{"schemaVersion":"developer.reits.tech/runner-factory-controller/v1","status":"D05_ACCEPTANCE_CLOSURE_DOSSIER_READY_FAIL_CLOSED","truth":{"liveEndpoint":false,"durableIdempotency":false,"runtimeSignerConfigured":false,"applySupported":false,"cloudMutations":0,"liveWorkers":0,"runtimeReceipts":0,"paidResourcesCreated":false},"controllerPolicy":{"schemaVersion":"developer.reits.tech/runner-factory-controller-policy/v1","status":"DRY_RUN_ONLY","webhook":{"event":"workflow_job","eventType":"workflow_job","admittedActions":["queued"],"maxBodyBytes":262144,"signatureAlgorithm":"HMAC-SHA256","signatureHeader":"X-Gitea-Signature","deliveryHeader":"X-Gitea-Delivery","eventHeader":"X-Gitea-Event","eventTypeHeader":"X-Gitea-Event-Type","deliveryPattern":"^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"},"admission":{"organization":"reits","requiredLabel":"ubuntu-latest","deniedLabels":["macos-latest","macOS","production","shared-production"],"maxJobsPerWorker":1,"repositories":["reits/data-sources","reits/im-core","reits/im-media-send-kit","reits/im-ui","reits/matrix-quant-im-ios","reits/matrix-x-chat-ios","reits/matrixantai-backtest","reits/matrixantai-sim","reits/miniapp-open-platform","reits/opensdk","reits/public-booking-platform","reits/quant-platform","reits/reits-auth","reits/reits-bbs","reits/reits-info-portal","reits/reits-knowledge","reits/reits-media","reits/trading-data-source"]},"idempotency":{"fields":["deliveryId","runId","jobId","attempt"],"scopes":["delivery-and-job-attempt","repository-job-attempt"],"algorithm":"SHA-256","runtimeStore":"NOT_CONFIGURED","dryRunStore":"IN_MEMORY_TEST_ONLY","replayAccepted":false},"receipts":{"format":"developer.reits.tech/runner-factory-receipt/v1","canonicalization":"recursive-key-order-json","chainAlgorithm":"SHA-256","dryRunSigner":"HMAC-SHA256-TEST-ONLY","dryRunKeyRef":"test://runner-factory/deterministic","runtimeSigner":"AWS_KMS_ADAPTER_IMPLEMENTED_NOT_CONFIGURED","secretValuesRecorded":false},"authorization":{"applySupported":false,"costApprovalRequired":true,"runtimeApprovalRequired":true,"clientMayEnableApply":false}},"workerTemplate":{"schemaVersion":"developer.reits.tech/runner-worker-template/v1","status":"PLAN_ONLY_NOT_APPLIED","truth":{"cloudResourcesCreated":0,"liveWorkers":0,"applySupported":false,"costApprovalRequired":true,"runtimeApprovalRequired":true},"compute":{"provider":"aws-ec2","region":"ap-southeast-2","architecture":"linux-amd64","instanceType":"c7i-flex.large","market":"on-demand","imageSelector":"/aws/service/canonical/ubuntu/server/24.04/stable/current/amd64/hvm/ebs-gp3/ami-id","imageDigestMustBeReceipted":true,"rootVolume":{"type":"gp3","sizeGiB":32,"encrypted":true,"deleteOnTermination":true,"persistentDataVolume":false}},"network":{"vpc":"dedicated-ci-only","subnet":"private-ephemeral-worker","publicIpv4":false,"ipv6":false,"ingressRules":0,"productionVpcRoute":false,"vpcPeering":false,"egress":"job-uid-to-loopback-squid-only","permittedJobSockets":["tcp://127.0.0.1:3128"]},"bootstrap":{"instanceProfilePhase":["F1"],"userDataContainsSecret":false,"registrationSecretTransport":"tmpfs-file-descriptor","registrationSecretIssuedAt":"F3_AFTER_REBOOT","registrationSecretDestroyedAt":"F3","profileDetachedAt":"F2","imdsDisabledAt":"F2","rebootRequiredBeforeAdmission":true,"runnerVersion":"2.0.0","ephemeralRegistration":true},"execution":{"runnerDaemonUid":"root","runnerCredentialPath":"/run/reits-runner/.runner","runnerCredentialMode":"0600","runnerCredentialStorage":"tmpfs","runnerCredentialSealedAt":"F5","assignmentLease":"root-daemon-memory-bound-to-exact-job","jobUid":"reits-job","mode":"rootless-dind-container","rootlessDockerSocket":"/run/user/1001/docker.sock","hostDockerSocketMounted":false,"hostFilesystemMounts":[],"maxJobs":1,"cloudCredentialsDuringJob":false,"imdsDuringJob":false,"productionRouteDuringJob":false},"retirement":{"trigger":"job-completed-or-timeout-or-control-failure","instanceTerminationRequired":true,"rootVolumeDeletionRequired":true,"runnerDeregistrationRequired":true,"replacementReceiptRequired":true,"jobCleanupAloneAccepted":false}},"fixtureSummary":{"total":20,"planOnly":1,"denied":19,"cases":[{"id":"RFC-01","mutation":"none","expected":"PLAN_ONLY","reason":"VALID_QUEUE"},{"id":"RFC-02","mutation":"replay","expected":"DENY","reason":"RF_WEBHOOK_REPLAY"},{"id":"RFC-03","mutation":"redelivery-new-id","expected":"DENY","reason":"RF_WEBHOOK_REPLAY"},{"id":"RFC-04","mutation":"tamper-signature","expected":"DENY","reason":"RF_SIGNATURE_INVALID"},{"id":"RFC-05","mutation":"missing-signature","expected":"DENY","reason":"RF_SIGNATURE_MISSING"},{"id":"RFC-06","mutation":"wrong-event","expected":"DENY","reason":"RF_EVENT"},{"id":"RFC-07","mutation":"wrong-event-type","expected":"DENY","reason":"RF_EVENT_TYPE"},{"id":"RFC-08","mutation":"form-content-type","expected":"DENY","reason":"RF_CONTENT_TYPE"},{"id":"RFC-09","mutation":"invalid-delivery","expected":"DENY","reason":"RF_DELIVERY_ID"},{"id":"RFC-10","mutation":"oversized-body","expected":"DENY","reason":"RF_BODY_SIZE"},{"id":"RFC-11","mutation":"malformed-json","expected":"DENY","reason":"RF_JSON_INVALID"},{"id":"RFC-12","mutation":"completed-action","expected":"DENY","reason":"RF_ACTION"},{"id":"RFC-13","mutation":"outside-organization","expected":"DENY","reason":"RF_ORGANIZATION"},{"id":"RFC-14","mutation":"unregistered-repository","expected":"DENY","reason":"RF_REPOSITORY_NOT_REGISTERED"},{"id":"RFC-15","mutation":"missing-linux-label","expected":"DENY","reason":"RF_RUNNER_LABEL"},{"id":"RFC-16","mutation":"mac-label","expected":"DENY","reason":"RF_PLATFORM_BOUNDARY"},{"id":"RFC-17","mutation":"zero-attempt","expected":"DENY","reason":"RF_ATTEMPT"},{"id":"RFC-18","mutation":"client-apply","expected":"DENY","reason":"RF_CLIENT_CONTROL_FIELD"},{"id":"RFC-19","mutation":"receipt-tamper","expected":"DENY","reason":"RF_RECEIPT_TAMPER"},{"id":"RFC-20","mutation":"receipt-reorder","expected":"DENY","reason":"RF_RECEIPT_SEQUENCE"}]},"runtimeAdapters":{"status":"PORTS_EXECUTABLE_NOT_CONFIGURED","truth":{"configuredRuntimeAdapters":0,"liveControllerReplicas":0,"liveWorkers":0,"runtimeReceipts":0,"awsCallsExecuted":0,"giteaWritesExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"ports":[{"id":"reservation-store","target":"dynamodb-transact-write","operation":"reserve + renew + recoverExpired + complete + fail","guard":"dual conditional rows + 120s lease + rotating fencing epoch","implementation":"ops/runner-factory/reservation-store.mjs","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","configured":false,"fake":"memory-dynamodb-driver"},{"id":"receipt-signer","target":"aws-kms-asymmetric","operation":"GetPublicKey + Sign + local verify","guard":"exact key ARN + pinned SPKI + DIGEST + ECDSA_SHA_256 + chain continuity","implementation":"ops/runner-factory/receipt-signer.mjs","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","configured":false,"fake":"memory-kms-driver"},{"id":"token-broker","target":"gitea-organization-runner-token","operation":"POST /orgs/reits/actions/runners/registration-token","guard":"HTTP 200 token header → owned mutable bytes → 30s single-consumer handle → zeroize","implementation":"ops/runner-factory/registration-token-broker.mjs","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","configured":false,"fake":"memory-gitea-token-driver"},{"id":"worker-provider","target":"aws-ec2 + one-job worker agent","operation":"launch + closeCloudBoundary + runJob + terminate","guard":"immutable template + private one-instance launch + profile/IMDS closure + one exact job + instance/root-volume retirement proof","implementation":"ops/runner-factory/worker-provider.mjs","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","configured":false,"fake":"memory-ec2-driver"},{"id":"gitea-control-plane","target":"gitea-actions + root-owned worker agent","operation":"registerEphemeral + verifyAssignment + deleteRunner","guard":"register only after cloud closure + exact org/repo/job/runner + reusable credential removed before code + Gitea 204/404 and local-state terminal proof","implementation":"ops/runner-factory/gitea-control-plane.mjs","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","configured":false,"fake":"memory-gitea-control-driver"},{"id":"capacity-controller","target":"durable-ephemeral-worker-capacity-ledger","operation":"acquire + confirmReplacement + freeze + inspect","guard":"global two-slot claim occurs before launch; only signed terminal replacement reopens generation N+1; ambiguity freezes the pool","implementation":"ops/runner-factory/capacity-controller.mjs","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","configured":false,"fake":"memory-capacity-driver"},{"id":"audit-sink","target":"append-only-receipt-journal","operation":"open + appendReceipt + sealFailure + inspect + verify","guard":"exact plan/job scope + pinned signatures + dual hash chain + CAS head + terminal seal","implementation":"ops/runner-factory/audit-sink.mjs","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","configured":false,"fake":"memory-audit-driver"}],"requestContracts":{"dynamoReservation":"two conditional items in one transaction","kmsSign":"canonical message digest, exact key ARN, pinned SPKI fingerprint and signing algorithm are receipted","giteaRegistrationToken":"HTTP 200 token response header must transfer as owned mutable bytes into a 30-second single-consumer capability; token value and digest are never recorded","giteaRunnerRead":"organization-scoped runner identity, name, ephemeral flag, status and exact labels must be attested before a capability is emitted","giteaJobRead":"repository and job identity must match the admitted event","giteaRunnerDelete":"204 and already-absent 404 are terminal success","ec2RunInstances":"ClientToken derives from the job-attempt key; an exact template ID plus numeric version requests one private, job-tagged instance","ec2TerminateInstances":"one exact instance is retired; DescribeInstances and DescribeVolumes must prove terminal state and root-volume absence"},"simulation":{"status":"PASS_TEST_ONLY","successCases":1,"failureCases":12,"safeTerminalCases":12,"compensatedCases":11,"lifecycleReceipts":10,"auditSuccessSeals":1,"auditFailureSeals":10,"verifiedAuditCases":11,"receiptTrust":"TEST_ONLY","secretExposureCount":0,"awsCallsExecuted":0,"giteaWritesExecuted":0},"sagaCases":[{"id":"RFS-01","failAt":null,"phase":"COMPLETE","expected":"SIMULATED_COMPLETE"},{"id":"RFS-02","failAt":"reservation","phase":"RESERVATION","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-03","failAt":"token-issue","phase":"TOKEN","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-04","failAt":"launch","phase":"LAUNCH","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-05","failAt":"register","phase":"REGISTRATION","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-06","failAt":"boundary","phase":"BOUNDARY","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-07","failAt":"assignment","phase":"ASSIGNMENT","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-08","failAt":"job","phase":"JOB","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-09","failAt":"terminate","phase":"RETIREMENT","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-10","failAt":"replacement","phase":"REPLACEMENT","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-11","failAt":"capacity-acquire","phase":"CAPACITY","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-12","failAt":"audit-open","phase":"AUDIT","expected":"SIMULATED_COMPENSATED_FAILURE"},{"id":"RFS-13","failAt":"audit-append","phase":"CAPACITY","expected":"SIMULATED_COMPENSATED_FAILURE"}],"productionPrerequisites":[{"id":"PERSISTENCE","resource":"DynamoDB reservation and capacity ledgers","status":"NOT_CREATED","approval":"cost-and-runtime"},{"id":"SIGNING","resource":"asymmetric KMS SIGN_VERIFY key","status":"NOT_CREATED","approval":"security-and-cost"},{"id":"TOKEN","resource":"root-scoped Gitea broker credential","status":"NOT_CONFIGURED","approval":"security-owner"},{"id":"COMPUTE","resource":"EC2 launch template and CI-only network","status":"NOT_CREATED","approval":"cost-and-runtime"},{"id":"JOURNAL","resource":"durable append-only receipt journal","status":"NOT_CREATED","approval":"security-and-cost"},{"id":"ONCALL","resource":"five-source reconciliation reader, metrics exporter, paging provider and owner","status":"NOT_CONFIGURED","approval":"platform-owner"}],"officialReferences":{"dynamoConditionalWrite":"https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_PutItem.html","kmsSign":"https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html","ec2Idempotency":"https://docs.aws.amazon.com/ec2/latest/devguide/ec2-api-idempotency.html","giteaOpenApi":"https://gitea.reits.tech/swagger.v1.json","giteaOpenApiVersion":"1.25.4","giteaOpenApiSha256":"sha256:e3f2132ce8d26427d092081a8706ea1935c2d56157728b4b36d22af67afc2e31"}},"servicePackage":{"status":"PACKAGE_EXECUTABLE_NOT_DEPLOYED","truth":{"systemdUnitInstalled":false,"liveControllerReplicas":0,"liveListeners":0,"publicRouteConfigured":false,"credentialFilesProvisioned":0,"configuredRuntimeAdapters":0,"productionWebhooksAccepted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"package":{"entrypoint":"ops/runner-factory/controller-service-main.mjs","httpServer":"ops/runner-factory/controller-http-server.mjs","serviceCore":"ops/runner-factory/controller-service-core.mjs","configuration":"ops/runner-factory/service-config.mjs","systemdTemplate":"ops/runner-factory/reits-runner-factory-controller.service","host":"127.0.0.1","port":8110,"mode":"EVIDENCE_ONLY","maxBodyBytes":262144,"maxInflightWebhooks":4,"applySupported":false},"endpoints":[{"method":"GET","path":"/healthz","success":200,"purpose":"process liveness without readiness claims"},{"method":"GET","path":"/readyz","success":200,"blocked":503,"purpose":"all production prerequisites must be receipted"},{"method":"POST","path":"/webhooks/gitea","success":202,"blocked":503,"purpose":"raw-body HMAC admission; production path currently blocked"}],"requestBoundary":{"socket":"loopback-only","proxyAuthentication":"GITEA_HMAC_RAW_BODY","cors":"ABSENT","bodyLimitEnforcedBeforeJson":true,"inflightLimit":4,"clientApplyFieldDenied":true,"secretValuesLogged":false,"errorStackExposed":false},"responseHeaders":["Cache-Control: no-store","Content-Type: application/json","Cross-Origin-Resource-Policy: same-origin","Referrer-Policy: no-referrer","X-Content-Type-Options: nosniff"],"readiness":{"status":"BLOCKED_CONFIGURATION","ready":false,"readyCount":0,"total":11,"source":"VERIFIED_ASSEMBLY_RECEIPT_ONLY","receiptVerified":false,"legacyBooleanEscalationAccepted":false,"missing":["RF_READY_DEDICATED_HOST","RF_READY_SERVICE_IDENTITY","RF_READY_WEBHOOK_SECRET","RF_READY_RESERVATION_STORE","RF_READY_RECEIPT_SIGNER","RF_READY_TOKEN_BROKER","RF_READY_WORKER_PROVIDER","RF_READY_GITEA_CONTROL","RF_READY_CAPACITY_CONTROLLER","RF_READY_AUDIT_SINK","RF_READY_OWNER_APPROVAL"]},"verification":{"status":"PASS_PACKAGE_TEST_ONLY","requestFixtures":15,"configFixtures":5,"fixtureWebhooksAccepted":1,"fixtureReplaysDenied":1,"productionWebhooksAccepted":0,"secretExposureCount":0,"externalWritesExecuted":0},"systemdHardening":["dedicated non-login identity","shared production host condition deny","credential file reference","no new privileges","strict filesystem protection","empty capabilities","loopback-only IP policy","0077 process umask"],"productionPrerequisites":["dedicated control-plane host","root-owned webhook credential","durable reservation table","asymmetric KMS signer","Gitea token broker credential","EC2 worker provider","append-only audit journal","durable capacity ledger, freeze alarm and owner approvals"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-service-fixtures/v1","requestCases":[{"id":"RFSVC-01","case":"health-loopback","expectedStatus":200,"expectedCode":"RF_SERVICE_ALIVE"},{"id":"RFSVC-02","case":"readiness-loopback","expectedStatus":503,"expectedCode":"RF_SERVICE_NOT_READY"},{"id":"RFSVC-03","case":"production-webhook-blocked","expectedStatus":503,"expectedCode":"RF_CONTROLLER_NOT_READY"},{"id":"RFSVC-04","case":"health-remote","expectedStatus":403,"expectedCode":"RF_SERVICE_NON_LOOPBACK"},{"id":"RFSVC-05","case":"readiness-remote","expectedStatus":403,"expectedCode":"RF_SERVICE_NON_LOOPBACK"},{"id":"RFSVC-06","case":"unknown-route","expectedStatus":404,"expectedCode":"RF_SERVICE_ROUTE"},{"id":"RFSVC-07","case":"webhook-get","expectedStatus":405,"expectedCode":"RF_SERVICE_METHOD"},{"id":"RFSVC-08","case":"webhook-options","expectedStatus":405,"expectedCode":"RF_SERVICE_METHOD"},{"id":"RFSVC-09","case":"fixture-valid","expectedStatus":202,"expectedCode":"RF_PLAN_ONLY"},{"id":"RFSVC-10","case":"fixture-replay","expectedStatus":409,"expectedCode":"RF_WEBHOOK_REPLAY"},{"id":"RFSVC-11","case":"fixture-bad-signature","expectedStatus":401,"expectedCode":"RF_SIGNATURE_INVALID"},{"id":"RFSVC-12","case":"fixture-client-control","expectedStatus":400,"expectedCode":"RF_CLIENT_CONTROL_FIELD"},{"id":"RFSVC-13","case":"fixture-unregistered-repository","expectedStatus":403,"expectedCode":"RF_REPOSITORY_NOT_REGISTERED"},{"id":"RFSVC-14","case":"fixture-oversize-declared","expectedStatus":413,"expectedCode":"RF_BODY_SIZE"},{"id":"RFSVC-15","case":"fixture-oversize-actual","expectedStatus":413,"expectedCode":"RF_BODY_SIZE"}],"configCases":[{"id":"RFSCFG-01","expectedCode":"RF_SERVICE_BIND"},{"id":"RFSCFG-02","expectedCode":"RF_SERVICE_PORT"},{"id":"RFSCFG-03","expectedCode":"RF_SERVICE_MODE"},{"id":"RFSCFG-04","expectedCode":"RF_SERVICE_FORBIDDEN_ENV"},{"id":"RFSCFG-05","expectedCode":"RF_SERVICE_FORBIDDEN_ENV"}]}},"reservationStore":{"schemaVersion":"developer.reits.tech/runner-factory-reservation-store/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T15:00:00Z","truth":{"dynamoTableCreated":false,"iamRoleConfigured":false,"adapterConfigured":false,"readinessGateSatisfied":false,"liveReservations":0,"dynamoReadsExecuted":0,"dynamoWritesExecuted":0,"recoveryDrillsObserved":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/reservation-store.mjs","testDriver":"ops/runner-factory/memory-dynamodb-driver.mjs","runtimeDriver":"NOT_CONFIGURED","tableName":"reits-runner-factory-reservations","partitionKey":"pk","recordsPerReservation":2,"consistentReads":true,"leaseSeconds":120,"replayRetentionSeconds":604800,"leaseTokenRecordedInLogs":false},"operations":[{"id":"reserve","dynamoOperation":"TransactWriteItems","records":2,"condition":"attribute_not_exists(pk)","result":"lease epoch 1"},{"id":"renew","dynamoOperation":"TransactWriteItems","records":2,"condition":"pair + scope + RESERVED + plan + lease token + epoch + unexpired","result":"same epoch, extended expiry"},{"id":"recoverExpired","dynamoOperation":"BatchGetItem + TransactWriteItems","records":2,"condition":"pair + scope + same plan + exact expired token/epoch/expiry","result":"new lease token, epoch + 1"},{"id":"complete","dynamoOperation":"TransactWriteItems","records":2,"condition":"pair + scope + RESERVED + plan + lease token + epoch + unexpired","result":"COMPLETED + receipt digest"},{"id":"fail","dynamoOperation":"TransactWriteItems","records":2,"condition":"pair + scope + RESERVED + plan + lease token + epoch + unexpired","result":"FAILED + terminal phase"}],"stateMachine":[{"from":"ABSENT","action":"reserve","to":"RESERVED","fencing":"leaseEpoch=1"},{"from":"RESERVED","action":"renew","to":"RESERVED","fencing":"same lease token"},{"from":"RESERVED_EXPIRED","action":"recoverExpired","to":"RESERVED","fencing":"new token + epoch increment"},{"from":"RESERVED","action":"complete","to":"COMPLETED","fencing":"current unexpired token"},{"from":"RESERVED","action":"fail","to":"FAILED","fencing":"current unexpired token"}],"invariants":["delivery and job-attempt keys change atomically","replay never overwrites an existing or terminal pair","expired leases require same-plan recovery, never fresh reserve","recovery rotates the lease token and increments the fencing epoch","stale token or epoch cannot renew, complete or fail","pair reads are strongly consistent and corruption fails closed","terminal rows retain replay evidence for seven days","lease token values never enter public evidence or structured logs"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":16,"allowedTransitions":5,"deniedTransitions":11,"atomicRollbackCases":1,"recoveryCases":1,"corruptionCases":2,"secretExposureCount":0,"externalCallsExecuted":0},"productionPrerequisites":["reviewed DynamoDB table with PITR, encryption and TTL","least-privilege controller IAM role scoped to one table","conditional-conflict, corruption and throttling metrics","expired-lease reconciler with single-owner election","backup restore and region-failure drill receipts","security, runtime and cost owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-reservation-store-fixtures/v1","fixedEpoch":1784566800,"cases":[{"id":"RFRS-01","case":"reserve-dual-key","expected":"ALLOW","reason":"RESERVED_EPOCH_1"},{"id":"RFRS-02","case":"duplicate-delivery","expected":"DENY","reason":"RF_RESERVATION_CONFLICT"},{"id":"RFRS-03","case":"duplicate-job-new-delivery","expected":"DENY","reason":"RF_RESERVATION_CONFLICT"},{"id":"RFRS-04","case":"partial-collision-atomic-rollback","expected":"DENY","reason":"RF_RESERVATION_CONFLICT"},{"id":"RFRS-05","case":"renew-current-lease","expected":"ALLOW","reason":"EXPIRY_EXTENDED"},{"id":"RFRS-06","case":"renew-wrong-token","expected":"DENY","reason":"RF_RESERVATION_STALE_LEASE"},{"id":"RFRS-07","case":"fresh-reserve-after-expiry","expected":"DENY","reason":"RF_RESERVATION_CONFLICT"},{"id":"RFRS-08","case":"recover-before-expiry","expected":"DENY","reason":"RF_RESERVATION_NOT_EXPIRED"},{"id":"RFRS-09","case":"recover-expired-same-plan","expected":"ALLOW","reason":"LEASE_EPOCH_INCREMENTED"},{"id":"RFRS-10","case":"recover-different-plan","expected":"DENY","reason":"RF_RESERVATION_CORRUPT"},{"id":"RFRS-11","case":"complete-stale-epoch","expected":"DENY","reason":"RF_RESERVATION_STALE_LEASE"},{"id":"RFRS-12","case":"complete-current-token","expected":"ALLOW","reason":"COMPLETED"},{"id":"RFRS-13","case":"replay-completed","expected":"DENY","reason":"RF_RESERVATION_CONFLICT"},{"id":"RFRS-14","case":"fail-current-token","expected":"ALLOW","reason":"FAILED"},{"id":"RFRS-15","case":"partial-pair-read","expected":"DENY","reason":"RF_RESERVATION_CORRUPT"},{"id":"RFRS-16","case":"pair-field-mismatch","expected":"DENY","reason":"RF_RESERVATION_CORRUPT"}]}},"receiptSigner":{"schemaVersion":"developer.reits.tech/runner-factory-receipt-signer/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T16:00:00Z","truth":{"kmsKeyCreated":false,"iamRoleConfigured":false,"adapterConfigured":false,"readinessGateSatisfied":false,"runtimeReceipts":0,"kmsGetPublicKeyCallsExecuted":0,"kmsSignCallsExecuted":0,"verificationDrillsObserved":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/receipt-signer.mjs","testDriver":"ops/runner-factory/memory-kms-driver.mjs","runtimeDriver":"NOT_CONFIGURED","keySelection":"EXACT_KEY_ARN","keyUsage":"SIGN_VERIFY","keySpec":"ECC_NIST_P256","messageType":"DIGEST","signingAlgorithm":"ECDSA_SHA_256","signatureEncoding":"ASN1_DER_BASE64","canonicalization":"recursive-key-order-json","maxCanonicalBytes":16384,"publicKeyPinnedBy":"SHA256_SPKI","privateKeyRecordedInEvidence":false},"operations":[{"id":"initialize","kmsOperation":"GetPublicKey","guard":"exact ARN + SIGN_VERIFY + ECC_NIST_P256 + ECDSA_SHA_256 + pinned SPKI fingerprint","result":"cached local verifier"},{"id":"sign","kmsOperation":"Sign","guard":"exact ARN + DIGEST + ECDSA_SHA_256 + canonical SHA-256","result":"DER signature bound to key metadata"},{"id":"verify","kmsOperation":"LOCAL","guard":"canonical digest + chain predecessor + pinned public key","result":"cryptographic receipt verdict"}],"stateMachine":[{"from":"UNINITIALIZED","action":"initialize","to":"KEY_PINNED","guard":"all key metadata and SPKI fingerprint match"},{"from":"KEY_PINNED","action":"sign genesis","to":"CHAIN_OPEN","guard":"sequence 0 + previousDigest null"},{"from":"CHAIN_OPEN","action":"sign next","to":"CHAIN_OPEN","guard":"sequence N + previous digest"},{"from":"CHAIN_OPEN","action":"verify","to":"VERIFIED","guard":"digest + ECDSA + continuity pass"},{"from":"ANY","action":"mismatch or outage","to":"FAIL_CLOSED","guard":"no unsigned receipt emitted"}],"invariants":["signing uses an exact KMS key ARN, never a mutable alias","the KMS key must be SIGN_VERIFY on ECC_NIST_P256","the SPKI SHA-256 fingerprint is pinned before signing","KMS signs exactly 32 digest bytes with MessageType DIGEST","the returned key ARN and algorithm must match the request","every receipt is locally verified before it leaves the adapter","sequence and predecessor digest make chain reordering fail closed","canonical facts are bounded plain JSON and secret-like string fields are denied","private key material never enters public evidence or runtime logs","TEST_ONLY signatures never increment runtime receipt truth"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":20,"allowedTransitions":5,"deniedTransitions":15,"keyPolicyDenials":5,"driverFailureDenials":2,"responseMismatchDenials":3,"tamperAndChainDenials":5,"signedReceipts":2,"verifiedChains":1,"secretExposureCount":0,"externalCallsExecuted":0},"productionPrerequisites":["reviewed asymmetric KMS SIGN_VERIFY key with rotation policy","least-privilege kms:GetPublicKey and kms:Sign controller IAM role","approved exact key ARN and SPKI fingerprint configuration","sign latency, throttling, invalid-signature and key-drift alarms","key-disable, rotation, rollback and verification drill receipts","security, runtime and cost owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-receipt-signer-fixtures/v1","fixedTime":"2026-07-20T16:00:00.000Z","cases":[{"id":"RFRK-01","case":"initialize-pinned-public-key","expected":"ALLOW","reason":"KEY_PINNED"},{"id":"RFRK-02","case":"sign-genesis-receipt","expected":"ALLOW","reason":"SIGNED_SEQUENCE_0"},{"id":"RFRK-03","case":"sign-chained-receipt","expected":"ALLOW","reason":"SIGNED_SEQUENCE_1"},{"id":"RFRK-04","case":"verify-two-receipt-chain","expected":"ALLOW","reason":"CHAIN_VERIFIED"},{"id":"RFRK-05","case":"reuse-cached-public-key","expected":"ALLOW","reason":"ONE_GET_PUBLIC_KEY"},{"id":"RFRK-06","case":"returned-key-arn-mismatch","expected":"DENY","reason":"RF_SIGNER_KEY_MISMATCH"},{"id":"RFRK-07","case":"spki-fingerprint-mismatch","expected":"DENY","reason":"RF_SIGNER_FINGERPRINT"},{"id":"RFRK-08","case":"wrong-key-usage","expected":"DENY","reason":"RF_SIGNER_KEY_POLICY"},{"id":"RFRK-09","case":"wrong-key-spec","expected":"DENY","reason":"RF_SIGNER_KEY_POLICY"},{"id":"RFRK-10","case":"signing-algorithm-absent","expected":"DENY","reason":"RF_SIGNER_KEY_POLICY"},{"id":"RFRK-11","case":"get-public-key-outage","expected":"DENY","reason":"RF_SIGNER_UNAVAILABLE"},{"id":"RFRK-12","case":"sign-outage","expected":"DENY","reason":"RF_SIGNER_UNAVAILABLE"},{"id":"RFRK-13","case":"sign-response-key-mismatch","expected":"DENY","reason":"RF_SIGNER_RESPONSE"},{"id":"RFRK-14","case":"sign-response-algorithm-mismatch","expected":"DENY","reason":"RF_SIGNER_RESPONSE"},{"id":"RFRK-15","case":"sign-response-invalid-signature","expected":"DENY","reason":"RF_SIGNER_SIGNATURE_INVALID"},{"id":"RFRK-16","case":"tampered-receipt-facts","expected":"DENY","reason":"RF_RECEIPT_DIGEST"},{"id":"RFRK-17","case":"tampered-receipt-digest","expected":"DENY","reason":"RF_RECEIPT_DIGEST"},{"id":"RFRK-18","case":"reordered-receipt-chain","expected":"DENY","reason":"RF_RECEIPT_SEQUENCE"},{"id":"RFRK-19","case":"secret-like-string-fact","expected":"DENY","reason":"RF_RECEIPT_FACTS_SECRET"},{"id":"RFRK-20","case":"invalid-genesis-predecessor","expected":"DENY","reason":"RF_RECEIPT_CHAIN"}]}},"tokenBroker":{"schemaVersion":"developer.reits.tech/runner-factory-registration-token-broker/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T16:40:00Z","truth":{"brokerCredentialConfigured":false,"runtimeDriverConfigured":false,"readinessGateSatisfied":false,"liveHandles":0,"giteaTokenCallsExecuted":0,"runtimeTokensIssued":0,"runtimeTokensConsumed":0,"runtimeTokensDestroyed":0,"tokenValuesRecorded":0,"tokenDigestsRecorded":0,"externalCallsExecuted":0,"giteaWritesExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/registration-token-broker.mjs","testDriver":"ops/runner-factory/memory-gitea-token-driver.mjs","runtimeDriver":"NOT_CONFIGURED","giteaVersion":"1.25.4","operationId":"orgCreateRunnerRegistrationToken","endpoint":"POST /api/v1/orgs/reits/actions/runners/registration-token","successStatus":200,"tokenTransport":"RESPONSE_HEADER_TOKEN_AS_MUTABLE_BYTES","handleIdSource":"INDEPENDENT_RANDOM_128_BIT","handleTtlSeconds":30,"maxTokenBytes":512,"singleConsumer":true,"zeroizeOnConsumerExit":true,"tokenValueRecorded":false,"tokenDigestRecorded":false},"operations":[{"id":"issue","actor":"controller","guard":"exact organization + plan scope + SecretRef-backed driver","result":"ACTIVE opaque capability"},{"id":"inspect","actor":"controller","guard":"metadata only; expiry may advance state","result":"secret-free lifecycle proof"},{"id":"consume","actor":"trusted Gitea registration adapter","guard":"ACTIVE + unexpired + single in-flight consumer","result":"CONSUMED and zeroized even on callback failure"},{"id":"destroy","actor":"controller compensation","guard":"not concurrently CONSUMING","result":"DESTROYED or idempotent terminal proof"}],"stateMachine":[{"from":"UNISSUED","action":"issue valid header bytes","to":"ACTIVE","guard":"HTTP 200 + mutable token header + bounded ASCII"},{"from":"ACTIVE","action":"inspect","to":"ACTIVE","guard":"no token or digest exposed"},{"from":"ACTIVE","action":"consume","to":"CONSUMING","guard":"atomic single-consumer claim"},{"from":"CONSUMING","action":"consumer exits","to":"CONSUMED","guard":"zeroize in finally on success or failure"},{"from":"ACTIVE","action":"destroy","to":"DESTROYED","guard":"zeroize without disclosure"},{"from":"ACTIVE","action":"TTL elapses","to":"EXPIRED","guard":"zeroize before denial"},{"from":"CONSUMED|DESTROYED|EXPIRED","action":"consume","to":"DENY","guard":"replay never reopens capability"}],"invariants":["the request is scoped to the configured organization and admitted factory plan","the broker credential is a SecretRef and never a caller-supplied value","Gitea 1.25.4 success is exactly HTTP 200 with the token response header","the runtime driver must transfer owned mutable bytes, never an immutable string","token bytes are bounded printable token characters and at most 512 bytes","the capability ID is independent random data and is never derived from the token","inspect and JSON serialization expose lifecycle metadata but no token or token digest","only one consumer may claim the capability and reentrant consumption is denied","TTL expiry zeroizes bytes before returning an expired verdict","consumer success and consumer failure both zeroize bytes in a finally boundary","explicit destroy is idempotent after a terminal state and cannot race consumption","TEST_ONLY token activity never increments runtime or Gitea-write truth"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":22,"allowedTransitions":6,"deniedTransitions":16,"requestAndScopeDenials":3,"driverAndResponseDenials":7,"lifecycleDenials":6,"handlesIssued":6,"handlesConsumed":3,"handlesDestroyedOrExpired":6,"tokenValuesRecorded":0,"tokenDigestsRecorded":0,"externalCallsExecuted":0},"productionPrerequisites":["root-scoped Gitea broker credential delivered by a systemd Credential file","isolated runtime driver that transfers the token header directly into owned mutable bytes","exact Gitea base URL, organization and credential SecretRef configuration","token issue latency, response-contract, replay and expiry alarms","credential rotation, broker outage and zeroization drill receipts","security and runtime owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-registration-token-broker-fixtures/v1","fixedTime":"2026-07-20T16:40:00.000Z","cases":[{"id":"RFTB-01","case":"exact-gitea-request","expected":"ALLOW","reason":"REQUEST_PINNED"},{"id":"RFTB-02","case":"issue-active-capability","expected":"ALLOW","reason":"HANDLE_ACTIVE"},{"id":"RFTB-03","case":"inspect-redacted-proof","expected":"ALLOW","reason":"PROOF_SECRET_FREE"},{"id":"RFTB-04","case":"consume-once-and-zeroize","expected":"ALLOW","reason":"CONSUMED_ZEROIZED"},{"id":"RFTB-05","case":"destroy-before-consume","expected":"ALLOW","reason":"DESTROYED_ZEROIZED"},{"id":"RFTB-06","case":"idempotent-destroy-after-consume","expected":"ALLOW","reason":"TERMINAL_PROOF"},{"id":"RFTB-07","case":"non-https-or-pathful-base-url","expected":"DENY","reason":"RF_TOKEN_CONFIG"},{"id":"RFTB-08","case":"organization-scope-mismatch","expected":"DENY","reason":"RF_TOKEN_SCOPE"},{"id":"RFTB-09","case":"invalid-credential-reference","expected":"DENY","reason":"RF_TOKEN_CONFIG"},{"id":"RFTB-10","case":"gitea-driver-outage","expected":"DENY","reason":"RF_TOKEN_UNAVAILABLE"},{"id":"RFTB-11","case":"unexpected-http-status","expected":"DENY","reason":"RF_TOKEN_RESPONSE"},{"id":"RFTB-12","case":"missing-token-header","expected":"DENY","reason":"RF_TOKEN_MUTABILITY"},{"id":"RFTB-13","case":"immutable-string-token-header","expected":"DENY","reason":"RF_TOKEN_MUTABILITY"},{"id":"RFTB-14","case":"short-token-header","expected":"DENY","reason":"RF_TOKEN_FORMAT"},{"id":"RFTB-15","case":"oversized-token-header","expected":"DENY","reason":"RF_TOKEN_FORMAT"},{"id":"RFTB-16","case":"invalid-token-header-bytes","expected":"DENY","reason":"RF_TOKEN_FORMAT"},{"id":"RFTB-17","case":"unexpected-response-body","expected":"DENY","reason":"RF_TOKEN_RESPONSE"},{"id":"RFTB-18","case":"expired-before-consume","expected":"DENY","reason":"RF_TOKEN_EXPIRED"},{"id":"RFTB-19","case":"second-consume-replay","expected":"DENY","reason":"RF_TOKEN_REPLAY"},{"id":"RFTB-20","case":"consume-after-destroy","expected":"DENY","reason":"RF_TOKEN_DESTROYED"},{"id":"RFTB-21","case":"reentrant-consume","expected":"DENY","reason":"RF_TOKEN_IN_USE"},{"id":"RFTB-22","case":"consumer-failure-still-zeroizes","expected":"DENY","reason":"RF_TOKEN_CONSUMER"}]}},"workerProvider":{"schemaVersion":"developer.reits.tech/runner-factory-worker-provider/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T17:55:00Z","truth":{"launchTemplateCreated":false,"ciNetworkCreated":false,"bootstrapProfileCreated":false,"runtimeDriverConfigured":false,"readinessGateSatisfied":false,"liveWorkers":0,"runtimeJobs":0,"ec2CallsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/worker-provider.mjs","testDriver":"ops/runner-factory/memory-ec2-driver.mjs","runtimeDriver":"NOT_CONFIGURED","region":"ap-southeast-2","launchTemplateSelection":"EXACT_ID_AND_NUMERIC_VERSION","capacityPerRequest":1,"clientToken":"SHA256_JOB_ATTEMPT_KEY","publicIpv4":false,"ipv6":false,"bootstrapImds":"IMDSV2_REQUIRED_HOP_LIMIT_1","jobImds":"DISABLED","maxJobs":1,"rootVolume":"ENCRYPTED_GP3_DELETE_ON_TERMINATION","proofTransport":"OPAQUE_CAPABILITY_AND_SECRET_FREE_FACTS"},"operations":[{"id":"launch","target":"EC2 RunInstances + DescribeInstances","guard":"one private instance + exact immutable template + job-bound tags + attached encrypted disposable root","result":"BOOTSTRAP_RUNNING"},{"id":"closeCloudBoundary","target":"DescribeIamInstanceProfileAssociations + DisassociateIamInstanceProfile + ModifyInstanceMetadataOptions + RebootInstances + DescribeInstances","guard":"profile absent and IMDS disabled after reboot","result":"CLOUD_BOUNDARY_CLOSED"},{"id":"runJob","target":"injected one-job worker agent","guard":"exact admitted job + boundary closed + jobsCompleted zero","result":"JOB_FINISHED"},{"id":"terminate","target":"TerminateInstances + DescribeInstances + DescribeVolumes","guard":"exact instance terminated + exact root volume absent","result":"TERMINATED"}],"stateMachine":[{"from":"UNALLOCATED","action":"launch","to":"BOOTSTRAP_RUNNING","guard":"launch and attestation match"},{"from":"BOOTSTRAP_RUNNING","action":"closeCloudBoundary","to":"CLOUD_BOUNDARY_CLOSED","guard":"profile absent + IMDS disabled + reboot verified"},{"from":"CLOUD_BOUNDARY_CLOSED","action":"runJob","to":"JOB_RUNNING","guard":"exact job + zero prior jobs"},{"from":"JOB_RUNNING","action":"agent result","to":"JOB_FINISHED","guard":"exact instance/job + one completion"},{"from":"BOOTSTRAP_RUNNING|CLOUD_BOUNDARY_CLOSED|JOB_FINISHED|FAILED_NEEDS_TERMINATION","action":"terminate","to":"TERMINATING","guard":"exact instance ID"},{"from":"TERMINATING","action":"retirement proof","to":"TERMINATED","guard":"instance terminated + root volume absent"},{"from":"ANY_MUTATING","action":"driver/proof failure","to":"FAILED_NEEDS_TERMINATION","guard":"no later admission"},{"from":"FAILED_NEEDS_TERMINATION","action":"compensate","to":"TERMINATING","guard":"termination remains retryable"},{"from":"TERMINATED","action":"terminate","to":"TERMINATED","guard":"return idempotent terminal proof"}],"invariants":["launch uses an exact launch-template ID and numeric immutable version","ClientToken deterministically binds one admitted job attempt","each request asks for exactly one on-demand private worker","the worker receives no public IPv4, IPv6 or production route","bootstrap IMDS requires v2 and a hop limit of one","the bootstrap profile is exact and only present before admission","profile detachment and IMDS disablement are re-read after reboot","untrusted work cannot start before the cloud boundary is closed","the job identity must exactly match the launch plan","a worker completes at most one job and replay is denied","the root gp3 volume is encrypted and delete-on-termination","retirement requires both instance termination and volume absence","failed boundary, job or retirement proofs remain non-admissible","public proof excludes credentials, user data and mutable capabilities"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":34,"allowedTransitions":8,"deniedTransitions":26,"ec2OperationsModeled":8,"jobAgentOperationsModeled":1,"compensationCases":1,"idempotentTerminalCases":1,"secretExposureCount":0,"externalCallsExecuted":0},"failureClasses":[{"code":"RF_WORKER_CONFIG|DRIVER|SCOPE|HANDLE","phase":"PRE_MUTATION","action":"deny without EC2 call"},{"code":"RF_WORKER_LAUNCH_*","phase":"LAUNCH","action":"fail reservation and reconcile launch request ID"},{"code":"RF_WORKER_BOUNDARY_*","phase":"BOUNDARY","action":"keep offline and terminate"},{"code":"RF_WORKER_JOB_*","phase":"EXECUTION","action":"deny reuse and terminate"},{"code":"RF_WORKER_TERMINATION_*","phase":"RETIREMENT","action":"freeze capacity and page owner"}],"productionPrerequisites":["approved immutable launch template, AMI digest and numeric template version","dedicated private CI subnet, zero-ingress security group and verified no-production routes","least-privilege bootstrap instance profile with detach permission owned by the controller","AWS SDK runtime driver with bounded waiters, retry budgets and request-ID journaling","worker-agent authenticated channel that cannot mint cloud credentials","instance and root-volume orphan reconciliation alarms with a named on-call owner","security, runtime and cost-owner approval"],"officialReferences":{"runInstances":"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html","describeInstances":"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html","disassociateProfile":"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateIamInstanceProfile.html","modifyMetadata":"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceMetadataOptions.html","terminateInstances":"https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TerminateInstances.html"},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-worker-provider-fixtures/v1","fixedTime":"2026-07-20T17:20:00.000Z","cases":[{"id":"RFWP-01","case":"immutable-launch-template-request","expected":"ALLOW","reason":"REQUEST_PINNED"},{"id":"RFWP-02","case":"launch-one-private-bootstrap-worker","expected":"ALLOW","reason":"BOOTSTRAP_RUNNING"},{"id":"RFWP-03","case":"inspect-secret-free-worker-proof","expected":"ALLOW","reason":"PROOF_REDACTED"},{"id":"RFWP-04","case":"detach-profile-disable-imds-reboot-verify","expected":"ALLOW","reason":"CLOUD_BOUNDARY_CLOSED"},{"id":"RFWP-05","case":"run-exactly-one-admitted-job","expected":"ALLOW","reason":"JOB_FINISHED"},{"id":"RFWP-06","case":"terminate-and-prove-root-volume-deleted","expected":"ALLOW","reason":"TERMINATED"},{"id":"RFWP-07","case":"terminate-during-bootstrap-compensation","expected":"ALLOW","reason":"COMPENSATED"},{"id":"RFWP-08","case":"idempotent-terminal-proof","expected":"ALLOW","reason":"TERMINATED_IDEMPOTENT"},{"id":"RFWP-09","case":"mutable-launch-template-version","expected":"DENY","reason":"RF_WORKER_CONFIG"},{"id":"RFWP-10","case":"incomplete-ec2-driver","expected":"DENY","reason":"RF_WORKER_DRIVER"},{"id":"RFWP-11","case":"two-job-worker-plan","expected":"DENY","reason":"RF_WORKER_SCOPE"},{"id":"RFWP-12","case":"worker-region-mismatch","expected":"DENY","reason":"RF_WORKER_SCOPE"},{"id":"RFWP-13","case":"run-instances-outage","expected":"DENY","reason":"RF_WORKER_LAUNCH_UNAVAILABLE"},{"id":"RFWP-14","case":"multiple-instances-in-launch-response","expected":"DENY","reason":"RF_WORKER_LAUNCH_RESPONSE"},{"id":"RFWP-15","case":"public-address-in-launch-response","expected":"DENY","reason":"RF_WORKER_LAUNCH_RESPONSE"},{"id":"RFWP-16","case":"imds-v1-enabled-in-launch-response","expected":"DENY","reason":"RF_WORKER_LAUNCH_RESPONSE"},{"id":"RFWP-17","case":"wrong-bootstrap-profile","expected":"DENY","reason":"RF_WORKER_LAUNCH_RESPONSE"},{"id":"RFWP-18","case":"job-binding-tag-mismatch","expected":"DENY","reason":"RF_WORKER_LAUNCH_RESPONSE"},{"id":"RFWP-19","case":"root-volume-not-delete-on-termination","expected":"DENY","reason":"RF_WORKER_LAUNCH_RESPONSE"},{"id":"RFWP-20","case":"pre-boundary-describe-outage","expected":"DENY","reason":"RF_WORKER_BOUNDARY_UNAVAILABLE"},{"id":"RFWP-21","case":"profile-association-mismatch","expected":"DENY","reason":"RF_WORKER_BOUNDARY_PROOF"},{"id":"RFWP-22","case":"profile-detach-response-mismatch","expected":"DENY","reason":"RF_WORKER_BOUNDARY_PROOF"},{"id":"RFWP-23","case":"imds-disable-response-mismatch","expected":"DENY","reason":"RF_WORKER_BOUNDARY_PROOF"},{"id":"RFWP-24","case":"profile-retained-after-reboot","expected":"DENY","reason":"RF_WORKER_BOUNDARY_PROOF"},{"id":"RFWP-25","case":"imds-retained-after-reboot","expected":"DENY","reason":"RF_WORKER_BOUNDARY_PROOF"},{"id":"RFWP-26","case":"job-before-cloud-boundary","expected":"DENY","reason":"RF_WORKER_STATE"},{"id":"RFWP-27","case":"wrong-job-identity","expected":"DENY","reason":"RF_WORKER_JOB_SCOPE"},{"id":"RFWP-28","case":"job-agent-result-mismatch","expected":"DENY","reason":"RF_WORKER_JOB_RESPONSE"},{"id":"RFWP-29","case":"second-job-replay","expected":"DENY","reason":"RF_WORKER_JOB_REPLAY"},{"id":"RFWP-30","case":"terminate-instances-outage","expected":"DENY","reason":"RF_WORKER_TERMINATION_UNAVAILABLE"},{"id":"RFWP-31","case":"termination-response-instance-mismatch","expected":"DENY","reason":"RF_WORKER_TERMINATION_PROOF"},{"id":"RFWP-32","case":"instance-not-terminal-after-termination","expected":"DENY","reason":"RF_WORKER_TERMINATION_PROOF"},{"id":"RFWP-33","case":"root-volume-still-exists","expected":"DENY","reason":"RF_WORKER_TERMINATION_PROOF"},{"id":"RFWP-34","case":"forged-worker-capability","expected":"DENY","reason":"RF_WORKER_HANDLE"}]}},"giteaControlPlane":{"schemaVersion":"developer.reits.tech/runner-factory-gitea-control-plane/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T17:55:00Z","scope":{"baseUrl":"https://gitea.reits.tech","organization":"reits","repositoryPattern":"reits/<admitted-repository>","credentialSelection":"SECRET_REFERENCE_ONLY","agentSocket":"unix:///run/reits-runner/agent.sock","allowedLabels":["ubuntu-latest"],"maxJobs":1},"truth":{"runtimeDriverConfigured":false,"controlCredentialConfigured":false,"workerAgentInstalled":false,"liveRunners":0,"runtimeAssignments":0,"giteaReadsExecuted":0,"giteaWritesExecuted":0,"registrationSecretsRecorded":0,"runnerCredentialsRecorded":0,"readinessGateSatisfied":false,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/gitea-control-plane.mjs","testDriver":"ops/runner-factory/memory-gitea-control-driver.mjs","fixtureRegistry":"ops/runner-factory/gitea-control-plane-fixtures.json","verifier":"scripts/verify-runner-factory-gitea-control-plane.mjs","runtimeDriver":"NOT_CONFIGURED"},"operations":[{"id":"registerEphemeral","input":"cloud-closed worker + mutable one-time token bytes + exact org/repo/job/plan/labels","proof":"worker-agent attestation + org-scoped Gitea runner GET","failure":"retire unemitted runner or report cleanup unproven"},{"id":"verifyAssignment","input":"opaque runner capability + admitted job + maxJobs=1","proof":"repo job GET binds runner_id/name + root agent removes reusable file and holds one exact-job memory lease","failure":"FAILED_NEEDS_DELETE"},{"id":"deleteRunner","input":"opaque runner capability","proof":"org runner DELETE returns 204/404 + root agent destroys credential and assignment state","failure":"FAILED_NEEDS_DELETE and retryable"}],"modeledCalls":[{"boundary":"worker-agent","operation":"RegisterRunner","authority":"one-time mutable token bytes","recorded":false},{"boundary":"gitea-rest","operation":"GET /orgs/reits/actions/runners/{runner_id}","authority":"control credential reference"},{"boundary":"gitea-rest","operation":"GET /repos/{owner}/{repo}/actions/jobs/{job_id}","authority":"control credential reference"},{"boundary":"worker-agent","operation":"SealAssignment","authority":"root-owned unix socket"},{"boundary":"gitea-rest","operation":"DELETE /orgs/reits/actions/runners/{runner_id}","authority":"control credential reference"},{"boundary":"worker-agent","operation":"DestroyRunnerState","authority":"root-owned unix socket"}],"stateMachine":[{"from":"NONE","operation":"registerEphemeral","to":"REGISTERED","guard":"worker is CLOUD_BOUNDARY_CLOSED and both agent/API attest exact ephemeral runner"},{"from":"NONE","operation":"registration proof failure","to":"NO_HANDLE","guard":"DELETE 204/404 plus local destruction is attempted before returning"},{"from":"REGISTERED","operation":"verifyAssignment","to":"VERIFYING_ASSIGNMENT","guard":"exact job and maxJobs=1"},{"from":"VERIFYING_ASSIGNMENT","operation":"job + seal proof","to":"ASSIGNMENT_SEALED","guard":"runner_id/name match and reusable file is absent"},{"from":"VERIFYING_ASSIGNMENT","operation":"proof failure","to":"FAILED_NEEDS_DELETE","guard":"untrusted execution remains denied"},{"from":"REGISTERED","operation":"deleteRunner","to":"DELETING","guard":"pre-assignment compensation"},{"from":"ASSIGNMENT_SEALED","operation":"deleteRunner","to":"DELETING","guard":"normal retirement"},{"from":"FAILED_NEEDS_DELETE","operation":"deleteRunner","to":"DELETING","guard":"failure compensation or retry"},{"from":"DELETING","operation":"204/404 + local destruction","to":"DELETED","guard":"both control-plane and worker-local authority are terminal"},{"from":"DELETED","operation":"deleteRunner","to":"DELETED","guard":"side-effect-free idempotent retry"}],"invariants":["registration occurs only after the EC2 profile is detached, IMDS is disabled and reboot readback passes","the 30-second registration-token handle is issued after cloud-boundary closure, never across launch or reboot","registration secret is passed as the same mutable Buffer and is never copied, serialized, hashed or retained","organization, repository, job, plan, worker, labels and maxJobs are exact rather than caller-selected","runner registration must be ephemeral and independently re-read through the organization-scoped Gitea API","public runner capability excludes control credentials, registration bytes and reusable runner credentials","assignment requires Gitea job status in_progress with exact runner_id, runner_name and labels","Gitea assignment proof and root-owned worker-agent credential proof are distinct and both mandatory","the reusable .runner file is absent before untrusted code while one exact-job lease remains in root daemon memory","reits-job cannot read the runner credential file, agent socket or assignment lease","a second assignment or wrong job is permanently denied","runner deletion accepts only Gitea 204 or already-absent 404 as control-plane terminal","retirement additionally destroys credential files, the in-memory lease and worker-local runner state","registration failures after runner creation attempt cleanup before any capability can escape","failed assignment or deletion stays non-admissible and requires retry or worker termination","no test-driver call counts as a Gitea read, write, live runner or runtime assignment"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":34,"allowedTransitions":8,"deniedTransitions":26,"adapterOperations":3,"modeledCalls":6,"internalRegistrationCompensations":3,"idempotentTerminalCases":2,"secretExposureCount":0,"externalCallsExecuted":0},"failureClasses":[{"code":"RF_GITEA_CONFIG|DRIVER|SCOPE|LABELS|WORKER|HANDLE","phase":"PRE_MUTATION","action":"deny without registration"},{"code":"RF_GITEA_REGISTRATION_*","phase":"REGISTRATION","action":"delete any identifiable unemitted runner, destroy local state and terminate worker"},{"code":"RF_GITEA_ASSIGNMENT_*","phase":"ASSIGNMENT","action":"deny job, delete runner and terminate worker"},{"code":"RF_GITEA_CREDENTIAL_SEAL_*","phase":"CREDENTIAL_BOUNDARY","action":"deny untrusted code, delete runner and terminate worker"},{"code":"RF_GITEA_DELETE_*|RF_GITEA_LOCAL_RETIREMENT_PROOF","phase":"RETIREMENT","action":"retry 204/404 reconciliation; freeze capacity if terminal proof remains missing"}],"productionPrerequisites":["least-privilege Gitea credential reference restricted to reits organization runner read/delete and admitted repository job read","root-owned worker-agent binary and unix socket with an authenticated controller channel","runner version and labels pinned in the immutable AMI, with --ephemeral enforced","tmpfs credential path and filesystem/UID denial test proving reits-job cannot read root authority","bounded API retries, delete reconciliation journal and orphan-runner alarm","registration/assignment/retirement runtime receipts joined to plan, worker, runner and job identities","security owner, Gitea owner and runtime owner approval"],"officialReferences":{"liveOpenApi":"https://gitea.reits.tech/swagger.v1.json","openApiVersion":"1.25.4","ephemeralRunners":"https://docs.gitea.com/usage/actions/act-runner#ephemeral-runners"},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-gitea-control-plane-fixtures/v1","fixedTime":"2026-07-20T17:55:00.000Z","cases":[{"id":"RFGC-01","expected":"ALLOW","reason":"EXACT_REQUESTS","scenario":"org runner GET, repository job GET and org runner DELETE remain exactly scoped"},{"id":"RFGC-02","expected":"ALLOW","reason":"REGISTERED","scenario":"cloud-closed worker and mutable token produce an attested ephemeral runner"},{"id":"RFGC-03","expected":"ALLOW","reason":"OPAQUE_CAPABILITY","scenario":"serialized handle contains proof but no mutable authority"},{"id":"RFGC-04","expected":"ALLOW","reason":"ASSIGNMENT_SEALED","scenario":"exact in-progress job and root-agent seal produce a one-job memory lease"},{"id":"RFGC-05","expected":"ALLOW","reason":"DELETE_204","scenario":"present runner and local authority both become terminal"},{"id":"RFGC-06","expected":"ALLOW","reason":"DELETE_404","scenario":"already-absent Gitea runner still requires local destruction"},{"id":"RFGC-07","expected":"ALLOW","reason":"PRE_ASSIGNMENT_COMPENSATION","scenario":"registered runner can retire before assignment"},{"id":"RFGC-08","expected":"ALLOW","reason":"IDEMPOTENT_DELETE","scenario":"retry after terminal proof performs no further calls"},{"id":"RFGC-09","expected":"DENY","reason":"RF_GITEA_CONFIG","scenario":"base URL contains a path"},{"id":"RFGC-10","expected":"DENY","reason":"RF_GITEA_DRIVER","scenario":"driver omits required operations"},{"id":"RFGC-11","expected":"DENY","reason":"RF_GITEA_SCOPE","scenario":"caller requests another organization"},{"id":"RFGC-12","expected":"DENY","reason":"RF_GITEA_SCOPE","scenario":"repository owner is outside reits"},{"id":"RFGC-13","expected":"DENY","reason":"RF_GITEA_REPLAY","scenario":"the same plan, worker, repository and job registration scope is reused"},{"id":"RFGC-14","expected":"DENY","reason":"RF_GITEA_SECRET","scenario":"registration token bytes are empty"},{"id":"RFGC-15","expected":"DENY","reason":"RF_GITEA_LABELS","scenario":"runner requests an unapproved label"},{"id":"RFGC-16","expected":"DENY","reason":"RF_GITEA_WORKER","scenario":"registration is attempted before cloud-boundary closure"},{"id":"RFGC-17","expected":"DENY","reason":"RF_GITEA_REGISTRATION_UNAVAILABLE","scenario":"worker-agent registration is unavailable"},{"id":"RFGC-18","expected":"DENY","reason":"RF_GITEA_REGISTRATION_COMPENSATION","scenario":"agent returns an unknown runner ID so cleanup cannot prove the actual created runner absent"},{"id":"RFGC-19","expected":"DENY","reason":"RF_GITEA_REGISTRATION_READ","scenario":"org runner read returns a mismatched runner ID and internal cleanup passes"},{"id":"RFGC-20","expected":"DENY","reason":"RF_GITEA_REGISTRATION_READ","scenario":"Gitea runner is not ephemeral and internal cleanup passes"},{"id":"RFGC-21","expected":"DENY","reason":"RF_GITEA_REGISTRATION_READ","scenario":"Gitea runner labels drift and internal cleanup passes"},{"id":"RFGC-22","expected":"DENY","reason":"RF_GITEA_ASSIGNMENT_SCOPE","scenario":"assignment job differs from admitted job"},{"id":"RFGC-23","expected":"DENY","reason":"RF_GITEA_ASSIGNMENT_SCOPE","scenario":"assignment permits more than one job"},{"id":"RFGC-24","expected":"DENY","reason":"RF_GITEA_ASSIGNMENT_UNAVAILABLE","scenario":"repository job read is unavailable"},{"id":"RFGC-25","expected":"DENY","reason":"RF_GITEA_ASSIGNMENT_PROOF","scenario":"job is assigned to another runner"},{"id":"RFGC-26","expected":"DENY","reason":"RF_GITEA_ASSIGNMENT_PROOF","scenario":"job has not entered in_progress"},{"id":"RFGC-27","expected":"DENY","reason":"RF_GITEA_ASSIGNMENT_PROOF","scenario":"job labels differ from runner labels"},{"id":"RFGC-28","expected":"DENY","reason":"RF_GITEA_CREDENTIAL_SEAL_UNAVAILABLE","scenario":"root-owned credential seal is unavailable"},{"id":"RFGC-29","expected":"DENY","reason":"RF_GITEA_CREDENTIAL_SEAL_PROOF","scenario":"reusable credential file remains present"},{"id":"RFGC-30","expected":"DENY","reason":"RF_GITEA_ASSIGNMENT_REPLAY","scenario":"runner receives a second assignment"},{"id":"RFGC-31","expected":"DENY","reason":"RF_GITEA_DELETE_PROOF","scenario":"Gitea delete returns a non-terminal status"},{"id":"RFGC-32","expected":"DENY","reason":"RF_GITEA_DELETE_UNAVAILABLE","scenario":"Gitea delete is unavailable"},{"id":"RFGC-33","expected":"DENY","reason":"RF_GITEA_LOCAL_RETIREMENT_PROOF","scenario":"worker-agent local state remains"},{"id":"RFGC-34","expected":"DENY","reason":"RF_GITEA_HANDLE","scenario":"caller forges the opaque capability"}]}},"capacityController":{"schemaVersion":"developer.reits.tech/runner-factory-capacity-controller/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T18:35:00Z","scope":{"poolId":"rfpool_linux-amd64","desiredSlots":2,"slotsPerAdmission":1,"maxJobsPerWorker":1,"capacityMeaning":"CONCURRENT_EPHEMERAL_WORKER_BUDGET_NOT_WARM_INSTANCES","failureMode":"WHOLE_POOL_FREEZE"},"truth":{"runtimeDriverConfigured":false,"durableCapacityLedgerCreated":false,"readinessGateSatisfied":false,"livePools":0,"liveSlots":0,"liveAcquisitions":0,"runtimeReplacements":0,"runtimeFreezes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/capacity-controller.mjs","testDriver":"ops/runner-factory/memory-capacity-driver.mjs","fixtureRegistry":"ops/runner-factory/capacity-controller-fixtures.json","verifier":"scripts/verify-runner-factory-capacity-controller.mjs","runtimeDriver":"NOT_CONFIGURED","receiptVerifier":"PINNED_KMS_PUBLIC_KEY_REQUIRED_AT_RUNTIME"},"operations":[{"id":"acquire","guard":"exact plan + one slot + one job + atomic available-slot claim","result":"opaque ACQUIRED capacity capability"},{"id":"confirmReplacement","guard":"terminal Worker proof + verified normal/compensation retirement receipt + generation CAS + consistent readback","result":"same slot AVAILABLE at generation N+1"},{"id":"freeze","guard":"occupied or uncertain slot + bounded reason + durable whole-pool readback","result":"FROZEN scheduling pool"},{"id":"inspect","guard":"unforgeable in-process capability","result":"secret-free slot proof"}],"driverCalls":[{"id":"AcquireSlot","mutation":true,"guard":"pool active + available slot + unique plan/job attempt"},{"id":"ReadSlot","mutation":false,"guard":"consistent exact-slot readback"},{"id":"ReplaceSlot","mutation":true,"guard":"lease + generation + plan/job + signed retirement digest"},{"id":"FreezePool","mutation":true,"guard":"uncertain slot causes global scheduling denial"},{"id":"ReadPool","mutation":false,"guard":"consistent freeze readback"}],"stateMachine":[{"from":"AVAILABLE","action":"acquire","to":"ACQUIRED","guard":"one exact slot claimed atomically"},{"from":"ACQUIRED","action":"confirmReplacement","to":"REPLACING","guard":"worker terminal + signed retirement receipt verified"},{"from":"REPLACING","action":"CAS + readback","to":"REPLACED","guard":"same slot available at generation N+1"},{"from":"REPLACING","action":"driver/proof failure","to":"FAILED_NEEDS_FREEZE","guard":"capacity cannot be admitted"},{"from":"ACQUIRED","action":"unsafe lifecycle failure","to":"FAILED_NEEDS_FREEZE","guard":"no silent slot release"},{"from":"ACQUIRED|REPLACING|FAILED_NEEDS_FREEZE","action":"freeze","to":"FROZEN","guard":"whole-pool freeze read back"},{"from":"REPLACED","action":"confirmReplacement","to":"REPLACED","guard":"side-effect-free terminal retry"},{"from":"FROZEN","action":"freeze","to":"FROZEN","guard":"side-effect-free terminal retry"},{"from":"REPLACED|FROZEN","action":"late conflicting mutation","to":"DENIED","guard":"terminal capability cannot cross state"}],"invariants":["global pool size is enforced before EC2 launch, not inferred after launch","capacity means concurrent ephemeral-worker budget and never claims warm instances","each admitted plan consumes exactly one slot for one job attempt","plan and job-attempt replay cannot acquire another slot","slot authority is an opaque capability and its lease token is never serialized","replacement requires the Worker capability to prove terminal instance and deleted root volume","replacement also requires a cryptographically verified normal or compensation retirement receipt","receipt facts bind the exact plan, job, worker ID and storage terminal state","replacement uses the current lease and generation as a fencing condition","replacement is accepted only after a consistent read shows generation N+1 available","an ambiguous replacement never reopens capacity and must freeze","an unsafe lifecycle failure freezes the whole scheduling pool","freeze is accepted only after an independent pool readback","terminal replacement and freeze retries are side-effect free","there is no adapter path that unfreezes production capacity","TEST_ONLY driver operations never count as runtime capacity evidence"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":30,"allowedTransitions":8,"deniedTransitions":22,"driverCallsModeled":5,"concurrencyBoundCases":2,"receiptAndWorkerProofDenials":8,"freezeProofCases":4,"idempotentTerminalCases":2,"leaseValuesRecorded":0,"externalCallsExecuted":0},"failureClasses":[{"code":"RF_CAPACITY_CONFIG|DRIVER|VERIFIER|SCOPE","phase":"PRE_MUTATION","action":"deny before capacity claim"},{"code":"RF_CAPACITY_ACQUIRE_*|REPLAY","phase":"ADMISSION","action":"deny launch; reconcile any ambiguous claim"},{"code":"RF_CAPACITY_RECEIPT_*|WORKER_PROOF","phase":"RETIREMENT","action":"keep slot non-admissible and freeze"},{"code":"RF_CAPACITY_REPLACE_*","phase":"REPLACEMENT","action":"freeze whole pool; page owner"},{"code":"RF_CAPACITY_FREEZE_*","phase":"CONTAINMENT","action":"deny all scheduling externally; require operator reconciliation"}],"productionPrerequisites":["durable strongly consistent capacity ledger with atomic slot claim and generation CAS","runtime driver identity restricted to one reviewed pool and no unfreeze permission","pinned KMS public verifier for normal and compensation retirement receipts","Controller Saga integration that acquires capacity before EC2 launch","alarm and named on-call owner for acquire ambiguity, replacement drift and freeze failure","operator runbook requiring orphan reconciliation before a separate approved unfreeze path","security, runtime, reliability and cost-owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-capacity-controller-fixtures/v1","fixedTime":"2026-07-20T18:35:00.000Z","cases":[{"id":"RFCC-01","expected":"ALLOW","reason":"ACQUIRED","scenario":"exact plan atomically claims one of two slots"},{"id":"RFCC-02","expected":"ALLOW","reason":"OPAQUE_PROOF","scenario":"serialized handle excludes the lease token"},{"id":"RFCC-03","expected":"ALLOW","reason":"REPLACED","scenario":"verified F8 and terminal worker reopen generation N+1"},{"id":"RFCC-04","expected":"ALLOW","reason":"REPLACED_IDEMPOTENT","scenario":"terminal replacement retry performs no driver call"},{"id":"RFCC-05","expected":"ALLOW","reason":"FROZEN","scenario":"occupied slot freezes the whole pool"},{"id":"RFCC-06","expected":"ALLOW","reason":"FROZEN_AFTER_UNCERTAINTY","scenario":"replacement failure remains containable by freeze"},{"id":"RFCC-07","expected":"ALLOW","reason":"FROZEN_IDEMPOTENT","scenario":"terminal freeze retry performs no driver call"},{"id":"RFCC-08","expected":"ALLOW","reason":"TWO_SLOT_BOUND","scenario":"two distinct plans consume two distinct slots"},{"id":"RFCC-09","expected":"DENY","reason":"RF_CAPACITY_CONFIG","scenario":"caller configures three desired slots"},{"id":"RFCC-10","expected":"DENY","reason":"RF_CAPACITY_DRIVER","scenario":"driver omits a required operation"},{"id":"RFCC-11","expected":"DENY","reason":"RF_CAPACITY_VERIFIER","scenario":"receipt verifier is absent"},{"id":"RFCC-12","expected":"DENY","reason":"RF_CAPACITY_SCOPE","scenario":"plan requests two slots"},{"id":"RFCC-13","expected":"DENY","reason":"RF_CAPACITY_REPLAY","scenario":"same plan attempts a second acquisition"},{"id":"RFCC-14","expected":"DENY","reason":"RF_CAPACITY_ACQUIRE_UNAVAILABLE","scenario":"slot mutation is unavailable"},{"id":"RFCC-15","expected":"DENY","reason":"RF_CAPACITY_ACQUIRE_PROOF","scenario":"acquire response returns the wrong plan"},{"id":"RFCC-16","expected":"DENY","reason":"RF_CAPACITY_ACQUIRE_PROOF","scenario":"consistent read returns the wrong generation"},{"id":"RFCC-17","expected":"DENY","reason":"RF_CAPACITY_ACQUIRE_PROOF","scenario":"third concurrent plan exceeds the two-slot pool"},{"id":"RFCC-18","expected":"DENY","reason":"RF_CAPACITY_HANDLE","scenario":"caller forges a capacity capability"},{"id":"RFCC-19","expected":"DENY","reason":"RF_CAPACITY_RECEIPT_VERIFY","scenario":"retirement signature verification returns false"},{"id":"RFCC-20","expected":"DENY","reason":"RF_CAPACITY_RECEIPT_VERIFY","scenario":"retirement verifier is unavailable"},{"id":"RFCC-21","expected":"DENY","reason":"RF_CAPACITY_RECEIPT_PROOF","scenario":"receipt is not the F8 instance-termination stage"},{"id":"RFCC-22","expected":"DENY","reason":"RF_CAPACITY_RECEIPT_PROOF","scenario":"receipt binds another plan"},{"id":"RFCC-23","expected":"DENY","reason":"RF_CAPACITY_WORKER_PROOF","scenario":"worker is still running"},{"id":"RFCC-24","expected":"DENY","reason":"RF_CAPACITY_WORKER_PROOF","scenario":"root volume deletion is unproven"},{"id":"RFCC-25","expected":"DENY","reason":"RF_CAPACITY_REPLACE_UNAVAILABLE","scenario":"replacement CAS is unavailable"},{"id":"RFCC-26","expected":"DENY","reason":"RF_CAPACITY_REPLACE_PROOF","scenario":"replacement response does not advance generation"},{"id":"RFCC-27","expected":"DENY","reason":"RF_CAPACITY_REPLACE_PROOF","scenario":"replacement readback retains a lease"},{"id":"RFCC-28","expected":"DENY","reason":"RF_CAPACITY_STATE","scenario":"confirmed slot cannot be frozen by a late caller"},{"id":"RFCC-29","expected":"DENY","reason":"RF_CAPACITY_FREEZE_REASON","scenario":"free-form freeze reason is rejected"},{"id":"RFCC-30","expected":"DENY","reason":"RF_CAPACITY_FREEZE_PROOF","scenario":"freeze readback does not show the pool