{"schemaVersion":"developer.reits.tech/runner-controller-installation-evidence/v1","status":"G07_G08_DENIED_NO_HARDENED_INSTALLATION_OR_LIVE_RUNTIME_PROOFS","observedAt":"2026-07-21T09:25:19Z","observationMode":"READ_ONLY_INSTALLATION_ENDPOINT_AND_WEBHOOK_AUDIT_NO_SERVICE_CHANGE","program":{"acceptedKnives":4,"totalKnives":36,"currentKnife":"D05","closeoutCut":5,"remainingIncludingCurrent":32,"remainingAfterAcceptance":31,"d05Accepted":false},"gateSummary":{"targetedGates":2,"satisfiedGates":0,"positiveAcceptanceReceipts":0,"missingInstallationReceipts":8,"missingLiveProofs":8,"decision":"DENY_AND_ESCALATE_TO_PLATFORM_SRE_AND_QA"},"gates":[{"id":"D05-G07","name":"HARDENED_CONTROLLER_INSTALLATION","owner":"PLATFORM_SRE","target":"non-login identity, root-owned unit, exact digest, filesystem ownership, credential references, hardening profile, loopback-only network policy and signed installation receipt","observed":"service user, group, unit, installation root, runtime directories, manifest, process and listener are absent","positiveReceiptsObserved":0,"decision":"DENIED_HARDENED_INSTALLATION_ABSENT"},{"id":"D05-G08","name":"LIVE_HEALTH_READINESS_NEGATIVE_WEBHOOK","owner":"QA","target":"live health and readiness receipts plus unsigned, invalid-signature, stale, replay, wrong-scope and unready webhook denial receipts","observed":"health, readiness and six webhook probe attempts all returned HTTP 000 because the Controller listener is absent; connection refusal is not application-level denial proof","positiveReceiptsObserved":0,"decision":"DENIED_LIVE_RUNTIME_PROOFS_UNAVAILABLE"}],"host":{"environment":"production EC2 / ap-southeast-2","portalReleaseAtAudit":"developer-portal@7df4c8f73386-eaad97e745fd","portalSourceAtAudit":"7df4c8f733866b7ba18ccbb3b4ef69e35c10d2af","checks":[{"id":"INS-01","label":"service user","target":"reits-runner-factory / non-login","observed":"ABSENT","status":"MISSING"},{"id":"INS-02","label":"service group","target":"reits-runner-factory","observed":"ABSENT","status":"MISSING"},{"id":"INS-03","label":"root-owned systemd unit","target":"/etc/systemd/system/reits-runner-factory-controller.service","observed":"ABSENT","status":"MISSING"},{"id":"INS-04","label":"runtime manifest","target":"/etc/reits-runner-factory/controller-runtime.json","observed":"ABSENT","status":"MISSING"},{"id":"INS-05","label":"installation root","target":"/opt/reits-runner-factory or /usr/local/lib/reits-runner-factory","observed":"ABSENT","status":"MISSING"},{"id":"INS-06","label":"state and runtime directories","target":"/var/lib/reits-runner-factory and /run/reits-runner-factory","observed":"ABSENT / ABSENT","status":"MISSING"},{"id":"INS-07","label":"unit and process","target":"loaded / active / enabled / dedicated process","observed":"not-found / inactive / disabled / 0","status":"SAFE_ABSENT"},{"id":"INS-08","label":"listener and proxy","target":"127.0.0.1:8110 / no nginx route","observed":"0 / 0","status":"SAFE_CLOSED"}]},"installation":{"sourceTemplate":"ops/runner-factory/reits-runner-factory-controller.service","targetUnit":"/etc/systemd/system/reits-runner-factory-controller.service","serviceIdentity":"reits-runner-factory:reits-runner-factory","workingDirectory":"/opt/reits-runner-factory/current","endpoint":"127.0.0.1:8110","sourceStatus":"IMPLEMENTED_PACKAGE_TEST_ONLY","productionStatus":"NOT_INSTALLED","hardening":[{"id":"dedicated-identity","requirement":"dedicated non-login identity","directives":["User=reits-runner-factory","Group=reits-runner-factory"],"sourceStatus":"IMPLEMENTED","productionStatus":"MISSING"},{"id":"shared-host-deny","requirement":"shared production host condition deny","directives":["ConditionPathExists=!