exact clean revision.","Provision the dedicated service account, systemd credential and immutable release directory without mutating crawler data.","Pass local health and release identity probes, exercise the named rollback, then atomically move current."]}],"units":[{"id":"auth-systemd","repository":"reits/reits-auth","service":"reits-auth","channel":"systemd","environment":"production","source":{"status":"BOUND","revision":"157b8590e4625ad2fda802410303461a69a74bd3","ref":"production release directory","dirty":false},"artifact":{"status":"BOUND","kind":"linux-amd64-binary","digest":"sha256:541d2a4d515d39ecf2b95b616cf29a1aeb96aa4d75e038dfe4d399b9899fabab","path":"/opt/reits-auth/current/bin/reits-auth"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"redacted-config-manifest","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"PARTIAL","target":"ec2/systemd/reits-auth","observedAt":"2026-07-20T08:53:00Z","runtimeIdentityUrl":"https://auth.reits.tech/v1/meta"},"rollback":{"status":"PARTIAL","targetReleaseId":null,"verifiedAt":null},"provenance":{"status":"MISSING","predicateType":null,"builderId":null,"signed":false}},{"id":"data-sources-systemd","repository":"reits/data-sources","service":"reits-data-sources","channel":"systemd","environment":"production","source":{"status":"BOUND","revision":"a01a445d0a1052d0ebd3bbec17d0942349684cad","ref":".deploy-state/last-main.sha","dirty":false},"artifact":{"status":"BOUND","kind":"linux-amd64-binary","digest":"sha256:eb553e7188da61907b1adfa00a97efe6fa97e50b859be1af0180568d3452a44d","path":"/opt/data-sources/reits-crawler"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"redacted-config-manifest","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"OBSERVED","target":"ec2/systemd/reits-data-sources","observedAt":"2026-07-20T08:53:00Z","runtimeIdentityUrl":null},"rollback":{"status":"PARTIAL","targetReleaseId":null,"verifiedAt":null},"provenance":{"status":"MISSING","predicateType":null,"builderId":null,"signed":false}},{"id":"open-developer-api","repository":"reits/miniapp-open-platform","service":"reits-developer-api","channel":"systemd","environment":"production","source":{"status":"BOUND","revision":"fb1a1b45124f153ae685c9b5142b3186c98e5054","ref":"deploy/release.sha","dirty":false},"artifact":{"status":"BOUND","kind":"linux-amd64-binary","digest":"sha256:f8538fb51cf8ae39040cd0c9b6776def48cea5ace962f30a613d8faf35058aae","path":"/opt/miniapp-open-platform/services/developer-api/bin/developer-api"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"redacted-config-manifest","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"OBSERVED","target":"ec2/systemd/reits-developer-api","observedAt":"2026-07-20T08:53:00Z","runtimeIdentityUrl":null},"rollback":{"status":"MISSING","targetReleaseId":null,"verifiedAt":null},"provenance":{"status":"MISSING","predicateType":null,"builderId":null,"signed":false}},{"id":"open-miniapp-gateway","repository":"reits/miniapp-open-platform","service":"reits-miniapp-gateway","channel":"systemd","environment":"production","source":{"status":"BOUND","revision":"fb1a1b45124f153ae685c9b5142b3186c98e5054","ref":"deploy/release.sha","dirty":false},"artifact":{"status":"BOUND","kind":"linux-amd64-binary","digest":"sha256:03727e1ada0c57626b8016cfbd60e0f14c11a3a561fa67f9311ec6d7fb740711","path":"/opt/miniapp-open-platform/services/miniapp-gateway/bin/miniapp-gateway"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"redacted-config-manifest","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"OBSERVED","target":"ec2/systemd/reits-miniapp-gateway","observedAt":"2026-07-20T08:53:00Z","runtimeIdentityUrl":null},"rollback":{"status":"MISSING","targetReleaseId":null,"verifiedAt":null},"provenance":{"status":"MISSING","predicateType":null,"builderId":null,"signed":false}},{"id":"booking-systemd","repository":"reits/public-booking-platform","service":"reits-order","channel":"systemd","environment":"production","source":{"status":"BOUND","revision":"738aeaa76fd571d378a150ff6c4a2a633d83f1f8","ref":".deploy-state/current-sha","dirty":false},"artifact":{"status":"PARTIAL","kind":"source-entry-only","digest":"sha256:182bbcd5ecd0d81c9457289fe248d30c739c318fb6933d67cb101fc608b584a8","path":"/opt/reits-order/source/apps/api/server.js"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"redacted-config-manifest","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"BOUND","target":"ec2/systemd/reits-order","observedAt":"2026-07-20T08:53:00Z","runtimeIdentityUrl":"https://order.reits.tech/api/health"},"rollback":{"status":"BOUND","targetReleaseId":"previous immutable release directory","verifiedAt":"2026-07-20T08:53:00Z"},"provenance":{"status":"MISSING","predicateType":null,"builderId":null,"signed":false}},{"id":"im-core-container","repository":"reits/im-core","service":"im-core-four-role-stack","channel":"container","environment":"production","source":{"status":"BOUND","revision":"d5306718153dcfa8b43f4f975992f312480a54a4","ref":".deploy-state/current-sha + runtime meta","dirty":false},"artifact":{"status":"BOUND","kind":"docker-image-id","digest":"sha256:070cf7846ddca4a638ab064b6956435c500eb51344ed482b3af01bbf9b238a39","path":"im-core:production"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"redacted-config-manifest","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"BOUND","target":"ec2/docker/im-core","observedAt":"2026-07-20T08:53:00Z","runtimeIdentityUrl":"https://api.reits.tech/api/v1/meta/app"},"rollback":{"status":"PARTIAL","targetReleaseId":null,"verifiedAt":null},"provenance":{"status":"MISSING","predicateType":null,"builderId":null,"signed":false}},{"id":"info-portal-container","repository":"reits/reits-info-portal","service":"reits-info-portal-web","channel":"container","environment":"production","source":{"status":"BOUND","revision":"3c322a59bdf6e70f7b08454e467f11aa5fb3f6ef","ref":".deploy-state/current-sha + image tag","dirty":false},"artifact":{"status":"BOUND","kind":"docker-image-id","digest":"sha256:0ea2e2947278fe95df4ff1795ecc3585dae80b0af63c155c1991923073477670","path":"reits-info-portal:3c322a59bdf6"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"redacted-config-manifest","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"OBSERVED","target":"ec2/docker/reits-info-portal-web","observedAt":"2026-07-20T08:53:00Z","runtimeIdentityUrl":null},"rollback":{"status":"PARTIAL","targetReleaseId":null,"verifiedAt":null},"provenance":{"status":"MISSING","predicateType":null,"builderId":null,"signed":false}},{"id":"bbs-container","repository":"reits/reits-bbs","service":"reits-nodebb","channel":"container","environment":"production","source":{"status":"BOUND","revision":"8f1d1f3878eaa7d32d8dc91f6fd761f0dfe475c8","ref":".deploy-state/current-sha + image tag","dirty":false},"artifact":{"status":"BOUND","kind":"docker-image-id","digest":"sha256:7b5843bff63b03947c8aa759ffc7431f5c269102dacbe6c6fe7f375c743ba150","path":"reits-nodebb:8f1d1f3878ea"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"redacted-config-manifest","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"OBSERVED","target":"ec2/docker/reits-nodebb","observedAt":"2026-07-20T08:53:00Z","runtimeIdentityUrl":null},"rollback":{"status":"PARTIAL","targetReleaseId":null,"verifiedAt":null},"provenance":{"status":"MISSING","predicateType":null,"builderId":null,"signed":false}},{"id":"developer-portal-ec2","repository":"local/developer-portal","service":"reits-developer-portal","channel":"systemd","environment":"production","source":{"status":"BOUND","revision":"41e96a61a9410533320608800e6cd66141d47568","ref":"REVISION + immutable release directory","dirty":false},"artifact":{"status":"BOUND","kind":"vinext-dist-tree","digest":"sha256:d30343296f97af83ef90beb7773ad968f39135dbb48bd501b69068d51f6ceaa6","path":"/opt/reits-developer-portal/releases/41e96a61a9410533320608800e6cd66141d47568/dist"},"sbom":{"status":"BOUND","kind":"cyclonedx-1.5-json","digest":"sha256:4200c298c32592d420ad7e580b7909e63611d9e5e1c2f94a443e58444f8eb253","path":"/opt/reits-developer-portal/releases/41e96a61a9410533320608800e6cd66141d47568/.release/sbom.cdx.json"},"configuration":{"status":"BOUND","kind":"public-config-manifest","digest":"sha256:2acb68789cd717dbd5104c8f4f15d45dc7148be2a1119961cae15838e9c18db8","path":"public/release-config.json"},"migration":{"status":"BOUND","kind":"migration-set","digest":"sha256:dc6c9dd2ab96033d9dfd46da240fbf27c35c6cd4a260d96b19ef35c16a0cdfd7","path":"public/release-migrations.json"},"secrets":{"status":"BOUND","referencesOnly":true,"refs":[]},"deployment":{"status":"BOUND","target":"ec2/systemd/reits-developer-portal","observedAt":"2026-07-20T09:36:49Z","runtimeIdentityUrl":"https://developer.reits.tech/api/release-unit"},"rollback":{"status":"BOUND","targetReleaseId":"developer-portal@a31365313c7a","verifiedAt":"2026-07-20T09:36:49Z"},"provenance":{"status":"OBSERVED","predicateType":"https://slsa.dev/provenance/v1","builderId":"developer.reits.tech/local-release-builder/v1","signed":false}},{"id":"developer-portal-sites","repository":"local/developer-portal","service":"reits-developer-portal","channel":"sites","environment":"production","source":{"status":"BOUND","revision":"a31365313c7a7d87e3b93716e2ce5e8d8b84a369","ref":"Sites