frozen"}]}},"auditSink":{"schemaVersion":"developer.reits.tech/runner-factory-audit-sink/v1","status":"ADAPTER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T16:30:00Z","scope":{"partition":"ONE_JOURNAL_PER_PLAN_AND_JOB_ATTEMPT","entryModel":"DUAL_HASH_CHAIN_SIGNED_RECEIPTS_PLUS_TERMINAL_FAILURE","successSeal":"EXACT_F9_REPLACEMENT_RECEIPT","failureSeal":"ENUMERATED_CONTROLLER_FACTS_AFTER_RECEIPT_RECONCILIATION","mutationPolicy":"CREATE_AND_CONDITIONAL_APPEND_ONLY_NO_UPDATE_OR_DELETE"},"truth":{"runtimeDriverConfigured":false,"durableJournalCreated":false,"iamRoleConfigured":false,"readinessGateSatisfied":false,"liveJournals":0,"runtimeEntries":0,"runtimeSuccessSeals":0,"runtimeFailureSeals":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"adapter":"ops/runner-factory/audit-sink.mjs","testDriver":"ops/runner-factory/memory-audit-driver.mjs","fixtureRegistry":"ops/runner-factory/audit-sink-fixtures.json","verifier":"scripts/verify-runner-factory-audit-sink.mjs","runtimeDriver":"NOT_CONFIGURED","receiptVerifier":"PINNED_KMS_PUBLIC_KEY_REQUIRED_AT_RUNTIME","writerIdentity":"EXACT_CONTROLLER_IAM_ROLE_REQUIRED_AT_RUNTIME","canonicalization":"recursive-key-order-json","digestAlgorithm":"SHA-256"},"operations":[{"id":"open","guard":"exact plan, job attempt, repository and job scope","result":"opaque journal capability"},{"id":"appendReceipt","guard":"pinned signature + exact scope + contiguous receipt and entry predecessors","result":"CAS-appended dual-chain entry"},{"id":"sealFailure","guard":"reconcile signed receipts + bounded phase, code and compensation facts","result":"terminal failure entry"},{"id":"inspect","guard":"opaque capability + consistent head read","result":"secret-free head proof"},{"id":"verify","guard":"consistent full range + entry hashes + signatures + both predecessor chains","result":"independent chain verdict"}],"driverCalls":[{"id":"CreateJournal","mode":"CONDITIONAL_CREATE","guard":"head absent or exact same scope"},{"id":"ReadHead","mode":"CONSISTENT_READ","guard":"scope, writer, sequence, digest and terminal state agree"},{"id":"AppendEntry","mode":"ATOMIC_CAS","guard":"expected head sequence + digest + OPEN and new entry absent"},{"id":"ReadEntry","mode":"CONSISTENT_READ","guard":"ambiguous-write recovery and exact replay only"},{"id":"ReadRange","mode":"CONSISTENT_READ","guard":"complete ordered range for independent verification"}],"stateMachine":[{"from":"ABSENT","action":"open","to":"OPEN_EMPTY","guard":"conditional journal creation"},{"from":"OPEN_EMPTY","action":"open replay","to":"OPEN_EMPTY","guard":"same exact scope"},{"from":"OPEN_EMPTY","action":"append F0","to":"OPEN_ACTIVE","guard":"signed genesis receipt"},{"from":"OPEN_ACTIVE","action":"append F1-F8","to":"OPEN_ACTIVE","guard":"both chains remain contiguous"},{"from":"OPEN_ACTIVE","action":"append exact F9","to":"SEALED_SUCCESS","guard":"replacement-capacity receipt"},{"from":"OPEN_EMPTY","action":"sealFailure","to":"SEALED_FAILURE","guard":"no signed receipt exists"},{"from":"OPEN_ACTIVE","action":"reconcile + sealFailure","to":"SEALED_FAILURE","guard":"all signed receipts are present first"},{"from":"SEALED_FAILURE","action":"exact seal replay","to":"SEALED_FAILURE","guard":"terminal payload is byte-equivalent"},{"from":"OPEN_OR_TERMINAL","action":"inspect","to":"SAME","guard":"consistent head proof"},{"from":"OPEN_OR_TERMINAL","action":"verify","to":"VERIFIED_SAME","guard":"full dual-chain verification"}],"invariants":["one journal is deterministically partitioned by exact plan and job-attempt scope","journal capabilities are opaque object identities and never serialize write authority","the runtime writer must be one exact controller IAM role rather than a mutable alias","entries are created only through expected-sequence, expected-digest and OPEN-state CAS","the driver surface exposes no entry update, journal delete or adapter-side unseal operation","every receipt is verified by the pinned asymmetric public key before persistence","every signed receipt binds plan, job attempt, repository and job identity","receipt sequence and receipt predecessor digest must be contiguous","entry sequence and entry predecessor digest form an independent outer chain","ambiguous append is accepted only after exact entry and consistent-head readback","same sequence with different content is a terminal conflict rather than an overwrite","only signed sequence F9 kind replacement-capacity may seal successful completion","failure sealing first reconciles every signed receipt supplied by the Saga","terminal failure facts accept only bounded codes and enumerated compensation identifiers","a terminal journal accepts only byte-equivalent replay and never new entries","full verification rereads the complete range and recomputes every digest","secret-like arbitrary strings, credentials and token material never enter the journal contract","TEST_ONLY driver evidence never increments runtime journal, read, write or readiness truth"],"verification":{"status":"PASS_TEST_DRIVER_ONLY","fixtures":36,"allowedTransitions":10,"deniedTransitions":26,"operations":5,"driverCallsModeled":5,"hashChainsVerified":2,"ambiguousWriteRecoveryCases":2,"scopeAndSignatureDenials":8,"terminalConflictDenials":4,"secretValuesRecorded":0,"externalCallsExecuted":0},"failureClasses":[{"id":"SCOPE_OR_HANDLE","effect":"deny before journal authority is used"},{"id":"SIGNATURE_OR_RECEIPT_CHAIN","effect":"deny untrusted, cross-job or reordered receipt"},{"id":"APPEND_AMBIGUITY","effect":"recover only exact committed entry, otherwise fail closed"},{"id":"HEAD_OR_RANGE_DRIFT","effect":"deny independent verification and page operator"},{"id":"TERMINAL_CONFLICT","effect":"preserve first terminal fact and deny mutation"},{"id":"DRIVER_UNAVAILABLE","effect":"block admission or compensate the Saga without claiming audit durability"}],"productionPrerequisites":["reviewed durable journal table with point-in-time recovery and encryption","transactional head CAS plus immutable entry rows with no update or delete API","least-privilege controller writer role pinned by exact IAM ARN","separate read-only verifier role and scheduled full-chain verification","retention, export, legal-hold and disaster-recovery policy","append conflict, verification drift, stale-open-journal and seal-failure paging","security, runtime, retention and cost owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-audit-sink-fixtures/v1","fixedTime":"2026-07-20T16:30:00Z","cases":[{"id":"RFAS-01","operation":"open","expected":"ALLOW","proof":"new exact-scope journal"},{"id":"RFAS-02","operation":"open","expected":"ALLOW","proof":"same-scope idempotent replay"},{"id":"RFAS-03","operation":"appendReceipt","expected":"ALLOW","proof":"signed F0 genesis"},{"id":"RFAS-04","operation":"appendReceipt","expected":"ALLOW","proof":"signed contiguous F1"},{"id":"RFAS-05","operation":"inspect","expected":"ALLOW","proof":"consistent open head"},{"id":"RFAS-06","operation":"verify","expected":"ALLOW","proof":"active dual chain"},{"id":"RFAS-07","operation":"appendReceipt","expected":"ALLOW","proof":"exact F9 success seal"},{"id":"RFAS-08","operation":"sealFailure","expected":"ALLOW","proof":"empty-journal terminal failure"},{"id":"RFAS-09","operation":"sealFailure","expected":"ALLOW","proof":"missing signed receipts reconciled before seal"},{"id":"RFAS-10","operation":"sealFailure","expected":"ALLOW","proof":"byte-equivalent terminal replay"},{"id":"RFAS-11","operation":"create","expected":"DENY","code":"RF_AUDIT_DRIVER"},{"id":"RFAS-12","operation":"create","expected":"DENY","code":"RF_AUDIT_CONFIG"},{"id":"RFAS-13","operation":"open","expected":"DENY","code":"RF_AUDIT_SCOPE"},{"id":"RFAS-14","operation":"open","expected":"DENY","code":"RF_AUDIT_CREATE_UNAVAILABLE"},{"id":"RFAS-15","operation":"open","expected":"DENY","code":"RF_AUDIT_CREATE_PROOF"},{"id":"RFAS-16","operation":"inspect","expected":"DENY","code":"RF_AUDIT_HANDLE"},{"id":"RFAS-17","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_VERIFY"},{"id":"RFAS-18","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_VERIFY"},{"id":"RFAS-19","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SCOPE"},{"id":"RFAS-20","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SCOPE"},{"id":"RFAS-21","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SCOPE"},{"id":"RFAS-22","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SCOPE"},{"id":"RFAS-23","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_SEQUENCE"},{"id":"RFAS-24","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_RECEIPT_CHAIN"},{"id":"RFAS-25","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_APPEND_UNAVAILABLE"},{"id":"RFAS-26","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_APPEND_PROOF"},{"id":"RFAS-27","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_APPEND_PROOF"},{"id":"RFAS-28","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_SUCCESS_PROOF"},{"id":"RFAS-29","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_FAILURE_SHAPE"},{"id":"RFAS-30","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_FAILURE_SHAPE"},{"id":"RFAS-31","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_FAILURE_SHAPE"},{"id":"RFAS-32","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_TERMINAL_CONFLICT"},{"id":"RFAS-33","operation":"appendReceipt","expected":"DENY","code":"RF_AUDIT_SEALED"},{"id":"RFAS-34","operation":"sealFailure","expected":"DENY","code":"RF_AUDIT_SEALED"},{"id":"RFAS-35","operation":"verify","expected":"DENY","code":"RF_AUDIT_CHAIN"},{"id":"RFAS-36","operation":"verify","expected":"DENY","code":"RF_AUDIT_HEAD_PROOF"}]}},"reconciliationPlanner":{"schemaVersion":"developer.reits.tech/runner-factory-reconciliation-planner/v1","status":"PLANNER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T19:30:00Z","scope":{"mode":"READ_ONLY_CROSS_PORT_RECONCILIATION","sources":5,"sourceWindowSeconds":300,"mutationPolicy":"PLAN_ONLY_NO_EXTERNAL_ACTION","failureMode":"FREEZE_AND_PAGE_PLAN"},"truth":{"runtimeSourcesConfigured":0,"schedulerIntegrated":false,"metricsExporterConfigured":false,"pagingProviderConfigured":false,"readinessGateSatisfied":false,"liveReports":0,"runtimeContainments":0,"pagesSent":0,"mutationsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"planner":"ops/runner-factory/reconciliation-planner.mjs","fixtureRegistry":"ops/runner-factory/reconciliation-planner-fixtures.json","verifier":"scripts/verify-runner-factory-reconciliation-planner.mjs","runtimeSourceReader":"NOT_CONFIGURED","metricExporter":"NOT_CONFIGURED","pagingProvider":"NOT_CONFIGURED"},"operations":[{"id":"assess","guard":"exact bounded five-source snapshot and no secret-like keys","result":"deterministic SAFE or CONTAIN report"},{"id":"summarize","guard":"one to 1000 verified reports","result":"bounded severity and containment totals"},{"id":"buildMetrics","guard":"fixed metric names and controller-only label","result":"eight low-cardinality gauge samples"},{"id":"buildPage","guard":"CONTAIN report only; stable category dedupe","result":"identifier-free PLANNED_NOT_SENT page"}],"sourceReads":[{"id":"Reservation","boundary":"consistent dual-row reservation state, lease and terminal reason"},{"id":"Capacity","boundary":"consistent pool/slot state, exact scope and fenced generation"},{"id":"Worker","boundary":"instance lifecycle, root-volume retirement and exact job binding"},{"id":"Runner","boundary":"Gitea state plus root-agent credential and local-state proof"},{"id":"Journal","boundary":"consistent head, exact scope, receipt count and immutable terminal state"}],"stateMachine":[{"from":"SNAPSHOT","condition":"all sources exact and prelaunch","to":"HEALTHY_PRELAUNCH"},{"from":"SNAPSHOT","condition":"worker bootstrap and no runner","to":"HEALTHY_BOOTSTRAP"},{"from":"SNAPSHOT","condition":"active reservation, occupied slot, live worker, sealed runner authority","to":"HEALTHY_IN_FLIGHT"},{"from":"SNAPSHOT","condition":"complete reservation, replacement, double retirement and success journal","to":"HEALTHY_COMPLETE"},{"from":"SNAPSHOT","condition":"failed reservation, no live resources and failure journal","to":"HEALTHY_FAILED"},{"from":"SNAPSHOT","condition":"pool already frozen","to":"CONTAINED_FROZEN"},{"from":"SNAPSHOT","condition":"source unavailable or unknown","to":"SOURCE_UNAVAILABLE"},{"from":"SNAPSHOT","condition":"any cross-source plan/job mismatch","to":"SCOPE_MISMATCH"},{"from":"SNAPSHOT","condition":"expired lease or stale open journal","to":"STALE_CONTROL_STATE"},{"from":"SNAPSHOT","condition":"orphan worker/runner or credential authority remains live","to":"ORPHAN_AUTHORITY"},{"from":"SNAPSHOT","condition":"capacity, retirement or journal terminal contradiction","to":"TERMINAL_CONFLICT"},{"from":"SNAPSHOT","condition":"no exact safe state matches","to":"UNCLASSIFIED_DRIFT"}],"invariants":["reconciliation reads reservation, capacity, worker, runner and journal as separate authorities","every observed non-absent authority binds the exact plan and job scope","unavailable or unknown source data can never produce a safe verdict","an expired active lease cannot remain schedulable","a live worker without an active reservation is an orphan","a live runner without a live exact worker is an orphan","registered or online runner authority must already be sealed from untrusted code","available capacity with a live worker is an overcommit risk","occupied capacity after worker termination is stranded until replacement proof","worker termination is incomplete until root-volume deletion is proved","runner retirement is incomplete until both Gitea and local state are absent","success journal state requires a completed reservation","failure journal state requires a failed reservation","an open journal older than five minutes is stale","any unclassified cross-source combination fails closed","metrics use fixed names and no repository, job, runner, instance or plan labels","page plans contain only verdict, severity, digest and category dedupe identity","the planner performs zero mutations, external reads, writes or page deliveries"],"metricSeries":["reits_rf_reconciliation_reports","reits_rf_reconciliation_safe","reits_rf_reconciliation_contained","reits_rf_reconciliation_freeze_required","reits_rf_reconciliation_page_p0","reits_rf_reconciliation_page_p1","reits_rf_reconciliation_page_p2","reits_rf_reconciliation_unclassified"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":32,"safeOutcomes":7,"containedOutcomes":24,"deniedInputs":1,"freezePlans":23,"pagePlans":24,"metricSeries":8,"highCardinalityLabels":0,"secretValuesRecorded":0,"mutationsExecuted":0,"externalCallsExecuted":0},"failureClasses":[{"code":"SOURCE_UNAVAILABLE","owner":"platform-oncall","containment":"freeze scheduling and retry consistent reads"},{"code":"SCOPE_MISMATCH","owner":"security-oncall","containment":"freeze, preserve evidence and deny all automatic cleanup"},{"code":"ORPHAN_WORKER|CAPACITY_*","owner":"platform-oncall","containment":"freeze and require terminal Worker plus root-volume proof"},{"code":"ORPHAN_RUNNER|CREDENTIAL_*","owner":"security-oncall","containment":"freeze and require Gitea plus root-agent deletion proof"},{"code":"SUCCESS_CONFLICT|FAILURE_CONFLICT|JOURNAL_STALE","owner":"platform-and-security","containment":"preserve both chains and require manual reconciliation"},{"code":"UNCLASSIFIED_DRIFT","owner":"platform-oncall","containment":"freeze because absence of a known-safe state is unsafe"}],"productionPrerequisites":["strongly consistent read-only identities for all five authoritative sources","bounded snapshot coordinator with skew, timeout and partial-read controls","scheduler freeze integration that cannot be bypassed by webhook admission","separate approved executors for termination, deletion, sealing and lease recovery","Prometheus-compatible exporter with the fixed eight-series label policy","paging provider, dedupe window, escalation policy, owner and recovery runbook","security, platform, reliability and cost-owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-reconciliation-planner-fixtures/v1","fixedTime":"2026-07-20T19:30:00.000Z","cases":[{"id":"RFR-01","profile":"healthy-prelaunch","expected":"SAFE","verdict":"HEALTHY_PRELAUNCH","severity":"P3","freezeRequired":false},{"id":"RFR-02","profile":"healthy-bootstrap","expected":"SAFE","verdict":"HEALTHY_BOOTSTRAP","severity":"P3","freezeRequired":false},{"id":"RFR-03","profile":"healthy-registered","expected":"SAFE","verdict":"HEALTHY_IN_FLIGHT","severity":"P3","freezeRequired":false},{"id":"RFR-04","profile":"healthy-online","expected":"SAFE","verdict":"HEALTHY_IN_FLIGHT","severity":"P3","freezeRequired":false},{"id":"RFR-05","profile":"healthy-complete","expected":"SAFE","verdict":"HEALTHY_COMPLETE","severity":"P3","freezeRequired":false},{"id":"RFR-06","profile":"healthy-failed","expected":"SAFE","verdict":"HEALTHY_FAILED","severity":"P3","freezeRequired":false},{"id":"RFR-07","profile":"deterministic-replay","expected":"SAFE","verdict":"HEALTHY_COMPLETE","severity":"P3","freezeRequired":false},{"id":"RFR-08","profile":"already-frozen","expected":"CONTAIN","verdict":"CONTAINED_FROZEN","severity":"P1","freezeRequired":false},{"id":"RFR-09","profile":"reservation-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-10","profile":"capacity-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-11","profile":"worker-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-12","profile":"runner-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-13","profile":"journal-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-14","profile":"reservation-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-15","profile":"capacity-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-16","profile":"worker-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-17","profile":"runner-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-18","profile":"journal-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-19","profile":"lease-expired","expected":"CONTAIN","verdict":"LEASE_EXPIRED","severity":"P2","freezeRequired":true},{"id":"RFR-20","profile":"orphan-worker","expected":"CONTAIN","verdict":"ORPHAN_WORKER","severity":"P0","freezeRequired":true},{"id":"RFR-21","profile":"orphan-runner","expected":"CONTAIN","verdict":"ORPHAN_RUNNER","severity":"P0","freezeRequired":true},{"id":"RFR-22","profile":"credential-authority-live","expected":"CONTAIN","verdict":"CREDENTIAL_AUTHORITY_LIVE","severity":"P0","freezeRequired":true},{"id":"RFR-23","profile":"capacity-overcommit","expected":"CONTAIN","verdict":"CAPACITY_OVERCOMMIT_RISK","severity":"P0","freezeRequired":true},{"id":"RFR-24","profile":"capacity-stranded","expected":"CONTAIN","verdict":"CAPACITY_STRANDED","severity":"P1","freezeRequired":true},{"id":"RFR-25","profile":"termination-unproven","expected":"CONTAIN","verdict":"TERMINATION_UNPROVEN","severity":"P1","freezeRequired":true},{"id":"RFR-26","profile":"runner-retirement-unproven","expected":"CONTAIN","verdict":"RUNNER_RETIREMENT_UNPROVEN","severity":"P1","freezeRequired":true},{"id":"RFR-27","profile":"success-conflict","expected":"CONTAIN","verdict":"SUCCESS_CONFLICT","severity":"P0","freezeRequired":true},{"id":"RFR-28","profile":"failure-conflict","expected":"CONTAIN","verdict":"FAILURE_CONFLICT","severity":"P1","freezeRequired":true},{"id":"RFR-29","profile":"journal-stale","expected":"CONTAIN","verdict":"JOURNAL_STALE","severity":"P2","freezeRequired":true},{"id":"RFR-30","profile":"capacity-generation-invalid","expected":"CONTAIN","verdict":"CAPACITY_GENERATION_INVALID","severity":"P1","freezeRequired":true},{"id":"RFR-31","profile":"unclassified-drift","expected":"CONTAIN","verdict":"UNCLASSIFIED_DRIFT","severity":"P1","freezeRequired":true},{"id":"RFR-32","profile":"secret-like-field","expected":"DENY","errorCode":"RF_RECON_INPUT_SECRET"}]}},"snapshotCoordinator":{"schemaVersion":"developer.reits.tech/runner-factory-reconciliation-snapshot-coordinator/v1","status":"COORDINATOR_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T20:30:00Z","scope":{"mode":"FIVE_SOURCE_CONCURRENT_READ_ONLY","sources":5,"consistency":"STRONGLY_CONSISTENT","timeoutMs":2000,"maxCaptureSkewMs":2000,"partialReadPolicy":"NORMALIZE_UNKNOWN_AND_CONTAIN","mutationPolicy":"NO_WRITE_CAPABILITY"},"truth":{"configuredSourceReaders":0,"runtimeIdentityConfigured":false,"runtimeCaptures":0,"runtimeSourceReads":0,"liveSnapshots":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"readinessGateSatisfied":false,"deploymentPermitted":false},"implementation":{"coordinator":"ops/runner-factory/reconciliation-snapshot-coordinator.mjs","fixtureRegistry":"ops/runner-factory/reconciliation-snapshot-coordinator-fixtures.json","verifier":"scripts/verify-runner-factory-reconciliation-snapshot-coordinator.mjs","reservationReader":"NOT_CONFIGURED","capacityReader":"NOT_CONFIGURED","workerReader":"NOT_CONFIGURED","runnerReader":"NOT_CONFIGURED","journalReader":"NOT_CONFIGURED"},"operations":[{"id":"plan","guard":"exact capture, plan, job-attempt, repository, pool and slot scope","result":"five immutable strongly-consistent read requests with one deadline"},{"id":"capture","guard":"five authority-pinned reader functions and bounded response identities","result":"complete or explicitly unavailable normalized snapshot packet"},{"id":"verify","guard":"exact packet shape, source order and recomputed read/snapshot/packet digests","result":"local boolean verification without external reads or writes"}],"sourceReaders":[{"source":"Reservation","authority":"reservation-ledger","query":"exact dual-key reservation, lease and terminal state"},{"source":"Capacity","authority":"capacity-ledger","query":"exact pool slot, generation, occupancy and freeze state"},{"source":"Worker","authority":"ec2-worker-read-model","query":"exact instance lifecycle and root-volume retirement state"},{"source":"Runner","authority":"gitea-runner-read-model","query":"exact Gitea plus root-agent credential and local-state facts"},{"source":"Journal","authority":"append-only-journal","query":"exact consistent head, terminal state and receipt count"}],"captureStates":[{"id":"PLANNED","meaning":"five read requests share one scope digest and deadline"},{"id":"READING","meaning":"all five read-only ports execute concurrently"},{"id":"COMPLETE","meaning":"five observed authority-pinned results fit the skew window"},{"id":"PARTIAL_UNAVAILABLE","meaning":"one to four sources normalized to UNKNOWN for containment"},{"id":"ALL_UNAVAILABLE","meaning":"zero sources observed and scheduling must contain"},{"id":"DENIED_INTEGRITY","meaning":"identity, consistency, shape, time, secret or digest guard failed"}],"invariants":["one capture binds an exact plan, job attempt, repository, pool and slot scope","exactly five named reader ports are required and no wildcard reader is accepted","all source queries request strongly consistent reads under one bounded deadline","source name and authority are pinned independently of driver-returned payload data","every response must echo the exact immutable request digest","every observed read timestamp must fall inside the capture deadline","the maximum skew between observed source reads cannot exceed two seconds","reader rejection or timeout becomes explicit UNAVAILABLE and UNKNOWN evidence","partial reads are never omitted, substituted with cache data or treated as safe","cross-source scope drift is preserved for the reconciliation planner to contain","secret-like keys are rejected before snapshot or receipt materialization","source records use exact bounded fields and enum states without extension bags","source receipts are ordered Reservation, Capacity, Worker, Runner and Journal","snapshot identity commits to scope, normalized facts and all source receipts","read-plan, snapshot and packet digests are independently recomputed on verify","deterministic replay of the same capture and source facts yields the same digests","the coordinator owns no terminate, delete, seal, release, freeze or page operation","runtime source reads, writes, mutations, snapshots and secret values remain zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":30,"completeCaptures":3,"partialCaptures":7,"allUnavailableCaptures":1,"deniedInputs":19,"sourceReadAttempts":55,"unavailableSourceResults":16,"plannerIntegrationCases":11,"secretValuesRecorded":0,"externalCallsExecuted":0,"mutationsExecuted":0},"failureClasses":[{"code":"RF_SOURCE_TIMEOUT|RF_SOURCE_UNAVAILABLE","effect":"normalize that source to UNKNOWN and force planner containment"},{"code":"RF_RECON_SOURCE_IDENTITY","effect":"deny response with wrong source, authority, consistency, digest or timestamp identity"},{"code":"RF_RECON_SOURCE_SHAPE","effect":"deny malformed or extension-bearing source facts"},{"code":"RF_RECON_CAPTURE_SKEW|RF_RECON_SOURCE_TIME","effect":"deny incoherent capture timing instead of joining unrelated reads"},{"code":"RF_RECON_CAPTURE_SECRET","effect":"deny secret-like input before it can enter receipts or snapshot evidence"},{"code":"RF_RECON_CAPTURE_DIGEST","effect":"deny any read-plan, snapshot or packet evidence tamper"}],"productionPrerequisites":["dedicated loopback Controller runtime identity and root-owned configuration","strongly consistent Reservation reader with exact dual-key scope","strongly consistent Capacity reader with pool generation fencing","credential-free EC2 Worker read model with volume retirement proof","read-only Gitea and root-agent Runner evidence aggregation","consistent append-only Journal head and range verifier","deadline, retry-budget and partial-read telemetry with fixed labels","security, platform, reliability and cost-owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-reconciliation-snapshot-coordinator-fixtures/v1","fixedTime":"2026-07-20T20:30:00.000Z","cases":[{"id":"RFSC-01","profile":"all-observed","expected":"CAPTURE","status":"COMPLETE","observedSources":5},{"id":"RFSC-02","profile":"deterministic-replay","expected":"CAPTURE","status":"COMPLETE","observedSources":5},{"id":"RFSC-03","profile":"reservation-timeout","expected":"CAPTURE","status":"PARTIAL_UNAVAILABLE","observedSources":4},{"id":"RFSC-04","profile":"capacity-error","expected":"CAPTURE","status":"PARTIAL_UNAVAILABLE","observedSources":4},{"id":"RFSC-05","profile":"worker-timeout","expected":"CAPTURE","status":"PARTIAL_UNAVAILABLE","observedSources":4},{"id":"RFSC-06","profile":"runner-error","expected":"CAPTURE","status":"PARTIAL_UNAVAILABLE","observedSources":4},{"id":"RFSC-07","profile":"journal-timeout","expected":"CAPTURE","status":"PARTIAL_UNAVAILABLE","observedSources":4},{"id":"RFSC-08","profile":"two-unavailable","expected":"CAPTURE","status":"PARTIAL_UNAVAILABLE","observedSources":3},{"id":"RFSC-09","profile":"four-unavailable","expected":"CAPTURE","status":"PARTIAL_UNAVAILABLE","observedSources":1},{"id":"RFSC-10","profile":"all-unavailable","expected":"CAPTURE","status":"ALL_UNAVAILABLE","observedSources":0},{"id":"RFSC-11","profile":"scope-drift-preserved","expected":"CAPTURE","status":"COMPLETE","observedSources":5,"plannerVerdict":"SCOPE_MISMATCH"},{"id":"RFSC-12","profile":"wrong-source","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFSC-13","profile":"wrong-authority","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFSC-14","profile":"eventual-consistency","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFSC-15","profile":"wrong-request-digest","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFSC-16","profile":"invalid-read-time","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFSC-17","profile":"capture-skew","expected":"DENY","errorCode":"RF_RECON_CAPTURE_SKEW"},{"id":"RFSC-18","profile":"read-after-deadline","expected":"DENY","errorCode":"RF_RECON_SOURCE_TIME"},{"id":"RFSC-19","profile":"secret-like-response","expected":"DENY","errorCode":"RF_RECON_SOURCE_SECRET"},{"id":"RFSC-20","profile":"extra-response-field","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFSC-21","profile":"missing-response-field","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFSC-22","profile":"extra-value-field","expected":"DENY","errorCode":"RF_RECON_SOURCE_SHAPE"},{"id":"RFSC-23","profile":"invalid-source-state","expected":"DENY","errorCode":"RF_RECON_SOURCE_SHAPE"},{"id":"RFSC-24","profile":"secret-like-scope","expected":"DENY","errorCode":"RF_RECON_CAPTURE_SECRET"},{"id":"RFSC-25","profile":"invalid-capture-id","expected":"DENY","errorCode":"RF_RECON_CAPTURE_SCOPE"},{"id":"RFSC-26","profile":"invalid-repository","expected":"DENY","errorCode":"RF_RECON_CAPTURE_SCOPE"},{"id":"RFSC-27","profile":"invalid-job-id","expected":"DENY","errorCode":"RF_RECON_CAPTURE_SCOPE"},{"id":"RFSC-28","profile":"invalid-pool-id","expected":"DENY","errorCode":"RF_RECON_CAPTURE_SCOPE"},{"id":"RFSC-29","profile":"tampered-packet","expected":"DENY","errorCode":"RF_RECON_CAPTURE_DIGEST"},{"id":"RFSC-30","profile":"missing-reader","expected":"DENY","errorCode":"RF_RECON_SOURCE_CONFIG"}]}},"runtimeAssembly":{"schemaVersion":"developer.reits.tech/runner-factory-controller-runtime-assembly/v1","status":"ASSEMBLY_VERIFIER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T21:00:00Z","scope":{"mode":"READINESS_RECEIPT_ONLY_NO_ADAPTER_CONSTRUCTION","readerBindings":5,"readinessGates":11,"serviceBind":"127.0.0.1:8110","serviceMode":"EVIDENCE_ONLY","attestationMaxAgeSeconds":300,"secretPolicy":"CONFIGREF_AND_KEYREF_ONLY","mutationPolicy":"NO_RUNTIME_INSTALL_NO_SOURCE_CALL_NO_WRITE"},"truth":{"manifestInstalled":false,"runtimeIdentityConfigured":false,"configuredReaderBindings":0,"verifiedReadinessGates":0,"readinessReady":false,"runtimeReadinessReceipts":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"assembly":"ops/runner-factory/controller-runtime-assembly.mjs","configuration":"ops/runner-factory/service-config.mjs","fixtureRegistry":"ops/runner-factory/controller-runtime-assembly-fixtures.json","verifier":"scripts/verify-runner-factory-controller-runtime-assembly.mjs","productionManifest":"NOT_INSTALLED","productionAttestationVerifier":"NOT_CONFIGURED"},"operations":[{"id":"plan","guard":"exact service identity, five ordered readers and reference-only configuration","result":"immutable assembly plan and manifest digest"},{"id":"assemble","guard":"fresh dedicated-host identity plus zero to eleven verified gate attestations","result":"blocked or ready receipt without constructing an adapter"},{"id":"verify","guard":"recompute plan, identity, receipt and packet digests and reverify attestations","result":"local integrity verdict with no external call"},{"id":"toControllerRuntime","guard":"only a verified packet may project ordered readiness gates","result":"receipt-backed service readiness snapshot"}],"readerBindings":[{"source":"Reservation","authority":"reservation-ledger","driver":"dynamodb-consistent-get","permission":"dynamodb:GetItem","configuration":["table ARN ref","IAM role ARN ref"]},{"source":"Capacity","authority":"capacity-ledger","driver":"dynamodb-consistent-get","permission":"dynamodb:GetItem","configuration":["table ARN ref","IAM role ARN ref"]},{"source":"Worker","authority":"ec2-worker-read-model","driver":"ec2-describe","permission":"ec2:DescribeInstances+ec2:DescribeVolumes","configuration":["region ref","IAM role ARN ref"]},{"source":"Runner","authority":"gitea-runner-read-model","driver":"gitea-root-agent-composite","permission":"gitea:read-runner+read-job+agent:read","configuration":["Gitea origin ref","credential ref","agent socket ref"]},{"source":"Journal","authority":"append-only-journal","driver":"dynamodb-consistent-query","permission":"dynamodb:Query","configuration":["table ARN ref","IAM role ARN ref"]}],"readinessGates":["RF_READY_DEDICATED_HOST","RF_READY_SERVICE_IDENTITY","RF_READY_WEBHOOK_SECRET","RF_READY_RESERVATION_STORE","RF_READY_RECEIPT_SIGNER","RF_READY_TOKEN_BROKER","RF_READY_WORKER_PROVIDER","RF_READY_GITEA_CONTROL","RF_READY_CAPACITY_CONTROLLER","RF_READY_AUDIT_SINK","RF_READY_OWNER_APPROVAL"],"stateModel":[{"id":"MANIFEST_PLANNED","meaning":"service, reader and attestation boundaries have one digest"},{"id":"IDENTITY_BOUND","meaning":"fresh dedicated-host and non-login service identity matches the manifest"},{"id":"GATES_PARTIAL","meaning":"one or more required attestations remain missing and readiness stays blocked"},{"id":"READY_VERIFIED","meaning":"all eleven fresh attestations verify under the pinned key reference"},{"id":"DENIED_INTEGRITY","meaning":"identity, scope, time, signature, shape