{"schemaVersion":"developer.reits.tech/runner-controller-readiness-evidence/v1","status":"G03_G04_DENIED_NO_PRODUCTION_CONFIGURATION_OR_FACTORIES","observedAt":"2026-07-21T08:48:05Z","observationMode":"READ_ONLY_HOST_AND_SOURCE_AUDIT_NO_INSTALL_NO_CONFIGURATION","program":{"acceptedKnives":4,"totalKnives":36,"currentKnife":"D05","closeoutCut":3,"remainingIncludingCurrent":32,"remainingAfterAcceptance":31,"d05Accepted":false},"gateSummary":{"targetedGates":2,"satisfiedGates":0,"positiveAcceptanceReceipts":0,"missingReceiptRequirements":10,"decision":"DENY_AND_ESCALATE_TO_SECURITY_AND_ARCHITECTURE"},"gates":[{"id":"D05-G03","name":"ROOT_OWNED_RUNTIME_CONFIGURATION","owner":"SECURITY","target":"root-owned canonical manifest, eleven typed ConfigRefs, one verify-only KeyRef and a least-visible SecretRef boundary","observed":"manifest, service identity and resolved production references are absent on the production host","positiveReceiptsObserved":0,"decision":"DENIED_CONFIGURATION_NOT_INSTALLED"},{"id":"D05-G04","name":"REVIEWED_PRODUCTION_FACTORIES","owner":"GLOBAL_ARCHITECTURE","target":"six reviewed production factories, five authority-pinned read sources and one verify-only attestation verifier","observed":"closed source implementations and fixture proofs exist, but every factory remains TEST_ONLY with zero production bindings","positiveReceiptsObserved":0,"decision":"DENIED_FACTORIES_NOT_PRODUCTION_BOUND"}],"host":{"environment":"production EC2 / ap-southeast-2","observedPortalRelease":"edcc18b7bf7de9d3bd0fa54e363d646251e3dded","checks":[{"id":"CFG-01","label":"runtime manifest","target":"/etc/reits-runner-factory/controller-runtime.json","observed":"ABSENT","status":"DENIED"},{"id":"CFG-02","label":"service unit","target":"/etc/systemd/system/reits-runner-factory-controller.service","observed":"ABSENT","status":"DENIED"},{"id":"CFG-03","label":"service identity","target":"reits-runner-factory non-login user","observed":"ABSENT","status":"DENIED"},{"id":"CFG-04","label":"installed runtime","target":"/usr/local/lib or /opt/reits-runner-factory","observed":"ABSENT","status":"DENIED"},{"id":"CFG-05","label":"systemd state","target":"loaded and intentionally stopped before activation","observed":"not-found / inactive","status":"DENIED"},{"id":"CFG-06","label":"controller process","target":"dedicated identity only after authorization","observed":"0","status":"SAFE_ABSENT"},{"id":"CFG-07","label":"loopback listener","target":"127.0.0.1:8110 only after G01-G11","observed":"0","status":"SAFE_CLOSED"}]},"configuration":{"manifestPath":"/etc/reits-runner-factory/controller-runtime.json","requiredOwner":"root","requiredGroup":"reits-runner-factory","requiredMode":"0640","maxBytes":65536,"manifestInstalled":false,"configuredConfigRefs":0,"requiredConfigRefs":11,"configuredKeyRefs":0,"requiredKeyRefs":1,"referenceTypes":[{"kind":"DYNAMODB_TABLE_ARN","count":3,"state":"NOT_CONFIGURED"},{"kind":"IAM_ROLE_ARN","count":4,"state":"NOT_CONFIGURED"},{"kind":"AWS_REGION","count":1,"state":"NOT_CONFIGURED"},{"kind":"HTTPS_ORIGIN","count":1,"state":"NOT_CONFIGURED"},{"kind":"SECRET_REF","count":1,"state":"NOT_CONFIGURED"},{"kind":"ROOT_AGENT_SOCKET","count":1,"state":"NOT_CONFIGURED"},{"kind":"ECDSA_P256_SHA256","count":1,"state":"NOT_CONFIGURED"}]},"factoryReview":{"auditedSourceRevision":"edcc18b7bf7de9d3bd0fa54e363d646251e3dded","implementation":"ops/runner-factory/controller-bootstrap-composition.mjs","closedFactoryCount":6,"readOnlySourceCount":5,"productionBindings":0,"components":[{"id":"ReservationReader","kind":"READ_ONLY_READER","authority":"reservation-ledger","permission":"dynamodb:GetItem","sourceState":"IMPLEMENTED_TEST_ONLY","productionState":"NOT_BOUND"},{"id":"CapacityReader","kind":"READ_ONLY_READER","authority":"capacity-ledger","permission":"dynamodb:GetItem","sourceState":"IMPLEMENTED_TEST_ONLY","productionState":"NOT_BOUND"},{"id":"WorkerReader","kind":"READ_ONLY_READER","authority":"ec2-worker-read-model","permission":"ec2:DescribeInstances+ec2:DescribeVolumes","sourceState":"IMPLEMENTED_TEST_ONLY","productionState":"NOT_BOUND"},{"id":"RunnerReader","kind":"READ_ONLY_READER","authority":"gitea-runner-read-model","permission":"gitea:read-runner+read-job+agent:read","sourceState":"IMPLEMENTED_TEST_ONLY","productionState":"NOT_BOUND"},{"id":"JournalReader","kind":"READ_ONLY_READER","authority":"append-only-journal","permission":"dynamodb:Query","sourceState":"IMPLEMENTED_TEST_ONLY","productionState":"NOT_BOUND"},{"id":"ReadinessAttestationVerifier","kind":"ATTESTATION_VERIFIER","authority":"root-owned-trust-store","permission":"verify-only","sourceState":"IMPLEMENTED_TEST_ONLY","productionState":"NOT_BOUND"}]},"verificationPacks":[{"id":"runtime-configuration","status":"PASS_CONFIGURATION_NOT_INSTALLED","fixtures":36,"accepted":2,"denied":34},{"id":"bootstrap-composition","status":"PASS_BOOTSTRAP_NOT_INSTALLED","fixtures":45,"accepted":7,"denied":38},{"id":"runtime-assembly","status":"PASS_ASSEMBLY_NOT_CONFIGURED","fixtures":32,"accepted":1,"denied":31},{"id":"service-runtime","status":"PASS_SERVICE_RUNTIME_BOOTSTRAP_NOT_INSTALLED","fixtures":40,"accepted":7,"denied":33}],"receiptRequirements":[{"gate":"D05-G03","id":"CONFIG-01","requirement":"canonical manifest file proof bound to one descriptor and exact release","status":"MISSING"},{"gate":"D05-G03","id":"CONFIG-02","requirement":"root:reits-runner-factory ownership, mode 0640 and single hard-link receipt","status":"MISSING"},{"gate":"D05-G03","id":"CONFIG-03","requirement":"all eleven typed ConfigRefs resolve from reviewed read-only stores","status":"MISSING"},{"gate":"D05-G03","id":"CONFIG-04","requirement":"verify-only KeyRef and pinned P-256 public SPKI digest resolve without private material","status":"MISSING"},{"gate":"D05-G03","id":"CONFIG-05","requirement":"Security signs a fresh configuration bundle with SecretRef-only visibility","status":"MISSING"},{"gate":"D05-G04","id":"FACTORY-01","requirement":"five production read-only factories are independently reviewed at exact source revision","status":"MISSING"},{"gate":"D05-G04","id":"FACTORY-02","requirement":"production verify-only attestation factory is independently reviewed and key pinned","status":"MISSING"},{"gate":"D05-G04","id":"FACTORY-03","requirement":"real SDK and root-agent constructors prove least privilege and reverse cleanup","status":"MISSING"},{"gate":"D05-G04","id":"FACTORY-04","requirement":"five production source bindings complete one read-only snapshot without mutation","status":"MISSING"},{"gate":"D05-G04","id":"FACTORY-05","requirement":"Global Architecture signs the exact composition and production binding receipt","status":"MISSING"}],"operatorPlan":{"nextAction":"Security must install and attest the root-owned configuration boundary on an approved dedicated host; Global Architecture must then review six real production factories and five read-source bindings before any readiness or listener review.","forbiddenActions":["Do not copy fixture-only factories into production and relabel them as reviewed adapters.","Do not place credential values in the manifest, evidence JSON, logs or API responses.","Do not install the Controller on the shared production portal host without dedicated-host approval.","Do not start port 8110 or create a service handler from missing configuration receipts.","Do not mark G03 or G04 satisfied from passing fixture suites or source presence alone."]},"safetyTruth":{"readOnlyAuditPerformed":true,"credentialsRecorded":false,"configurationWrites":0,"serviceInstallations":0,"productionFactoriesConstructed":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"listenerStarts":0,"paidResourcesCreated":false,"g03Satisfied":false,"g04Satisfied":false,"d05Accepted":false},"verification":{"status":"PASS_READ_ONLY_CONFIGURATION_AND_FACTORY_OBSERVATION","targetedGates":2,"satisfiedGates":0,"hostChecks":7,"installedConfigurationArtifacts":0,"closedSourceFactories":6,"productionFactoryBindings":0,"fixtureCases":153,"positiveAcceptanceReceipts":0,"missingReceiptRequirements":10,"externalWritesExecuted":0,"listenerStarts":0},"discovery":{"workbench":"/release-foundation#runner-controller-readiness-evidence","schema":"/schemas/runner-controller-readiness-evidence.v1.schema.json","runtimeConfiguration":"/api/runner-factory/controller/runtime-configuration","bootstrapComposition":"/api/runner-factory/controller/bootstrap-composition","runtimeAssembly":"/api/runner-factory/controller/runtime-assembly","d05Closure":"/api/runner-factory/controller/d05-acceptance-closure"}}