version 81","dirty":false},"artifact":{"status":"BOUND","kind":"sites-content-archive","digest":"sha256:eac2b21b4ae0d656a45f5c1fd5f1e64c7027c3a7d68ba569609b5d0a4fdb54cc","path":"Sites version 81"},"sbom":{"status":"MISSING","kind":"cyclonedx-json","digest":null,"path":null},"configuration":{"status":"MISSING","kind":"sites-environment-revision","digest":null,"path":null},"migration":{"status":"MISSING","kind":"migration-set","digest":null,"path":null},"secrets":{"status":"MISSING","referencesOnly":true,"refs":[]},"deployment":{"status":"OBSERVED","target":"sites/reits-developer","observedAt":"2026-07-20T08:39:36Z","runtimeIdentityUrl":null},"rollback":{"status":"BOUND","targetReleaseId":"Sites version 80","verifiedAt":"2026-07-20T08:39:36Z"},"provenance":{"status":"MISSING","predicateType":null,"builderId":"openai-sites","signed":false}}],"standards":{"sbom":{"format":"CycloneDX JSON","preferredVersion":"1.7","minimumAcceptedVersion":"1.5","mediaType":"application/vnd.cyclonedx+json","implementationNote":"npm 11 emits CycloneDX 1.5; upgrade the builder output to 1.7 without rewriting receipts in place."},"provenance":{"predicateType":"https://slsa.dev/provenance/v1","minimumClaim":"L1-shaped unsigned provenance until a hosted isolated builder exists"},"containerAnnotations":["org.opencontainers.image.created","org.opencontainers.image.source","org.opencontainers.image.version","org.opencontainers.image.revision"]},"acceptance":["The organization runner policy is ACCEPTED and all 18 evidence gates execute.","Every deployed unit binds exact source, full artifact digest, SBOM, public configuration, migration set and SecretRefs.","Every public health/meta response returns the same release identity without secret material.","Build provenance identifies the isolated builder and cannot be edited by the workload after build.","Every unit names and verifies a rollback target before promotion."],"metrics":{"units":10,"exactSource":10,"artifactBound":9,"runtimeIdentityBound":3,"sbomBound":1,"configurationBound":1,"migrationBound":1,"secretRefBound":1,"rollbackBound":3,"signedProvenance":0},"runnerCapacity":{"schemaVersion":"developer.reits.tech/runner-capacity/v1","status":"ACTIVE_BLOCKED","observedAt":"2026-07-21T07:56:54Z","current":{"linux":{"registered":1,"online":1,"scope":"repository","repository":"reits/im-core","eligibleRepositories":1},"macos":{"registered":2,"online":0,"scope":"unavailable","eligibleRepositories":0},"organization":{"registered":0,"online":0,"successfulGates":1,"queuedGates":17},"productionHostEligible":false,"productionHostGuard":{"status":"BOUND","path":"/etc/reits-production-host","runnerServiceActive":false,"observedAt":"2026-07-21T07:56:54Z"},"reason":"The only accessible EC2 hosts public web, Gitea, IM, business services, databases and logging; CI workloads must not share this failure and trust domain."},"target":{"linuxOrganizationRunners":2,"macosOrganizationRunners":1,"concurrencyPerRunner":1,"ephemeralWorkspace":true,"singleUseRunnerCredential":true,"jobIsolation":"ephemeral-vm-or-rootless-dind","dedicatedCompute":true,"productionNetworkAccess":false,"dockerSocketMounted":false},"isolation":["Dedicated CI compute account or VM; no production service is co-located.","Untrusted pull-request jobs cannot access home directories, cloud credentials, Docker sockets or production subnets.","The organization registration secret exists only during offline bootstrap, is never committed/logged and is reset before any daemon starts.","CPU, memory, process, disk and job duration limits are enforced; workspaces are destroyed after every job.","The job UID can reach only loopback; outbound CONNECT requests pass through a root-managed proxy allowlist that denies private destinations and direct sockets."],"registration":{"scope":"organization","organization":"reits","tokenEndpoint":"/api/v1/orgs/reits/actions/runners/registration-token","linuxLabels":["ubuntu-latest","ubuntu-24.04"],"macosLabels":["macos-latest","self-hosted","macOS"],"tokenStorage":"GITEA_RUNNER_REGISTRATION_TOKEN_FILE","tokenValueRecorded":false},"provisioning":{"status":"REVISION_REQUIRED","liveStackStatus":"NOT_DEPLOYED","costApprovalRequired":true,"template":"ops/gitea-runner/cloudformation.yaml","deployCommand":"ops/gitea-runner/deploy.sh","preflightCommand":"npm run runner-foundation:verify","validation":{"staticPolicy":"PASS","cfnLint":"PASS","awsValidateTemplate":"BLOCKED_IAM","awsPrincipal":"iam-user/cc","observedAt":"2026-07-20T11:40:44Z"},"topology":{"vpc":"new-ci-only-vpc","availabilityZones":2,"linuxInstances":2,"instanceTypeDefault":"t3.large","inboundRules":0,"outboundPolicy":"job UID may open only TCP 127.0.0.1:3128; root-managed CONNECT broker/bootstrap retain security-group HTTPS","productionVpcRoute":false},"cleanup":{"status":"HOOK_READY_UNTRUSTED_RECEIPT","runnerVersion":"2.0.0","postTaskScript":"ops/gitea-runner/post-task-cleanup.sh","timeout":"1m","roots":["/var/lib/reits-runner/work","/var/lib/reits-runner/tmp"],"builtInCleanupPrecedesHook":true,"trustedReceipt":false,"reason":"Gitea Runner 2.0.0 invokes the root-owned hook after built-in cleanup, but the hook still runs as the reusable daemon/job UID and cannot issue a trusted isolation receipt."},"credentialBoundary":{"status":"BLOCKED_HOST_EXECUTOR_SHARED_UID","observedAt":"2026-07-20T12:08:15Z","giteaVersion":"1.25.4","templateRunnerVersion":"2.0.0","executionMode":"host","daemonUser":"reits-runner","jobUser":"reits-runner","credentialPath":"/var/lib/reits-runner/.runner","jobCanReadRunnerCredential":true,"credentialRevokedBeforeJob":false,"runnerReusableAcrossJobs":true,"deploymentPermitted":false,"blockCode":"RUNNER_CREDENTIAL_SHARED_UID","minimumEphemeralVersion":"0.2.12","safeTarget":"single-use ephemeral VM factory with the rootless DinD lifecycle contract at /api/runner-factory","officialReference":"https://docs.gitea.com/1.24/usage/actions/act-runner#ephemeral-runners","acceptance":["The job cannot read or reuse the daemon credential file.","The runner credential is revoked before untrusted code starts.","The compute or rootless container boundary is replaced after each job.","Cleanup and replacement emit an operator-trusted receipt."]},"egress":{"status":"TEMPLATE_READY","enforcement":"job-uid-proxy-endpoint-only","proxy":"http://127.0.0.1:3128","permittedJobSockets":["tcp://127.0.0.1:3128"],"directJobNetwork":false,"loopbackDnsDenied":true,"otherLoopbackDenied":true,"privateDestinationsDenied":true,"allowlistSource":"ops/gitea-runner/egress-allowlist.txt","allowedDomains":16,"fixtureCases":13,"domainGroups":[{"id":"control","label":"Gitea control","domains":["gitea.reits.tech","dl.gitea.com"]},{"id":"node","label":"Node packages","domains":["nodejs.org","registry.npmjs.org"]},{"id":"go","label":"Go modules","domains":["proxy.golang.org","sum.golang.org","storage.googleapis.com"]},{"id":"source","label":"Source fixtures","domains":["github.com","api.github.com","objects.githubusercontent.com","raw.githubusercontent.com"]},{"id":"rust","label":"Rust crates","domains":["crates.io","static.crates.io","index.crates.io"]},{"id":"python","label":"Python packages","domains":["pypi.org","files.pythonhosted.org"]}],"credentialsLogged":false,"validation":["Squid binds only to loopback and denies non-CONNECT, non-443, private, link-local and unlisted destinations.","A root-owned nftables output chain permits only TCP 127.0.0.1:3128 for the reits-runner UID and rejects every other IPv4, IPv6, UDP and loopback socket.","The runner service exports uppercase and lowercase proxy variables and requires the egress guard service.","The allowlist and proxy configuration are immutable root-owned inputs and contain no credential values.","Thirteen deterministic cases cover allowed paths plus direct, loopback DNS, local-service, IPv6 loopback, suffix, literal-IP, private, metadata, non-443 and unlisted denial."],"residualRisks":["The template is not deployed, so runtime enforcement and recovery receipts do not yet exist.","CONNECT authority filtering still requires an adversarial shared-CDN/SNI drill before acceptance.","Allowlisted package and source domains remain possible exfiltration channels; untrusted pull requests must receive no reusable secret.","Changing a package domain requires an owner-reviewed allowlist revision and a replacement rollout."]