or digest verification failed"}],"invariants":["readiness cannot be enabled by environment booleans or caller-provided gate flags","one manifest binds one production controller identity and one immutable assembly identifier","the service identity is a dedicated non-login user with an exact UID and GID","the manifest only permits loopback port 8110 in EVIDENCE_ONLY mode","the runtime host must attest dedicated control-plane use and no production workload sharing","runtime identity freshness is bounded by the manifest attestation age","exactly five ordered source-reader descriptors exist without wildcard fallback","every reader is strongly consistent and has read-only least-privilege operations","reader configuration uses ConfigRef values and never embeds credentials or secret material","the attestation verifier key is an exact KeyRef and cannot be supplied inline","exactly eleven named readiness gates exist and unknown gate names are denied","gate readiness comes from the presence of a verified attestation rather than a boolean field","every attestation binds controller, manifest, runtime identity and evidence digest","every attestation is fresh, unexpired and verified by the injected pinned verifier","duplicate gate attestations are denied instead of last-write-wins replacement","partial evidence produces BLOCKED_CONFIGURATION with an exact missing-gate list","READY_VERIFIED requires eleven of eleven verified attestations","plan, identity, readiness receipt and packet digests are independently recomputed","a runtime projection can only be derived from a fully verified assembly packet","assembly owns no install, listener, source call, adapter construction, external write or mutation"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":32,"readyPackets":1,"blockedPackets":5,"deniedInputs":26,"verifiedAttestations":30,"controllerProjectionCases":6,"booleanEscalationsDenied":1,"secretValuesRecorded":0,"externalCallsExecuted":0,"mutationsExecuted":0},"failureClasses":[{"code":"RF_ASSEMBLY_MANIFEST|SERVICE|READERS","effect":"deny unsafe service or reader assembly before identity evaluation"},{"code":"RF_ASSEMBLY_IDENTITY|IDENTITY_TIME","effect":"deny shared, stale or scope-drifted controller runtime identity"},{"code":"RF_ASSEMBLY_ATTESTATION|ATTESTATION_SET|ATTESTATION_TIME","effect":"deny malformed, duplicate, unknown, stale or expired Gate evidence"},{"code":"RF_ASSEMBLY_SIGNATURE","effect":"deny when the injected pinned verifier rejects or fails"},{"code":"RF_ASSEMBLY_RECEIPT|RUNTIME|PACKET|DIGEST","effect":"deny any readiness projection or digest inconsistency"},{"code":"RF_ASSEMBLY_SECRET","effect":"deny secret-like fields before plan, receipt or packet materialization"}],"productionPrerequisites":["install one reviewed root-owned production assembly manifest","attest a dedicated control-plane host with no shared production workload","install the exact non-login reits-runner-factory service identity","resolve all five reader ConfigRefs under a read-only IAM and local-agent boundary","configure the pinned asymmetric readiness-attestation verifier","issue and verify all eleven scope-bound readiness attestations","persist and expose the readiness receipt digest through loopback health only","obtain security, runtime and cost owner approvals before any Controller activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-runtime-assembly-fixtures/v1","fixedTime":"2026-07-20T21:00:00.000Z","cases":[{"id":"RFRA-01","profile":"all-gates","expected":"ASSEMBLE","status":"READY_VERIFIED","readyCount":11},{"id":"RFRA-02","profile":"no-gates","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":0},{"id":"RFRA-03","profile":"one-gate","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":1},{"id":"RFRA-04","profile":"three-gates","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":3},{"id":"RFRA-05","profile":"five-gates","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":5},{"id":"RFRA-06","profile":"ten-gates","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":10},{"id":"RFRA-07","profile":"secret-like-manifest","expected":"DENY","errorCode":"RF_ASSEMBLY_SECRET"},{"id":"RFRA-08","profile":"bad-assembly-id","expected":"DENY","errorCode":"RF_ASSEMBLY_MANIFEST"},{"id":"RFRA-09","profile":"wrong-environment","expected":"DENY","errorCode":"RF_ASSEMBLY_MANIFEST"},{"id":"RFRA-10","profile":"login-service","expected":"DENY","errorCode":"RF_ASSEMBLY_SERVICE"},{"id":"RFRA-11","profile":"shared-host-class","expected":"DENY","errorCode":"RF_ASSEMBLY_SERVICE"},{"id":"RFRA-12","profile":"wildcard-bind","expected":"DENY","errorCode":"RF_ASSEMBLY_SERVICE"},{"id":"RFRA-13","profile":"run-mode","expected":"DENY","errorCode":"RF_ASSEMBLY_SERVICE"},{"id":"RFRA-14","profile":"reader-reordered","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-15","profile":"reader-missing","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-16","profile":"wrong-reader-authority","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-17","profile":"eventual-consistency","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-18","profile":"write-permission","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-19","profile":"unknown-driver","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-20","profile":"duplicate-config-ref","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-21","profile":"wrong-controller-identity","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-22","profile":"shared-production-workloads","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-23","profile":"wrong-service-user","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-24","profile":"wrong-service-uid","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-25","profile":"stale-identity","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY_TIME"},{"id":"RFRA-26","profile":"identity-manifest-drift","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-27","profile":"duplicate-gate","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION_SET"},{"id":"RFRA-28","profile":"unknown-gate","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFRA-29","profile":"wrong-attestation-subject","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFRA-30","profile":"wrong-attestation-issuer","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFRA-31","profile":"expired-attestation","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION_TIME"},{"id":"RFRA-32","profile":"bad-signature","expected":"DENY","errorCode":"RF_ASSEMBLY_SIGNATURE"}]}},"runtimeConfiguration":{"schemaVersion":"developer.reits.tech/runner-factory-controller-runtime-configuration/v1","status":"CONFIGURATION_LOADER_IMPLEMENTED_NOT_INSTALLED","observedAt":"2026-07-20T21:30:00Z","scope":{"mode":"ROOT_OWNED_MANIFEST_AND_REFERENCE_RESOLUTION_ONLY","manifestPath":"/etc/reits-runner-factory/controller-runtime.json","owner":"root","group":"reits-runner-factory","fileMode":"0640","maxBytes":65536,"configRefs":11,"keyRefs":1,"resolutionMaxAgeSeconds":300,"secretPolicy":"SECRETREF_ONLY_NO_SECRET_VALUE","mutationPolicy":"NO_INSTALL_NO_ADAPTER_CONSTRUCTION_NO_WRITE"},"truth":{"manifestInstalled":false,"productionFileReads":0,"configuredConfigRefs":0,"configuredKeyRefs":0,"runtimeConfigurationBundles":0,"runtimeAdaptersConstructed":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"loader":"ops/runner-factory/controller-runtime-configuration.mjs","assembly":"ops/runner-factory/controller-runtime-assembly.mjs","fixtureRegistry":"ops/runner-factory/controller-runtime-configuration-fixtures.json","verifier":"scripts/verify-runner-factory-controller-runtime-configuration.mjs","productionManifest":"NOT_INSTALLED","productionConfigStore":"NOT_CONFIGURED","productionTrustStore":"NOT_CONFIGURED"},"operations":[{"id":"loadManifest","guard":"O_NOFOLLOW, exact path, root:service ownership, 0640, one link, stable inode and bounded bytes","result":"canonical manifest plus file proof"},{"id":"resolveConfigRefs","guard":"eleven ordered typed references from one root-owned store","result":"safe values or exact missing list without secret material"},{"id":"resolveKeyRef","guard":"one pinned verify-only P-256 trust descriptor","result":"public-key fingerprint metadata or blocked configuration"},{"id":"prepare","guard":"manifest plan and all resolution metadata are fresh and digest-bound","result":"resolved or blocked immutable configuration bundle"},{"id":"verify","guard":"recompute file, reference-set, resolution, assembly-plan and bundle digests","result":"local integrity verdict without constructing adapters"}],"referenceTypes":[{"kind":"DYNAMODB_TABLE_ARN","count":3,"constraint":"ap-southeast-2 and exact reviewed table name"},{"kind":"IAM_ROLE_ARN","count":4,"constraint":"exact read-only role suffix without wildcard"},{"kind":"AWS_REGION","count":1,"constraint":"ap-southeast-2"},{"kind":"HTTPS_ORIGIN","count":1,"constraint":"https://gitea.reits.tech"},{"kind":"SECRET_REF","count":1,"constraint":"opaque SecretRef only; never a credential value"},{"kind":"ROOT_AGENT_SOCKET","count":1,"constraint":"exact /run read-only agent socket"},{"kind":"ECDSA_P256_SHA256","count":1,"constraint":"VERIFY_ONLY metadata and pinned SPKI digest"}],"stateModel":[{"id":"UNLOADED","meaning":"no production manifest or reference has been read"},{"id":"FILE_VERIFIED","meaning":"path, ownership, mode, link count and same-descriptor metadata passed"},{"id":"MANIFEST_VALIDATED","meaning":"canonical JSON passed the runtime assembly manifest planner"},{"id":"REFERENCES_PARTIAL","meaning":"one or more typed references are absent and activation remains blocked"},{"id":"CONFIGURATION_RESOLVED","meaning":"eleven ConfigRefs and one KeyRef are fresh, typed and digest-bound"},{"id":"DENIED_INTEGRITY","meaning":"file, encoding, manifest, reference, time or digest contract failed"}],"invariants":["only /etc/reits-runner-factory/controller-runtime.json may be opened","the production driver opens with O_NOFOLLOW and O_CLOEXEC","the manifest must be a regular file rather than a symlink, directory or device","the file owner is root and the group is the dedicated reits-runner-factory identity","the file mode is exactly 0640 and the hard-link count is exactly one","the manifest is non-empty and bounded to 65536 bytes","before and after metadata from the same open descriptor must match exactly","the verified byte length must equal the file size metadata","the file is strict UTF-8 without NUL bytes","the file is canonical JSON with exactly one trailing newline","the parsed manifest must pass the existing runtime assembly planner","the file proof binds path, inode, device, mtime, size and content digest","the manifest contains exactly eleven ordered ConfigRefs","every ConfigRef has one expected semantic type and no generic fallback","DynamoDB and IAM ARNs are exact-suffix and wildcard-free","the Gitea origin is HTTPS and pinned to gitea.reits.tech","the credential configuration resolves only to a SecretRef, never a credential value","the root-agent socket is pinned beneath /run/reits-runner-factory","the readiness KeyRef resolves to VERIFY_ONLY P-256 metadata without private material","all resolution metadata is no older than five minutes and never from the future","missing references produce BLOCKED_CONFIGURATION rather than a partial runtime adapter","file, reference-set, resolution, assembly-plan and bundle digests are independently recomputed","bundle verification never constructs a reader, signer, credential or listener","production installation, reads, adapters, writes, mutations and paid resources remain zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":36,"resolvedBundles":2,"blockedBundles":5,"deniedInputs":29,"configRefs":11,"keyRefs":1,"referenceTypes":7,"deterministicReplays":1,"tamperedBundlesDenied":1,"secretValuesRecorded":0,"externalWritesExecuted":0,"mutationsExecuted":0},"failureClasses":[{"code":"RF_RUNTIME_CONFIG_PATH|FILE_READ|FILE_METADATA|FILE_SIZE|TOCTOU","effect":"deny an untrusted path, link, owner, mode, size or changing descriptor"},{"code":"RF_RUNTIME_CONFIG_ENCODING|JSON|CANONICAL|MANIFEST","effect":"deny malformed bytes or a manifest outside the assembly contract"},{"code":"RF_RUNTIME_CONFIG_REF_SET|RESOLVER|RESOLUTION|RESOLUTION_TIME","effect":"deny missing inventory, unsafe type/source/value or stale ConfigRef metadata"},{"code":"RF_RUNTIME_CONFIG_KEY_REF|KEY_RESOLVER|KEY|KEY_TIME","effect":"deny an unpinned, signing-capable, private or stale trust descriptor"},{"code":"RF_RUNTIME_CONFIG_BUNDLE|FILE_PROOF|MISSING|STATUS|DIGEST","effect":"deny any bundle truth or digest inconsistency"}],"productionPrerequisites":["install the reviewed canonical manifest as root:reits-runner-factory mode 0640","provision the eleven exact ConfigRef records in a root-owned read-only store","provision the verify-only KeyRef descriptor and pinned public SPKI digest","bind ConfigRef resolution to read-only IAM roles and the root-agent socket ACL","attach the verified configuration bundle to Controller boot before readiness evaluation","issue the eleven readiness attestations only after live configuration checks","install and supervise the Controller on its dedicated host while keeping loopback-only bind","obtain security, runtime and cost owner approvals before activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-runtime-configuration-fixtures/v1","fixedTime":"2026-07-20T21:30:00.000Z","cases":[{"id":"RFRC-01","profile":"complete","expected":"PREPARE","status":"CONFIGURATION_RESOLVED","resolved":12},{"id":"RFRC-02","profile":"deterministic-replay","expected":"PREPARE","status":"CONFIGURATION_RESOLVED","resolved":12},{"id":"RFRC-03","profile":"one-config-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":11},{"id":"RFRC-04","profile":"five-config-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":7},{"id":"RFRC-05","profile":"all-config-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":1},{"id":"RFRC-06","profile":"key-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":11},{"id":"RFRC-07","profile":"all-references-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":0},{"id":"RFRC-08","profile":"wrong-path","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_PATH"},{"id":"RFRC-09","profile":"symlink","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-10","profile":"wrong-owner","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-11","profile":"wrong-group","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-12","profile":"permissive-mode","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-13","profile":"hard-link","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-14","profile":"oversize","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-15","profile":"empty","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-16","profile":"size-mismatch","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_SIZE"},{"id":"RFRC-17","profile":"nul-byte","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_ENCODING"},{"id":"RFRC-18","profile":"invalid-utf8","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_ENCODING"},{"id":"RFRC-19","profile":"invalid-json","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_JSON"},{"id":"RFRC-20","profile":"noncanonical-json","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_CANONICAL"},{"id":"RFRC-21","profile":"inode-drift","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_TOCTOU"},{"id":"RFRC-22","profile":"mtime-drift","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_TOCTOU"},{"id":"RFRC-23","profile":"manifest-invalid","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_MANIFEST"},{"id":"RFRC-24","profile":"resolver-wrong-ref","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-25","profile":"resolver-wrong-kind","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-26","profile":"wrong-table-arn","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-27","profile":"wildcard-role","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-28","profile":"wrong-region","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-29","profile":"http-origin","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-30","profile":"inline-credential","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-31","profile":"wrong-socket","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-32","profile":"stale-config","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION_TIME"},{"id":"RFRC-33","profile":"key-sign-usage","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_KEY"},{"id":"RFRC-34","profile":"key-private-material","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_KEY"},{"id":"RFRC-35","profile":"key-bad-fingerprint","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_KEY"},{"id":"RFRC-36","profile":"key-stale","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_KEY_TIME"}]}},"bootstrapComposition":{"schemaVersion":"developer.reits.tech/runner-factory-controller-bootstrap-composition/v1","status":"BOOTSTRAP_COMPOSER_IMPLEMENTED_NOT_INSTALLED","observedAt":"2026-07-20T22:00:00Z","scope":{"mode":"TEST_ONLY_COMPOSITION_NO_LISTENER","configurationInput":"VERIFIED_RESOLVED_BUNDLE_ONLY","readers":5,"attestationVerifiers":1,"componentFactories":6,"singleUseBundle":true,"reverseCleanup":true,"externalReadPolicy":"NO_READ_DURING_COMPOSITION","mutationPolicy":"NO_WRITE_NO_LISTENER_NO_LIFECYCLE_ADAPTER"},"truth":{"productionCompositions":0,"productionComponentsConstructed":0,"configuredReaderBindings":0,"configuredAttestationVerifiers":0,"runtimeBootstrapReceipts":0,"runtimeProjections":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"composer":"ops/runner-factory/controller-bootstrap-composition.mjs","configurationLoader":"ops/runner-factory/controller-runtime-configuration.mjs","snapshotCoordinator":"ops/runner-factory/reconciliation-snapshot-coordinator.mjs","runtimeAssembly":"ops/runner-factory/controller-runtime-assembly.mjs","serviceRuntime":"ops/runner-factory/service-config.mjs","fixtureRegistry":"ops/runner-factory/controller-bootstrap-composition-fixtures.json","verifier":"scripts/verify-runner-factory-controller-bootstrap-composition.mjs","productionEntrypoint":"UNCHANGED_UNCONFIGURED"},"operations":[{"id":"plan","guard":"positively verified, fully resolved and currently valid configuration bundle","result":"six-component digest-bound bootstrap plan without construction"},{"id":"compose","guard":"one configuration bundle may be consumed once by six exact factories","result":"opaque non-forgeable TEST_ONLY bootstrap capability"},{"id":"verify","guard":"recompute plan, component, composition and receipt digests","result":"standalone receipt integrity verdict without component access"},{"id":"project","guard":"one live capability may project exactly once","result":"five guarded readers plus one guarded attestation verifier"},{"id":"dispose","guard":"composed components close in reverse order and block future calls","result":"idempotent terminal disposal evidence"}],"components":[{"id":"ReservationReader","kind":"READ_ONLY_READER","authority":"reservation-ledger","configRefs":2,"consumer":"snapshot-coordinator"},{"id":"CapacityReader","kind":"READ_ONLY_READER","authority":"capacity-ledger","configRefs":2,"consumer":"snapshot-coordinator"},{"id":"WorkerReader","kind":"READ_ONLY_READER","authority":"ec2-worker-read-model","configRefs":2,"consumer":"snapshot-coordinator"},{"id":"RunnerReader","kind":"READ_ONLY_READER","authority":"gitea-runner-read-model","configRefs":3,"consumer":"snapshot-coordinator"},{"id":"JournalReader","kind":"READ_ONLY_READER","authority":"append-only-journal","configRefs":2,"consumer":"snapshot-coordinator"},{"id":"ReadinessAttestationVerifier","kind":"ATTESTATION_VERIFIER","authority":"root-owned-trust-store","configRefs":1,"consumer":"runtime-assembly"}],"consumers":[{"id":"snapshot-coordinator","input":"five authority-pinned read functions","proof":"one complete five-source TEST_ONLY capture"},{"id":"runtime-assembly","input":"one verify-only P-256 attestation function","proof":"one signed-gate TEST_ONLY assembly packet"},{"id":"controller-readiness","input":"receipt-backed runtime projection","proof":"one 1/11 blocked service readiness projection"}],"stateModel":[{"id":"UNPLANNED","meaning":"no configuration bundle has been verified or consumed"},{"id":"CONFIGURATION_VERIFIED","meaning":"the resolved bundle and validity window passed again"},{"id":"COMPOSING","meaning":"six factories are executing in deterministic order"},{"id":"COMPOSED","meaning":"one opaque capability owns all six TEST_ONLY components"},{"id":"PROJECTED","meaning":"guarded readers and verifier were exposed exactly once"},{"id":"DISPOSED","meaning":"all components closed in reverse and future calls are denied"},{"id":"DENIED","meaning":"configuration, factory, component, handle, receipt or cleanup failed closed"}],"invariants":["only a positively verified CONFIGURATION_RESOLVED bundle may be planned","all twelve references must be present before composition begins","the bundle must be current at the bootstrap clock and not merely internally well formed","the configuration bundle digest binds every component plan","the manifest and assembly-plan digests remain unchanged across bootstrap","exactly five read-only Reader components and one attestation verifier are required","factory names and ordering are closed rather than caller extensible","Reservation Reader receives exactly its table and read-role references","Capacity Reader receives exactly its table and read-role references","Worker Reader receives exactly its region and read-role references","Runner Reader receives only origin, opaque SecretRef and root-agent socket references","Journal Reader receives exactly its table and read-role references","the attestation verifier receives verify-only public trust metadata without private material","configuration values are represented publicly only by a configuration digest","all constructed components must identify as TEST_ONLY","Reader components expose only read and dispose callables","the verifier component exposes only verify and dispose callables","no component may expose a listen, server, start, write or mutation surface","one bundle digest may create only one bootstrap capability","a bootstrap capability cannot be forged from its public fields","a capability may project dependencies exactly once","projected calls are guarded by the live capability state","partial factory failure disposes every completed component in reverse order","terminal disposal attempts every component in reverse order","post-disposal Reader and verifier calls are denied","plan, component, composition and receipt digests are independently recomputed","composition performs zero external reads, writes, mutations and listener starts","the production service entrypoint remains unconfigured and production truth remains zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":45,"acceptedOutcomes":7,"deniedOutcomes":38,"snapshotIntegrations":1,"assemblyIntegrations":1,"readinessProjections":1,"replayedBundlesDenied":1,"forgedHandlesDenied":1,"postDisposeCallsDenied":1,"reverseCleanupCases":6,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"listenerStarts":0},"failureClasses":[{"code":"RF_BOOTSTRAP_CONFIGURATION_VERIFY|CONFIGURATION_BLOCKED|CONFIGURATION_TIME|CONFIGURATION_BINDING","effect":"deny unverified, partial, expired, future or rebound configuration"},{"code":"RF_BOOTSTRAP_FACTORY|FACTORY_SET|COMPONENT","effect":"deny missing factories, constructor failures and components with excess authority"},{"code":"RF_BOOTSTRAP_REPLAY|HANDLE","effect":"deny bundle reuse, projected capability reuse and forged handles"},{"code":"RF_BOOTSTRAP_PLAN|RECEIPT|DIGEST","effect":"deny component inventory, plan, composition or receipt drift"},{"code":"RF_BOOTSTRAP_CLEANUP|DISPOSED","effect":"deny ambiguous cleanup and every call after terminal disposal"},{"code":"RF_RECON_SOURCE_*|RF_ASSEMBLY_SIGNATURE","effect":"downstream readers and verifier remain fail closed after projection"}],"productionPrerequisites":["install the reviewed root-owned runtime manifest and resolve all twelve references","implement five production read-only factories with exact IAM and network boundaries","implement the production P-256 public-key verifier without signing authority","prove constructor and disposal behavior for every real SDK and root-agent client","bind the projected readers to the production snapshot coordinator","bind the projected verifier to runtime assembly before readiness evaluation","issue a dedicated host and service identity receipt for the Controller process","install and supervise the loopback-only Controller only after all eleven Gates attest","obtain security, runtime and cost owner approvals before activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-bootstrap-composition-fixtures/v1","fixedTime":"2026-07-20T22:00:00.000Z","cases":[{"id":"RFBC-01","profile":"compose-and-project","expected":"ACCEPT","outcome":"COMPOSED_TEST_ONLY"},{"id":"RFBC-02","profile":"deterministic-plan","expected":"ACCEPT","outcome":"BOOTSTRAP_PLAN_READY_TEST_ONLY"},{"id":"RFBC-03","profile":"snapshot-integration","expected":"ACCEPT","outcome":"COMPLETE"},{"id":"RFBC-04","profile":"assembly-integration","expected":"ACCEPT","outcome":"BLOCKED_CONFIGURATION_1_OF_11"},{"id":"RFBC-05","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFBC-06","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFBC-07","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFBC-08","profile":"blocked-configuration","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_BLOCKED"},{"id":"RFBC-09","profile":"expired-configuration","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_TIME"},{"id":"RFBC-10","profile":"future-configuration","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_TIME"},{"id":"RFBC-11","profile":"tampered-configuration","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_VERIFY"},{"id":"RFBC-12","profile":"replayed-bundle","expected":"DENY","errorCode":"RF_BOOTSTRAP_REPLAY"},{"id":"RFBC-13","profile":"forged-handle","expected":"DENY","errorCode":"RF_BOOTSTRAP_HANDLE"},{"id":"RFBC-14","profile":"project-replay","expected":"DENY","errorCode":"RF_BOOTSTRAP_HANDLE"},{"id":"RFBC-15","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_BOOTSTRAP_DISPOSED"},{"id":"RFBC-16","profile":"receipt-status-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_RECEIPT"},{"id":"RFBC-17","profile":"receipt-component-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_RECEIPT"},{"id":"RFBC-18","profile":"receipt-digest-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_DIGEST"},{"id":"RFBC-19","profile":"plan-component-order-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_PLAN"},{"id":"RFBC-20","profile":"plan-config-ref-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_PLAN"},{"id":"RFBC-21","profile":"plan-digest-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_DIGEST"},{"id":"RFBC-22","profile":"missing-factory","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY_SET"},{"id":"RFBC-23","profile":"extra-factory","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY_SET"},{"id":"RFBC-24","profile":"non-function-factory","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY_SET"},{"id":"RFBC-25","profile":"reservation-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-26","profile":"capacity-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-27","profile":"worker-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-28","profile":"runner-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-29","profile":"journal-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-30","profile":"verifier-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-31","profile":"reader-wrong-kind","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-32","profile":"reader-wrong-mode","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-33","profile":"reader-missing-read","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-34","profile":"reader-missing-dispose","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-35","profile":"verifier-wrong-kind","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-36","profile":"verifier-wrong-mode","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-37","profile":"verifier-missing-verify","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-38","profile":"verifier-missing-dispose","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-39","profile":"partial-cleanup-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_CLEANUP"},{"id":"RFBC-40","profile":"reader-bad-response","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFBC-41","profile":"verifier-false","expected":"DENY","errorCode":"RF_ASSEMBLY_SIGNATURE"},{"id":"RFBC-42","profile":"invalid-clock","expected":"DENY","errorCode":"RF_BOOTSTRAP_CLOCK"},{"id":"RFBC-43","profile":"configuration-verifier-false","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_VERIFY"},{"id":"RFBC-44","profile":"configuration-verifier-throws","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_VERIFY"},{"id":"RFBC-45","profile":"invalid-receipt-shape","expected":"DENY","errorCode":"RF_BOOTSTRAP_RECEIPT"}]}},"serviceRuntimeBootstrap":{"schemaVersion":"developer.reits.tech/runner-factory-controller-service-runtime-bootstrap/v1","status":"SERVICE_RUNTIME_BOOTSTRAP_IMPLEMENTED_NOT_INSTALLED","observedAt":"2026-07-21T00:00:00Z","scope":{"mode":"TEST_ONLY_SERVICE_HANDLER_NO_LISTENER","configurationInput":"VERIFIED_RESOLVED_BUNDLE_ONLY","readinessInput":"ELEVEN_SIGNED_GATE_ATTESTATIONS","output":"OPAQUE_IN_MEMORY_REQUEST_HANDLER","networkAuthority":"NONE","productionWebhookPolicy":"ALWAYS_BLOCKED","mutationPolicy":"NO_WRITE_NO_LISTENER_NO_LIFECYCLE_ADAPTER"},"truth":{"productionBootstraps":0,"productionServiceHandlers":0,"configuredReadinessGates":0,"runtimeBootstrapReceipts":0,"runtimeHandlerProjections":0,"controllerListeners":0,"productionWebhooksAccepted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"bootstrap":"ops/runner-factory/controller-service-runtime-bootstrap.mjs","configurationLoader":"ops/runner-factory/controller-runtime-configuration.mjs","componentComposer":"ops/runner-factory/controller-bootstrap-composition.mjs","runtimeAssembly":"ops/runner-factory/controller-runtime-assembly.mjs","serviceCore":"ops/runner-factory/controller-service-core.mjs","fixtureRegistry":"ops/runner-factory/controller-service-runtime-bootstrap-fixtures.json","verifier":"scripts/verify-runner-factory-controller-service-runtime-bootstrap.mjs","productionEntrypoint":"UNCHANGED_UNCONFIGURED"},"operations":[{"id":"prepare","guard":"resolved single-use bundle plus eleven positively verified Gate attestations","result":"opaque digest-bound service runtime capability"},{"id":"verify","guard":"exact upstream identities, zero-authority truth and receipt digest","result":"standalone runtime bootstrap receipt verdict"},{"id":"project","guard":"live unexpired capability may project once","result":"guarded in-memory request handler without a network listener"},{"id":"dispose","guard":"projection state is terminally revoked before component cleanup","result":"six bootstrap components disposed and future calls denied"}],"chain":[{"id":"configuration","input":"root-owned manifest + 11 ConfigRef + 1 KeyRef","proof":"CONFIGURATION_RESOLVED bundle digest"},{"id":"composition","input":"six closed TEST_ONLY factories","proof":"bootstrap receipt + opaque capability"},{"id":"assembly","input":"runtime identity + 11 signed Gate attestations","proof":"READY_VERIFIED packet + receipt-backed runtime"},{"id":"service","input":"safe config + frozen policy/template + verified runtime","proof":"ready in-memory handler; webhook remains blocked"},{"id":"network","input":"none","proof":"listener authorization absent and listener starts zero"}],"stateModel":[{"id":"UNPREPARED","meaning":"no configuration bundle or component capability has been consumed"},{"id":"COMPOSING","meaning":"the six-component TEST_ONLY closure is being built"},{"id":"ASSEMBLING","meaning":"identity and all Gate attestations are being verified"},{"id":"READY_HANDLER","meaning":"a receipt-backed service core exists only in memory"},{"id":"PROJECTED","meaning":"one guarded request function has been