/etc/reits-production-host"],"sourceStatus":"IMPLEMENTED","productionStatus":"MISSING"},{"id":"credential-reference","requirement":"credential file reference","directives":["LoadCredential=webhook:/etc/reits-runner-factory/secrets/gitea-webhook"],"sourceStatus":"IMPLEMENTED","productionStatus":"MISSING"},{"id":"no-new-privileges","requirement":"no new privileges","directives":["NoNewPrivileges=true"],"sourceStatus":"IMPLEMENTED","productionStatus":"MISSING"},{"id":"filesystem-protection","requirement":"strict filesystem protection","directives":["ProtectSystem=strict","ProtectHome=true","PrivateTmp=true","PrivateDevices=true"],"sourceStatus":"IMPLEMENTED","productionStatus":"MISSING"},{"id":"empty-capabilities","requirement":"empty capabilities","directives":["CapabilityBoundingSet=","AmbientCapabilities="],"sourceStatus":"IMPLEMENTED","productionStatus":"MISSING"},{"id":"loopback-policy","requirement":"loopback-only IP policy","directives":["IPAddressDeny=any","IPAddressAllow=localhost"],"sourceStatus":"IMPLEMENTED","productionStatus":"MISSING"},{"id":"process-umask","requirement":"0077 process umask","directives":["UMask=0077"],"sourceStatus":"IMPLEMENTED","productionStatus":"MISSING"}],"receiptRequirements":[{"id":"identity","proof":"signed non-login UID/GID, shell, home and dedicated-host binding","status":"MISSING"},{"id":"unit-metadata","proof":"root:root ownership, 0644 mode, one hard link and stable descriptor metadata","status":"MISSING"},{"id":"unit-digest","proof":"reviewed unit digest bound to exact release, host and configuration","status":"MISSING"},{"id":"sandbox","proof":"systemd-analyze security and runtime sandbox receipt for all reviewed directives","status":"MISSING"},{"id":"filesystem","proof":"root-owned installation with least-write state and runtime directory permissions","status":"MISSING"},{"id":"credentials","proof":"root-owned SecretRef resolution with zero inline or logged credential values","status":"MISSING"},{"id":"network","proof":"loopback-only bind, zero public route and zero reverse proxy receipt","status":"MISSING"},{"id":"installation","proof":"signed stopped-state installation receipt before any service start","status":"MISSING"}]},"liveValidation":{"listener":"127.0.0.1:8110","listenerObserved":0,"probeAttempts":8,"applicationResponsesObserved":0,"proofsSatisfied":0,"connectionRefusalCountsAsDenialProof":false,"probes":[{"id":"LIVE-01","category":"LIVENESS","method":"GET","path":"/healthz","expected":"HTTP 200 with process liveness and exact runtime identity","observedHttp":"000","observed":"CONNECTION_REFUSED_LISTENER_ABSENT","proofStatus":"UNAVAILABLE_NOT_PASSED"},{"id":"LIVE-02","category":"READINESS","method":"GET","path":"/readyz","expected":"HTTP 200 READY with 11/11 receipt-backed Gates","observedHttp":"000","observed":"CONNECTION_REFUSED_LISTENER_ABSENT","proofStatus":"UNAVAILABLE_NOT_PASSED"},{"id":"LIVE-03","category":"UNSIGNED_WEBHOOK","method":"POST","path":"/webhooks/gitea","expected":"signed application-level rejection for missing HMAC","observedHttp":"000","observed":"NOT_EXECUTABLE_LISTENER_ABSENT","proofStatus":"UNAVAILABLE_NOT_PASSED"},{"id":"LIVE-04","category":"INVALID_SIGNATURE","method":"POST","path":"/webhooks/gitea","expected":"signed application-level rejection for invalid HMAC","observedHttp":"000","observed":"NOT_EXECUTABLE_LISTENER_ABSENT","proofStatus":"UNAVAILABLE_NOT_PASSED"},{"id":"LIVE-05","category":"STALE_DELIVERY","method":"POST","path":"/webhooks/gitea","expected":"signed application-level stale-delivery rejection","observedHttp":"000","observed":"NOT_EXECUTABLE_LISTENER_ABSENT","proofStatus":"UNAVAILABLE_NOT_PASSED"},{"id":"LIVE-06","category":"REPLAY","method":"POST","path":"/webhooks/gitea","expected":"HTTP 