},"bootstrapBoundary":["Runner registrations remain offline while the bootstrap IAM profile and IMDS are present.","The reusable Gitea registration token is rotated and its SSM SecureString is deleted before activation.","Both instance profiles are detached and IMDS is disabled before the first runner daemon starts.","Any replacement node remains fail-closed until the explicit finalization sequence is repeated."],"phases":[{"id":"R1","label":"Policy + template","status":"COMPLETE"},{"id":"R2","label":"Local cfn-lint","status":"COMPLETE"},{"id":"R3","label":"Egress guard static","status":"COMPLETE"},{"id":"R4","label":"Credential boundary","status":"BLOCKED"},{"id":"R5","label":"AWS API validation","status":"BLOCKED_IAM"},{"id":"R6","label":"Cost-approved provision","status":"APPROVAL_REQUIRED"},{"id":"R7","label":"18-gate isolation drill","status":"BLOCKED"},{"id":"R8","label":"Mac native lane","status":"BLOCKED"}]},"acceptance":["Both Linux organization runners are online and visible to at least two repositories.","A fixture pull request completes the evidence gate in every one of the 18 core repositories.","A malicious fixture cannot read host, cloud, Gitea admin or production-network material.","Mac Swift package and iOS policy lanes execute on the dedicated Mac runner.","Runner loss, queue depth and saturation are observable without treating queued as passed."]},"runnerControllerReadiness":{"targetedGates":2,"satisfiedGates":0,"positiveAcceptanceReceipts":0,"missingReceiptRequirements":10,"decision":"DENY_AND_ESCALATE_TO_SECURITY_AND_ARCHITECTURE"},"runnerControllerActivation":{"targetedGates":2,"satisfiedGates":0,"positiveAcceptanceReceipts":0,"missingArtifactGroups":14,"missingReadinessReceipts":11,"decision":"DENY_AND_ESCALATE_TO_CONTROLLER_AND_RELEASE_OWNERS"},"runnerControllerInstallation":{"targetedGates":2,"satisfiedGates":0,"positiveAcceptanceReceipts":0,"missingInstallationReceipts":8,"missingLiveProofs":8,"decision":"DENY_AND_ESCALATE_TO_PLATFORM_SRE_AND_QA"},"runnerFactory":{"schemaVersion":"developer.reits.tech/runner-factory/v1","status":"D05_ACCEPTANCE_CLOSURE_DOSSIER_READY_FAIL_CLOSED","observedAt":"2026-07-21T20:00:00Z","truth":{"liveWorkers":0,"liveFactoryController":false,"runtimeReceipts":0,"paidResourcesCreated":false,"deploymentPermitted":false,"reason":"The D05 closure dossier now consolidates eleven mandatory production gates and five independent decision seats without claiming any gate, signature, listener, handler or acceptance decision. D01-D04 remain accepted, D05 remains active, Controller readiness remains 0/11, product UI acceptance remains 0/85, and port 8110 plus every deployment, cloud, Gitea, billing and credential capability remain absent from the production composition root."},"source":{"giteaVersion":"1.25.4","runnerVersion":"2.0.0","minimumEphemeralVersion":"0.2.12","officialWebhookReference":"https://docs.gitea.com/1.25/usage/repository/webhooks","officialEphemeralReference":"https://docs.gitea.com/usage/actions/act-runner#ephemeral-runners","officialIsolationReference":"https://docs.gitea.com/usage/actions/act-runner#requirements"},"trigger":{"event":"workflow_job","controller":"IMPLEMENTED_DRY_RUN","idempotencyKey":["deliveryId","runId","jobId","attempt"],"replayAccepted":false},"controller":{"status":"DRY_RUN_READY","implementation":"ops/runner-factory/controller-core.mjs","policy":"ops/runner-factory/controller-policy.json","liveEndpoint":false,"applySupported":false,"rawBodySignature":"HMAC-SHA256","payloadLimitBytes":262144,"requiredHeaders":["X-Gitea-Signature","X-Gitea-Delivery","X-Gitea-Event","X-Gitea-Event-Type"],"admittedActions":["queued"],"admittedRepositories":18,"requiredRunnerLabel":"ubuntu-latest","idempotency":{"algorithm":"SHA-256","scopes":["delivery-and-job-attempt","repository-job-attempt"],"dryRunStore":"IN_MEMORY_TEST_ONLY","runtimeStore":"DYNAMODB_ADAPTER_IMPLEMENTED_NOT_CONFIGURED","durable":false},"receipts":{"dryRunCount":4,"dryRunTrust":"TEST_ONLY","dryRunSigner":"HMAC-SHA256-TEST-ONLY","runtimeSigner":"AWS_KMS_ADAPTER_IMPLEMENTED_NOT_CONFIGURED","secretValuesRecorded":false},"verification":{"fixtureCases":20,"planOnlyCases":1,"deniedCases":19,"cloudMutations":0,"result":"PASS_DRY_RUN_ONLY"}},"runtimeAdapters":{"status":"PORTS_EXECUTABLE_NOT_CONFIGURED","contract":"ops/runner-factory/runtime-adapter-contract.json","ports":7,"configured":0,"requestContracts":8,"sagaCases":13,"successCases":1,"safeTerminalCases":12,"compensatedCases":11,"lifecycleReceipts":10,"auditSuccessSeals":1,"auditFailureSeals":10,"verifiedAuditCases":11,"receiptTrust":"TEST_ONLY","productionPrerequisites":6,"secretExposureCount":0,"awsCallsExecuted":0,"giteaWritesExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"servicePackage":{"status":"PACKAGE_EXECUTABLE_NOT_DEPLOYED","contract":"ops/runner-factory/controller-service-contract.json","entrypoint":"ops/runner-factory/controller-service-main.mjs","systemdTemplate":"ops/runner-factory/reits-runner-factory-controller.service","bind":"127.0.0.1:8110","mode":"EVIDENCE_ONLY","endpoints":3,"readinessReady":0,"readinessTotal":11,"requestFixtures":15,"configFixtures":5,"fixtureWebhooksAccepted":1,"productionWebhooksAccepted":0,"liveListeners":0,"liveReplicas":0,"systemdUnitInstalled":false,"publicRouteConfigured":false,"credentialFilesProvisioned":0,"externalWritesExecuted":0,"secretExposureCount":0,"paidResourcesCreated":false,"deploymentPermitted":false},"runtimeAssembly":{"status":"ASSEMBLY_VERIFIER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-runtime-assembly-contract.json","assembly":"ops/runner-factory/controller-runtime-assembly.mjs","operations":4,"readerBindings":5,"readinessGates":11,"states":5,"invariants":20,"fixtures":32,"readyPackets":1,"blockedPackets":5,"deniedInputs":26,"verifiedAttestations":30,"controllerProjectionCases":6,"booleanEscalationsDenied":1,"serviceBind":"127.0.0.1:8110","serviceMode":"EVIDENCE_ONLY","attestationMaxAgeSeconds":300,"manifestInstalled":false,"runtimeIdentityConfigured":false,"configuredReaderBindings":0,"verifiedReadinessGates":0,"readinessReady":false,"runtimeReadinessReceipts":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"runtimeConfiguration":{"status":"CONFIGURATION_LOADER_IMPLEMENTED_NOT_INSTALLED","contract":"ops/runner-factory/controller-runtime-configuration-contract.json","loader":"ops/runner-factory/controller-runtime-configuration.mjs","operations":5,"configRefs":11,"keyRefs":1,"referenceTypes":7,"states":6,"invariants":24,"fixtures":36,"resolvedBundles":2,"blockedBundles":5,"deniedInputs":29,"deterministicReplays":1,"tamperedBundlesDenied":1,"manifestPath":"/etc/reits-runner-factory/controller-runtime.json","manifestOwner":"root:reits-runner-factory","manifestMode":"0640","manifestMaxBytes":65536,"resolutionMaxAgeSeconds":300,"manifestInstalled":false,"productionFileReads":0,"configuredConfigRefs":0,"configuredKeyRefs":0,"runtimeConfigurationBundles":0,"runtimeAdaptersConstructed":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"bootstrapComposition":{"status":"BOOTSTRAP_COMPOSER_IMPLEMENTED_NOT_INSTALLED","contract":"ops/runner-factory/controller-bootstrap-composition-contract.json","composer":"ops/runner-factory/controller-bootstrap-composition.mjs","operations":5,"componentFactories":6,"readerComponents":5,"attestationVerifiers":1,"consumers":3,"states":7,"invariants":28,"fixtures":45,"acceptedOutcomes":7,"deniedOutcomes":38,"snapshotIntegrations":1,"assemblyIntegrations":1,"readinessProjections":1,"replayedBundlesDenied":1,"forgedHandlesDenied":1,"postDisposeCallsDenied":1,"reverseCleanupCases":6,"productionCompositions":0,"productionComponentsConstructed":0,"configuredReaderBindings":0,"configuredAttestationVerifiers":0,"runtimeBootstrapReceipts":0,"runtimeProjections":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"serviceRuntimeBootstrap":{"status":"SERVICE_RUNTIME_BOOTSTRAP_IMPLEMENTED_NOT_INSTALLED","contract":"ops/runner-factory/controller-service-runtime-bootstrap-contract.json","bootstrap":"ops/runner-factory/controller-service-runtime-bootstrap.mjs","operations":4,"chainStages":5,"states":8,"invariants":30,"fixtures":40,"acceptedOutcomes":7,"deniedOutcomes":33,"readyHandlerProjections":4,"blockedReadinessCases":2,"attestationDenials":10,"runtimeIdentityDenials":3,"configurationAndFactoryDenials":4,"serviceFactoryDenials":3,"constructorDenials":3,"capabilityDenials":3,"receiptDenials":2,"timeDenials":2,"cleanupDenials":1,"productionBootstraps":0,"productionServiceHandlers":0,"configuredReadinessGates":0,"runtimeBootstrapReceipts":0,"runtimeHandlerProjections":0,"controllerListeners":0,"productionWebhooksAccepted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"productionEvidenceAdmission":{"status":"PRODUCTION_EVIDENCE_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-production-evidence-admission-contract.json","admission":"ops/runner-factory/controller-production-evidence-admission.mjs","operations":4,"requirements":6,"adapterQualifications":6,"readinessGates":11,"evidenceSignatures":19,"states":8,"invariants":34,"fixtures":56,"acceptedOutcomes":6,"deniedOutcomes":50,"fixtureEvidenceSignaturesVerified":339,"dossiersProjected":3,"productionAdmissionReceipts":0,"productionHostReceipts":0,"productionServiceIdentityReceipts":0,"qualifiedProductionAdapters":0,"configuredReadinessGates":0,"listenerAuthorizations":0,"controllerListeners":0,"productionWebhooksAccepted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"listenerAuthorization":{"status":"LISTENER_AUTHORIZATION_BOUNDARY_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-listener-authorization-contract.json","authorization":"ops/runner-factory/controller-listener-authorization.mjs","operations":4,"requirements":8,"ownerApprovals":4,"operationalDrills":2,"validitySeconds":120,"states":8,"invariants":36,"fixtures":53,"acceptedOutcomes":6,"deniedOutcomes":47,"fixtureEvidenceSignaturesVerified":132,"plansProjected":3,"productionListenerAuthorizationReceipts":0,"productionOwnerApprovals":0,"productionRollbackRehearsals":0,"productionNegativeWebhookRehearsals":0,"productionOperationalDrills":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"activationExecutor":{"status":"ACTIVATION_EXECUTOR_DRY_RUN_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-activation-executor-contract.json","executor":"ops/runner-factory/controller-activation-executor.mjs","operations":4,"requirements":8,"runtimeConfirmations":2,"runbookSteps":8,"rollbackTriggers":5,"requestValiditySeconds":60,"maintenanceWindowSeconds":900,"rollbackDeadlineSeconds":60,"states":9,"invariants":42,"fixtures":68,"acceptedOutcomes":6,"deniedOutcomes":62,"fixtureEvidenceSignaturesVerified":110,"runbooksProjected":3,"productionActivationPlanReceipts":0,"productionMaintenanceWindows":0,"productionRuntimeConfirmations":0,"productionPreflightReceipts":0,"productionRollbackGuards":0,"activationExecutorsConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"activationTransaction":{"status":"ACTIVATION_TRANSACTION_EXECUTOR_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-activation-transaction-executor-contract.json","executor":"ops/runner-factory/controller-activation-transaction-executor.mjs","memoryDriver":"ops/runner-factory/memory-controller-activation-transaction-driver.mjs","operations":4,"driverPorts":9,"forwardSteps":7,"compensationSteps":4,"requestValiditySeconds":30,"rollbackDeadlineSeconds":60,"states":12,"invariants":48,"fixtures":72,"acceptedOutcomes":18,"deniedOutcomes":54,"planReceiptsVerified":48,"fixtureStepReceiptsVerified":114,"committedTransactions":5,"rolledBackTransactions":9,"containedTransactions":4,"fixtureDriverCalls":130,"fixtureMutationOperations":30,"fixtureCompensationOperations":25,"productionActivationPlanReceipts":0,"productionTransactionRequests":0,"productionExecutorsConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"targetHostDriverQualification":{"status":"TARGET_HOST_DRIVER_QUALIFICATION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-target-host-driver-qualification-contract.json","evaluator":"ops/runner-factory/controller-target-host-driver-qualification.mjs","operations":4,"operationPorts":9,"denialProfiles":8,"permittedPaths":4,"systemdActions":5,"requestValiditySeconds":60,"rollbackDeadlineSeconds":60,"states":8,"invariants":44,"fixtures":64,"acceptedOutcomes":8,"deniedOutcomes":56,"transactionReceiptsVerified":49,"evidenceSignaturesVerified":198,"qualifiedDossiers":6,"qualificationReceiptsVerified":2,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostConformanceAdmission":{"status":"DISPOSABLE_HOST_CONFORMANCE_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-conformance-admission-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-conformance-admission.mjs","operations":4,"phases":12,"watchdogTriggers":8,"terminalAssertions":8,"evidenceSlots":12,"requestValiditySeconds":60,"watchdogDeadlineSeconds":60,"killEscalationSeconds":10,"states":9,"invariants":48,"fixtures":68,"acceptedOutcomes":8,"deniedOutcomes":60,"qualificationReceiptsVerified":54,"admittedPlans":5,"admissionReceiptsVerified":3,"disposedHandles":1,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostConformanceDossierSealer":{"status":"DISPOSABLE_HOST_CONFORMANCE_DOSSIER_SEALER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-conformance-dossier-sealer-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-conformance-dossier-sealer.mjs","operations":4,"phaseReceipts":12,"terminalAttestations":8,"evidenceSignaturesPerDossier":21,"states":10,"invariants":52,"fixtures":72,"acceptedOutcomes":8,"deniedOutcomes":64,"admissionReceiptsVerified":58,"evidenceSignaturesVerified":338,"sealedDossiers":5,"sealReceiptsVerified":3,"disposedHandles":1,"productionHostRuns":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostExecutionEnvelopeAuthorizer":{"status":"DISPOSABLE_HOST_EXECUTION_ENVELOPE_AUTHORIZER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-execution-envelope-authorizer-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-execution-envelope-authorizer.mjs","operations":4,"approvalAuthorities":3,"packageBindings":8,"requestValiditySeconds":60,"maximumMilliUsd":500,"maxRunSeconds":900,"maxCleanupSeconds":120,"states":11,"invariants":54,"fixtures":76,"acceptedOutcomes":8,"deniedOutcomes":68,"dossierReceiptsVerified":65,"approvalSignaturesVerified":62,"authorizedEnvelopes":5,"authorizationReceiptsVerified":3,"disposedHandles":1,"productionHostRuns":0,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostNoShellExecutor":{"status":"DISPOSABLE_HOST_NO_SHELL_EXECUTOR_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-no-shell-executor-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-no-shell-executor.mjs","operations":4,"typedPorts":8,"executorPorts":5,"retirementPorts":3,"forwardPhases":8,"compensationPhases":2,"requestValiditySeconds":30,"maxRunSeconds":900,"maxCleanupSeconds":120,"states":12,"invariants":58,"fixtures":80,"acceptedOutcomes":12,"deniedOutcomes":68,"envelopeReceiptsVerified":53,"stepSignaturesVerified":68,"retiredSessions":5,"rolledBackSessions":5,"containedSessions":1,"executorReceiptsVerified":3,"disposedHandles":1,"shellCommandsAccepted":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"productionExecutorsConfigured":0,"productionHostRuns":0,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostRealPrerequisitesAdmission":{"status":"DISPOSABLE_HOST_REAL_PREREQUISITES_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-real-prerequisites-admission-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-real-prerequisites-admission.mjs","operations":4,"prerequisiteSlots":8,"authorityIdentities":6,"requestValiditySeconds":30,"qualificationValiditySeconds":86400,"maximumMilliUsdCeiling":500,"quoteMaxAgeSeconds":300,"retirementSlaSeconds":120,"states":13,"invariants":62,"fixtures":84,"acceptedOutcomes":10,"deniedOutcomes":74,"executorReceiptsVerified":62,"qualificationSignaturesVerified":368,"admissionReceiptsVerified":3,"disposedHandles":1,"fixturePrerequisitesQualified":8,"productionPrerequisitesSatisfied":0,"userCostAuthorizationsObserved":0,"livePriceQuotesObserved":0,"durableClaimStoresConfigured":0,"productionDriversConfigured":0,"independentRetirementDriversConfigured":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionAuthorization":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_AUTHORIZATION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-authorization-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-authorization.mjs","operations":4,"evidenceSlots":9,"authorityIdentities":8,"requestValiditySeconds":30,"authorizationShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"quoteMaxAgeSeconds":300,"collectionWindowSeconds":600,"retirementSlaSeconds":120,"states":14,"invariants":66,"fixtures":