{"schemaVersion":"developer.reits.tech/runner-factory-audit-sink/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T16:30:00Z","scope":{"partition":"ONE_JOURNAL_PER_PLAN_AND_JOB_ATTEMPT","entryModel":"DUAL_HASH_CHAIN_SIGNED_RECEIPTS_PLUS_TERMINAL_FAILURE","successSeal":"EXACT_F9_REPLACEMENT_RECEIPT","failureSeal":"ENUMERATED_CONTROLLER_FACTS_AFTER_RECEIPT_RECONCILIATION","mutationPolicy":"CREATE_AND_CONDITIONAL_APPEND_ONLY_NO_UPDATE_OR_DELETE"},"truth":{"runtimeDriverConfigured":false,"durableJournalCreated":false,"iamRoleConfigured":false,"readinessGateSatisfied":false,"liveJournals":0,"runtimeEntries":0,"runtimeSuccessSeals":0,"runtimeFailureSeals":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/audit-sink.mjs","testDriver":"ops/runner-factory/memory-audit-driver.mjs","fixtureRegistry":"ops/runner-factory/audit-sink-fixtures.json","verifier":"scripts/verify-runner-factory-audit-sink.mjs","runtimeDriver":"NOT_CONFIGURED","receiptVerifier":"PINNED_KMS_PUBLIC_KEY_REQUIRED_AT_RUNTIME","writerIdentity":"EXACT_CONTROLLER_IAM_ROLE_REQUIRED_AT_RUNTIME","canonicalization":"recursive-key-order-json","digestAlgorithm":"SHA-256"},"operations":[{"id":"open","guard":"exact plan, job attempt, repository and job scope","result":"opaque journal capability"},{"id":"appendReceipt","guard":"pinned signature + exact scope + contiguous receipt and entry predecessors","result":"CAS-appended dual-chain entry"},{"id":"sealFailure","guard":"reconcile signed receipts + bounded phase, code and compensation facts","result":"terminal failure entry"},{"id":"inspect","guard":"opaque capability + consistent head read","result":"secret-free head proof"},{"id":"verify","guard":"consistent full range + entry hashes + signatures + both predecessor chains","result":"independent chain verdict"}],"driverCalls":[{"id":"CreateJournal","mode":"CONDITIONAL_CREATE","guard":"head absent or exact same scope"},{"id":"ReadHead","mode":"CONSISTENT_READ","guard":"scope, writer, sequence, digest and terminal state agree"},{"id":"AppendEntry","mode":"ATOMIC_CAS","guard":"expected head sequence + digest + OPEN and new entry absent"},{"id":"ReadEntry","mode":"CONSISTENT_READ","guard":"ambiguous-write recovery and exact replay only"},{"id":"ReadRange","mode":"CONSISTENT_READ","guard":"complete ordered range for independent verification"}],"stateMachine":[{"from":"ABSENT","action":"open","to":"OPEN_EMPTY","guard":"conditional journal creation"},{"from":"OPEN_EMPTY","action":"open replay","to":"OPEN_EMPTY","guard":"same exact scope"},{"from":"OPEN_EMPTY","action":"append F0","to":"OPEN_ACTIVE","guard":"signed genesis receipt"},{"from":"OPEN_ACTIVE","action":"append F1-F8","to":"OPEN_ACTIVE","guard":"both chains remain contiguous"},{"from":"OPEN_ACTIVE","action":"append exact F9","to":"SEALED_SUCCESS","guard":"replacement-capacity receipt"},{"from":"OPEN_EMPTY","action":"sealFailure","to":"SEALED_FAILURE","guard":"no signed receipt exists"},{"from":"OPEN_ACTIVE","action":"reconcile + sealFailure","to":"SEALED_FAILURE","guard":"all signed receipts are present first"},{"from":"SEALED_FAILURE","action":"exact seal replay","to":"SEALED_FAILURE","guard":"terminal payload is byte-equivalent"},{"from":"OPEN_OR_TERMINAL","action":"inspect","to":"SAME","guard":"consistent head proof"},{"from":"OPEN_OR_TERMINAL","action":"verify","to":"VERIFIED_SAME","guard":"full dual-chain verification"}],"invariants":["one journal is deterministically partitioned by exact plan and job-attempt scope","journal capabilities are opaque object identities and never serialize write authority","the runtime writer must be one exact controller IAM role rather than a mutable alias","entries are created only through expected-sequence, expected-digest and OPEN-state CAS","the driver surface exposes no entry update, journal delete or adapter-side unseal operation","every receipt is verified by the pinned asymmetric public key before persistence","every signed receipt binds plan, job attempt, repository and job identity","receipt sequence and receipt predecessor digest must be contiguous","entry sequence and entry predecessor digest form an independent outer chain","ambiguous append is accepted only after exact entry and consistent-head readback","same sequence with different content is a terminal conflict rather than an overwrite","only signed sequence F9 kind replacement-capacity may seal successful completion","failure sealing first reconciles every signed receipt supplied by the Saga","terminal failure facts accept only bounded codes and enumerated compensation identifiers","a terminal journal accepts only byte-equivalent replay and never new entries","full verification rereads the complete range and recomputes every digest","secret-like arbitrary strings, credentials and token material never enter the journal contract","TEST_ONLY driver evidence never increments