projected"},{"id":"DISPOSING","meaning":"future request calls are denied before reverse cleanup starts"},{"id":"DISPOSED","meaning":"all six components are closed and the handler is revoked"},{"id":"DENIED","meaning":"configuration, composition, assembly, service, receipt or cleanup failed closed"}],"invariants":["the orchestrator accepts only the exact TEST_ONLY bootstrap composer surface","service configuration remains EVIDENCE_ONLY on loopback port 8110","apply, public routing and external writes remain disabled","policy, worker template and service configuration are cloned and deeply frozen","a resolved configuration bundle is consumed only through the reviewed composer","exactly five read-only Readers and one verify-only attestation component remain underneath the capability","runtime assembly uses only the verifier projected by the live composition capability","runtime identity remains bound to the manifest controller, host and service identity","all eleven readiness Gate attestations are required before service construction","duplicate, stale, future, wrong-scope and bad-signature attestations deny bootstrap","a BLOCKED_CONFIGURATION assembly packet never creates a service handler","the runtime projection is reconstructed only from the verified readiness receipt","service readiness must report 11 of 11 with a verified receipt","the service factory may expose only handle, readiness, response headers and mode","the projected capability exposes one guarded request function and no socket function","no listen, server or start operation is accepted from the service factory","production webhook handling remains 503 even inside a ready TEST_ONLY handler","health and readiness requests remain loopback-context only","one runtime capability may project a handler exactly once","forged and replayed handles are rejected","expired readiness evidence cannot be prepared or projected","disposal revokes the request guard before component cleanup begins","post-disposal handler calls are rejected","prepare failure disposes every successfully composed component","cleanup ambiguity fails closed and never emits a capability","bootstrap, assembly and readiness receipt digests remain linked in one receipt","runtime bootstrap identity is deterministic for composition, assembly packet and observed time","receipt verification rejects shape, truth, identity and digest drift","external reads, writes, mutations and listener starts remain zero during orchestration","the production Controller entrypoint remains unconfigured and port 8110 remains absent"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":40,"acceptedOutcomes":7,"deniedOutcomes":33,"readyHandlerProjections":4,"blockedReadinessCases":2,"attestationDenials":10,"runtimeIdentityDenials":3,"configurationAndFactoryDenials":4,"serviceFactoryDenials":3,"constructorDenials":3,"capabilityDenials":3,"receiptDenials":2,"timeDenials":2,"cleanupDenials":1,"productionWebhooksAccepted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"listenerStarts":0},"failureClasses":[{"code":"RF_SERVICE_BOOTSTRAP_DEPENDENCIES|CONFIG|INPUT","effect":"deny incomplete, extended or authority-bearing orchestration inputs"},{"code":"RF_BOOTSTRAP_*","effect":"deny unverified configuration, factory drift, replay and component cleanup ambiguity"},{"code":"RF_ASSEMBLY_*","effect":"deny runtime identity, attestation, signature, time and packet drift"},{"code":"RF_SERVICE_BOOTSTRAP_READINESS|TIME","effect":"deny partial or expired readiness before a handler exists"},{"code":"RF_SERVICE_BOOTSTRAP_SERVICE","effect":"deny service factories that throw, stay unready or expose excess authority"},{"code":"RF_SERVICE_BOOTSTRAP_HANDLE|DISPOSED|CLEANUP","effect":"deny forged, replayed, revoked or ambiguously disposed capabilities"},{"code":"RF_SERVICE_BOOTSTRAP_RECEIPT|DIGEST","effect":"deny runtime bootstrap truth, identity and provenance drift"}],"productionPrerequisites":["install and verify the root-owned runtime manifest and all twelve typed references","replace all six TEST_ONLY factories with reviewed production read-only implementations","issue a dedicated host and non-login service identity receipt","produce fresh signed evidence for all eleven readiness Gates","prove the production service handler against real read adapters without granting write authority","add an independent owner-approved listener authorization receipt with expiry and rollback binding","install the hardened systemd unit only on the dedicated control-plane host","expose loopback through an authenticated reverse proxy only after security and runtime review","run live readiness, webhook denial, incident, rollback and cost-control acceptance before activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-service-runtime-bootstrap-fixtures/v1","fixedTime":"2026-07-21T00:00:00.000Z","cases":[{"id":"RFSB-01","profile":"ready-project","expected":"ACCEPT","outcome":"SERVICE_HANDLER_PROJECTED_TEST_ONLY"},{"id":"RFSB-02","profile":"ready-health","expected":"ACCEPT","outcome":"ALIVE_READY"},{"id":"RFSB-03","profile":"ready-readiness","expected":"ACCEPT","outcome":"READY_11_OF_11"},{"id":"RFSB-04","profile":"ready-webhook-blocked","expected":"ACCEPT","outcome":"PRODUCTION_WEBHOOK_503"},{"id":"RFSB-05","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFSB-06","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFSB-07","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFSB-08","profile":"zero-attestations","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_READINESS"},{"id":"RFSB-09","profile":"one-missing-attestation","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_READINESS"},{"id":"RFSB-10","profile":"duplicate-attestation","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION_SET"},{"id":"RFSB-11","profile":"invalid-signature","expected":"DENY","errorCode":"RF_ASSEMBLY_SIGNATURE"},{"id":"RFSB-12","profile":"verifier-false","expected":"DENY","errorCode":"RF_ASSEMBLY_SIGNATURE"},{"id":"RFSB-13","profile":"expired-attestation","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION_TIME"},{"id":"RFSB-14","profile":"future-attestation","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION_TIME"},{"id":"RFSB-15","profile":"wrong-subject","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFSB-16","profile":"wrong-manifest-digest","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFSB-17","profile":"wrong-identity-digest","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFSB-18","profile":"wrong-issuer-key","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFSB-19","profile":"unknown-gate","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFSB-20","profile":"identity-stale","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY_TIME"},{"id":"RFSB-21","profile":"identity-shared-host","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFSB-22","profile":"identity-wrong-user","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFSB-23","profile":"blocked-bundle","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_BLOCKED"},{"id":"RFSB-24","profile":"tampered-bundle","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_VERIFY"},{"id":"RFSB-25","profile":"expired-bundle","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_TIME"},{"id":"RFSB-26","profile":"factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFSB-27","profile":"unsafe-service-extra-key","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_SERVICE"},{"id":"RFSB-28","profile":"unsafe-service-unready","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_SERVICE"},{"id":"RFSB-29","profile":"service-factory-throws","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_SERVICE"},{"id":"RFSB-30","profile":"invalid-config-mode","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_CONFIG"},{"id":"RFSB-31","profile":"invalid-config-port","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_CONFIG"},{"id":"RFSB-32","profile":"forged-handle","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_HANDLE"},{"id":"RFSB-33","profile":"project-replay","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_HANDLE"},{"id":"RFSB-34","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_DISPOSED"},{"id":"RFSB-35","profile":"receipt-status-tamper","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_RECEIPT"},{"id":"RFSB-36","profile":"receipt-digest-tamper","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_DIGEST"},{"id":"RFSB-37","profile":"invalid-clock","expected":"DENY","errorCode":"RF_BOOTSTRAP_CLOCK"},{"id":"RFSB-38","profile":"expired-before-project","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_TIME"},{"id":"RFSB-39","profile":"cleanup-failure","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_CLEANUP"},{"id":"RFSB-40","profile":"unsafe-composer-surface","expected":"DENY","errorCode":"RF_SERVICE_BOOTSTRAP_DEPENDENCIES"}]}},"productionEvidenceAdmission":{"schemaVersion":"developer.reits.tech/runner-factory-controller-production-evidence-admission/v1","status":"PRODUCTION_EVIDENCE_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T03:00:00Z","scope":{"mode":"TEST_ONLY_PRODUCTION_EVIDENCE_NO_DEPLOYMENT","input":"SIGNED_RELEASE_HOST_SERVICE_ADAPTER_GATE_EVIDENCE","output":"OPAQUE_READ_ONLY_EVIDENCE_DOSSIER","networkAuthority":"NONE","deploymentAuthority":"NONE","mutationPolicy":"VERIFY_ONLY_NO_EXTERNAL_READ_NO_WRITE_NO_LISTENER"},"truth":{"productionAdmissionReceipts":0,"productionHostReceipts":0,"productionServiceIdentityReceipts":0,"qualifiedProductionAdapters":0,"configuredReadinessGates":0,"listenerAuthorizations":0,"controllerListeners":0,"productionWebhooksAccepted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"requirements":[{"id":"release","count":1,"proof":"signed exact source, artifact, configuration and rollback identity"},{"id":"host","count":1,"proof":"dedicated control-plane host, production marker, zero Runner service and loopback bind"},{"id":"service","count":1,"proof":"non-login UID/GID, no capabilities, credential references only and hardened unit digest"},{"id":"adapters","count":6,"proof":"five READ_ONLY Readers plus one VERIFY_ONLY attestation verifier"},{"id":"gates","count":11,"proof":"ordered issuer-pinned attestations bound to the exact manifest and runtime identity"},{"id":"readiness","count":1,"proof":"READY_VERIFIED receipt that reconstructs all eleven Gate facts"}],"operations":[{"id":"admit","guard":"all 19 evidence signatures, six adapters and eleven Gates verify within five minutes","result":"opaque evidence-only admission capability"},{"id":"verify","guard":"exact zero-authority receipt shape, identity and digest","result":"standalone admission receipt verdict"},{"id":"project","guard":"live capability may project once","result":"frozen dossier with no Handler, listener or deployment function"},{"id":"dispose","guard":"admitted or projected capability","result":"evidence references are terminally revoked"}],"stateModel":[{"id":"UNVERIFIED","meaning":"candidate facts have no authority"},{"id":"VERIFYING_IDENTITIES","meaning":"release, host and service bindings are checked"},{"id":"VERIFYING_ADAPTERS","meaning":"six production implementation qualifications are checked"},{"id":"VERIFYING_GATES","meaning":"eleven attestations and readiness reconstruction are checked"},{"id":"ADMITTED_EVIDENCE_ONLY","meaning":"a non-deployable evidence capability exists in memory"},{"id":"PROJECTED","meaning":"one frozen dossier has been projected"},{"id":"DISPOSED","meaning":"the capability and retained dossier are revoked"},{"id":"DENIED","meaning":"any identity, authority, time, signature or digest drift fails closed"}],"invariants":["release identity binds one signed production source, artifact, configuration and distinct rollback target","runtime identity is no older than five minutes","the host is dedicated to the control plane and reports no shared production workloads","the immutable production marker must be present","no Runner service may be active on the Controller host","the only admissible Controller bind is 127.0.0.1:8110","the service user and group are reits-runner-factory","the service account is non-root and non-login","the service home and unit name are exact","inline secret values remain zero and only credential references are allowed","the service has no Linux capabilities and NoNewPrivileges is true","exactly five read-only Readers and one verify-only component are admitted","adapter order, authority, operation, permission and ConfigRef sets are exact","every adapter implementation and configuration evidence is digest-bound","no adapter grants external write or listener authority","adapter qualifications bind the exact release and host","exactly eleven ordered readiness attestations are required","every Gate binds the exact controller, manifest and runtime identity","the readiness issuer is pinned to the reviewed production P-256 KeyRef","every signed receipt is current and valid for at most five minutes","nineteen signatures must verify positively","the READY_VERIFIED receipt reconstructs the same eleven Gate evidence digests","the readiness receipt identity digest is derived from the exact runtime identity","the admission expiry is the earliest upstream expiry","one admission capability can project only once","forged, replayed and disposed capabilities are denied","the projected dossier contains no function or mutable authority","the admission receipt always sets deploymentAuthorized=false","the admission receipt always sets listenerAuthorized=false and handlerCreated=false","external reads, writes, mutations and listener starts remain zero","secret-like fields are structurally rejected","production webhook acceptance remains zero","the existing unconfigured production entrypoint is unchanged","port 8110 remains absent until a separate owner-approved listener receipt exists"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":56,"acceptedOutcomes":6,"deniedOutcomes":50,"fixtureEvidenceSignaturesVerified":339,"productionAdmissionReceipts":0,"productionAdaptersQualified":0,"productionReadinessGates":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["publish a signed Controller release unit with an exercised rollback target","provision and attest a dedicated non-production control-plane host","install the reviewed non-login service identity and hardened unit without starting it","implement and independently review the five production read adapters","install the verify-only readiness public key through a root-owned KeyRef","collect nineteen fresh signatures and all eleven Gate evidence objects","run the admission verifier on the target host with external calls still disabled","obtain a separate expiring owner-approved listener authorization","perform live negative-webhook, rollback, incident, security and cost acceptance before activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-production-evidence-admission-fixtures/v1","fixedTime":"2026-07-21T03:00:00.000Z","cases":[{"id":"RFEA-01","profile":"admit","expected":"ACCEPT","outcome":"EVIDENCE_ADMITTED"},{"id":"RFEA-02","profile":"project","expected":"ACCEPT","outcome":"DOSSIER_PROJECTED"},{"id":"RFEA-03","profile":"verify-receipt","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFEA-04","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFEA-05","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFEA-06","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFEA-07","profile":"missing-verifier","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_DEPENDENCIES"},{"id":"RFEA-08","profile":"invalid-clock","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_CLOCK"},{"id":"RFEA-09","profile":"release-schema","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-10","profile":"release-staging","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-11","profile":"release-unsigned","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-12","profile":"release-source","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-13","profile":"release-rollback-self","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-14","profile":"identity-shared","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-15","profile":"identity-not-dedicated","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-16","profile":"identity-stale","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-17","profile":"identity-wrong-user","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-18","profile":"identity-host","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-19","profile":"host-shared","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-20","profile":"host-marker-missing","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-21","profile":"host-runner-active","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-22","profile":"host-bind-public","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-23","profile":"host-release","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-24","profile":"host-expired","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST_SIGNATURE"},{"id":"RFEA-25","profile":"host-signature","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST_SIGNATURE"},{"id":"RFEA-26","profile":"service-root","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-27","profile":"service-login","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-28","profile":"service-inline-secret","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SECRET"},{"id":"RFEA-29","profile":"service-capability","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-30","profile":"service-nnp","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-31","profile":"service-host","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-32","profile":"service-release","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-33","profile":"service-signature","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE_SIGNATURE"},{"id":"RFEA-34","profile":"adapter-missing","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER_SET"},{"id":"RFEA-35","profile":"adapter-order","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-36","profile":"adapter-mode","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-37","profile":"adapter-write","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-38","profile":"adapter-listener","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SECRET"},{"id":"RFEA-39","profile":"adapter-config-ref","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-40","profile":"adapter-implementation","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-41","profile":"adapter-signature","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER_SIGNATURE"},{"id":"RFEA-42","profile":"gate-missing","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE_SET"},{"id":"RFEA-43","profile":"gate-order","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE"},{"id":"RFEA-44","profile":"gate-controller","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE"},{"id":"RFEA-45","profile":"gate-manifest","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE"},{"id":"RFEA-46","profile":"gate-signature","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE_SIGNATURE"},{"id":"RFEA-47","profile":"gate-expired","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE_SIGNATURE"},{"id":"RFEA-48","profile":"readiness-blocked","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_READINESS"},{"id":"RFEA-49","profile":"readiness-identity","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_READINESS"},{"id":"RFEA-50","profile":"readiness-digest","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_READINESS_DIGEST"},{"id":"RFEA-51","profile":"readiness-gate","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_READINESS"},{"id":"RFEA-52","profile":"forged-handle","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HANDLE"},{"id":"RFEA-53","profile":"project-replay","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HANDLE"},{"id":"RFEA-54","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HANDLE"},{"id":"RFEA-55","profile":"receipt-status","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RECEIPT"},{"id":"RFEA-56","profile":"receipt-digest","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RECEIPT_DIGEST"}]}},"listenerAuthorization":{"schemaVersion":"developer.reits.tech/runner-factory-controller-listener-authorization/v1","status":"LISTENER_AUTHORIZATION_BOUNDARY_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T04:00:00Z","scope":{"mode":"TEST_ONLY_CANDIDATE_AUTHORIZATION_NO_ACTIVATION","input":"ADMISSION_ROLLBACK_WEBHOOK_DRILLS_OWNER_APPROVALS","output":"OPAQUE_ONE_SHOT_LISTENER_CANDIDATE","endpoint":"127.0.0.1:8110","validitySeconds":120,"networkAuthority":"NONE","deploymentAuthority":"NONE"},"truth":{"productionListenerAuthorizationReceipts":0,"productionOwnerApprovals":0,"productionRollbackRehearsals":0,"productionNegativeWebhookRehearsals":0,"productionOperationalDrills":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"requirements":[{"id":"admission","count":1,"proof":"authority-verified unexpired production-evidence admission receipt"},{"id":"request","count":1,"proof":"exact release, host, config, unit and loopback endpoint request"},{"id":"rollback","count":1,"proof":"signed distinct-target rollback rehearsal within 300 seconds"},{"id":"negative-webhook","count":1,"proof":"signed rejection proof for unsigned, invalid and stale deliveries"},{"id":"operational-drills","count":2,"proof":"ordered rollback and incident drill receipts"},{"id":"owner-approvals","count":4,"proof":"security, runtime, cost and operations approvals"},{"id":"nonce","count":1,"proof":"single-use scope-bound authorization nonce"},{"id":"expiry","count":1,"proof":"earliest upstream expiry with a 120-second maximum"}],"operations":[{"id":"authorize","guard":"verify every exact digest, signature, owner and time boundary","result":"opaque candidate handle only"},{"id":"verify","guard":"reconstruct the candidate receipt identity and authority truth","result":"boolean receipt validation"},{"id":"project","guard":"consume one live capability exactly once","result":"frozen non-executable listener plan"},{"id":"dispose","guard":"revoke retained candidate state","result":"idempotent disposal receipt"}],"stateModel":[{"id":"UNTRUSTED","meaning":"the packet has no listener-candidate standing"},{"id":"ADMISSION_BOUND","meaning":"the exact upstream admission digest is current"},{"id":"TARGET_BOUND","meaning":"release, host, config, unit and loopback endpoint match"},{"id":"RECOVERY_PROVEN","meaning":"rollback, negative webhook and two drills pass"},{"id":"OWNERS_APPROVED","meaning":"four independent approvals bind the same scope and nonce"},{"id":"CANDIDATE","meaning":"one opaque, two-minute, fixture-only capability exists"},{"id":"PROJECTED_OR_DISPOSED","meaning":"the capability cannot be consumed again"},{"id":"DENIED","meaning":"any drift fails closed without activation or mutation"}],"invariants":["the upstream admission receipt is exact, digest-bound, unexpired and positively verified by its authority","fixture-only admission can produce only a fixture-only listener candidate","release identity is unchanged from the admission receipt","rollback release is valid and distinct from the active release","controller identity is unchanged from the admission receipt","host identity is unchanged from the admission receipt","manifest digest is unchanged from the admission receipt","configuration digest is exact and scope-bound","systemd unit digest is exact and scope-bound","service user is exactly reits-runner-factory","service unit is exactly reits-runner-factory-controller.service","bind host is exactly 127.0.0.1","port is exactly 8110","public route is always false","reverse proxy is always false","the request window is no longer than 120 seconds","the candidate expires at the earliest upstream expiry","the nonce is format-checked and single-use","rollback evidence binds the exact release, target, host and configuration","rollback restore time is at most 300 seconds","unsigned webhook delivery is rejected","invalid webhook signature is rejected","stale webhook delivery is rejected","negative webhook rehearsal accepts zero requests and performs zero writes","rollback and incident drills are both required in canonical order","drills report PASS, no data loss and zero external writes","security, runtime, cost and operations owners are all required","each owner signs APPROVE_CANDIDATE_ONLY for the same scope and nonce","eight evidence signatures must verify positively","secret-like and executable fields are structurally rejected","the candidate handle is opaque, one-shot and WeakMap-backed","the projected plan exposes no function and zero executable steps","activationAuthorized and listenerStartAuthorized remain false","listener starts, external reads, writes and mutations remain zero","no paid resource or public route can be created","the production entrypoint remains unconfigured and port 8110 remains absent"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":53,"acceptedOutcomes":6,"deniedOutcomes":47,"fixtureEvidenceSignaturesVerified":132,"plansProjected":3,"productionListenerAuthorizationReceipts":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["replace fixture admission with a live target-host admission receipt","exercise rollback on the exact signed production release pair","run negative webhook tests against the stopped loopback service harness","complete incident and rollback drills with retained evidence","collect independent security, runtime, cost and operations signatures","issue a live 120-second nonce only inside the approved maintenance window","rerun verification on the target host without starting the service","obtain a separate activation executor implementation and review","activate only after an auditable production receipt and immediate rollback guard exist"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-listener-authorization-fixtures/v1","fixedTime":"2026-07-21T04:00:00.000Z","cases":[{"id":"RFLA-01","profile":"authorize","expected":"ACCEPT","outcome":"CANDIDATE_AUTHORIZED"},{"id":"RFLA-02","profile":"project","expected":"ACCEPT","outcome":"PLAN_PROJECTED"},{"id":"RFLA-03","profile":"verify-receipt","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFLA-04","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFLA-05","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFLA-06","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFLA-07","profile":"missing-verifier","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DEPENDENCIES"},{"id":"RFLA-08","profile":"invalid-clock","expected":"DENY","errorCode":"RF_LISTENER_AUTH_CLOCK"},{"id":"RFLA-09","profile":"admission-status","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ADMISSION"},{"id":"RFLA-10","profile":"admission-expired","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ADMISSION"},{"id":"RFLA-11","profile":"admission-digest","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ADMISSION_DIGEST"},{"id":"RFLA-12","profile":"request-public-bind","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-13","profile":"request-port","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-14","profile":"request-public-route","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-15","profile":"request-proxy","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-16","profile":"request-release","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-17","profile":"request-rollback-self","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-18","profile":"request-controller","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-19","profile":"request-host","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-20","profile":"request-manifest","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-21","profile":"request-unit","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-22","profile":"request-user","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-23","profile":"request-expired","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-24","profile":"request-long-window","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-25","profile":"secret-material","expected":"DENY","errorCode":"RF_LISTENER_AUTH_SECRET"},{"id":"RFLA-26","profile":"rollback-release","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK"},{"id":"RFLA-27","profile":"rollback-target","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK"},{"id":"RFLA-28","profile":"rollback-slow","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK"},{"id":"RFLA-29","profile":"rollback-config","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK"},{"id":"RFLA-30","profile":"rollback-signature","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK_SIGNATURE"},{"id":"RFLA-31","profile":"webhook-unsigned","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK"},{"id":"RFLA-32","profile":"webhook-invalid","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK"},{"id":"RFLA-33","profile":"webhook-stale","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK"},{"id":"RFLA-34","profile":"webhook-accepted","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK"},{"id":"RFLA-35","profile":"webhook-signature","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK_SIGNATURE"},{"id":"RFLA-36","profile":"drill-missing","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL_SET"},{"id":"RFLA-37","profile":"drill-order","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL"},{"id":"RFLA-38","profile":"drill-fail","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL"},{"id":"RFLA-39","profile":"drill-data-loss","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL"},{"id":"RFLA-40","profile":"drill-signature","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL_SIGNATURE"},{"id":"RFLA-41","profile":"approval-missing","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL_SET"},{"id":"RFLA-42","profile":"approval-order","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL"},{"id":"RFLA-43","profile":"approval-decision","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL"},{"id":"RFLA-44","profile":"approval-scope","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL"},{"id":"RFLA-45","profile":"approval-nonce","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL"},{"id":"RFLA-46","profile":"approval-signature","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL_SIGNATURE"},{"id":"RFLA-47","profile":"forged-handle","expected":"DENY","errorCode":"RF_LISTENER_AUTH_HANDLE"},{"id":"RFLA-48","profile":"project-replay","expected":"DENY","errorCode":"RF_LISTENER_AUTH_HANDLE"},{"id":"RFLA-49","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_LISTENER_AUTH_HANDLE"},{"id":"RFLA-50","profile":"receipt-status","expected":"DENY","errorCode":"RF_LISTENER_AUTH_RECEIPT"},{"id":"RFLA-51","profile":"receipt-digest","expected":"DENY","errorCode":"RF_LISTENER_AUTH_RECEIPT_DIGEST"},{"id":"RFLA-52","profile":"nonce-replay","expected":"DENY","errorCode":"RF_LISTENER_AUTH_NONCE"},{"id":"RFLA-53","profile":"admission-provenance","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ADMISSION_PROVENANCE"}]}},"activationExecutor":{"schemaVersion":"developer.reits.tech/runner-factory-controller-activation-executor/v1","status":"ACTIVATION_EXECUTOR_DRY_RUN_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T05:00:00Z","scope":{"mode":"TEST_ONLY_RUNBOOK_NO_EXECUTOR","input":"LISTENER_CANDIDATE_WINDOW_PREFLIGHT_ROLLBACK_GUARD_CONFIRMATIONS","output":"OPAQUE_ONE_SHOT_ACTIVATION_RUNBOOK","endpoint":"127.0.0.1:8110","requestValiditySeconds":60,"maintenanceWindowSeconds":900,"rollbackDeadlineSeconds":60,"networkAuthority":"NONE","deploymentAuthority":"NONE"},"truth":{"productionActivationPlanReceipts":0,"productionMaintenanceWindows":0,"productionRuntimeConfirmations":0,"productionPreflightReceipts":0,"productionRollbackGuards":0,"activationExecutorsConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"requirements":[{"id":"listener-candidate","count":1,"proof":"authority-verified unexpired listener candidate with zero activation authority"},{"id":"plan-request","count":1,"proof":"PLAN_ACTIVATION_ONLY bound to exact release, host, config, unit and loopback target"},{"id":"maintenance-window","count":1,"proof":"signed open change