92,"acceptedOutcomes":12,"deniedOutcomes":80,"upstreamReceiptsVerified":72,"evidenceSignaturesVerified":254,"authorizationReceiptsVerified":3,"authorizedEnvelopes":10,"disposedHandles":2,"fixtureAuthorizationShapesVerified":9,"productionAuthorizationsObserved":0,"userCostAuthorizationsObserved":0,"livePriceQuotesObserved":0,"durableClaimReservationsObserved":0,"productionDriversObserved":0,"watchdogEscrowsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionTransactionIntent":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_TRANSACTION_INTENT_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-transaction-intent-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-transaction-intent.mjs","operations":4,"factorSlots":7,"authorityIdentities":6,"requestValiditySeconds":30,"factorShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"quoteMaxAgeSeconds":300,"collectionWindowSeconds":600,"retirementSlaSeconds":120,"states":13,"invariants":70,"fixtures":96,"acceptedOutcomes":12,"deniedOutcomes":84,"upstreamReceiptsVerified":73,"factorSignaturesVerified":205,"intentReceiptsVerified":3,"projectedIntents":12,"disposedHandles":2,"fixtureIntentFactorsVerified":7,"realUserConfirmationsObserved":0,"userCostAuthorizationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"policyRevalidationsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionDetachedUserConfirmation":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_DETACHED_USER_CONFIRMATION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-detached-user-confirmation-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-detached-user-confirmation.mjs","operations":4,"proofSlots":5,"authorityIdentities":4,"requestValiditySeconds":30,"challengeValiditySeconds":120,"signatureValiditySeconds":120,"proofShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"collectionWindowSeconds":600,"retirementSlaSeconds":120,"states":14,"invariants":74,"fixtures":100,"acceptedOutcomes":14,"deniedOutcomes":86,"upstreamReceiptsVerified":80,"detachedSignaturesVerified":51,"proofSignaturesVerified":162,"confirmationReceiptsVerified":3,"projectedConfirmations":14,"disposedHandles":2,"fixtureConfirmationProofsVerified":5,"fixtureDetachedSignaturesVerified":1,"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"policyRevalidationsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionQuoteBudgetClaimTransactionPlan":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_QUOTE_BUDGET_CLAIM_TRANSACTION_PLAN_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-quote-budget-claim-transaction-plan-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-quote-budget-claim-transaction-plan.mjs","operations":4,"planSteps":5,"authorityIdentities":5,"requestValiditySeconds":30,"planShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"quoteMaxAgeSeconds":300,"holdTtlSeconds":900,"claimTtlSeconds":900,"collectionWindowSeconds":600,"retirementSlaSeconds":120,"states":15,"invariants":78,"fixtures":104,"acceptedOutcomes":14,"deniedOutcomes":90,"upstreamReceiptsVerified":81,"planStepReceiptsVerified":172,"planReceiptsVerified":3,"projectedPlans":17,"disposedHandles":2,"fixturePlanStepsVerified":5,"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"policyRevalidationsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionAtomicTransactionCommitAdmission":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_ATOMIC_TRANSACTION_COMMIT_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-atomic-transaction-commit-admission-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-atomic-transaction-commit-admission.mjs","operations":4,"admissionSlots":5,"authorityIdentities":5,"requestValiditySeconds":30,"admissionShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"quoteMaxAgeSeconds":300,"holdTtlSeconds":900,"claimTtlSeconds":900,"states":16,"invariants":82,"productionPrerequisites":17,"fixtures":108,"acceptedOutcomes":16,"deniedOutcomes":92,"upstreamReceiptsVerified":80,"admissionSlotReceiptsVerified":162,"admissionReceiptsVerified":3,"projectedAdmissions":16,"disposedHandles":2,"fixtureAdmissionShapesVerified":5,"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"atomicCoordinatorsObserved":0,"compensationReceiptsObserved":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"transactionCommitPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionTransactionCommitExecutionAuthorizationHandoff":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_TRANSACTION_COMMIT_EXECUTION_AUTHORIZATION_HANDOFF_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-transaction-commit-execution-authorization-handoff-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-transaction-commit-execution-authorization-handoff.mjs","operations":4,"handoffSlots":5,"authorityIdentities":5,"requestValiditySeconds":30,"handoffShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"states":17,"invariants":86,"productionPrerequisites":18,"fixtures":112,"acceptedOutcomes":18,"deniedOutcomes":94,"upstreamReceiptsVerified":84,"handoffSlotReceiptsVerified":177,"handoffReceiptsVerified":3,"projectedHandoffs":19,"disposedHandles":2,"fixtureHandoffShapesVerified":5,"realTransactionCommitReceiptsObserved":0,"durableBudgetSettlementsObserved":0,"activeHostLeasesObserved":0,"executionPolicyRevalidationsObserved":0,"executionAuthorityGrantsObserved":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"transactionCommitPermitted":false,"executionHandoffPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityTrustRevocationAdmission":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_TRUST_REVOCATION_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-trust-revocation-admission-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-trust-revocation-admission.mjs","operations":4,"trustSlots":6,"authorityIdentities":6,"requestValiditySeconds":30,"trustShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"states":18,"invariants":90,"productionPrerequisites":19,"fixtures":116,"acceptedOutcomes":20,"deniedOutcomes":96,"upstreamReceiptsVerified":89,"trustSlotReceiptsVerified":236,"trustReceiptsVerified":3,"projectedAdmissions":22,"disposedHandles":2,"fixtureTrustShapesVerified":6,"productionAuthorityInterfacesObserved":0,"pinnedProductionKeysObserved":0,"keyRotationDrillsObserved":0,"grantRevocationDrillsObserved":0,"compensationDrillsObserved":0,"leaseExpiryDrillsObserved":0,"grantExpiryDrillsObserved":0,"immutableAuditWitnessesObserved":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"authorityTrustPermitted":false,"executionHandoffPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReview":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review.mjs","operations":4,"recoverySlots":7,"authorityIdentities":7,"requestValiditySeconds":30,"recoveryShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"states":19,"invariants":94,"productionPrerequisites":20,"fixtures":120,"acceptedOutcomes":22,"deniedOutcomes":98,"upstreamReceiptsVerified":98,"recoverySlotReceiptsVerified":331,"recoveryReceiptsVerified":3,"projectedReviews":25,"disposedHandles":2,"fixtureRecoveryShapesVerified":7,"productionCompromiseSignalsObserved":0,"quarantinedKeyGenerations":0,"grantContainmentsObserved":0,"leaseContainmentsObserved":0,"settlementCompensationsObserved":0,"capacityReleasesObserved":0,"auditContinuityWitnessesObserved":0,"operatorEscalationsObserved":0,"recoveryReadmissionsObserved":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"containmentReviewPermitted":false,"recoveryPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmission":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_SUCCESSOR_GENERATION_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission.mjs","operations":4,"admissionSlots":5,"authorityIdentities":5,"requestValiditySeconds":30,"admissionShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"states":20,"invariants":98,"productionPrerequisites":25,"fixtures":124,"acceptedOutcomes":24,"deniedOutcomes":100,"upstreamReceiptsVerified":102,"admissionSlotReceiptsVerified":252,"admissionReceiptsVerified":3,"projectedAdmissions":28,"disposedHandles":2,"fixtureAdmissionShapesVerified":5,"successorKeyCustodyEvidenceObserved":0,"revokedGenerationPropagationEvidenceObserved":0,"cleanGrantIssuanceEvidenceObserved":0,"auditContinuationEvidenceObserved":0,"independentOwnerApprovalsObserved":0,"successorGenerationAdmissionsObserved":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsIssued":0,"grantsRevoked":0,"auditWritesExecuted":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"successorGenerationAdmissionPