{"schemaVersion":"developer.reits.tech/runner-factory-capacity-controller/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T18:35:00Z","scope":{"poolId":"rfpool_linux-amd64","desiredSlots":2,"slotsPerAdmission":1,"maxJobsPerWorker":1,"capacityMeaning":"CONCURRENT_EPHEMERAL_WORKER_BUDGET_NOT_WARM_INSTANCES","failureMode":"WHOLE_POOL_FREEZE"},"truth":{"runtimeDriverConfigured":false,"durableCapacityLedgerCreated":false,"readinessGateSatisfied":false,"livePools":0,"liveSlots":0,"liveAcquisitions":0,"runtimeReplacements":0,"runtimeFreezes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/capacity-controller.mjs","testDriver":"ops/runner-factory/memory-capacity-driver.mjs","fixtureRegistry":"ops/runner-factory/capacity-controller-fixtures.json","verifier":"scripts/verify-runner-factory-capacity-controller.mjs","runtimeDriver":"NOT_CONFIGURED","receiptVerifier":"PINNED_KMS_PUBLIC_KEY_REQUIRED_AT_RUNTIME"},"operations":[{"id":"acquire","guard":"exact plan + one slot + one job + atomic available-slot claim","result":"opaque ACQUIRED capacity capability"},{"id":"confirmReplacement","guard":"terminal Worker proof + verified normal/compensation retirement receipt + generation CAS + consistent readback","result":"same slot AVAILABLE at generation N+1"},{"id":"freeze","guard":"occupied or uncertain slot + bounded reason + durable whole-pool readback","result":"FROZEN scheduling pool"},{"id":"inspect","guard":"unforgeable in-process capability","result":"secret-free slot proof"}],"driverCalls":[{"id":"AcquireSlot","mutation":true,"guard":"pool active + available slot + unique plan/job attempt"},{"id":"ReadSlot","mutation":false,"guard":"consistent exact-slot readback"},{"id":"ReplaceSlot","mutation":true,"guard":"lease + generation + plan/job + signed retirement digest"},{"id":"FreezePool","mutation":true,"guard":"uncertain slot causes global scheduling denial"},{"id":"ReadPool","mutation":false,"guard":"consistent freeze readback"}],"stateMachine":[{"from":"AVAILABLE","action":"acquire","to":"ACQUIRED","guard":"one exact slot claimed atomically"},{"from":"ACQUIRED","action":"confirmReplacement","to":"REPLACING","guard":"worker terminal + signed retirement receipt verified"},{"from":"REPLACING","action":"CAS + readback","to":"REPLACED","guard":"same slot available at generation N+1"},{"from":"REPLACING","action":"driver/proof failure","to":"FAILED_NEEDS_FREEZE","guard":"capacity cannot be admitted"},{"from":"ACQUIRED","action":"unsafe lifecycle failure","to":"FAILED_NEEDS_FREEZE","guard":"no silent slot release"},{"from":"ACQUIRED|REPLACING|FAILED_NEEDS_FREEZE","action":"freeze","to":"FROZEN","guard":"whole-pool freeze read back"},{"from":"REPLACED","action":"confirmReplacement","to":"REPLACED","guard":"side-effect-free terminal retry"},{"from":"FROZEN","action":"freeze","to":"FROZEN","guard":"side-effect-free terminal retry"},{"from":"REPLACED|FROZEN","action":"late conflicting mutation","to":"DENIED","guard":"terminal capability cannot cross state"}],"invariants":["global pool size is enforced before EC2 launch, not inferred after launch","capacity means concurrent ephemeral-worker budget and never claims warm instances","each admitted plan consumes exactly one slot for one job attempt","plan and job-attempt replay cannot acquire another slot","slot authority is an opaque capability and its lease token is never serialized","replacement requires the Worker capability to prove terminal instance and deleted root volume","replacement also requires a cryptographically verified normal or compensation retirement receipt","receipt facts bind the exact plan, job, worker ID and storage terminal state","replacement uses the current lease and generation as a fencing condition","replacement is accepted only after a consistent read shows generation N+1 available","an ambiguous replacement never reopens capacity and must freeze","an unsafe lifecycle failure freezes the whole scheduling pool","freeze is accepted only after an independent pool readback","terminal replacement and freeze retries are side-effect free","there is no adapter path that unfreezes production capacity","TEST_ONLY driver operations never count as runtime capacity evidence"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":30,"allowedTransitions":8,"deniedTransitions":22,"driverCallsModeled":5,"concurrencyBoundCases":2,"receiptAndWorkerProofDenials":8,"freezeProofCases":4,"idempotentTerminalCases":2,"leaseValuesRecorded":0,"externalCallsExecuted":0},"failureClasses":[{"code":"RF_CAPACITY_CONFIG|DRIVER|VERIFIER|SCOPE","phase":"PRE_MUTATION","action":"deny before capacity claim"},{"code":"RF_CAPACITY_ACQUIRE_*|REPLAY","phase":"ADMISSION","action":"deny launch; reconcile any ambiguous claim"},{"code":"RF_CAPACITY_RECEIPT_*|WORKER_PROOF","phase":"RETIREMENT","action":"keep