{"schemaVersion":"developer.reits.tech/runner-cost-approval/v1","status":"T03_REPOSITORY_IMPLEMENTED_DUAL_APPROVAL_REQUIRED","observedAt":"2026-07-24T07:58:32Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T03","title":"Approve two isolated Linux runner costs","owners":["Product Owner","FinOps"],"repositoryImplementationComplete":true,"currentExecutablePrerequisite":"D05-T02","currentExecutablePrerequisiteSatisfied":false,"liveDualApprovalObserved":false,"deploymentAdmitted":false,"productionAccepted":false,"nextTask":"D05-T04","nextTaskTitle":"Deploy and complete 18-repository isolation qualification","nextTaskBlocked":true},"quote":{"region":"ap-southeast-2","location":"Asia Pacific (Sydney)","currency":"USD","billingModel":"ON_DEMAND","hoursAssumption":730,"priceListRetrievedAt":"2026-07-24T07:58:32Z","components":[{"id":"COMPUTE","label":"2 × t3.large Linux","quantity":1460,"unit":"instance-hours","rateUsd":0.1056,"monthlyUsd":154.176,"sku":"B7WDU84CV8BAGNYW"},{"id":"ROOT_STORAGE","label":"2 × 80 GB gp3","quantity":160,"unit":"GB-month","rateUsd":0.096,"monthlyUsd":15.36,"sku":"QR74UAP3E9WUYT9B"},{"id":"PUBLIC_IPV4","label":"2 × in-use public IPv4","quantity":1460,"unit":"address-hours","rateUsd":0.005,"monthlyUsd":7.3,"sku":"JZP2PURP9VVQ96GH"}],"fixedBaseUsd":176.836,"fixedBaseRoundedUsd":176.84,"proposedMonthlyAuthorizationCeilingUsd":250,"variableAllowanceUsd":73.164,"variableAllowancePercentOfBase":41.373,"notFixed":["Internet and regional data transfer","Single-job replacement overlap","Taxes, credits, discounts and currency conversion","Any resource or performance setting outside the exact template"]},"infrastructureBinding":{"requestId":"D05-T03-LINUX-RUNNERS-V1","requestPath":"ops/runner-cost-approval/request.json","requestDigest":"sha256:55467056b51a687287e0aba44dd7f7dafcba223110e384a9bc54ad7ab8c8fcbe","templatePath":"ops/gitea-runner/cloudformation.yaml","templateSha256":"62d847f115feab4d01dd6d58fdb211a3d1b94c8ed5e3580de5c5b1463116cadb","priceSnapshotPath":"ops/runner-cost-approval/price-snapshot.json","priceSnapshotSha256":"13f3e40f3030f05b1264758faa085b78d68ce7bb2d4f8c0c39e1cfa449b72526","availabilityZones":2,"instanceType":"t3.large","desiredCapacity":2,"maximumCapacity":2,"concurrencyPerRunner":1,"rootVolumeType":"gp3","rootVolumeGiBEach":80,"cpuCreditMode":"standard","paidDetailedMonitoring":false,"natGateways":0,"inboundRules":0,"productionVpcRoutes":0},"approvalContract":{"requiredRoles":["PRODUCT_OWNER","FINOPS"],"requiredSignatures":2,"observedSignatures":0,"distinctPrincipalsRequired":true,"signatureAlgorithm":"Ed25519","maximumValidityDays":31,"approvalIsNonRenewing":true,"templateChangeInvalidatesApproval":true,"priceSnapshotChangeRequiresRequote":true,"maximumMonthlyAuthorizationUsd":250,"verificationCommand":"node ops/runner-cost-approval/verify-receipt.mjs","deploymentWithoutValidReceipt":"DENY"},"approvalSeats":[{"role":"PRODUCT_OWNER","decision":"PENDING","principal":null,"keyId":null,"signedAt":null,"scope":"Approve business need, two-runner scope and non-renewing lease."},{"role":"FINOPS","decision":"PENDING","principal":null,"keyId":null,"signedAt":null,"scope":"Approve current quote, USD ceiling, exclusions and account budget ownership."}],"costControls":[{"id":"C01","title":"Exact source binding","state":"IMPLEMENTED","mechanism":"Receipt binds the request digest, runner template SHA-256, region and approved ceiling."},{"id":"C02","title":"Dual-owner signature","state":"IMPLEMENTED_PENDING_KEYS","mechanism":"Ed25519 signatures from distinct trusted Product Owner and FinOps principals are mandatory."},{"id":"C03","title":"Bounded compute rate","state":"IMPLEMENTED","mechanism":"T3 CPU credits use standard mode and paid one-minute detailed monitoring is disabled."},{"id":"C04","title":"No hidden network appliance","state":"IMPLEMENTED","mechanism":"The stack contains no NAT Gateway or load balancer; two charged public IPv4 addresses are explicit."},{"id":"C05","title":"Non-renewing lease","state":"IMPLEMENTED","mechanism":"A CloudFormation scheduled action sets ASG min, desired and max capacity to zero at receipt expiry."},{"id":"C06","title":"Fail-closed deploy","state":"IMPLEMENTED","mechanism":"The deploy path rejects absent, stale, over-cap, wrong-region, wrong-template or invalid signatures before mutation."}],"liveEvidence":{"productOwnerSignaturesObserved":0,"finOpsSignaturesObserved":0,"validReceiptsObserved":0,"awsBudgetsObserved":0,"paidResourcesCreated":0,"runnerStacksCreated":0,"organizationRunnersOnline":0,"d05GateG01Satisfied":false},"sources":[{"label":"AWS Price List documentation","url":"https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/price-changes.html"},{"label":"Amazon EC2 Sydney price list v20260723171241","url":"https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonEC2/20260723171241/ap-southeast-2/index.csv"},{"label":"Amazon VPC Sydney price list v20260713171339","url":"https://pricing.us-east-1.amazonaws.com/offers/v1.0/aws/AmazonVPC/20260713171339/ap-southeast-2/index.csv"}],"invariants":{"priceSnapshotIsApproval":false,"repositoryPacketIsOwnerApproval":false,"environmentLatchAloneAuthorizesSpend":false,"unpricedResourcesAuthorized":false,"paidResourcesCreated":0,"productionChangesAuthorized":0,"d05Accepted":false,"programAdvanced":false},"boundary":"D05-T03 repository engineering is complete: the official price snapshot, exact quote, dual-signature receipt verifier, deploy admission and lease expiry are implemented. Product Owner and FinOps have not signed, no cost receipt is valid, D05-T02 live AWS identity remains the current executable prerequisite, D05-T04 remains blocked, G01 remains false, D05 remains 0/11 and implementation remains 4/36."}