runtime journal, read, write or readiness truth"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":36,"allowedTransitions":10,"deniedTransitions":26,"operations":5,"driverCallsModeled":5,"hashChainsVerified":2,"ambiguousWriteRecoveryCases":2,"scopeAndSignatureDenials":8,"terminalConflictDenials":4,"secretValuesRecorded":0,"externalCallsExecuted":0},"failureClasses":[{"id":"SCOPE_OR_HANDLE","effect":"deny before journal authority is used"},{"id":"SIGNATURE_OR_RECEIPT_CHAIN","effect":"deny untrusted, cross-job or reordered receipt"},{"id":"APPEND_AMBIGUITY","effect":"recover only exact committed entry, otherwise fail closed"},{"id":"HEAD_OR_RANGE_DRIFT","effect":"deny independent verification and page operator"},{"id":"TERMINAL_CONFLICT","effect":"preserve first terminal fact and deny mutation"},{"id":"DRIVER_UNAVAILABLE","effect":"block admission or compensate the Saga without claiming audit durability"}],"productionPrerequisites":["reviewed durable journal table with point-in-time recovery and encryption","transactional head CAS plus immutable entry rows with no update or delete API","least-privilege controller writer role pinned by exact IAM ARN","separate read-only verifier role and scheduled full-chain verification","retention, export, legal-hold and disaster-recovery policy","append conflict, verification drift, stale-open-journal and seal-failure paging","security, runtime, retention and cost owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-audit-sink-fixtures/v1","fixedTime":"2026-07-20T16:30:00Z","cases":[{"id":"RFAS-01","operation":"open","expected":"ALLOW","proof":"new exact-scope journal"},{"id":"RFAS-02","operation":"open","expected":"ALLOW","proof":"same-scope idempotent replay"},{"id":"RFAS-03","operation":"appendReceipt","expected":"ALLOW","proof":"signed F0 genesis"},{"id":"RFAS-04","operation":"appendReceipt","expected":"ALLOW","proof":"signed contiguous F1"},{"id":"RFAS-05","operation":"inspect","expected":"ALLOW","proof":"consistent open head"},{"id":"RFAS-06","operation":"verify","expected":"ALLOW","proof":"active dual chain"},{"id":"RFAS-07","operation":"appendReceipt","expected":"ALLOW","proof":"exact F9 success seal"},{"id":"RFAS-08","operation":"sealFailure","expected":"ALLOW","proof":"empty-journal terminal failure"},{"id":"RFAS-09","operation":"sealFailure","expected":"ALLOW","proof":"missing signed receipts reconciled before seal"},{"id":"RFAS-10","operation":"sealFailure","expected":"ALLOW","proof":"byte-equivalent terminal replay"},{"id":"RFAS-11","operation":"create","expected":"DENY","code":"RF_AUDIT_DRIVER"},{"id":"RFAS-12","operation":"create","expected":"DENY","code":"RF_AUDIT_CONFIG"},{"id":"RFAS-13","operation":"open","expected":"DENY","code":"RF_AUDIT_SCOPE"},{"id":"RFAS-14","operation":"open","expected":"DENY","code":"RF_AUDIT_CREATE_UNAVAILABLE"},{"id":"RFAS-15","operation":"open","expected":"DENY","code":"RF_AUDIT_CREATE_PROOF"},{"id":"RFAS-16","operation":"inspect","expected":"DENY","code":"RF_AUDIT_HANDLE"},{"id":"RFAS-17","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_VERIFY"},{"id":"RFAS-18","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_VERIFY"},{"id":"RFAS-19","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SCOPE"},{"id":"RFAS-20","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SCOPE"},{"id":"RFAS-21","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SCOPE"},{"id":"RFAS-22","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SCOPE"},{"id":"RFAS-23","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SEQUENCE"},{"id":"RFAS-24","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_CHAIN"},{"id":"RFAS-25","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_APPEND_UNAVAILABLE"},{"id":"RFAS-26","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_APPEND_PROOF"},{"id":"RFAS-27","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_APPEND_PROOF"},{"id":"RFAS-28","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_SUCCESS_PROOF"},{"id":"RFAS-29","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_FAILURE_SHAPE"},{"id":"RFAS-30","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_FAILURE_SHAPE"},{"id":"RFAS-31","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_FAILURE_SHAPE"},{"id":"RFAS-32","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_TERMINAL_CONFLICT"},{"id":"RFAS-33","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_SEALED"},{"id":"RFAS-34","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_SEALED"},{"id":"RFAS-35","operation":"verify","expected":"DENY","code":"RF_AUDIT_CHAIN"},{"id":"RFAS-36","operation":"verify","expected":"DENY","code":"RF_AUDIT_HEAD_PROOF"}]},"discovery":{"lifecycle":"/api/runner-factory","controller":"/api/runner-factory/controller","workbench":"/release-foundation#audit-journal","schema":"/schemas/runner-factory-audit-sink.v1.schema.json"}}