{"schemaVersion":"developer.reits.tech/runner-live-audit/v1","status":"DENIED_NO_ELIGIBLE_CAPACITY","observedAt":"2026-07-21T07:56:54Z","sources":{"gitea":{"apiBase":"https://gitea.reits.tech/api/v1","observedAt":"2026-07-21T07:55:13.309Z","adminRunners":3,"organizationRunners":0,"repositoriesScanned":21,"credentialBoundary":"local Git credential helper; values not recorded","secretValuesRecorded":false},"aws":{"observedAt":"2026-07-20T11:40:44Z","freshness":"STALE_NOT_REOBSERVED_AWS_CLI_UNAVAILABLE","account":"668891722825","principal":"arn:aws:iam::668891722825:user/cc","region":"ap-southeast-2","runningInstances":1,"autoScalingGroups":0,"cloudFormationInventory":"BLOCKED_IAM","productionInstance":{"id":"i-09a6dae0352cff5af","name":"CC","type":"c8i-flex.xlarge","publicIp":"54.206.197.2","runnerEligible":false,"reason":"Shared production failure domain for Gitea, business services, IM, databases and logs."}}},"summary":{"registered":3,"online":1,"eligible":0,"organizationOnline":0,"activeCandidates":2,"pendingStatuses":2,"successfulStatuses":1,"failedStatuses":1,"reusableAwsInstances":0},"runners":[{"id":2,"name":"reits-im-core-linux-arm64","platform":"linux","architecture":"arm64-name-declared","status":"online","busy":false,"ephemeral":false,"scope":"repository","scopeEvidence":"Visible only from reits/im-core after scanning all 21 reits repositories; absent from the reits organization inventory.","repository":"reits/im-core","labels":["ubuntu-latest","ubuntu-24.04","ubuntu-22.04"],"admission":"DENIED","criteria":[{"id":"online","label":"Runner online","status":"PASS","evidence":"Gitea admin API reports online and idle."},{"id":"scope","label":"Organization scope","status":"FAIL","evidence":"Repository-scoped to reits/im-core."},{"id":"ephemeral","label":"Ephemeral workspace","status":"FAIL","evidence":"Gitea reports ephemeral=false."},{"id":"isolation","label":"Dedicated compute attestation","status":"MISSING","evidence":"No reviewed host or network attestation is bound."},{"id":"architecture","label":"Reviewed architecture","status":"FAIL","evidence":"Runner name declares arm64; reviewed D05 Linux template is x86_64."}]},{"id":14,"name":"matrix-quant-macos-Kobes-MacBook-Pro","platform":"macos","architecture":"unreported","status":"offline","busy":false,"ephemeral":false,"scope":"repository","scopeEvidence":"Visible only from reits/matrix-quant-im-ios after scanning all 21 reits repositories; absent from the reits organization inventory.","repository":"reits/matrix-quant-im-ios","labels":["macos-latest","ubuntu-latest"],"admission":"DENIED","criteria":[{"id":"online","label":"Runner online","status":"FAIL","evidence":"Gitea admin API reports offline."},{"id":"scope","label":"Organization scope","status":"FAIL","evidence":"Repository-scoped to reits/matrix-quant-im-ios."},{"id":"ephemeral","label":"Ephemeral workspace","status":"FAIL","evidence":"Gitea reports ephemeral=false."},{"id":"isolation","label":"Dedicated compute attestation","status":"MISSING","evidence":"No reviewed host, launchd identity or network attestation is bound."},{"id":"labels","label":"Platform-safe labels","status":"FAIL","evidence":"macOS and Ubuntu labels collide on the same offline runner."}]},{"id":1,"name":"pp-mac-ios-runner","platform":"macos","architecture":"unreported","status":"offline","busy":false,"ephemeral":false,"scope":"instance","scopeEvidence":"Present in the admin inventory, absent from the reits organization inventory and every one of its 21 repository inventories.","repository":null,"labels":["macos-latest","self-hosted","macOS","ubuntu-latest","ubuntu-24.04","ubuntu-22.04"],"admission":"DENIED","criteria":[{"id":"online","label":"Runner online","status":"FAIL","evidence":"Gitea admin API reports offline."},{"id":"scope","label":"Organization scope","status":"FAIL","evidence":"Instance runner is not registered to reits organization scope."},{"id":"ephemeral","label":"Ephemeral workspace","status":"FAIL","evidence":"Gitea reports ephemeral=false."},{"id":"isolation","label":"Dedicated compute attestation","status":"MISSING","evidence":"No reviewed host or network attestation is bound."},{"id":"labels","label":"Platform-safe labels","status":"FAIL","evidence":"macOS and Ubuntu labels collide on the same offline runner."}]}],"candidateQueues":[{"repository":"reits/data-sources","pullRequest":1,"head":"fd9b873244d68abeab142318692393d85d5be68f","decision":"WAITING_RUNNER","contexts":[{"name":"REITS Minimum CI / gate (pull_request)","role":"REQUIRED","status":"PENDING","description":"Waiting to run"},{"name":"REITS Minimum CI / minimum (pull_request)","role":"DEPENDENT","status":"PENDING","description":"Blocked by required conditions"}]},{"repository":"reits/reits-auth","pullRequest":6,"head":"b697a726c1b9f92813293ef49c65924b0b035597","decision":"CHECKS_FAILED","contexts":[{"name":"reits-auth security CI / verify (pull_request)","role":"REQUIRED","status":"SUCCESS","description":"Successful in 51s"},{"name":"REITS Minimum CI / gate (pull_request)","role":"REQUIRED","status":"FAILURE","description":"Failing after 5s"}]}],"admissionPolicy":["Runner must be online at reits organization scope.","Runner must be ephemeral with concurrency one and a destroyed workspace after every job.","Runner platform and architecture must match its labels and the reviewed toolchain.","A dedicated-compute, no-production-route and no-cloud-credential attestation must be bound.","No production host, Docker socket, reusable registration secret or broad private route may be present."],"decision":{"requiresCostApproval":true,"nextAction":"Provision the reviewed two-node organization runner stack after explicit cost approval, then rotate the registration token and execute the isolation drill.","forbiddenAction":"Do not expand the im-core runner scope or schedule CI on the shared production EC2."},"discovery":{"workbench":"/release-foundation","schema":"/schemas/runner-live-audit.v1.schema.json","capacity":"/api/runner-capacity","capacityEvidence":"/api/runner-capacity/evidence","controllerReadinessEvidence":"/api/runner-controller/readiness-evidence","factory":"/api/runner-factory","releaseUnits":"/api/release-units"}}