window no longer than 15 minutes"},{"id":"preflight","count":1,"proof":"signed stopped-state proof for 8110, unit, proxy, portal 8100 and rollback"},{"id":"rollback-guard","count":1,"proof":"signed 60-second health/readiness/identity/bind/proxy trigger policy"},{"id":"runtime-confirmations","count":2,"proof":"distinct change owner and incident commander confirmations"},{"id":"nonce","count":1,"proof":"single-use scope-bound activation-planning nonce"},{"id":"expiry","count":1,"proof":"earliest upstream expiry with a 60-second request maximum"}],"operations":[{"id":"prepare","guard":"verify upstream authority, exact stopped state, window, guard and separation of duties","result":"opaque dry-run handle only"},{"id":"verify","guard":"reconstruct runbook identity and zero-authority truth","result":"boolean receipt validation"},{"id":"project","guard":"consume one live capability exactly once","result":"frozen eight-step runbook with no executor"},{"id":"dispose","guard":"revoke retained runbook state","result":"idempotent disposal receipt"}],"stateModel":[{"id":"UNTRUSTED","meaning":"the packet has no activation-planning standing"},{"id":"CANDIDATE_BOUND","meaning":"the authoritative listener candidate is current and unmodified"},{"id":"WINDOW_OPEN","meaning":"the signed change window is open and no longer than 15 minutes"},{"id":"STOPPED_STATE_PROVEN","meaning":"8110, unit, service, proxy and route are absent while portal 8100 is healthy"},{"id":"ROLLBACK_GUARDED","meaning":"the complete fail trigger set has a 60-second recovery deadline"},{"id":"TWO_PERSON_CONFIRMED","meaning":"two different subjects confirm the same dry-run scope"},{"id":"RUNBOOK_CANDIDATE","meaning":"one opaque fixture-only zero-executor capability exists"},{"id":"PROJECTED_OR_DISPOSED","meaning":"the capability cannot be consumed again"},{"id":"DENIED","meaning":"any drift fails closed without install, start, listener or mutation"}],"runbookSteps":[{"order":1,"id":"VERIFY_CANDIDATE","mode":"NO_EXECUTOR"},{"order":2,"id":"VERIFY_WINDOW","mode":"NO_EXECUTOR"},{"order":3,"id":"SNAPSHOT_ROLLBACK","mode":"NO_EXECUTOR"},{"order":4,"id":"INSTALL_UNIT","mode":"NO_EXECUTOR"},{"order":5,"id":"START_LOOPBACK","mode":"NO_EXECUTOR"},{"order":6,"id":"PROBE_HEALTH","mode":"NO_EXECUTOR"},{"order":7,"id":"AUTO_ROLLBACK","mode":"NO_EXECUTOR"},{"order":8,"id":"SEAL_RECEIPT","mode":"NO_EXECUTOR"}],"rollbackTriggers":["START_ERROR","READINESS_TIMEOUT","IDENTITY_DRIFT","UNEXPECTED_BIND","PROXY_DRIFT"],"invariants":["the upstream listener candidate is exact, digest-bound, unexpired and positively verified by its authority","fixture-only listener authority can produce only a fixture-only dry-run runbook","the listener candidate carries activationAuthorized=false and listenerStartAuthorized=false","release identity is unchanged from the listener candidate","rollback release is unchanged from the listener candidate and remains distinct","controller identity is unchanged from the listener candidate","host identity is unchanged from the listener candidate","manifest digest is unchanged from the listener candidate","configuration digest is unchanged from the listener candidate","systemd unit digest is unchanged from the listener candidate","the only request action is PLAN_ACTIVATION_ONLY","service user is exactly reits-runner-factory","service unit is exactly reits-runner-factory-controller.service","bind host is exactly 127.0.0.1 and port is exactly 8110","public route and reverse proxy requests are always false","the plan request window is no longer than 60 seconds","the maintenance window is signed, currently open and no longer than 15 minutes","the maintenance change identifier is format constrained","preflight proves port 8110 is absent","preflight proves the Controller unit is not installed","preflight proves the Controller service is not active","preflight proves no proxy or public route is configured","preflight proves the existing portal on 8100 is healthy","preflight proves the exact rollback release is present","preflight requires at least one GiB of disk headroom","rollback deadline is no longer than 60 seconds","rollback probes are exactly /healthz and /readyz","rollback requires two healthy probes","start error, readiness timeout, identity drift, unexpected bind and proxy drift all trigger rollback","the rollback guard itself exposes no executor","change owner and incident commander are both required in canonical order","change owner and incident commander must be different subjects","both subjects sign CONFIRM_DRY_RUN_ONLY for the same scope and nonce","five evidence signatures must verify positively","the nonce is format-checked and single-use","secret-like and executable fields are structurally rejected","the runbook handle is opaque, one-shot and WeakMap-backed","the projected runbook contains eight declarative NO_EXECUTOR steps","the projected runbook exposes no function and zero executable steps","activation, unit install, service start and listener start remain false","external reads, writes, mutations, paid resources, proxy and public routes remain zero","the production entrypoint remains unconfigured and port 8110 remains absent"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":68,"acceptedOutcomes":6,"deniedOutcomes":62,"fixtureEvidenceSignaturesVerified":110,"runbooksProjected":3,"productionActivationPlanReceipts":0,"activationExecutorsConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["replace the fixture listener candidate with an authority-verified target-host candidate","open an approved production maintenance window with an immutable change identifier","capture signed target-host preflight while 8110, unit, service, proxy and route are absent","prove portal 8100 health and the exact rollback release before any install action","collect different change owner and incident commander subjects for the exact scope","implement a separately reviewed least-privilege executor without shell interpolation","implement an independently testable rollback executor and 60-second watchdog","exercise install, start, health, readiness and every rollback trigger on a non-production host","obtain a new authority receipt before activation; this dry-run runbook can never be promoted"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-activation-executor-fixtures/v1","fixedTime":"2026-07-21T05:00:00.000Z","cases":[{"id":"RFAE-01","profile":"prepare","expected":"ACCEPT","outcome":"RUNBOOK_PREPARED"},{"id":"RFAE-02","profile":"project","expected":"ACCEPT","outcome":"RUNBOOK_PROJECTED"},{"id":"RFAE-03","profile":"verify-receipt","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFAE-04","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFAE-05","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFAE-06","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFAE-07","profile":"missing-verifier","expected":"DENY","errorCode":"RF_ACTIVATION_DEPENDENCIES"},{"id":"RFAE-08","profile":"invalid-clock","expected":"DENY","errorCode":"RF_ACTIVATION_CLOCK"},{"id":"RFAE-09","profile":"candidate-status","expected":"DENY","errorCode":"RF_ACTIVATION_CANDIDATE"},{"id":"RFAE-10","profile":"candidate-expired","expected":"DENY","errorCode":"RF_ACTIVATION_CANDIDATE"},{"id":"RFAE-11","profile":"candidate-digest","expected":"DENY","errorCode":"RF_ACTIVATION_CANDIDATE_DIGEST"},{"id":"RFAE-12","profile":"candidate-provenance","expected":"DENY","errorCode":"RF_ACTIVATION_CANDIDATE_PROVENANCE"},{"id":"RFAE-13","profile":"request-action","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-14","profile":"request-release","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-15","profile":"request-rollback","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-16","profile":"request-controller","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-17","profile":"request-host","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-18","profile":"request-manifest","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-19","profile":"request-config","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-20","profile":"request-unit","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-21","profile":"request-user","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-22","profile":"request-bind","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-23","profile":"request-port","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-24","profile":"request-route","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-25","profile":"request-proxy","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-26","profile":"request-expired","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-27","profile":"request-long-window","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-28","profile":"request-nonce","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-29","profile":"secret-material","expected":"DENY","errorCode":"RF_ACTIVATION_EXECUTABLE_MATERIAL"},{"id":"RFAE-30","profile":"window-change-id","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-31","profile":"window-status","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-32","profile":"window-release","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-33","profile":"window-host","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-34","profile":"window-not-open","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-35","profile":"window-too-long","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-36","profile":"window-signature","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW_SIGNATURE"},{"id":"RFAE-37","profile":"preflight-release","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-38","profile":"preflight-rollback","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-39","profile":"preflight-controller","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-40","profile":"preflight-port-present","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-41","profile":"preflight-service-installed","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-42","profile":"preflight-service-active","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-43","profile":"preflight-proxy","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-44","profile":"preflight-route","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-45","profile":"preflight-portal-unhealthy","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-46","profile":"preflight-rollback-missing","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-47","profile":"preflight-disk","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-48","profile":"preflight-config","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-49","profile":"preflight-unit","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-50","profile":"preflight-signature","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT_SIGNATURE"},{"id":"RFAE-51","profile":"guard-deadline","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_GUARD"},{"id":"RFAE-52","profile":"guard-paths","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_GUARD"},{"id":"RFAE-53","profile":"guard-triggers","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_GUARD"},{"id":"RFAE-54","profile":"guard-executor","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_GUARD"},{"id":"RFAE-55","profile":"guard-signature","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_SIGNATURE"},{"id":"RFAE-56","profile":"confirmation-missing","expected":"DENY","errorCode":"RF_ACTIVATION_CONFIRMATION_SET"},{"id":"RFAE-57","profile":"confirmation-same-subject","expected":"DENY","errorCode":"RF_ACTIVATION_SEPARATION_OF_DUTIES"},{"id":"RFAE-58","profile":"confirmation-decision","expected":"DENY","errorCode":"RF_ACTIVATION_CONFIRMATION"},{"id":"RFAE-59","profile":"confirmation-scope","expected":"DENY","errorCode":"RF_ACTIVATION_CONFIRMATION"},{"id":"RFAE-60","profile":"confirmation-signature","expected":"DENY","errorCode":"RF_ACTIVATION_CONFIRMATION_SIGNATURE"},{"id":"RFAE-61","profile":"forged-handle","expected":"DENY","errorCode":"RF_ACTIVATION_HANDLE"},{"id":"RFAE-62","profile":"project-replay","expected":"DENY","errorCode":"RF_ACTIVATION_HANDLE"},{"id":"RFAE-63","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_ACTIVATION_HANDLE"},{"id":"RFAE-64","profile":"receipt-status","expected":"DENY","errorCode":"RF_ACTIVATION_RECEIPT"},{"id":"RFAE-65","profile":"receipt-digest","expected":"DENY","errorCode":"RF_ACTIVATION_RECEIPT_DIGEST"},{"id":"RFAE-66","profile":"nonce-replay","expected":"DENY","errorCode":"RF_ACTIVATION_NONCE"},{"id":"RFAE-67","profile":"clock-rollback","expected":"DENY","errorCode":"RF_ACTIVATION_CLOCK_ROLLBACK"},{"id":"RFAE-68","profile":"expired-before-project","expected":"DENY","errorCode":"RF_ACTIVATION_EXPIRED"}]}},"activationTransaction":{"schemaVersion":"developer.reits.tech/runner-factory-controller-activation-transaction-executor/v1","status":"ACTIVATION_TRANSACTION_EXECUTOR_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T05:00:00Z","scope":{"mode":"IN_MEMORY_TEST_DRIVER_ONLY","input":"AUTHORITY_VERIFIED_TEST_ONLY_ACTIVATION_PLAN_AND_30_SECOND_FIXTURE_REQUEST","output":"DIGEST_BOUND_COMMIT_ROLLBACK_OR_CONTAINMENT_RECEIPT","endpoint":"127.0.0.1:8110","requestValiditySeconds":30,"rollbackDeadlineSeconds":60,"networkAuthority":"NONE","deploymentAuthority":"NONE","productionEntrypointWired":false},"truth":{"productionActivationPlanReceipts":0,"productionTransactionRequests":0,"productionExecutorsConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"ports":[{"id":"acquireLock","operation":"ACQUIRE_LOCK","authority":"fixture-driver-only"},{"id":"snapshotRollback","operation":"SNAPSHOT_ROLLBACK","authority":"fixture-driver-only"},{"id":"installUnit","operation":"INSTALL_UNIT","authority":"fixture-driver-only"},{"id":"startLoopback","operation":"START_LOOPBACK","authority":"fixture-driver-only"},{"id":"probeHealth","operation":"PROBE_HEALTH_OR_READY","authority":"fixture-driver-only"},{"id":"stopLoopback","operation":"STOP_LOOPBACK","authority":"fixture-driver-only"},{"id":"removeUnit","operation":"REMOVE_UNIT","authority":"fixture-driver-only"},{"id":"restoreSnapshot","operation":"RESTORE_SNAPSHOT","authority":"fixture-driver-only"},{"id":"releaseLock","operation":"RELEASE_LOCK","authority":"fixture-driver-only"}],"operations":[{"id":"prepare","guard":"revalidate the exact zero-authority activation plan and a 30-second fixture-only request","result":"opaque one-shot transaction handle"},{"id":"execute","guard":"consume the handle once and invoke only the nine typed driver ports","result":"committed, rolled-back or contained fixture receipt"},{"id":"verify","guard":"reconstruct transaction identity, result shape and production-zero truth","result":"boolean receipt validation"},{"id":"dispose","guard":"revoke retained transaction state before execution","result":"idempotent disposal receipt"}],"forwardSequence":["ACQUIRE_LOCK","SNAPSHOT_ROLLBACK","INSTALL_UNIT","START_LOOPBACK","PROBE_HEALTH","PROBE_READY","RELEASE_LOCK"],"compensationSequence":["STOP_LOOPBACK","REMOVE_UNIT","RESTORE_SNAPSHOT","RELEASE_LOCK"],"stateModel":[{"id":"UNTRUSTED","meaning":"the packet has no transaction standing"},{"id":"PLAN_BOUND","meaning":"the authoritative fixture-only plan is exact and current"},{"id":"PREPARED","meaning":"one opaque 30-second fixture capability exists"},{"id":"LOCKED","meaning":"the in-memory host fence was acquired"},{"id":"SNAPSHOTTED","meaning":"the in-memory rollback state was captured"},{"id":"UNIT_INSTALLED_FIXTURE","meaning":"the digest-bound unit exists only inside the memory driver"},{"id":"LOOPBACK_STARTED_FIXTURE","meaning":"the memory driver reports only 127.0.0.1:8110"},{"id":"HEALTHY_FIXTURE","meaning":"both fixture health paths positively verified"},{"id":"COMMITTED_FIXTURE","meaning":"the success receipt is test-only and grants no production authority"},{"id":"ROLLED_BACK_FIXTURE","meaning":"reverse-order compensation proved a clean memory state"},{"id":"CONTAINED_FIXTURE","meaning":"ambiguous compensation is sealed for manual review without production effect"},{"id":"DENIED","meaning":"input, provenance, sequence or receipt drift failed closed"}],"invariants":["the upstream plan is exact, digest-bound, unexpired and positively verified by its authority","the upstream plan remains fixture-only with activationAuthorized=false","the upstream plan remains unconfigured with executorConfigured=false","the upstream plan proves no installed unit, running service or listener","the transaction action is exactly EXECUTE_FIXTURE_TRANSACTION_ONLY","the transaction mode is exactly IN_MEMORY_TEST_DRIVER","the transaction request lives no longer than 30 seconds","the transaction cannot outlive the upstream plan","release identity is unchanged from the plan","rollback release is unchanged from the plan and remains distinct","controller and host identities are unchanged from the plan","manifest, configuration and unit digests are unchanged from the plan","service user is exactly reits-runner-factory","service unit is exactly reits-runner-factory-controller.service","bind host is exactly 127.0.0.1 and port is exactly 8110","health paths are exactly /healthz then /readyz","public route and reverse proxy requests are always false","the transaction nonce is format checked and single use","secret-like and executable fields are structurally rejected","the driver exposes exactly nine named ports and no generic command port","the production entrypoint does not import or configure this executor","the opaque handle is WeakMap-backed, one-shot and disposable","lock acquisition precedes every fixture mutation","rollback snapshot precedes fixture unit installation","fixture unit installation precedes fixture loopback start","fixture loopback start precedes health and readiness probes","each driver receipt is exact, digest-bound and positively verified","each driver receipt remains bound to plan, release, host, config and unit","every driver receipt reports loopback 8110 with no route or proxy","health and readiness must both positively prove their exact paths","unit or listener identity drift triggers compensation","step verifier rejection triggers compensation","start, health and readiness failure trigger compensation","compensation stops loopback before removing the fixture unit","compensation removes the fixture unit before restoring the snapshot","the fixture lock is released after success or compensation","a clean reverse sequence seals FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK","any compensation or lock-release ambiguity seals FIXTURE_ACTIVATION_TRANSACTION_CONTAINED","a committed receipt explicitly names its in-memory fixture state","a rolled-back receipt proves snapshot, unit and listener are all absent","a contained receipt preserves the compound failure code","fixture driver calls are counted separately from production external reads and writes","fixture mutation operations are counted separately from production mutations","all production activation, executor, unit, service and listener truth remains false","external reads, writes, mutations, paid resources, proxy and public routes remain zero","the executor module imports no child process, shell or network implementation","port 8110 is never opened by this repository packet","the fixture transaction receipt cannot be promoted into production authority"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":72,"acceptedOutcomes":18,"deniedOutcomes":54,"planReceiptsVerified":48,"fixtureStepReceiptsVerified":114,"committedTransactions":5,"rolledBackTransactions":9,"containedTransactions":4,"fixtureDriverCalls":130,"fixtureMutationOperations":30,"fixtureCompensationOperations":25,"productionActivationPlanReceipts":0,"productionExecutorsConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["replace the fixture-only activation plan with a newly reviewed production authority receipt","implement a target-host driver as a separate least-privilege package with no shell interpolation","bind every target-host effect receipt to an asymmetric production signer and monotonic journal","run the transaction and every compensation branch on a disposable non-production host","prove the 60-second rollback watchdog independently from the forward executor","prove systemd sandbox, filesystem ownership and configuration references on the target host","capture live negative evidence that no public route or reverse proxy exists","obtain a new two-person change authorization for the exact target-host transaction","wire the production executor only through a separately reviewed composition root","repeat EC2 inventory and port audit immediately before any production activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-activation-transaction-executor-fixtures/v1","fixedTime":"2026-07-21T05:00:00.000Z","cases":[{"id":"RFATX-01","profile":"prepare","expected":"ACCEPT","outcome":"PREPARED"},{"id":"RFATX-02","profile":"execute-commit","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_COMMITTED"},{"id":"RFATX-03","profile":"verify-receipt","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFATX-04","profile":"dispose","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFATX-05","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFATX-06","profile":"fail-acquire","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-07","profile":"fail-snapshot","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-08","profile":"fail-install","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-09","profile":"fail-start","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-10","profile":"fail-health","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-11","profile":"fail-ready","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-12","profile":"compensate-stop-contained","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_CONTAINED"},{"id":"RFATX-13","profile":"compensate-remove-contained","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_CONTAINED"},{"id":"RFATX-14","profile":"compensate-restore-contained","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_CONTAINED"},{"id":"RFATX-15","profile":"drift-install","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-16","profile":"drift-start","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-17","profile":"verifier-reject-start","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_ROLLED_BACK"},{"id":"RFATX-18","profile":"fail-release-contained","expected":"ACCEPT","outcome":"FIXTURE_ACTIVATION_TRANSACTION_CONTAINED"},{"id":"RFATX-19","profile":"missing-plan-verifier","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_DEPENDENCIES"},{"id":"RFATX-20","profile":"missing-step-verifier","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_DEPENDENCIES"},{"id":"RFATX-21","profile":"driver-missing-port","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_DEPENDENCIES"},{"id":"RFATX-22","profile":"driver-extra-port","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_DEPENDENCIES"},{"id":"RFATX-23","profile":"invalid-clock","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_CLOCK"},{"id":"RFATX-24","profile":"plan-status","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-25","profile":"plan-expired","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-26","profile":"plan-digest","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN_DIGEST"},{"id":"RFATX-27","profile":"plan-id","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN_DIGEST"},{"id":"RFATX-28","profile":"plan-release-format","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-29","profile":"plan-same-rollback","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-30","profile":"plan-bind","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-31","profile":"plan-port","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-32","profile":"plan-authority","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-33","profile":"plan-executor","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-34","profile":"plan-unit","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-35","profile":"plan-service","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-36","profile":"plan-listener","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-37","profile":"plan-route","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-38","profile":"plan-proxy","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-39","profile":"plan-executable-steps","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-40","profile":"plan-external-write","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN"},{"id":"RFATX-41","profile":"plan-prohibited","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_EXECUTABLE_MATERIAL"},{"id":"RFATX-42","profile":"plan-provenance","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN_PROVENANCE"},{"id":"RFATX-43","profile":"plan-provenance-throws","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_PLAN_PROVENANCE"},{"id":"RFATX-44","profile":"request-action","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-45","profile":"request-mode","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-46","profile":"request-plan-id","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-47","profile":"request-plan-receipt","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-48","profile":"request-release","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-49","profile":"request-rollback","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-50","profile":"request-controller","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-51","profile":"request-host","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-52","profile":"request-manifest","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-53","profile":"request-config","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-54","profile":"request-unit","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-55","profile":"request-user","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-56","profile":"request-unit-name","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-57","profile":"request-bind","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-58","profile":"request-port","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-59","profile":"request-paths","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-60","profile":"request-route","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-61","profile":"request-proxy","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-62","profile":"request-nonce","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-63","profile":"request-expired","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-64","profile":"request-too-long","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-65","profile":"request-beyond-plan","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_REQUEST"},{"id":"RFATX-66","profile":"request-prohibited","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_EXECUTABLE_MATERIAL"},{"id":"RFATX-67","profile":"forged-handle","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_HANDLE"},{"id":"RFATX-68","profile":"execute-replay","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_HANDLE"},{"id":"RFATX-69","profile":"execute-after-dispose","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_HANDLE"},{"id":"RFATX-70","profile":"receipt-status","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_RECEIPT"},{"id":"RFATX-71","profile":"receipt-digest","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_RECEIPT_DIGEST"},{"id":"RFATX-72","profile":"nonce-replay","expected":"DENY","errorCode":"RF_ACTIVATION_TRANSACTION_NONCE"}]}},"targetHostDriverQualification":{"schemaVersion":"developer.reits.tech/runner-factory-target-host-driver-qualification/v1","status":"TARGET_HOST_DRIVER_QUALIFICATION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T06:00:00Z","scope":{"mode":"DOSSIER_VERIFICATION_ONLY","input":"EXACT_TRANSACTION_CONTRACT_DRIVER_DESCRIPTOR_AND_SIGNED_QUALIFICATION_EVIDENCE","output":"TEST_ONLY_TARGET_HOST_DRIVER_QUALIFICATION_RECEIPT","packageLoaded":false,"driverExecuted":false,"networkAuthority":"NONE","deploymentAuthority":"NONE","productionEntrypointWired":false},"truth":{"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"operations":[{"id":"prepare","guard":"verify exact upstream transaction contract, closed descriptor and 17 signed evidence objects","result":"opaque one-shot qualification handle"},{"id":"qualify","guard":"consume the handle without loading or executing the candidate package","result":"test-only qualification receipt"},{"id":"verify","guard":"recompute receipt identity and zero-production counters","result":"boolean receipt validation"},{"id":"dispose","guard":"revoke an unused qualification handle","result":"idempotent disposal receipt"}],"descriptor":{"packageName":"@reits/runner-factory-target-host-driver","platform":"linux/amd64","interfaceMode":"TYPED_EFFECT_PORTS_ONLY","operationPorts":9,"permittedPaths":4,"systemdActions":5,"genericCommandPort":false,"shellInterpolation":false,"networkClient":false,"credentialReads":false,"stepReceiptSigner":"ASYMMETRIC_REQUIRED_NOT_CONFIGURED","monotonicJournal":"DURABLE_REQUIRED_NOT_CONFIGURED"},"operationPorts":[{"id":"acquireLock","operation":"ACQUIRE_LOCK"},{"id":"snapshotRollback","operation":"SNAPSHOT_ROLLBACK"},{"id":"installUnit","operation":"INSTALL_UNIT"},{"id":"startLoopback","operation":"START_LOOPBACK"},{"id":"probeHealth","operation":"PROBE_HEALTH_OR_READY"},{"id":"stopLoopback","operation":"STOP_LOOPBACK"},{"id":"removeUnit","operation":"REMOVE_UNIT"},{"id":"restoreSnapshot","operation":"RESTORE_SNAPSHOT"},{"id":"releaseLock","operation":"RELEASE_LOCK"}],"pathPolicy":[{"id":"lock","path":"/run/lock/reits-runner-factory-controller.lock","access":"create-exclusive + remove"},{"id":"release","path":"/opt/reits-runner-factory/releases/{releaseId}","access":"read immutable candidate only"},{"id":"rollback","path":"/var/lib/reits-runner-factory/rollback/{changeId}.json","access":"create-exact + restore-exact"},{"id":"unit","path":"/etc/systemd/system/reits-runner-factory-controller.service","access":"install exact digest + remove exact"}],"systemdActionPolicy":[{"action":"daemon-reload","scope":"after exact unit install or removal only"},{"action":"is-active","scope":"exact controller unit only"},{"action":"show","scope":"allowlisted unit properties only"},{"action":"start","scope":"exact unit after lock and snapshot"},{"action":"stop","scope":"exact unit during compensation"}],"denialProfiles":["GENERIC_COMMAND_PORT","SHELL_INTERPOLATION","PATH_TRAVERSAL","DYNAMIC_UNIT_NAME","PUBLIC_BIND","REVERSE_PROXY","CREDENTIAL_READ","UNSIGNED_STEP_RECEIPT"],"stateModel":[{"id":"UNTRUSTED","meaning":"the candidate has no qualification standing"},{"id":"TRANSACTION_BOUND","meaning":"the exact fixture transaction contract was positively verified"},{"id":"DESCRIPTOR_BOUND","meaning":"the separate package exposes only the exact typed surface"},{"id":"EVIDENCE_BOUND","meaning":"nine port and eight denial receipts are exact and signed"},{"id":"PREPARED","meaning":"one opaque 60-second dossier capability exists"},{"id":"QUALIFIED_TEST_ONLY","meaning":"the dossier passed without package loading or execution"},{"id":"DISPOSED","meaning":"an unused capability was revoked"},{"id":"DENIED","meaning":"shape, provenance, scope or receipt drift failed closed"}],"invariants":["the exact activation-transaction contract digest is pinned by the evaluator","the upstream contract receipt remains unexpired and positively verified","the upstream production entrypoint remains disconnected","the upstream executor, systemd, service and listener counters remain zero","the candidate is a separate package and not the Controller composition root","the candidate source is an exact forty-character revision","the candidate artifact is bound by a SHA-256 digest","the candidate platform is exactly Linux amd64","the service user is exactly reits-runner-factory","the systemd unit name is exact and cannot be caller-selected","the bind address is exactly loopback and the port is exactly 8110","health targets are exactly healthz followed by readyz","the interface contains exactly nine ordered typed effect ports","the interface contains no generic command port","shell interpolation is structurally forbidden","dynamic systemd unit names are structurally forbidden","mutable path expansion is structurally forbidden","the package has no network client authority","the package has no credential read authority","filesystem scope is exactly four reviewed path templates","systemd scope is exactly five reviewed unit-specific actions","step receipts require an asymmetric signer that is not configured here","effect ordering requires a durable monotonic journal that is not configured here","rollback deadline remains sixty seconds","the descriptor is explicitly test-only and not production configured","every descriptor field is exact and digest-bound","nine operation-port evidence receipts are required in exact order","eight negative-guard evidence receipts are required in exact order","every evidence receipt is bound to candidate, descriptor and transaction contract","every evidence receipt has an exact deterministic identity","every evidence receipt has a recomputed canonical digest","every evidence receipt requires positive asymmetric verification","evidence cannot expire before the qualification request","the request is dossier-only and lives no longer than sixty seconds","the request nonce is format checked and single use","secret-like and executable fields are rejected recursively","the opaque handle is WeakMap-backed, one-shot and disposable","qualification does not import or load the candidate package","qualification does not execute a driver port","qualification grants neither network nor deployment authority","the production Controller entrypoint does not import the evaluator","the qualification receipt cannot be promoted into an activation plan","all production driver, unit, service, listener, route and proxy counters remain zero","external reads, writes, mutations and paid resources remain zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":64,"acceptedOutcomes":8,"deniedOutcomes":56,"transactionReceiptsVerified":49,"evidenceSignaturesVerified":198,"qualifiedDossiers":6,"qualificationReceiptsVerified":2,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["implement the driver in a separate repository from this dossier evaluator","review every filesystem and systemd syscall in the candidate package","attach an asymmetric production step signer without exporting private material","attach a durable monotonic journal with ambiguity containment","run all nine ports and eight denials on a disposable non-production host","prove every compensation branch inside the independent sixty-second watchdog","prove the installed systemd sandbox and exact filesystem ownership","capture live negative route, proxy, credential and public-bind evidence","obtain a fresh production authority receipt and separate composition review"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-target-host-driver-qualification-fixtures/v1","fixedTime":"2026-07-21T06:00:00.000Z","cases":[{"id":"RFDQ-01","profile":"prepare","expected":"ACCEPT","outcome":"QUALIFICATION_DOSSIER_PREPARED"},{"id":"RFDQ-02","profile":"qualify","expected":"ACCEPT","outcome":"TARGET_HOST_DRIVER_CANDIDATE_QUALIFIED_TEST_ONLY"},{"id":"RFDQ-03","profile":"verify-receipt","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFDQ-04","profile":"dispose","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFDQ-05","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFDQ-06","profile":"qualify-second-evaluator","expected":"ACCEPT","outcome":"TARGET_HOST_DRIVER_CANDIDATE_QUALIFIED_TEST_ONLY"},{"id":"RFDQ-07","profile":"verify-roundtrip","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFDQ-08","profile":"qualification-id-stable","expected":"ACCEPT","outcome":"TARGET_HOST_DRIVER_CANDIDATE_QUALIFIED_TEST_ONLY"},{"id":"RFDQ-09","profile":"missing-transaction-verifier","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DEPENDENCIES"},{"id":"RFDQ-10","profile":"missing-evidence-verifier","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DEPENDENCIES"},{"id":"RFDQ-11","profile":"invalid-clock","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_CLOCK"},{"id":"RFDQ-12","profile":"transaction-schema","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-13","profile":"transaction-status","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-14","profile":"transaction-contract-digest","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-15","profile":"transaction-executor-digest","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-16","profile":"transaction-fixture-driver-digest","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-17","profile":"transaction-entrypoint-wired","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-18","profile":"transaction-production-executors","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-19","profile":"transaction-listener","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-20","profile":"transaction-external-write","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION"},{"id":"RFDQ-21","profile":"transaction-receipt-digest","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION_DIGEST"},{"id":"RFDQ-22","profile":"transaction-prohibited","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EXECUTABLE_MATERIAL"},{"id":"RFDQ-23","profile":"transaction-provenance","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION_PROVENANCE"},{"id":"RFDQ-24","profile":"transaction-provenance-throws","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_TRANSACTION_PROVENANCE"},{"id":"RFDQ-25","profile":"descriptor-schema","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-26","profile":"descriptor-package","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-27","profile":"descriptor-version","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-28","profile":"descriptor-artifact","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-29","profile":"descriptor-source","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-30","profile":"descriptor-platform","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-31","profile":"descriptor-architecture","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-32","profile":"descriptor-user","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-33","profile":"descriptor-unit","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-34","profile":"descriptor-bind","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-35","profile":"descriptor-port","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-36","profile":"descriptor-health","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-37","profile":"descriptor-operation-ports","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-38","profile":"descriptor-reordered-port","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-39","profile":"descriptor-interface","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-40","profile":"descriptor-generic-command","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-41","profile":"descriptor-shell","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-42","profile":"descriptor-dynamic-unit","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-43","profile":"descriptor-path-expansion","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-44","profile":"descriptor-network","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-45","profile":"descriptor-credential","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-46","profile":"descriptor-signer","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-47","profile":"descriptor-journal","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-48","profile":"descriptor-deadline","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-49","profile":"descriptor-test-only","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-50","profile":"descriptor-production","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR"},{"id":"RFDQ-51","profile":"descriptor-prohibited","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EXECUTABLE_MATERIAL"},{"id":"RFDQ-52","profile":"descriptor-digest","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_DESCRIPTOR_DIGEST"},{"id":"RFDQ-53","profile":"evidence-missing-operation","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE"},{"id":"RFDQ-54","profile":"evidence-missing-denial","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE"},{"id":"RFDQ-55","profile":"evidence-operation-drift","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE"},{"id":"RFDQ-56","profile":"evidence-operation-outcome","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE"},{"id":"RFDQ-57","profile":"evidence-operation-signature","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE_DIGEST"},{"id":"RFDQ-58","profile":"evidence-denial-profile","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE"},{"id":"RFDQ-59","profile":"evidence-denial-outcome","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE"},{"id":"RFDQ-60","profile":"evidence-expired","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE"},{"id":"RFDQ-61","profile":"evidence-provenance","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_EVIDENCE_PROVENANCE"},{"id":"RFDQ-62","profile":"request-action","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_REQUEST"},{"id":"RFDQ-63","profile":"forged-handle","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_HANDLE"},{"id":"RFDQ-64","profile":"receipt-digest","expected":"DENY","errorCode":"RF_TARGET_DRIVER_QUALIFICATION_RECEIPT_DIGEST"}]}},"disposableHostConformanceAdmission":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-conformance-admission/v1","status":"DISPOSABLE_HOST_CONFORMANCE_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T07:00:00Z","scope":{"mode":"PLAN_ADMISSION_ONLY_NO_HOST_EXECUTION","input":"EXACT_DRIVER_QUALIFICATION_HOST_PROFILE_PLAN_AND_EMPTY_EVIDENCE_MANIFEST","output":"TEST_ONLY_DISPOSABLE_HOST_CONFORMANCE_PLAN_ADMISSION_RECEIPT","hostProvisioned":false,"packageLoaded":false,"driverExecuted":false,"watchdogStarted":false,"networkAuthority":"NONE","deploymentAuthority":"NONE","productionEntrypointWired":false},"truth":{"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"operations":[{"id":"prepare","guard":"verify exact upstream qualification, isolated host profile, frozen plan and empty evidence manifest","result":"opaque one-shot admission handle"},{"id":"admit","guard":"consume the handle without provisioning a host or loading a package","result":"test-only conformance-plan admission receipt"},{"id":"verify","guard":"recompute admission identity and zero-execution counters","result":"boolean receipt validation"},{"id":"dispose","guard":"revoke an unused admission handle","result":"idempotent disposal receipt"}],"hostProfile":{"provider":"AWS_EC2_DISPOSABLE_TEST_HOST","environment":"NON_PRODUCTION_CONFORMANCE","platform":"linux/amd64","lifecycle":"ONE_PLAN_ONE_HOST_TERMINATE","productionAccount":false,"productionVpc":false,"publicIp":false,"ipv6":false,"ingressRules":0,"productionRoute":false,"peering":false,"instanceProfile":false,"imdsEnabled":false,"artifactDelivery":"PRESTAGED_IMMUTABLE_IMAGE","encryptedRootVolume":true,"deleteOnTermination":true,"productionHostMarkerExpected":false,"serviceUser":"reits-runner-factory","unitName":"reits-runner-factory-controller.service","endpoint":"127.0.0.1:8110"},"phases":[{"ordinal":1,"id":"claimHost","evidenceType":"HOST_CLAIM","state":"PLANNED_NOT_EXECUTED"},{"ordinal":2,"id":"verifyIsolation","evidenceType":"ISOLATION_ATTESTATION","state":"PLANNED_NOT_EXECUTED"},{"ordinal":3,"id":"verifyBaseline","evidenceType":"BASELINE_ATTESTATION","state":"PLANNED_NOT_EXECUTED"},{"ordinal":4,"id":"stageArtifact","evidenceType":"ARTIFACT_ATTESTATION","state":"PLANNED_NOT_EXECUTED"},{"ordinal":5,"id":"exerciseForward","evidenceType":"FORWARD_TRACE","state":"PLANNED_NOT_EXECUTED"},{"ordinal":6,"id":"exerciseDenials","evidenceType":"NEGATIVE_GUARD_TRACE","state":"PLANNED_NOT_EXECUTED"},{"ordinal":7,"id":"triggerWatchdog","evidenceType":"WATCHDOG_TRACE","state":"PLANNED_NOT_EXECUTED"},{"ordinal":8,"id":"exerciseCompensation","evidenceType":"COMPENSATION_TRACE","state":"PLANNED_NOT_EXECUTED"},{"ordinal":9,"id":"verifyHostClean","evidenceType":"HOST_CLEAN_ATTESTATION","state":"PLANNED_NOT_EXECUTED"},{"ordinal":10,"id":"verifyNetworkClean","evidenceType":"NETWORK_CLEAN_ATTESTATION","state":"PLANNED_NOT_EXECUTED"},{"ordinal":11,"id":"retireHost","evidenceType":"RETIREMENT_ATTESTATION","state":"PLANNED_NOT_EXECUTED"},{"ordinal":12,"id":"sealDossier","evidenceType":"DOSSIER_SEAL","state":"PLANNED_NOT_EXECUTED"}],"watchdog":{"mode":"INDEPENDENT_FAIL_CLOSED_OBSERVER","owner":"DISPOSABLE_HOST_WATCHDOG","sharesControllerProcess":false,"sharesControllerUser":false,"deadlineSeconds":60,"killEscalationSeconds":10,"triggers":["PROCESS_EXIT_NON_ZERO","HEALTH_DEADLINE_EXCEEDED","READY_DEADLINE_EXCEEDED","PUBLIC_BIND_DETECTED","REVERSE_PROXY_DETECTED","UNIT_DIGEST_DRIFT","ROLLBACK_EVIDENCE_MISSING","MONOTONIC_JOURNAL_GAP"],"terminalAssertions":["CONTROLLER_PROCESS_ABSENT","PORT_8110_ABSENT","PUBLIC_BIND_ABSENT","REVERSE_PROXY_ABSENT","UNIT_REMOVED_OR_EXACTLY_RESTORED","ROLLBACK_SNAPSHOT_EXACTLY_RESTORED","EXCLUSIVE_LOCK_RELEASED","HOST_AND_ROOT_VOLUME_RETIRED"],"commands":[],"networkAuthority":"NONE","deploymentAuthority":"NONE"},"evidenceManifest":{"requiredSlots":12,"observedEvidence":0,"state":"REQUIRED_NOT_OBSERVED","signer":"ASYMMETRIC_REQUIRED_NOT_CONFIGURED","hostCallsExecuted":0,"driverCallsExecuted":0,"watchdogStarts":0},"stateModel":[{"id":"UNTRUSTED","meaning":"no upstream qualification standing exists"},{"id":"QUALIFICATION_BOUND","meaning":"the exact target-host driver qualification was positively verified"},{"id":"HOST_PROFILE_BOUND","meaning":"the non-production disposable-host boundary is exact"},{"id":"PLAN_BOUND","meaning":"twelve phases and the independent watchdog are frozen without commands"},{"id":"EVIDENCE_MANIFEST_BOUND","meaning":"all twelve future evidence slots are explicit and unobserved"},{"id":"PREPARED","meaning":"one opaque sixty-second admission capability exists"},{"id":"ADMITTED_TEST_ONLY","meaning":"the plan may proceed only to a separately authorized disposable-host run"},{"id":"DISPOSED","meaning":"an unused capability was revoked"},{"id":"DENIED","meaning":"shape, isolation, provenance, execution material or receipt drift failed closed"}],"invariants":["the exact target-host driver qualification contract digest is pinned by the admission evaluator","the upstream qualification receipt is live and positively verified by the authoritative verifier","the upstream qualification remains dossier-only and grants no activation authority","the upstream package-loaded and driver-executed flags remain false","the upstream production driver, unit, service, listener, route, proxy and mutation counters remain zero","the candidate host provider is a disposable non-production EC2 test host","the candidate host is Linux amd64","the candidate host lifecycle is exactly one plan, one host and termination","the candidate host is not in a production account","the candidate host is not in a production VPC","the candidate host has no public IP or IPv6","the candidate host has zero ingress rules","the candidate host has no production route or peering","the candidate host has no instance profile or IMDS","the candidate artifact arrives only in a prestaged immutable image","the encrypted root volume is delete-on-termination","the production-host marker must be absent","the service identity and unit name are exact","the candidate endpoint remains exactly loopback port 8110","the conformance plan contains exactly twelve ordered phases","every phase remains PLANNED_NOT_EXECUTED","the plan contains no execution commands or shell material","the plan does not permit host provisioning","the plan does not permit package loading","the plan does not permit activation","the independent watchdog has a different process owner","the independent watchdog does not share the Controller process","the independent watchdog does not share the Controller user","the watchdog deadline is exactly sixty seconds","the watchdog kill escalation begins after ten seconds","the watchdog contains exactly eight reviewed triggers","the watchdog contains exactly eight terminal assertions","the watchdog contains no commands","the watchdog grants no network or deployment authority","the evidence manifest contains exactly twelve phase-bound slots","every evidence slot remains REQUIRED_NOT_OBSERVED","every evidence slot requires an asymmetric signer that is not configured here","the evidence manifest contains zero observed host evidence","the evidence manifest contains zero host and driver calls","the evidence manifest contains zero watchdog starts","the request lives no longer than sixty seconds and uses a single-use nonce","secret-like, user-data and executable fields are rejected recursively","the opaque handle is WeakMap-backed, one-shot and disposable","admission does not provision or contact a host","admission does not load a package or execute a driver","the production Controller entrypoint does not import the admission evaluator","the admission receipt cannot be promoted into a host claim or activation request","all production and paid-resource counters remain zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":68,"acceptedOutcomes":8,"deniedOutcomes":60,"qualificationReceiptsVerified":54,"admittedPlans":5,"admissionReceiptsVerified":3,"disposedHandles":1,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["obtain explicit cost and runtime approval for a disposable non-production host","create a dedicated non-production account and VPC with no production connectivity","build and sign the prestaged immutable conformance image","implement the separate target-host driver package and complete syscall review","configure an asymmetric evidence signer without exporting private material","configure a durable monotonic journal and independent watchdog identity","execute all twelve phases and eight watchdog triggers on the disposable host","capture signed terminal evidence for process, port, proxy, unit, snapshot and lock cleanup","prove instance and root-volume retirement from an independent authority","review the sealed conformance dossier before any production activation discussion"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-conformance-admission-fixtures/v1","cases":[{"id":"RFDHCA-01","mutation":"ADMIT_BASELINE","expected":"ACCEPT"},{"id":"RFDHCA-02","mutation":"ADMIT_SECOND_NONCE","expected":"ACCEPT"},{"id":"RFDHCA-03","mutation":"ADMIT_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHCA-04","mutation":"VERIFY_RECEIPT","expected":"ACCEPT"},{"id":"RFDHCA-05","mutation":"VERIFY_RECEIPT_REPLAY","expected":"ACCEPT"},{"id":"RFDHCA-06","mutation":"DISPOSE_AND_REPLAY","expected":"ACCEPT"},{"id":"RFDHCA-07","mutation":"PREPARE_ONLY","expected":"ACCEPT"},{"id":"RFDHCA-08","mutation":"PREPARE_SECOND","expected":"ACCEPT"},{"id":"RFDHCA-09","mutation":"DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHCA-10","mutation":"CONTRACT_DIGEST_INVALID","expected":"DENY"},{"id":"RFDHCA-11","mutation":"VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHCA-12","mutation":"VERIFIER_THROW","expected":"DENY"},{"id":"RFDHCA-13","mutation":"CLOCK_INVALID","expected":"DENY"},{"id":"RFDHCA-14","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHCA-15","mutation":"USER_DATA_KEY","expected":"DENY"},{"id":"RFDHCA-16","mutation":"QUAL_STATUS","expected":"DENY"},{"id":"RFDHCA-17","mutation":"QUAL_EXPIRED","expected":"DENY"},{"id":"RFDHCA-18","mutation":"QUAL_PACKAGE_LOADED","expected":"DENY"},{"id":"RFDHCA-19","mutation":"QUAL_DRIVER_EXECUTED","expected":"DENY"},{"id":"RFDHCA-20","mutation":"QUAL_LISTENER","expected":"DENY"},{"id":"RFDHCA-21","mutation":"QUAL_ROUTE","expected":"DENY"},{"id":"RFDHCA-22","mutation":"QUAL_DIGEST","expected":"DENY"},{"id":"RFDHCA-23","mutation":"QUAL_PORT_DIGESTS","expected":"DENY"},{"id":"RFDHCA-24","mutation":"QUAL_SIGNATURE_COUNT","expected":"DENY"},{"id":"RFDHCA-25","mutation":"QUAL_EXTRA_KEY","expected":"DENY"},{"id":"RFDHCA-26","mutation":"HOST_PRODUCTION_ACCOUNT","expected":"DENY"},{"id":"RFDHCA-27","mutation":"HOST_PRODUCTION_VPC","expected":"DENY"},{"id":"RFDHCA-28","mutation":"HOST_PUBLIC_IP","expected":"DENY"},{"id":"RFDHCA-29","mutation":"HOST_IPV6","expected":"DENY"},{"id":"RFDHCA-30","mutation":"HOST_INGRESS","expected":"DENY"},{"id":"RFDHCA-31","mutation":"HOST_PRODUCTION_ROUTE","expected":"DENY"},{"id":"RFDHCA-32","mutation":"HOST_PEERING","expected":"DENY"},{"id":"RFDHCA-33","mutation":"HOST_INSTANCE_PROFILE","expected":"DENY"},{"id":"RFDHCA-34","mutation":"HOST_IMDS","expected":"DENY"},{"id":"RFDHCA-35","mutation":"HOST_ARTIFACT_DELIVERY","expected":"DENY"},{"id":"RFDHCA-36","mutation":"HOST_ROOT_UNENCRYPTED","expected":"DENY"},{"id":"RFDHCA-37","mutation":"HOST_DELETE_FALSE","expected":"DENY"},{"id":"RFDHCA-38","mutation":"HOST_MARKER_TRUE","expected":"DENY"},{"id":"RFDHCA-39","mutation":"HOST_SERVICE_USER","expected":"DENY"},{"id":"RFDHCA-40","mutation":"HOST_UNIT_NAME","expected":"DENY"},{"id":"RFDHCA-41","mutation":"HOST_PUBLIC_BIND","expected":"DENY"},{"id":"RFDHCA-42","mutation":"PLAN_MODE","expected":"DENY"},{"id":"RFDHCA-43","mutation":"PLAN_CONTRACT_DIGEST","expected":"DENY"},{"id":"RFDHCA-44","mutation":"PLAN_PHASE_ORDER","expected":"DENY"},{"id":"RFDHCA-45","mutation":"PLAN_PHASE_STATE","expected":"DENY"},{"id":"RFDHCA-46","mutation":"PLAN_COMMAND","expected":"DENY"},{"id":"RFDHCA-47","mutation":"PLAN_SHELL","expected":"DENY"},{"id":"RFDHCA-48","mutation":"PLAN_HOST_PROVISION","expected":"DENY"},{"id":"RFDHCA-49","mutation":"PLAN_PACKAGE_LOAD","expected":"DENY"},{"id":"RFDHCA-50","mutation":"PLAN_ACTIVATION","expected":"DENY"},{"id":"RFDHCA-51","mutation":"WATCHDOG_SHARED_PROCESS","expected":"DENY"},{"id":"RFDHCA-52","mutation":"WATCHDOG_SHARED_USER","expected":"DENY"},{"id":"RFDHCA-53","mutation":"WATCHDOG_DEADLINE","expected":"DENY"},{"id":"RFDHCA-54","mutation":"WATCHDOG_TRIGGER","expected":"DENY"},{"id":"RFDHCA-55","mutation":"WATCHDOG_COMMAND","expected":"DENY"},{"id":"RFDHCA-56","mutation":"MANIFEST_SLOT_MISSING","expected":"DENY"},{"id":"RFDHCA-57","mutation":"MANIFEST_SLOT_STATE","expected":"DENY"},{"id":"RFDHCA-58","mutation":"MANIFEST_SLOT_SIGNER","expected":"DENY"},{"id":"RFDHCA-59","mutation":"MANIFEST_OBSERVED","expected":"DENY"},{"id":"RFDHCA-60","mutation":"MANIFEST_HOST_CALL","expected":"DENY"},{"id":"RFDHCA-61","mutation":"MANIFEST_DIGEST","expected":"DENY"},{"id":"RFDHCA-62","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHCA-63","mutation":"REQUEST_MODE","expected":"DENY"},{"id":"RFDHCA-64","mutation":"REQUEST_NONCE_FORMAT","expected":"DENY"},{"id":"RFDHCA-65","mutation":"REQUEST_EXPIRED","expected":"DENY"},{"id":"RFDHCA-66","mutation":"REQUEST_LONG_TTL","expected":"DENY"},{"id":"RFDHCA-67","mutation":"REQUEST_MANIFEST_DIGEST","expected":"DENY"},{"id":"RFDHCA-68","mutation":"REQUEST_NONCE_REPLAY","expected":"DENY"}]}},"disposableHostConformanceDossierSealer":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-conformance-dossier-sealer-contract/v1","status":"DISPOSABLE_HOST_CONFORMANCE_DOSSIER_SEALER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T08:00:00.000Z","scope":{"mode":"FIXTURE_EVIDENCE_SEALING_ONLY_NO_HOST_EXECUTION","input":"EXACT_PLAN_ADMISSION_PLUS_EXECUTION_AND_SIGNED_EVIDENCE_RECEIPTS","output":"TEST_ONLY_CONFORMANCE_DOSSIER_SEAL","hostContacted":false,"packageLoaded":false,"driverExecuted":false,"watchdogStarted":false,"productionEvidenceObserved":false,"promotionAuthority":"NONE","productionEntrypointWired":false},"operations":["prepare","seal","verify","dispose"],"upstream":{"contract":"controller-disposable-host-conformance-admission-contract.json","receiptStatus":"DISPOSABLE_HOST_CONFORMANCE_PLAN_ADMITTED_TEST_ONLY","verification":"ASYMMETRIC_VERIFY_ONLY_FIXTURE","contractDigest":"SHA256_PINNED_AT_VERIFIER_RUNTIME"},"evidenceTopology":{"executionReceipts":1,"phaseReceipts":12,"terminalAttestations":8,"evidenceSignaturesPerDossier":21,"journal":"MONOTONIC_HASH_CHAIN","phaseSigner":"fixture-p256-conformance-evidence","executionSigner":"fixture-p256-conformance-execution","terminalAuthority":"INDEPENDENT_FIXTURE_WATCHDOG","executionMode":"IN_MEMORY_HOST_EVIDENCE_FIXTURE_ONLY","promotionAuthority":"NONE"},"phases":[{"ordinal":1,"id":"claimHost","evidenceType":"HOST_CLAIM"},{"ordinal":2,"id":"verifyIsolation","evidenceType":"ISOLATION_ATTESTATION"},{"ordinal":3,"id":"verifyBaseline","evidenceType":"BASELINE_ATTESTATION"},{"ordinal":4,"id":"stageArtifact","evidenceType":"ARTIFACT_ATTESTATION"},{"ordinal":5,"id":"exerciseForward","evidenceType":"FORWARD_TRACE"},{"ordinal":6,"id":"exerciseDenials","evidenceType":"NEGATIVE_GUARD_TRACE"},{"ordinal":7,"id":"triggerWatchdog","evidenceType":"WATCHDOG_TRACE"},{"ordinal":8,"id":"exerciseCompensation","evidenceType":"COMPENSATION_TRACE"},{"ordinal":9,"id":"verifyHostClean","evidenceType":"HOST_CLEAN_ATTESTATION"},{"ordinal":10,"id":"verifyNetworkClean","evidenceType":"NETWORK_CLEAN_ATTESTATION"},{"ordinal":11,"id":"retireHost","evidenceType":"RETIREMENT_ATTESTATION"},{"ordinal":12,"id":"sealDossier","evidenceType":"DOSSIER_SEAL"}],"terminalAssertions":["CONTROLLER_PROCESS_ABSENT","PORT_8110_ABSENT","PUBLIC_BIND_ABSENT","REVERSE_PROXY_ABSENT","UNIT_REMOVED_OR_EXACTLY_RESTORED","ROLLBACK_SNAPSHOT_EXACTLY_RESTORED","EXCLUSIVE_LOCK_RELEASED","HOST_AND_ROOT_VOLUME_RETIRED"],"stateModel":["UNTRUSTED","PLAN_ADMISSION_BOUND","EXECUTION_RECEIPT_BOUND","PHASE_CHAIN_BOUND","TERMINAL_PROOF_BOUND","PREPARED","SEALED_TEST_ONLY","VERIFIED","DISPOSED","DENIED"],"truth":{"productionHostRuns":0,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"selectedDenialTrace":{"fixtureId":"RFDHCDS-58","mutation":"TERMINAL_AUTHORITY","expected":"DENY","reason":"Controller self-report cannot replace the independent terminal watchdog authority."},"invariants":["the upstream plan-admission receipt must match its exact v1 schema","the upstream admission receipt digest is recalculated before trust","the upstream admission contract digest is pinned exactly","the upstream admission receipt is positively verified by an injected authority","the upstream admission remains test-only and grants no host execution authority","the execution receipt must match its exact v1 schema","the execution receipt is bound to the admitted plan identity","the execution receipt is bound to the admission receipt digest","the execution evidence mode remains in-memory fixture only","the execution receipt grants no deployment authority","the execution receipt contains no commands","the execution duration cannot exceed fifteen minutes","the host claim and immutable image are digest-bound","exactly twelve phase receipts are required","phase receipt order is immutable","each phase identity and evidence type are exact","every phase remains VERIFIED_FIXTURE_ONLY","every phase is bound to the same plan and execution","every phase payload carries a SHA-256 digest","the first phase begins at the all-zero genesis digest","every later phase is chained to its immediate predecessor","every phase timestamp lies inside the execution interval","every phase receipt digest is recalculated before trust","exactly eight terminal attestations are required","terminal assertion order is immutable","every terminal status remains PROVED_FIXTURE_ONLY","every terminal attestation is bound to the same execution","terminal authority must be INDEPENDENT_FIXTURE_WATCHDOG","every terminal evidence value carries a SHA-256 digest","every terminal timestamp lies inside the execution interval","every terminal receipt digest is recalculated before trust","the execution receipt binds all twelve phase receipt digests","the execution receipt binds all eight terminal attestation digests","the execution journal head equals the final phase receipt digest","one execution plus twelve phases plus eight terminals require twenty-one positive signature verifications","a false evidence-verifier result fails closed","an evidence-verifier exception fails closed","the request binds admission, execution, phase bundle and terminal bundle digests","the request lives no longer than sixty seconds","the request nonce is single-use","secret-like and executable fields are rejected recursively","all evidence objects reject unknown fields","the opaque preparation handle is WeakMap-backed","the opaque preparation handle is one-shot","an unused handle can be disposed and disposal is idempotent","a disposed handle cannot seal a dossier","a sealed dossier verdict is fixture-conformant only","a sealed dossier has no production-promotion authority","the production Controller entrypoint does not import the dossier sealer","dossier sealing does not contact, provision or mutate a host","dossier sealing does not start a service, listener, proxy or route","all production, external-write and paid-resource counters remain zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":72,"acceptedOutcomes":8,"deniedOutcomes":64,"admissionReceiptsVerified":58,"evidenceSignaturesVerified":338,"sealedDossiers":5,"sealReceiptsVerified":3,"disposedHandles":1,"productionHostRuns":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["obtain explicit cost and runtime approval for a disposable non-production host","create a dedicated non-production account and VPC with no production connectivity","build and sign the prestaged immutable conformance image","implement the separate target-host driver package and complete syscall review","configure asymmetric evidence signers without exporting private material","configure a durable monotonic journal and independent watchdog identity","execute all twelve phases and eight watchdog assertions on the disposable host","capture signed terminal evidence for process, port, proxy, unit, snapshot and lock cleanup","prove instance and root-volume retirement from an independent authority","review the sealed production dossier under a separately approved promotion