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionCanaryReactivationAuthorization":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_SUCCESSOR_GENERATION_ADMISSION_CANARY_REACTIVATION_AUTHORIZATION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization.mjs","operations":4,"authorizationSlots":5,"authorityIdentities":5,"requestValiditySeconds":30,"authorizationShapeValiditySeconds":3600,"canaryGrantTtlSeconds":300,"observationWindowSeconds":900,"rollbackTriggerDeadlineSeconds":30,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"states":21,"invariants":102,"productionPrerequisites":30,"fixtures":128,"acceptedOutcomes":26,"deniedOutcomes":102,"upstreamReceiptsVerified":106,"authorizationSlotReceiptsVerified":267,"authorizationReceiptsVerified":3,"projectedAuthorizations":31,"disposedHandles":2,"fixtureAuthorizationShapesVerified":5,"verifierFanoutEvidenceObserved":0,"boundedCanaryGrantEvidenceObserved":0,"observationWindowEvidenceObserved":0,"automaticRollbackTriggerEvidenceObserved":0,"terminalAuditWitnessEvidenceObserved":0,"canaryReactivationAuthorizationsObserved":0,"keysCreated":0,"grantsIssued":0,"rollbackTriggersArmed":0,"auditWritesExecuted":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"canaryReactivationAuthorizationPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionCanaryReactivationAuthorizationOutcomeAdjudication":{"status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_SUCCESSOR_GENERATION_ADMISSION_CANARY_REACTIVATION_AUTHORIZATION_OUTCOME_ADJUDICATION_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-outcome-adjudication-contract.json","evaluator":"ops/runner-factory/controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-outcome-adjudication.mjs","operations":4,"adjudicationSlots":5,"authorityIdentities":5,"outcomeClasses":3,"requestValiditySeconds":30,"adjudicationShapeValiditySeconds":3600,"observationWindowSeconds":900,"rollbackCompletionDeadlineSeconds":30,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"states":22,"invariants":106,"productionPrerequisites":35,"fixtures":132,"acceptedOutcomes":28,"deniedOutcomes":104,"upstreamReceiptsVerified":110,"adjudicationSlotReceiptsVerified":282,"adjudicationReceiptsVerified":3,"projectedAdjudications":34,"disposedHandles":2,"fixtureAdjudicationShapesVerified":5,"fixtureOutcomeClassesVerified":3,"canaryObservationEvidenceObserved":0,"terminalHealthEvidenceObserved":0,"rollbackCompletionEvidenceObserved":0,"auditContinuityEvidenceObserved":0,"independentOwnerOutcomeReviewsObserved":0,"outcomeAdjudicationsObserved":0,"promotionsExecuted":0,"grantWidensExecuted":0,"rollbackSuppressionsExecuted":0,"auditWritesExecuted":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"outcomeClassification":"UNOBSERVED","promotionPermitted":false,"grantWideningPermitted":false,"rollbackSuppressionPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"d05AcceptanceClosure":{"status":"D05_ACCEPTANCE_CLOSURE_DOSSIER_IMPLEMENTED_FAIL_CLOSED","contract":"ops/runner-factory/controller-d05-acceptance-closure-contract.json","fixturesRegistry":"ops/runner-factory/controller-d05-acceptance-closure-fixtures.json","operations":4,"closureGates":11,"closureGatesSatisfied":0,"decisionSeats":5,"decisionClasses":3,"invariants":12,"fixtures":24,"validatedShapeCases":3,"deniedCases":21,"acceptedKnives":4,"totalKnives":36,"remainingIncludingCurrent":32,"remainingAfterAcceptance":31,"controllerReadinessSatisfied":0,"controllerReadinessTotal":11,"productUiAccepted":0,"productUiTotal":85,"liveEvidenceReceiptsObserved":0,"independentSignaturesObserved":0,"d05AcceptanceDecisionsObserved":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"systemdUnitsInstalled":0,"productionHandlersConstructed":0,"productionWebhooksAccepted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"d05Accepted":false,"deploymentPermitted":false},"reservationStore":{"status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/reservation-store-contract.json","adapter":"ops/runner-factory/reservation-store.mjs","runtimeDriver":"NOT_CONFIGURED","recordsPerReservation":2,"operations":5,"invariants":8,"fixtures":16,"allowedTransitions":5,"deniedTransitions":11,"leaseSeconds":120,"replayRetentionSeconds":604800,"fencingEpochVerified":2,"configured":false,"readinessGateSatisfied":false,"tableCreated":false,"iamRoleConfigured":false,"liveReservations":0,"dynamoReadsExecuted":0,"dynamoWritesExecuted":0,"secretExposureCount":0,"paidResourcesCreated":false,"deploymentPermitted":false},"receiptSigner":{"status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/receipt-signer-contract.json","adapter":"ops/runner-factory/receipt-signer.mjs","runtimeDriver":"NOT_CONFIGURED","operations":3,"invariants":10,"fixtures":20,"allowedTransitions":5,"deniedTransitions":15,"signedReceipts":2,"verifiedChains":1,"keySelection":"EXACT_KEY_ARN","keyUsage":"SIGN_VERIFY","keySpec":"ECC_NIST_P256","signingAlgorithm":"ECDSA_SHA_256","publicKeyPinnedBy":"SHA256_SPKI","configured":false,"readinessGateSatisfied":false,"kmsKeyCreated":false,"iamRoleConfigured":false,"runtimeReceipts":0,"kmsGetPublicKeyCallsExecuted":0,"kmsSignCallsExecuted":0,"secretExposureCount":0,"paidResourcesCreated":false,"deploymentPermitted":false},"tokenBroker":{"status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/registration-token-broker-contract.json","adapter":"ops/runner-factory/registration-token-broker.mjs","runtimeDriver":"NOT_CONFIGURED","operations":4,"stateTransitions":7,"invariants":12,"fixtures":22,"allowedTransitions":6,"deniedTransitions":16,"handleTtlSeconds":30,"maxTokenBytes":512,"tokenTransport":"GITEA_RESPONSE_HEADER_TOKEN_AS_MUTABLE_BYTES","configured":false,"readinessGateSatisfied":false,"brokerCredentialConfigured":false,"liveHandles":0,"giteaTokenCallsExecuted":0,"runtimeTokensIssued":0,"runtimeTokensConsumed":0,"runtimeTokensDestroyed":0,"tokenValuesRecorded":0,"tokenDigestsRecorded":0,"externalCallsExecuted":0,"giteaWritesExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"workerProvider":{"status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/worker-provider-contract.json","adapter":"ops/runner-factory/worker-provider.mjs","runtimeDriver":"NOT_CONFIGURED","operations":4,"stateTransitions":9,"invariants":14,"fixtures":34,"allowedTransitions":8,"deniedTransitions":26,"ec2OperationsModeled":8,"maxJobs":1,"launchTemplateSelection":"EXACT_ID_AND_NUMERIC_VERSION","bootstrapImds":"IMDSV2_REQUIRED_HOP_LIMIT_1","jobImds":"DISABLED","rootVolume":"ENCRYPTED_GP3_DELETE_ON_TERMINATION","configured":false,"readinessGateSatisfied":false,"launchTemplateCreated":false,"ciNetworkCreated":false,"bootstrapProfileCreated":false,"liveWorkers":0,"runtimeJobs":0,"ec2CallsExecuted":0,"secretExposureCount":0,"paidResourcesCreated":false,"deploymentPermitted":false},"giteaControlPlane":{"status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/gitea-control-plane-contract.json","adapter":"ops/runner-factory/gitea-control-plane.mjs","runtimeDriver":"NOT_CONFIGURED","operations":3,"stateTransitions":10,"invariants":16,"fixtures":34,"allowedTransitions":8,"deniedTransitions":26,"modeledCalls":6,"internalRegistrationCompensations":3,"maxJobs":1,"registrationOrder":"AFTER_CLOUD_BOUNDARY_CLOSE_AND_REBOOT","assignmentProof":"GITEA_JOB_PLUS_ROOT_AGENT_SEAL","credentialBoundary":"NO_REUSABLE_FILE_PLUS_ROOT_MEMORY_EXACT_JOB_LEASE","deleteTerminalStatuses":[204,404],"configured":false,"readinessGateSatisfied":false,"controlCredentialConfigured":false,"workerAgentInstalled":false,"liveRunners":0,"runtimeAssignments":0,"giteaReadsExecuted":0,"giteaWritesExecuted":0,"registrationSecretsRecorded":0,"runnerCredentialsRecorded":0,"secretExposureCount":0,"paidResourcesCreated":false,"deploymentPermitted":false},"capacityController":{"status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/capacity-controller-contract.json","adapter":"ops/runner-factory/capacity-controller.mjs","runtimeDriver":"NOT_CONFIGURED","operations":4,"stateTransitions":9,"invariants":16,"fixtures":30,"allowedTransitions":8,"deniedTransitions":22,"driverCallsModeled":5,"desiredSlots":2,"slotsPerAdmission":1,"maxJobsPerWorker":1,"capacityMeaning":"CONCURRENT_EPHEMERAL_WORKER_BUDGET_NOT_WARM_INSTANCES","failureMode":"WHOLE_POOL_FREEZE","configured":false,"readinessGateSatisfied":false,"durableCapacityLedgerCreated":false,"receiptVerifierConfigured":false,"livePools":0,"liveSlots":0,"liveAcquisitions":0,"runtimeReplacements":0,"runtimeFreezes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"leaseValuesRecorded":0,"secretExposureCount":0,"paidResourcesCreated":false,"deploymentPermitted":false},"auditSink":{"status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/audit-sink-contract.json","adapter":"ops/runner-factory/audit-sink.mjs","runtimeDriver":"NOT_CONFIGURED","operations":5,"stateTransitions":10,"invariants":18,"fixtures":36,"allowedTransitions":10,"deniedTransitions":26,"driverCallsModeled":5,"partition":"ONE_JOURNAL_PER_PLAN_AND_JOB_ATTEMPT","entryModel":"DUAL_HASH_CHAIN_SIGNED_RECEIPTS_PLUS_TERMINAL_FAILURE","successSeal":"EXACT_F9_REPLACEMENT_RECEIPT","mutationPolicy":"CREATE_AND_CONDITIONAL_APPEND_ONLY_NO_UPDATE_OR_DELETE","configured":false,"readinessGateSatisfied":false,"durableJournalCreated":false,"iamRoleConfigured":false,"liveJournals":0,"runtimeEntries":0,"runtimeSuccessSeals":0,"runtimeFailureSeals":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"reconciliationPlanner":{"status":"PLANNER_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/reconciliation-planner-contract.json","planner":"ops/runner-factory/reconciliation-planner.mjs","runtimeSourceReader":"NOT_CONFIGURED","operations":4,"sourceReads":5,"stateTransitions":12,"invariants":18,"metricSeries":8,"fixtures":32,"safeOutcomes":7,"containedOutcomes":24,"deniedInputs":1,"freezePlans":23,"pagePlans":24,"mutationPolicy":"PLAN_ONLY_NO_EXTERNAL_ACTION","configuredRuntimeSources":0,"schedulerIntegrated":false,"metricsExporterConfigured":false,"pagingProviderConfigured":false,"readinessGateSatisfied":false,"liveReports":0,"runtimeContainments":0,"pagesSent":0,"mutationsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"snapshotCoordinator":{"status":"COORDINATOR_IMPLEMENTED_NOT_CONFIGURED","contract":"ops/runner-factory/reconciliation-snapshot-coordinator-contract.json","coordinator":"ops/runner-factory/reconciliation-snapshot-coordinator.mjs","operations":3,"sourceReaders":5,"captureStates":6,"invariants":18,"fixtures":30,"completeCaptures":3,"partialCaptures":7,"allUnavailableCaptures":1,"deniedInputs":19,"sourceReadAttempts":55,"unavailableSourceResults":16,"plannerIntegrationCases":11,"consistency":"STRONGLY_CONSISTENT","timeoutMs":2000,"maxCaptureSkewMs":2000,"partialReadPolicy":"NORMALIZE_UNKNOWN_AND_CONTAIN","configuredSourceReaders":0,"runtimeIdentityConfigured":false,"runtimeCaptures":0,"runtimeSourceReads":0,"liveSnapshots":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"readinessGateSatisfied":false,"deploymentPermitted":false},"target":{"poolSize":2,"maxJobsPerWorker":1,"executionMode":"rootless-dind-container","ephemeralRegistration":true,"persistentRunnerDataVolume":false,"hostDockerSocketMounted":false,"productionRoute":false,"replaceWorkerAfterJob":true,"trustedReceiptIssuer":"factory-control-plane"},"workerTemplate":{"status":"PLAN_ONLY_NOT_APPLIED","path":"ops/runner-factory/worker-launch-template.json","provider":"aws-ec2","region":"ap-southeast-2","architecture":"linux-amd64","instanceType":"c7i-flex.large","cloudResourcesCreated":0,"rootVolume":"encrypted-gp3-delete-on-termination","network":"private-ci-only-no-production-route","credentialBoundary":"root-owned-tmpfs-vs-reits-job","jobRuntime":"rootless-dind-container","hostMounts":0,"applySupported":false,"costApprovalRequired":true,"runtimeApprovalRequired":true},"compensations":[{"id":"RC-01","phase":"INGRESS","failure":"signature-or-payload-denied","action":"return-denial-without-reservation","safeState":"NO_RESOURCE","runtime":"NOT_OBSERVED"},{"id":"RC-02","phase":"RESERVATION","failure":"duplicate-or-conditional-write-conflict","action":"return-existing-plan-reference","safeState":"NO_SECOND_WORKER","runtime":"NOT_OBSERVED"},{"id":"RC-03","phase":"LAUNCH","failure":"instance-launch-failed-or-ambiguous","action":"freeze-whole-pool-and-reconcile-idempotent-launch","safeState":"NO_NEW_SCHEDULING_ON_AMBIGUITY","runtime":"NOT_OBSERVED"},{"id":"RC-04","phase":"REGISTRATION","failure":"ephemeral-registration-failed","action":"revoke-secret-and-terminate-worker","safeState":"NO_LIVE_REGISTRATION_SECRET","runtime":"NOT_OBSERVED"},{"id":"RC-05","phase":"BOUNDARY","failure":"profile-detach-imds-disable-or-reboot-failed","action":"keep-runner-offline-and-terminate-worker","safeState":"NO_JOB_WITH_CLOUD_CREDENTIAL","runtime":"NOT_OBSERVED"},{"id":"RC-06","phase":"ASSIGNMENT","failure":"wrong-job-or-second-assignment","action":"revoke-runner-and-terminate-worker","safeState":"ONE_JOB_MAXIMUM","runtime":"NOT_OBSERVED"},{"id":"RC-07","phase":"EXECUTION","failure":"job-timeout-or-runner-loss","action":"terminate-worker-and-record-terminal-failure","safeState":"NO_REUSED_WORKER","runtime":"NOT_OBSERVED"},{"id":"RC-08","phase":"RETIREMENT","failure":"termination-or-replacement-receipt-missing","action":"freeze-whole-pool-and-page-operator","safeState":"POOL_FAILS_CLOSED","runtime":"NOT_OBSERVED"}],"stages":[{"id":"F0","state":"QUEUE_CAPACITY_ACQUIRED","label":"Queue + capacity admitted","actor":"factory-control-plane","trust":"CONTROL","receipt":"queue-capacity-admission","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":false,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":false,"jobsCompleted":0,"replacementReceipt":false}},{"id":"F1","state":"WORKER_BOOTSTRAP","label":"Worker bootstrap","actor":"root-bootstrap","trust":"BOOTSTRAP","receipt":"instance-attestation","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":false,"cloudCredentials":true,"imdsEnabled":true,"workerAlive":true,"jobsCompleted":0,"replacementReceipt":false}},{"id":"F2","state":"CLOUD_BOUNDARY_CLOSED","label":"Cloud boundary closed","actor":"factory-control-plane","trust":"CONTROL","receipt":"profile-detached-imds-disabled-rebooted","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":false,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":true,"jobsCompleted":0,"replacementReceipt":false}},{"id":"F3","state":"EPHEMERAL_REGISTERED","label":"Ephemeral registered","actor":"gitea-runner","trust":"CONTROL","receipt":"ephemeral-registration","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":true,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":true,"jobsCompleted":0,"replacementReceipt":false}},{"id":"F4","state":"READY_FOR_ONE_JOB","label":"One-job ready","actor":"admission-controller","trust":"CONTROL","receipt":"worker-admission","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":true,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":true,"jobsCompleted":0,"replacementReceipt":false}},{"id":"F5","state":"ASSIGNED_REUSABLE_CREDENTIAL_SEALED","label":"Reusable credential sealed","actor":"gitea-control-plane","trust":"CONTROL","receipt":"assignment-credential-seal","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":false,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":true,"jobsCompleted":0,"replacementReceipt":false}},{"id":"F6","state":"JOB_CONTAINER_RUNNING","label":"Untrusted job","actor":"rootless-dind","trust":"UNTRUSTED","receipt":"job-start","facts":{"untrustedCode":true,"registrationSecret":false,"reusableRunnerCredentialLive":false,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":true,"jobsCompleted":0,"replacementReceipt":false}},{"id":"F7","state":"JOB_FINISHED","label":"Job finished","actor":"gitea-runner","trust":"UNTRUSTED","receipt":"job-result-untrusted-cleanup","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":false,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":true,"jobsCompleted":1,"replacementReceipt":false}},{"id":"F8","state":"WORKER_RETIRED","label":"Worker retired","actor":"factory-control-plane","trust":"CONTROL","receipt":"instance-termination","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":false,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":false,"jobsCompleted":1,"replacementReceipt":false}},{"id":"F9","state":"REPLACEMENT_CONFIRMED","label":"Pool replaced","actor":"factory-control-plane","trust":"CONTROL","receipt":"replacement-capacity","facts":{"untrustedCode":false,"registrationSecret":false,"reusableRunnerCredentialLive":false,"cloudCredentials":false,"imdsEnabled":false,"workerAlive":false,"jobsCompleted":1,"replacementReceipt":true}}],"invariants":[{"code":"RF_ONE_JOB","label":"Worker handles at most one job","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_SEAL_BEFORE_CODE","label":"Reusable runner credential is removed before untrusted code; exact-job lease remains root-only","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_NO_JOB_CLOUD","label":"Job runs without instance profile or IMDS","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_NO_REGISTRATION_SECRET","label":"Registration secret is destroyed before admission","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_ROOTLESS_DIND","label":"Job