slot non-admissible and freeze"},{"code":"RF_CAPACITY_REPLACE_*","phase":"REPLACEMENT","action":"freeze whole pool; page owner"},{"code":"RF_CAPACITY_FREEZE_*","phase":"CONTAINMENT","action":"deny all scheduling externally; require operator reconciliation"}],"productionPrerequisites":["durable strongly consistent capacity ledger with atomic slot claim and generation CAS","runtime driver identity restricted to one reviewed pool and no unfreeze permission","pinned KMS public verifier for normal and compensation retirement receipts","Controller Saga integration that acquires capacity before EC2 launch","alarm and named on-call owner for acquire ambiguity, replacement drift and freeze failure","operator runbook requiring orphan reconciliation before a separate approved unfreeze path","security, runtime, reliability and cost-owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-capacity-controller-fixtures/v1","fixedTime":"2026-07-20T18:35:00.000Z","cases":[{"id":"RFCC-01","expected":"ALLOW","reason":"ACQUIRED","scenario":"exact plan atomically claims one of two slots"},{"id":"RFCC-02","expected":"ALLOW","reason":"OPAQUE_PROOF","scenario":"serialized handle excludes the lease token"},{"id":"RFCC-03","expected":"ALLOW","reason":"REPLACED","scenario":"verified F8 and terminal worker reopen generation N+1"},{"id":"RFCC-04","expected":"ALLOW","reason":"REPLACED_IDEMPOTENT","scenario":"terminal replacement retry performs no driver call"},{"id":"RFCC-05","expected":"ALLOW","reason":"FROZEN","scenario":"occupied slot freezes the whole pool"},{"id":"RFCC-06","expected":"ALLOW","reason":"FROZEN_AFTER_UNCERTAINTY","scenario":"replacement failure remains containable by freeze"},{"id":"RFCC-07","expected":"ALLOW","reason":"FROZEN_IDEMPOTENT","scenario":"terminal freeze retry performs no driver call"},{"id":"RFCC-08","expected":"ALLOW","reason":"TWO_SLOT_BOUND","scenario":"two distinct plans consume two distinct slots"},{"id":"RFCC-09","expected":"DENY","reason":"RF_CAPACITY_CONFIG","scenario":"caller configures three desired slots"},{"id":"RFCC-10","expected":"DENY","reason":"RF_CAPACITY_DRIVER","scenario":"driver omits a required operation"},{"id":"RFCC-11","expected":"DENY","reason":"RF_CAPACITY_VERIFIER","scenario":"receipt verifier is absent"},{"id":"RFCC-12","expected":"DENY","reason":"RF_CAPACITY_SCOPE","scenario":"plan requests two slots"},{"id":"RFCC-13","expected":"DENY","reason":"RF_CAPACITY_REPLAY","scenario":"same plan attempts a second acquisition"},{"id":"RFCC-14","expected":"DENY","reason":"RF_CAPACITY_ACQUIRE_UNAVAILABLE","scenario":"slot mutation is unavailable"},{"id":"RFCC-15","expected":"DENY","reason":"RF_CAPACITY_ACQUIRE_PROOF","scenario":"acquire response returns the wrong plan"},{"id":"RFCC-16","expected":"DENY","reason":"RF_CAPACITY_ACQUIRE_PROOF","scenario":"consistent read returns the wrong generation"},{"id":"RFCC-17","expected":"DENY","reason":"RF_CAPACITY_ACQUIRE_PROOF","scenario":"third concurrent plan exceeds the two-slot pool"},{"id":"RFCC-18","expected":"DENY","reason":"RF_CAPACITY_HANDLE","scenario":"caller forges a capacity capability"},{"id":"RFCC-19","expected":"DENY","reason":"RF_CAPACITY_RECEIPT_VERIFY","scenario":"retirement signature verification returns false"},{"id":"RFCC-20","expected":"DENY","reason":"RF_CAPACITY_RECEIPT_VERIFY","scenario":"retirement verifier is unavailable"},{"id":"RFCC-21","expected":"DENY","reason":"RF_CAPACITY_RECEIPT_PROOF","scenario":"receipt is not the F8 instance-termination stage"},{"id":"RFCC-22","expected":"DENY","reason":"RF_CAPACITY_RECEIPT_PROOF","scenario":"receipt binds another plan"},{"id":"RFCC-23","expected":"DENY","reason":"RF_CAPACITY_WORKER_PROOF","scenario":"worker is still running"},{"id":"RFCC-24","expected":"DENY","reason":"RF_CAPACITY_WORKER_PROOF","scenario":"root volume deletion is unproven"},{"id":"RFCC-25","expected":"DENY","reason":"RF_CAPACITY_REPLACE_UNAVAILABLE","scenario":"replacement CAS is unavailable"},{"id":"RFCC-26","expected":"DENY","reason":"RF_CAPACITY_REPLACE_PROOF","scenario":"replacement response does not advance generation"},{"id":"RFCC-27","expected":"DENY","reason":"RF_CAPACITY_REPLACE_PROOF","scenario":"replacement readback retains a lease"},{"id":"RFCC-28","expected":"DENY","reason":"RF_CAPACITY_STATE","scenario":"confirmed slot cannot be frozen by a late caller"},{"id":"RFCC-29","expected":"DENY","reason":"RF_CAPACITY_FREEZE_REASON","scenario":"free-form freeze reason is rejected"},{"id":"RFCC-30","expected":"DENY","reason":"RF_CAPACITY_FREEZE_PROOF","scenario":"freeze readback does not show the pool frozen"}]},"discovery":{"lifecycle":"/api/runner-factory","controller":"/api/runner-factory/controller","workbench":"/release-foundation#capacity-controller","schema":"/schemas/runner-factory-capacity-controller.v1.schema.json"}}