409 replay rejection bound to prior accepted delivery identity","observedHttp":"000","observed":"NOT_EXECUTABLE_LISTENER_ABSENT","proofStatus":"UNAVAILABLE_NOT_PASSED"},{"id":"LIVE-07","category":"WRONG_SCOPE","method":"POST","path":"/webhooks/gitea","expected":"HTTP 403 rejection for unregistered repository scope","observedHttp":"000","observed":"NOT_EXECUTABLE_LISTENER_ABSENT","proofStatus":"UNAVAILABLE_NOT_PASSED"},{"id":"LIVE-08","category":"UNREADY","method":"POST","path":"/webhooks/gitea","expected":"HTTP 503 RF_CONTROLLER_NOT_READY with zero accepted requests and writes","observedHttp":"000","observed":"NOT_EXECUTABLE_LISTENER_ABSENT","proofStatus":"UNAVAILABLE_NOT_PASSED"}]},"verificationPacks":[{"id":"controller-service-package","status":"PASS_PACKAGE_TEST_ONLY","fixtures":20,"accepted":1,"denied":19,"productionEffects":0},{"id":"service-runtime-bootstrap","status":"PASS_FIXTURE_ONLY","fixtures":40,"accepted":7,"denied":33,"productionEffects":0},{"id":"activation-transaction","status":"PASS_FIXTURE_ONLY","fixtures":72,"accepted":18,"denied":54,"productionEffects":0},{"id":"target-host-driver-qualification","status":"PASS_FIXTURE_ONLY","fixtures":64,"accepted":8,"denied":56,"productionEffects":0}],"operatorPlan":{"nextAction":"Platform SRE must first obtain G03-G07 prerequisites on an approved dedicated non-production control-plane host and retain a signed stopped-state installation receipt. QA may run health, readiness and negative webhook probes only after an independently authorized loopback start, with immediate rollback and zero public route.","forbiddenActions":["Do not count source unit directives, fixture-only service tests or target-host qualification dossiers as a production installation receipt.","Do not count HTTP 000 or connection refusal as proof that unsigned, invalid, stale, replayed, wrong-scope or unready webhooks were rejected by application logic.","Do not install or start the Controller on the current shared production Portal host without the dedicated-host and earlier Gate receipts.","Do not create an nginx route, public bind, inline credential, generic shell executor or privileged service identity for port 8110.","Do not run live webhook tests before a signed rollback guard, maintenance window, listener authorization and exact release scope exist."]},"safetyTruth":{"readOnlyAuditPerformed":true,"loopbackProbeAttempts":8,"credentialsRecorded":false,"configurationWrites":0,"serviceInstallations":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"applicationResponsesObserved":0,"negativeWebhookProofsIssued":0,"reverseProxyChanges":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"g07Satisfied":false,"g08Satisfied":false,"d05Accepted":false},"verification":{"status":"PASS_READ_ONLY_INSTALLATION_AND_LIVE_PROBE_OBSERVATION","targetedGates":2,"satisfiedGates":0,"hostChecks":8,"hardeningControls":8,"installationReceiptsObserved":0,"liveProbeAttempts":8,"applicationResponsesObserved":0,"liveProofsSatisfied":0,"fixtureCases":196,"positiveAcceptanceReceipts":0,"systemdUnitsInstalled":0,"listenerStarts":0,"reverseProxyRoutes":0,"externalWritesExecuted":0},"discovery":{"workbench":"/release-foundation#runner-controller-installation-evidence","schema":"/schemas/runner-controller-installation-evidence.v1.schema.json","servicePackage":"/api/runner-factory/controller","serviceRuntime":"/api/runner-factory/controller/service-runtime-bootstrap","listenerAuthorization":"/api/runner-factory/controller/listener-authorization","activationTransaction":"/api/runner-factory/controller/activation-transaction","d05Closure":"/api/runner-factory/controller/d05-acceptance-closure"}}