runs in rootless DinD, never host mode","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_NO_HOST_SOCKET","label":"Host Docker socket is never mounted","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_NO_PERSISTENT_DATA","label":"Runner credential volume is not persisted","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_NO_PRODUCTION_ROUTE","label":"Worker has no production network route","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_REPLACE_AFTER_JOB","label":"Whole worker is retired and replaced","contract":"PASS","runtime":"NOT_OBSERVED"},{"code":"RF_CONTROL_PLANE_RECEIPT","label":"Retirement receipt is issued outside the job boundary","contract":"PASS","runtime":"NOT_OBSERVED"}],"fixtures":[{"id":"RF-A01","phase":"F6","mutation":{"field":"reusableRunnerCredentialLive","value":true},"expected":"DENY","violation":"RF_SEAL_BEFORE_CODE"},{"id":"RF-A02","phase":"F6","mutation":{"field":"cloudCredentials","value":true},"expected":"DENY","violation":"RF_NO_JOB_CLOUD"},{"id":"RF-A03","phase":"F6","mutation":{"field":"registrationSecret","value":true},"expected":"DENY","violation":"RF_NO_REGISTRATION_SECRET"},{"id":"RF-A04","phase":"F6","mutation":{"field":"executionMode","value":"host"},"expected":"DENY","violation":"RF_ROOTLESS_DIND"},{"id":"RF-A05","phase":"F6","mutation":{"field":"hostDockerSocketMounted","value":true},"expected":"DENY","violation":"RF_NO_HOST_SOCKET"},{"id":"RF-A06","phase":"F6","mutation":{"field":"persistentRunnerDataVolume","value":true},"expected":"DENY","violation":"RF_NO_PERSISTENT_DATA"},{"id":"RF-A07","phase":"F6","mutation":{"field":"productionRoute","value":true},"expected":"DENY","violation":"RF_NO_PRODUCTION_ROUTE"},{"id":"RF-A08","phase":"F7","mutation":{"field":"jobsCompleted","value":2},"expected":"DENY","violation":"RF_ONE_JOB"},{"id":"RF-A09","phase":"F9","mutation":{"field":"replacementReceipt","value":false},"expected":"DENY","violation":"RF_REPLACE_AFTER_JOB"},{"id":"RF-A10","phase":"F0","mutation":{"field":"replayAccepted","value":true},"expected":"DENY","violation":"RF_WEBHOOK_REPLAY"},{"id":"RF-A11","phase":"F4","mutation":{"field":"untrustedCode","value":true},"expected":"DENY","violation":"RF_SEAL_BEFORE_CODE"},{"id":"RF-A12","phase":"F7","mutation":{"field":"cleanupWithoutRetirementAccepted","value":true},"expected":"DENY","violation":"RF_CONTROL_PLANE_RECEIPT"}],"acceptance":{"status":"BLOCKED_RUNTIME","requiredRuntimeReceipts":["queue-capacity-admission","instance-attestation","profile-detached-imds-disabled-rebooted","ephemeral-registration","assignment-credential-seal","job-result","instance-termination","replacement-capacity"],"requiredDrills":["credential replay denied","second job denied","IMDS denied","production route denied","host socket denied","worker replacement observed"]}},"runnerAudit":{"registered":3,"online":1,"eligible":0,"organizationOnline":0,"activeCandidates":2,"pendingStatuses":2,"successfulStatuses":1,"failedStatuses":1,"reusableAwsInstances":0},"pipeline":[{"id":"01","label":"Source","detail":"exact 40-char revision","gate":"dirty=false"},{"id":"02","label":"Build","detail":"isolated builder","gate":"no production trust"},{"id":"03","label":"Package","detail":"full artifact + SBOM","gate":"sha256 bound"},{"id":"04","label":"Configure","detail":"public config + migration","gate":"SecretRef only"},{"id":"05","label":"Promote","detail":"immutable target","gate":"runtime identity"},{"id":"06","label":"Recover","detail":"named previous release","gate":"rollback verified"}],"evidenceFields":[["SOURCE","source.revision","Git 真值，不接受短 SHA"],["ARTIFACT","artifact.digest","完整目录、二进制或 OCI image"],["SBOM","sbom.digest","CycloneDX JSON 与 artifact 同次构建"],["CONFIG","configuration.digest","仅公开配置和引用名"],["MIGRATION","migration.digest","数据库/存储变更集合"],["SECRETS","secrets.refs[]","只记录 SecretRef，绝不记录值"],["DEPLOY","deployment.target","环境、目标与观测时间"],["ROLLBACK","rollback.targetReleaseId","晋级前存在且已验证"],["PROVENANCE","provenance.builderId","独立 builder 与签名状态"]],"failureRules":[{"code":"RU_SOURCE_UNBOUND","meaning":"部署无法回指一个干净的 40 位 source revision。","owner":"repository owner"},{"code":"RU_ARTIFACT_PARTIAL","meaning":"只摘要入口文件，不能证明完整运行制品未漂移。","owner":"build owner"},{"code":"RU_SBOM_MISSING","meaning":"依赖物料表未与该制品摘要绑定。","owner":"supply chain"},{"code":"RU_CONFIG_UNBOUND","meaning":"公开配置、迁移集或 SecretRef 未形成独立摘要。","owner":"service owner"},{"code":"RU_RUNTIME_IDENTITY","meaning":"运行态 health/meta 不返回同一份安全发布身份。","owner":"runtime owner"},{"code":"RU_ROLLBACK_UNVERIFIED","meaning":"没有命名并验证可恢复的前一发布单元。","owner":"release owner"}],"discovery":{"workbench":"/release-foundation","releaseUnitSchema":"/schemas/release-unit.v1.schema.json","runnerCapacitySchema":"/schemas/runner-capacity.v1.schema.json","runnerCapacity":"/api/runner-capacity","runnerCapacityEvidenceSchema":"/schemas/runner-capacity-evidence.v1.schema.json","runnerCapacityEvidence":"/api/runner-capacity/evidence","runnerControllerReadinessEvidenceSchema":"/schemas/runner-controller-readiness-evidence.v1.schema.json","runnerControllerReadinessEvidence":"/api/runner-controller/readiness-evidence","runnerControllerActivationEvidenceSchema":"/schemas/runner-controller-activation-evidence.v1.schema.json","runnerControllerActivationEvidence":"/api/runner-controller/activation-evidence","runnerControllerInstallationEvidenceSchema":"/schemas/runner-controller-installation-evidence.v1.schema.json","runnerControllerInstallationEvidence":"/api/runner-controller/installation-evidence","runnerAuditSchema":"/schemas/runner-live-audit.v1.schema.json","runnerAudit":"/api/runner-audit","runnerFactorySchema":"/schemas/runner-factory.v1.schema.json","runnerFactory":"/api/runner-factory","runnerFactoryControllerSchema":"/schemas/runner-factory-controller.v1.schema.json","runnerFactoryController":"/api/runner-factory/controller","runnerFactoryWorkerProviderSchema":"/schemas/runner-factory-worker-provider.v1.schema.json","runnerFactoryWorkerProvider":"/api/runner-factory/worker-provider","runnerFactoryGiteaControlPlaneSchema":"/schemas/runner-factory-gitea-control-plane.v1.schema.json","runnerFactoryGiteaControlPlane":"/api/runner-factory/gitea-control-plane","runnerFactoryCapacityControllerSchema":"/schemas/runner-factory-capacity-controller.v1.schema.json","runnerFactoryCapacityController":"/api/runner-factory/capacity-controller","runnerFactoryAuditSinkSchema":"/schemas/runner-factory-audit-sink.v1.schema.json","runnerFactoryAuditSink":"/api/runner-factory/audit-sink","runnerFactoryReconciliationSchema":"/schemas/runner-factory-reconciliation-planner.v1.schema.json","runnerFactoryReconciliation":"/api/runner-factory/reconciliation","runnerFactorySnapshotCoordinatorSchema":"/schemas/runner-factory-reconciliation-snapshot-coordinator.v1.schema.json","runnerFactorySnapshotCoordinator":"/api/runner-factory/reconciliation/snapshot-coordinator","runnerFactoryRuntimeAssemblySchema":"/schemas/runner-factory-controller-runtime-assembly.v1.schema.json","runnerFactoryRuntimeAssembly":"/api/runner-factory/controller/runtime-assembly","runnerFactoryRuntimeConfigurationSchema":"/schemas/runner-factory-controller-runtime-configuration.v1.schema.json","runnerFactoryRuntimeConfiguration":"/api/runner-factory/controller/runtime-configuration","runnerFactoryBootstrapCompositionSchema":"/schemas/runner-factory-controller-bootstrap-composition.v1.schema.json","runnerFactoryBootstrapComposition":"/api/runner-factory/controller/bootstrap-composition","runnerFactoryServiceRuntimeBootstrapSchema":"/schemas/runner-factory-controller-service-runtime-bootstrap.v1.schema.json","runnerFactoryServiceRuntimeBootstrap":"/api/runner-factory/controller/service-runtime-bootstrap","runnerFactoryProductionEvidenceAdmissionSchema":"/schemas/runner-factory-controller-production-evidence-admission.v1.schema.json","runnerFactoryProductionEvidenceAdmission":"/api/runner-factory/controller/production-evidence-admission","runnerFactoryListenerAuthorizationSchema":"/schemas/runner-factory-controller-listener-authorization.v1.schema.json","runnerFactoryListenerAuthorization":"/api/runner-factory/controller/listener-authorization","runnerFactoryActivationExecutorSchema":"/schemas/runner-factory-controller-activation-executor.v1.schema.json","runnerFactoryActivationExecutor":"/api/runner-factory/controller/activation-executor","runnerFactoryActivationTransactionSchema":"/schemas/runner-factory-controller-activation-transaction-executor.v1.schema.json","runnerFactoryActivationTransaction":"/api/runner-factory/controller/activation-transaction","runtimeIdentity":"/api/release-unit"}}