policy"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-conformance-dossier-sealer-fixtures/v1","mode":"FIXTURE_EVIDENCE_SEALING_ONLY_NO_HOST_EXECUTION","cases":[{"id":"RFDHCDS-01","mutation":"SEAL_BASELINE","expected":"ACCEPT"},{"id":"RFDHCDS-02","mutation":"SEAL_SECOND_NONCE","expected":"ACCEPT"},{"id":"RFDHCDS-03","mutation":"SEAL_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHCDS-04","mutation":"VERIFY_SEAL_RECEIPT","expected":"ACCEPT"},{"id":"RFDHCDS-05","mutation":"VERIFY_SEAL_RECEIPT_REPLAY","expected":"ACCEPT"},{"id":"RFDHCDS-06","mutation":"DISPOSE_AND_REPLAY","expected":"ACCEPT"},{"id":"RFDHCDS-07","mutation":"PREPARE_ONLY","expected":"ACCEPT"},{"id":"RFDHCDS-08","mutation":"PREPARE_SECOND","expected":"ACCEPT"},{"id":"RFDHCDS-09","mutation":"DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHCDS-10","mutation":"CONTRACT_DIGEST_INVALID","expected":"DENY"},{"id":"RFDHCDS-11","mutation":"ADMISSION_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHCDS-12","mutation":"ADMISSION_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHCDS-13","mutation":"EVIDENCE_VERIFIER_MISSING","expected":"DENY"},{"id":"RFDHCDS-14","mutation":"EVIDENCE_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHCDS-15","mutation":"EVIDENCE_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHCDS-16","mutation":"CLOCK_INVALID","expected":"DENY"},{"id":"RFDHCDS-17","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHCDS-18","mutation":"ADMISSION_STATUS","expected":"DENY"},{"id":"RFDHCDS-19","mutation":"ADMISSION_MODE","expected":"DENY"},{"id":"RFDHCDS-20","mutation":"ADMISSION_HOST_PROVISIONED","expected":"DENY"},{"id":"RFDHCDS-21","mutation":"ADMISSION_DRIVER_EXECUTED","expected":"DENY"},{"id":"RFDHCDS-22","mutation":"ADMISSION_ROUTE","expected":"DENY"},{"id":"RFDHCDS-23","mutation":"ADMISSION_DIGEST","expected":"DENY"},{"id":"RFDHCDS-24","mutation":"ADMISSION_TIME_ORDER","expected":"DENY"},{"id":"RFDHCDS-25","mutation":"ADMISSION_PHASES","expected":"DENY"},{"id":"RFDHCDS-26","mutation":"ADMISSION_EVIDENCE_SLOTS","expected":"DENY"},{"id":"RFDHCDS-27","mutation":"EXECUTION_SCHEMA","expected":"DENY"},{"id":"RFDHCDS-28","mutation":"EXECUTION_STATUS","expected":"DENY"},{"id":"RFDHCDS-29","mutation":"EXECUTION_MODE","expected":"DENY"},{"id":"RFDHCDS-30","mutation":"EXECUTION_PLAN_ID","expected":"DENY"},{"id":"RFDHCDS-31","mutation":"EXECUTION_ADMISSION_DIGEST","expected":"DENY"},{"id":"RFDHCDS-32","mutation":"EXECUTION_HOST_CLAIM","expected":"DENY"},{"id":"RFDHCDS-33","mutation":"EXECUTION_IMAGE_DIGEST","expected":"DENY"},{"id":"RFDHCDS-34","mutation":"EXECUTION_PHASE_DIGESTS","expected":"DENY"},{"id":"RFDHCDS-35","mutation":"EXECUTION_TERMINAL_DIGESTS","expected":"DENY"},{"id":"RFDHCDS-36","mutation":"EXECUTION_TIME_ORDER","expected":"DENY"},{"id":"RFDHCDS-37","mutation":"EXECUTION_DURATION","expected":"DENY"},{"id":"RFDHCDS-38","mutation":"EXECUTION_COMMAND","expected":"DENY"},{"id":"RFDHCDS-39","mutation":"EXECUTION_NETWORK_AUTHORITY","expected":"DENY"},{"id":"RFDHCDS-40","mutation":"PHASE_MISSING","expected":"DENY"},{"id":"RFDHCDS-41","mutation":"PHASE_ORDER","expected":"DENY"},{"id":"RFDHCDS-42","mutation":"PHASE_ID","expected":"DENY"},{"id":"RFDHCDS-43","mutation":"PHASE_EVIDENCE_TYPE","expected":"DENY"},{"id":"RFDHCDS-44","mutation":"PHASE_STATUS","expected":"DENY"},{"id":"RFDHCDS-45","mutation":"PHASE_PLAN_ID","expected":"DENY"},{"id":"RFDHCDS-46","mutation":"PHASE_EXECUTION_ID","expected":"DENY"},{"id":"RFDHCDS-47","mutation":"PHASE_PAYLOAD_DIGEST","expected":"DENY"},{"id":"RFDHCDS-48","mutation":"PHASE_PREDECESSOR","expected":"DENY"},{"id":"RFDHCDS-49","mutation":"PHASE_SIGNER","expected":"DENY"},{"id":"RFDHCDS-50","mutation":"PHASE_TIME_BEFORE","expected":"DENY"},{"id":"RFDHCDS-51","mutation":"PHASE_TIME_AFTER","expected":"DENY"},{"id":"RFDHCDS-52","mutation":"PHASE_DIGEST","expected":"DENY"},{"id":"RFDHCDS-53","mutation":"TERMINAL_MISSING","expected":"DENY"},{"id":"RFDHCDS-54","mutation":"TERMINAL_ORDER","expected":"DENY"},{"id":"RFDHCDS-55","mutation":"TERMINAL_ASSERTION","expected":"DENY"},{"id":"RFDHCDS-56","mutation":"TERMINAL_STATUS","expected":"DENY"},{"id":"RFDHCDS-57","mutation":"TERMINAL_EXECUTION_ID","expected":"DENY"},{"id":"RFDHCDS-58","mutation":"TERMINAL_AUTHORITY","expected":"DENY"},{"id":"RFDHCDS-59","mutation":"TERMINAL_EVIDENCE_DIGEST","expected":"DENY"},{"id":"RFDHCDS-60","mutation":"TERMINAL_TIME","expected":"DENY"},{"id":"RFDHCDS-61","mutation":"TERMINAL_DIGEST","expected":"DENY"},{"id":"RFDHCDS-62","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHCDS-63","mutation":"REQUEST_MODE","expected":"DENY"},{"id":"RFDHCDS-64","mutation":"REQUEST_EXECUTION_ID","expected":"DENY"},{"id":"RFDHCDS-65","mutation":"REQUEST_NONCE_FORMAT","expected":"DENY"},{"id":"RFDHCDS-66","mutation":"REQUEST_EXPIRED","expected":"DENY"},{"id":"RFDHCDS-67","mutation":"REQUEST_LONG_TTL","expected":"DENY"},{"id":"RFDHCDS-68","mutation":"REQUEST_NONCE_REPLAY","expected":"DENY"},{"id":"RFDHCDS-69","mutation":"EXECUTION_EXTRA_KEY","expected":"DENY"},{"id":"RFDHCDS-70","mutation":"ADMISSION_EXTRA_KEY","expected":"DENY"},{"id":"RFDHCDS-71","mutation":"PHASE_EXTRA_KEY","expected":"DENY"},{"id":"RFDHCDS-72","mutation":"TERMINAL_EXTRA_KEY","expected":"DENY"}]}},"disposableHostExecutionEnvelopeAuthorizer":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-execution-envelope-authorizer-contract/v1","status":"DISPOSABLE_HOST_EXECUTION_ENVELOPE_AUTHORIZER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T09:00:00.000Z","scope":{"mode":"EXECUTION_ENVELOPE_AUTHORIZATION_ONLY_NO_HOST_LAUNCH","input":"SEALED_FIXTURE_DOSSIER_PLUS_INDEPENDENT_COST_RUNTIME_AND_RETIREMENT_APPROVALS","output":"TEST_ONLY_NO_LAUNCH_EXECUTION_ENVELOPE_AUTHORIZATION","hostContacted":false,"hostProvisioned":false,"packageLoaded":false,"driverExecuted":false,"watchdogStarted":false,"pricingQuoteFetched":false,"approvalAuthorityConfigured":false,"launchAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"operations":["prepare","authorize","verify","dispose"],"upstream":{"contract":"controller-disposable-host-conformance-dossier-sealer-contract.json","receiptStatus":"DISPOSABLE_HOST_CONFORMANCE_DOSSIER_SEALED_TEST_ONLY","verdict":"CONFORMANT_FIXTURE_ONLY","verification":"ASYMMETRIC_VERIFY_ONLY_FIXTURE","contractDigest":"SHA256_PINNED_AT_VERIFIER_RUNTIME"},"approvalTopology":[{"ordinal":1,"authority":"INDEPENDENT_COST_OWNER","signerKeyId":"fixture-p256-cost-owner","decision":"synthetic estimate is inside a 500 milli-USD test ceiling"},{"ordinal":2,"authority":"INDEPENDENT_RUNTIME_OWNER","signerKeyId":"fixture-p256-runtime-owner","decision":"900-second isolated non-production run and 120-second cleanup boundary"},{"ordinal":3,"authority":"INDEPENDENT_RETIREMENT_WATCHDOG","signerKeyId":"fixture-p256-retirement-watchdog","decision":"instance and root-volume retirement proof is mandatory"}],"budgetEnvelope":{"currency":"USD","pricingBasis":"SYNTHETIC_FIXTURE_NOT_LIVE_QUOTE","estimatedMilliUsd":140,"approvedMaximumMilliUsd":500,"livePriceReads":0,"billingWrites":0,"paidResourcesCreated":false},"runtimeEnvelope":{"environment":"NON_PRODUCTION_CONFORMANCE","region":"ap-southeast-2","platform":"linux/amd64","maxRunSeconds":900,"maxCleanupSeconds":120,"productionConnectivity":false,"publicNetwork":false,"artifactDelivery":"PRESTAGED_IMMUTABLE_IMAGE","commandSurface":"NONE_IN_AUTHORIZATION_LAYER","secretSurface":"CONFIGREFS_ONLY_NOT_RESOLVED"},"packageBindings":["sealed dossier receipt","immutable image","target-host driver artifact","Controller service bundle","twelve-phase conformance plan bundle","independent watchdog bundle","deny-by-default network policy","instance-and-volume cleanup policy"],"stateModel":["UNTRUSTED","DOSSIER_BOUND","COST_APPROVED_TEST_ONLY","RUNTIME_APPROVED_TEST_ONLY","RETIREMENT_RESERVED_TEST_ONLY","PACKAGE_MANIFEST_BOUND","PREPARED","AUTHORIZED_TEST_ONLY_NO_LAUNCH","VERIFIED","DISPOSED","DENIED"],"truth":{"productionHostRuns":0,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"selectedDenialTrace":{"fixtureId":"RFDHEA-31","mutation":"COST_ESTIMATE_OVER_MAX","expected":"DENY","reason":"A synthetic estimate above the independently approved maximum cannot mint an execution envelope."},"invariants":["the upstream dossier receipt must match its exact v1 schema","the upstream dossier receipt digest is recalculated before trust","the upstream dossier contract digest is pinned exactly","the upstream dossier is positively verified by an injected authority","the upstream dossier verdict remains fixture-conformant only","the upstream dossier grants no promotion authority","the upstream production host, package, driver, service and listener counters remain zero","cost approval is bound to the exact dossier receipt digest","cost approval is issued only by the independent cost owner","cost approval uses a dedicated P-256 fixture signer","cost approval uses USD milli-units without floating-point arithmetic","the synthetic estimated cost is non-negative","the synthetic estimated cost cannot exceed the approved maximum","the approved maximum cannot exceed 500 milli-USD","the pricing basis explicitly denies a live quote claim","cost approval must be live at authorization time","runtime approval is bound to the exact dossier receipt digest","runtime approval is issued only by the independent runtime owner","runtime approval fixes the non-production conformance environment","runtime approval fixes ap-southeast-2 and Linux amd64","runtime approval fixes the run deadline at 900 seconds","runtime approval fixes cleanup at 120 seconds","runtime approval forbids production connectivity and public networking","runtime approval must be live at authorization time","retirement reservation is bound to the exact dossier receipt digest","retirement reservation is issued by an independent watchdog authority","retirement reservation requires all eight terminal assertions","retirement reservation requires instance retirement","retirement reservation requires root-volume retirement","retirement reservation must be live at authorization time","cost, runtime and retirement use three distinct signer identities","all three approval signatures are positively verified","a false approval-verifier result fails closed","an approval-verifier exception fails closed","the package manifest is exact-shape and immutable","the package manifest binds the dossier, release and candidate","the package manifest binds the immutable image and six policy/artifact digests","artifact delivery remains prestaged and immutable","the authorization layer exposes no command surface","the authorization layer resolves no secret values","manifest run, cleanup and cost limits equal their independent approvals","the package manifest grants no launch authority","the production entrypoint is not wired","the request binds the dossier, three approvals and package manifest","the request lives no longer than sixty seconds","the request nonce is single-use","secret-like, executable, client and provisioning fields are rejected recursively","the opaque handle is WeakMap-backed, one-shot and disposable","authorization cannot contact or provision a host","authorization cannot load a package or execute a driver","authorization cannot start a watchdog, service, listener, proxy or route","the authorization receipt is eligible only for a separately approved fixture executor","the production Controller entrypoint does not import the authorizer","all production, external-write and paid-resource counters remain zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":76,"acceptedOutcomes":8,"deniedOutcomes":68,"dossierReceiptsVerified":65,"approvalSignaturesVerified":62,"authorizedEnvelopes":5,"authorizationReceiptsVerified":3,"disposedHandles":1,"productionHostRuns":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["obtain explicit user authorization for paid disposable non-production compute","replace synthetic cost evidence with a reviewed immutable pricing quote source","create a dedicated non-production account and VPC with no production connectivity","build and sign the prestaged immutable conformance image and all package artifacts","configure independent cost, runtime and retirement signing authorities","implement and syscall-review a separate host executor with no shell surface","configure a durable monotonic execution journal and independent watchdog runtime","execute the package on one disposable host under the exact cost and time envelope","capture independent process, port, proxy, unit, snapshot, lock, instance and volume retirement proof","review the resulting real-host dossier before any production activation discussion"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-execution-envelope-authorizer-fixtures/v1","mode":"EXECUTION_ENVELOPE_AUTHORIZATION_ONLY_NO_HOST_LAUNCH","cases":[{"id":"RFDHEA-01","mutation":"AUTHORIZE_BASELINE","expected":"ACCEPT"},{"id":"RFDHEA-02","mutation":"AUTHORIZE_SECOND_NONCE","expected":"ACCEPT"},{"id":"RFDHEA-03","mutation":"AUTHORIZE_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHEA-04","mutation":"VERIFY_AUTHORIZATION_RECEIPT","expected":"ACCEPT"},{"id":"RFDHEA-05","mutation":"VERIFY_AUTHORIZATION_RECEIPT_REPLAY","expected":"ACCEPT"},{"id":"RFDHEA-06","mutation":"DISPOSE_AND_REPLAY","expected":"ACCEPT"},{"id":"RFDHEA-07","mutation":"PREPARE_ONLY","expected":"ACCEPT"},{"id":"RFDHEA-08","mutation":"PREPARE_SECOND","expected":"ACCEPT"},{"id":"RFDHEA-09","mutation":"DOSSIER_DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHEA-10","mutation":"APPROVAL_DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHEA-11","mutation":"CONTRACT_DIGEST_INVALID","expected":"DENY"},{"id":"RFDHEA-12","mutation":"DOSSIER_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHEA-13","mutation":"DOSSIER_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHEA-14","mutation":"APPROVAL_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHEA-15","mutation":"APPROVAL_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHEA-16","mutation":"CLOCK_INVALID","expected":"DENY"},{"id":"RFDHEA-17","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHEA-18","mutation":"DOSSIER_STATUS","expected":"DENY"},{"id":"RFDHEA-19","mutation":"DOSSIER_VERDICT","expected":"DENY"},{"id":"RFDHEA-20","mutation":"DOSSIER_PROMOTION","expected":"DENY"},{"id":"RFDHEA-21","mutation":"DOSSIER_PRODUCTION_HOST","expected":"DENY"},{"id":"RFDHEA-22","mutation":"DOSSIER_PACKAGE_COUNT","expected":"DENY"},{"id":"RFDHEA-23","mutation":"DOSSIER_DIGEST","expected":"DENY"},{"id":"RFDHEA-24","mutation":"DOSSIER_EXTRA_KEY","expected":"DENY"},{"id":"RFDHEA-25","mutation":"COST_SCHEMA","expected":"DENY"},{"id":"RFDHEA-26","mutation":"COST_STATUS","expected":"DENY"},{"id":"RFDHEA-27","mutation":"COST_AUTHORITY","expected":"DENY"},{"id":"RFDHEA-28","mutation":"COST_SUBJECT","expected":"DENY"},{"id":"RFDHEA-29","mutation":"COST_CURRENCY","expected":"DENY"},{"id":"RFDHEA-30","mutation":"COST_ESTIMATE_NEGATIVE","expected":"DENY"},{"id":"RFDHEA-31","mutation":"COST_ESTIMATE_OVER_MAX","expected":"DENY"},{"id":"RFDHEA-32","mutation":"COST_MAX_OVER_CAP","expected":"DENY"},{"id":"RFDHEA-33","mutation":"COST_PRICING_BASIS","expected":"DENY"},{"id":"RFDHEA-34","mutation":"COST_WINDOW","expected":"DENY"},{"id":"RFDHEA-35","mutation":"COST_SIGNER","expected":"DENY"},{"id":"RFDHEA-36","mutation":"COST_DIGEST","expected":"DENY"},{"id":"RFDHEA-37","mutation":"COST_EXTRA_KEY","expected":"DENY"},{"id":"RFDHEA-38","mutation":"RUNTIME_SCHEMA","expected":"DENY"},{"id":"RFDHEA-39","mutation":"RUNTIME_STATUS","expected":"DENY"},{"id":"RFDHEA-40","mutation":"RUNTIME_AUTHORITY","expected":"DENY"},{"id":"RFDHEA-41","mutation":"RUNTIME_SUBJECT","expected":"DENY"},{"id":"RFDHEA-42","mutation":"RUNTIME_ENVIRONMENT","expected":"DENY"},{"id":"RFDHEA-43","mutation":"RUNTIME_REGION","expected":"DENY"},{"id":"RFDHEA-44","mutation":"RUNTIME_PLATFORM","expected":"DENY"},{"id":"RFDHEA-45","mutation":"RUNTIME_MAX_RUN","expected":"DENY"},{"id":"RFDHEA-46","mutation":"RUNTIME_MAX_CLEANUP","expected":"DENY"},{"id":"RFDHEA-47","mutation":"RUNTIME_PRODUCTION_CONNECTIVITY","expected":"DENY"},{"id":"RFDHEA-48","mutation":"RUNTIME_PUBLIC_NETWORK","expected":"DENY"},{"id":"RFDHEA-49","mutation":"RUNTIME_WINDOW","expected":"DENY"},{"id":"RFDHEA-50","mutation":"RUNTIME_SIGNER","expected":"DENY"},{"id":"RFDHEA-51","mutation":"RUNTIME_DIGEST","expected":"DENY"},{"id":"RFDHEA-52","mutation":"RUNTIME_EXTRA_KEY","expected":"DENY"},{"id":"RFDHEA-53","mutation":"RETIREMENT_SCHEMA","expected":"DENY"},{"id":"RFDHEA-54","mutation":"RETIREMENT_STATUS","expected":"DENY"},{"id":"RFDHEA-55","mutation":"RETIREMENT_AUTHORITY","expected":"DENY"},{"id":"RFDHEA-56","mutation":"RETIREMENT_SUBJECT","expected":"DENY"},{"id":"RFDHEA-57","mutation":"RETIREMENT_CLEANUP","expected":"DENY"},{"id":"RFDHEA-58","mutation":"RETIREMENT_ASSERTIONS","expected":"DENY"},{"id":"RFDHEA-59","mutation":"RETIREMENT_INSTANCE","expected":"DENY"},{"id":"RFDHEA-60","mutation":"RETIREMENT_VOLUME","expected":"DENY"},{"id":"RFDHEA-61","mutation":"RETIREMENT_WINDOW","expected":"DENY"},{"id":"RFDHEA-62","mutation":"RETIREMENT_SIGNER","expected":"DENY"},{"id":"RFDHEA-63","mutation":"RETIREMENT_DIGEST","expected":"DENY"},{"id":"RFDHEA-64","mutation":"RETIREMENT_EXTRA_KEY","expected":"DENY"},{"id":"RFDHEA-65","mutation":"SHARED_APPROVAL_SIGNER","expected":"DENY"},{"id":"RFDHEA-66","mutation":"MANIFEST_SCHEMA","expected":"DENY"},{"id":"RFDHEA-67","mutation":"MANIFEST_MODE","expected":"DENY"},{"id":"RFDHEA-68","mutation":"MANIFEST_DOSSIER_DIGEST","expected":"DENY"},{"id":"RFDHEA-69","mutation":"MANIFEST_IMAGE_DIGEST","expected":"DENY"},{"id":"RFDHEA-70","mutation":"MANIFEST_COMMAND_SURFACE","expected":"DENY"},{"id":"RFDHEA-71","mutation":"MANIFEST_SECRET_SURFACE","expected":"DENY"},{"id":"RFDHEA-72","mutation":"MANIFEST_MAX_RUN","expected":"DENY"},{"id":"RFDHEA-73","mutation":"MANIFEST_MAX_COST","expected":"DENY"},{"id":"RFDHEA-74","mutation":"MANIFEST_LAUNCH_AUTHORITY","expected":"DENY"},{"id":"RFDHEA-75","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHEA-76","mutation":"REQUEST_NONCE_REPLAY","expected":"DENY"}]}},"disposableHostNoShellExecutor":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-no-shell-executor-contract/v1","status":"DISPOSABLE_HOST_NO_SHELL_EXECUTOR_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T10:00:00Z","scope":{"mode":"IN_MEMORY_TYPED_PORT_DRIVER_NO_HOST","input":"AUTHORIZED_TEST_ONLY_NO_LAUNCH_ENVELOPE","output":"RETIRED_ROLLED_BACK_OR_CONTAINED_FIXTURE_SESSION_RECEIPT","driverMode":"CLOSED_TYPED_PORTS_ONLY","hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","paidHostAuthorizationPresent":false,"userCostAuthorizationReceiptObserved":false,"launchAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"operations":["prepare","execute","verify","dispose"],"upstream":{"contract":"controller-disposable-host-execution-envelope-authorizer-contract.json","receiptStatus":"DISPOSABLE_HOST_EXECUTION_ENVELOPE_AUTHORIZED_TEST_ONLY","verdict":"ELIGIBLE_FOR_SEPARATELY_APPROVED_FIXTURE_EXECUTOR_ONLY","verification":"ASYMMETRIC_VERIFY_ONLY_FIXTURE","launchAuthority":"NONE"},"authorityTopology":[{"authority":"FIXTURE_NO_SHELL_EXECUTOR","signerKeyId":"fixture-p256-no-shell-executor","ports":5,"mayRetire":false},{"authority":"INDEPENDENT_RETIREMENT_WATCHDOG","signerKeyId":"fixture-p256-independent-retirement-watchdog","ports":3,"mayOpenSession":false}],"hostClaim":{"strategy":"DETERMINISTIC_DIGEST_FROM_AUTHORIZATION_PACKAGE_AND_DOSSIER","idempotencyKey":"hostClaimKey","maximumClaimsPerEnvelope":1,"fixtureClaimsOnly":true,"awsClientTokenDerived":false,"durableClaimStoreConfigured":false},"deadlineEnvelope":{"requestValiditySeconds":30,"maxRunSeconds":900,"maxCleanupSeconds":120,"watchdogAuthority":"INDEPENDENT_RETIREMENT_WATCHDOG","deadlineDriverConfigured":false,"runtimeClockConfigured":false},"typedPorts":[{"ordinal":1,"operation":"CLAIM_HOST","method":"claimHost","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"derive one fixture-only host claim","shell":false},{"ordinal":2,"operation":"BIND_EXECUTION_PACKAGE","method":"bindPackage","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"bind without loading package bytes","shell":false},{"ordinal":3,"operation":"START_DEADLINE_WATCHDOG","method":"startDeadlineWatchdog","authority":"INDEPENDENT_RETIREMENT_WATCHDOG","effect":"reserve fixture deadline observation","shell":false},{"ordinal":4,"operation":"ATTEST_ISOLATION","method":"attestIsolation","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"prove modeled network and credential closure","shell":false},{"ordinal":5,"operation":"OPEN_FIXTURE_SESSION","method":"openSession","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"open an in-memory typed session only","shell":false},{"ordinal":6,"operation":"SEAL_FIXTURE_SESSION","method":"sealSession","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"seal fixture evidence without a spawned process","shell":false},{"ordinal":7,"operation":"RETIRE_FIXTURE_HOST","method":"retireHost","authority":"INDEPENDENT_RETIREMENT_WATCHDOG","effect":"retire modeled instance and root volume","shell":false},{"ordinal":8,"operation":"VERIFY_RETIREMENT","method":"verifyRetirement","authority":"INDEPENDENT_RETIREMENT_WATCHDOG","effect":"positively verify terminal retirement","shell":false}],"forwardPhases":["CLAIM_HOST","BIND_EXECUTION_PACKAGE","START_DEADLINE_WATCHDOG","ATTEST_ISOLATION","OPEN_FIXTURE_SESSION","SEAL_FIXTURE_SESSION","RETIRE_FIXTURE_HOST","VERIFY_RETIREMENT"],"compensationPhases":["RETIRE_FIXTURE_HOST","VERIFY_RETIREMENT"],"stateModel":["UNTRUSTED","ENVELOPE_VERIFIED","REQUEST_BOUND","HOST_CLAIMED_FIXTURE_ONLY","PACKAGE_BOUND_NOT_LOADED","WATCHDOG_RESERVED_FIXTURE_ONLY","ISOLATION_ATTESTED_FIXTURE_ONLY","SESSION_OPEN_IN_MEMORY","SESSION_SEALED_IN_MEMORY","HOST_RETIREMENT_REQUESTED_FIXTURE_ONLY","RETIREMENT_VERIFIED_FIXTURE_ONLY","ROLLED_BACK_OR_CONTAINED"],"truth":{"productionExecutorsConfigured":0,"productionHostRuns":0,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"selectedDenialTrace":{"fixtureId":"RFDHNS-69","mutation":"STEP_SHELL_SURFACE","expected":"DENY","reason":"A typed fixture step that exposes BASH is rejected before it can become trusted executor evidence."},"invariants":["The production Controller composition root never imports this evaluator.","The evaluator accepts only the exact test-only no-launch envelope receipt shape.","The upstream envelope must be positively verified by its authoritative boundary.","False envelope-verifier results deny rather than falling back to local trust.","Envelope-verifier exceptions deny rather than becoming retryable launch authority.","The envelope must carry launchAuthority NONE and promotionAuthority NONE.","The envelope must report every production and external side-effect counter as zero.","The envelope synthetic estimate cannot exceed its maximum or 500 milli-USD.","The request is valid for no more than thirty seconds.","The request cannot outlive the upstream authorization envelope.","The request nonce differs from the upstream envelope nonce.","A nonce can prepare at most one opaque executor handle.","Opaque handles are identity-bound in a WeakMap and cannot be reconstructed.","Each opaque handle is one-shot and cannot execute twice.","Disposed handles cannot execute and repeated dispose is idempotent.","The host claim key is deterministically derived from authorization, package and dossier identity.","One envelope can produce at most one fixture host claim in one evaluator instance.","The host claim identifier is deterministically derived from the host claim key.","No durable production host-claim store is implied by fixture idempotency.","The exact driver surface contains five executor methods and three retirement methods.","Executor and retirement drivers must be separate object identities.","Neither driver exposes a generic command, callback, spawn or shell operation.","The request binds all eight typed operations in exact order.","Every typed step returns exact-shape digest-bound evidence.","Every step receipt is positively verified before the next phase.","False step verification stops forward progress and denies the invocation.","Step-verifier exceptions stop forward progress and deny the invocation.","Malformed step evidence cannot be converted into a successful terminal receipt.","The executor authority cannot sign independent watchdog or retirement steps.","The retirement authority cannot open or seal a fixture session.","The two fixture signer identities are distinct.","The shell surface remains NONE in the request, every step and the terminal receipt.","No fixture step may report a spawned process.","No fixture step may report host contact or package loading.","The package binding phase binds identity only and never loads bytes.","The watchdog reservation precedes isolation attestation and session opening.","Isolation attestation precedes every fixture session open.","A fixture session must be sealed before normal retirement begins.","Normal success requires both host and root-volume retirement.","Retirement verification is the final successful typed phase.","A known driver failure before host claim produces a safe rolled-back receipt.","A known driver failure after host claim invokes retirement compensation.","Retirement compensation uses only retireHost and verifyRetirement typed ports.","A clean compensated failure proves the host and root volume retired.","Retirement ambiguity produces CONTAINED rather than a clean rollback claim.","A contained receipt preserves the exact failure code for audit and freeze policy.","No successful or rolled-back receipt may leave an open fixture session.","The executor accepts no paid-host authorization from this development request.","The user cost-authorization receipt digest remains null in fixture mode.","Live pricing is not read and the synthetic estimate is not treated as a quote.","Production host runs and production host claims remain zero.","Production drivers, units, services, listeners, proxies and routes remain zero.","External reads, writes and mutations remain zero.","Paid resources remain absent and deployment remains forbidden.","Terminal receipts are digest-bound to authorization, claim key, nonce and request time.","Terminal receipt verification is deterministic and safe to replay.","Fixture calls and fixture claims never increment production truth counters.","Port 8110 and every public ingress path remain outside this evaluator."],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":80,"acceptedOutcomes":12,"deniedOutcomes":68,"envelopeReceiptsVerified":53,"stepSignaturesVerified":68,"retiredSessions":5,"rolledBackSessions":5,"containedSessions":1,"executorReceiptsVerified":3,"disposedHandles":1,"shellCommandsAccepted":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"productionHostRuns":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["A user must explicitly authorize a reviewed real cost ceiling and quote source for a paid disposable host.","A durable idempotent host-claim store with generation fencing must be deployed and recovery-drilled.","A reviewed no-shell production worker driver must implement the exact closed typed-port interface.","An independently owned deadline and retirement driver must be deployed with separate credentials.","A dedicated non-production VPC, subnet, security group and deny-by-default egress policy must exist.","An immutable image and every execution-package digest must be staged and re-verified on the target host.","The job credential, cloud credential and registration secret closures must be observed on a real disposable host.","Instance and root-volume retirement must be independently observed within the 120-second cleanup deadline.","Ambiguous launch, timeout and retirement drills must prove whole-pool freeze without orphaned capacity.","Controller 0/11 production readiness gates must pass with signed runtime evidence and rollback proof.","An explicit change window must authorize production wiring while port 8110, proxy and public routes remain separately controlled."],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-no-shell-executor-fixtures/v1","mode":"IN_MEMORY_TYPED_PORT_DRIVER_NO_HOST","cases":[{"id":"RFDHNS-01","mutation":"PREPARE_BASELINE","expected":"ACCEPT"},{"id":"RFDHNS-02","mutation":"EXECUTE_BASELINE","expected":"ACCEPT"},{"id":"RFDHNS-03","mutation":"VERIFY_RECEIPT","expected":"ACCEPT"},{"id":"RFDHNS-04","mutation":"VERIFY_RECEIPT_REPLAY","expected":"ACCEPT"},{"id":"RFDHNS-05","mutation":"DISPOSE_AND_REPLAY","expected":"ACCEPT"},{"id":"RFDHNS-06","mutation":"REQUEST_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHNS-07","mutation":"CLAIM_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-08","mutation":"BIND_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-09","mutation":"WATCHDOG_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-10","mutation":"OPEN_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-11","mutation":"SEAL_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-12","mutation":"RETIREMENT_DRIVER_FAIL_CONTAINED","expected":"ACCEPT"},{"id":"RFDHNS-13","mutation":"ENVELOPE_DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHNS-14","mutation":"STEP_DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHNS-15","mutation":"EXECUTOR_DRIVER_MISSING","expected":"DENY"},{"id":"RFDHNS-16","mutation":"RETIREMENT_DRIVER_MISSING","expected":"DENY"},{"id":"RFDHNS-17","mutation":"SHARED_DRIVER","expected":"DENY"},{"id":"RFDHNS-18","mutation":"CLOCK_INVALID","expected":"DENY"},{"id":"RFDHNS-19","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHNS-20","mutation":"ENVELOPE_SCHEMA","expected":"DENY"},{"id":"RFDHNS-21","mutation":"ENVELOPE_STATUS","expected":"DENY"},{"id":"RFDHNS-22","mutation":"ENVELOPE_VERDICT","expected":"DENY"},{"id":"RFDHNS-23","mutation":"ENVELOPE_MODE","expected":"DENY"},{"id":"RFDHNS-24","mutation":"ENVELOPE_AUTHORIZATION_ID","expected":"DENY"},{"id":"RFDHNS-25","mutation":"ENVELOPE_DIGEST","expected":"DENY"},{"id":"RFDHNS-26","mutation":"ENVELOPE_COST_OVER_CAP","expected":"DENY"},{"id":"RFDHNS-27","mutation":"ENVELOPE_MAX_RUN","expected":"DENY"},{"id":"RFDHNS-28","mutation":"ENVELOPE_MAX_CLEANUP","expected":"DENY"},{"id":"RFDHNS-29","mutation":"ENVELOPE_ELIGIBILITY","expected":"DENY"},{"id":"RFDHNS-30","mutation":"ENVELOPE_PRODUCTION_RUN","expected":"DENY"},{"id":"RFDHNS-31","mutation":"ENVELOPE_PRODUCTION_CLAIM","expected":"DENY"},{"id":"RFDHNS-32","mutation":"ENVELOPE_PRODUCTION_PACKAGE","expected":"DENY"},{"id":"RFDHNS-33","mutation":"ENVELOPE_PRODUCTION_DRIVER","expected":"DENY"},{"id":"RFDHNS-34","mutation":"ENVELOPE_PRODUCTION_SERVICE","expected":"DENY"},{"id":"RFDHNS-35","mutation":"ENVELOPE_EXTERNAL_WRITE","expected":"DENY"},{"id":"RFDHNS-36","mutation":"ENVELOPE_PAID_RESOURCE","expected":"DENY"},{"id":"RFDHNS-37","mutation":"ENVELOPE_LAUNCH_AUTHORITY","expected":"DENY"},{"id":"RFDHNS-38","mutation":"ENVELOPE_EXPIRED","expected":"DENY"},{"id":"RFDHNS-39","mutation":"ENVELOPE_EXTRA_KEY","expected":"DENY"},{"id":"RFDHNS-40","mutation":"REQUEST_SCHEMA","expected":"DENY"},{"id":"RFDHNS-41","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHNS-42","mutation":"REQUEST_MODE","expected":"DENY"},{"id":"RFDHNS-43","mutation":"REQUEST_RECEIPT_DIGEST","expected":"DENY"},{"id":"RFDHNS-44","mutation":"REQUEST_HOST_CLAIM_KEY","expected":"DENY"},{"id":"RFDHNS-45","mutation":"REQUEST_TYPED_OPERATIONS","expected":"DENY"},{"id":"RFDHNS-46","mutation":"REQUEST_MAX_RUN","expected":"DENY"},{"id":"RFDHNS-47","mutation":"REQUEST_MAX_CLEANUP","expected":"DENY"},{"id":"RFDHNS-48","mutation":"REQUEST_SHELL_SURFACE","expected":"DENY"},{"id":"RFDHNS-49","mutation":"REQUEST_PAID_AUTHORITY","expected":"DENY"},{"id":"RFDHNS-50","mutation":"REQUEST_USER_COST_RECEIPT","expected":"DENY"},{"id":"RFDHNS-51","mutation":"REQUEST_ENVELOPE_NONCE","expected":"DENY"},{"id":"RFDHNS-52","mutation":"REQUEST_NONCE_INVALID","expected":"DENY"},{"id":"RFDHNS-53","mutation":"REQUEST_EXPIRED","expected":"DENY"},{"id":"RFDHNS-54","mutation":"REQUEST_WINDOW_LONG","expected":"DENY"},{"id":"RFDHNS-55","mutation":"REQUEST_EXTRA_KEY","expected":"DENY"},{"id":"RFDHNS-56","mutation":"REQUEST_RELEASE_DRIFT","expected":"DENY"},{"id":"RFDHNS-57","mutation":"ENVELOPE_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHNS-58","mutation":"ENVELOPE_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHNS-59","mutation":"STEP_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHNS-60","mutation":"STEP_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHNS-61","mutation":"HANDLE_FORGED","expected":"DENY"},{"id":"RFDHNS-62","mutation":"HANDLE_REPLAY","expected":"DENY"},{"id":"RFDHNS-63","mutation":"HANDLE_DISPOSED","expected":"DENY"},{"id":"RFDHNS-64","mutation":"EXECUTE_EXPIRED","expected":"DENY"},{"id":"RFDHNS-65","mutation":"STEP_OPERATION","expected":"DENY"},{"id":"RFDHNS-66","mutation":"STEP_AUTHORITY","expected":"DENY"},{"id":"RFDHNS-67","mutation":"STEP_SIGNER","expected":"DENY"},{"id":"RFDHNS-68","mutation":"STEP_HOST_CLAIM_ID","expected":"DENY"},{"id":"RFDHNS-69","mutation":"STEP_SHELL_SURFACE","expected":"DENY"},{"id":"RFDHNS-70","mutation":"STEP_PROCESS_SPAWNED","expected":"DENY"},{"id":"RFDHNS-71","mutation":"STEP_HOST_CONTACTED","expected":"DENY"},{"id":"RFDHNS-72","mutation":"STEP_PACKAGE_LOADED","expected":"DENY"},{"id":"RFDHNS-73","mutation":"STEP_WATCHDOG_FACT","expected":"DENY"},{"id":"RFDHNS-74","mutation":"STEP_ISOLATION_FACT","expected":"DENY"},{"id":"RFDHNS-75","mutation":"STEP_SESSION_OPEN_FACT","expected":"DENY"},{"id":"RFDHNS-76","mutation":"STEP_SESSION_SEALED_FACT","expected":"DENY"},{"id":"RFDHNS-77","mutation":"STEP_HOST_RETIRED_FACT","expected":"DENY"},{"id":"RFDHNS-78","mutation":"STEP_ROOT_VOLUME_FACT","expected":"DENY"},{"id":"RFDHNS-79","mutation":"STEP_OBSERVED_AT","expected":"DENY"},{"id":"RFDHNS-80","mutation":"STEP_DIGEST","expected":"DENY"}]}},"disposableHostRealPrerequisitesAdmission":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-real-prerequisites-admission-contract/v1","status":"DISPOSABLE_HOST_REAL_PREREQUISITES_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T10:00:00Z","scope":{"mode":"FIXTURE_PREREQUISITE_VALIDATION_ONLY_NO_LAUNCH_NO_BILLING","input":"POSITIVELY_VERIFIED_RETIRED_NO_SHELL_FIXTURE_RECEIPT","output":"TEST_ONLY_PREREQUISITE_ADMISSION_RECEIPT","liveEvidenceCollected":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","paidHostAuthorizationPresent":false,"launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"operations":["prepare","admit","verify","dispose"],"upstream":{"contract":"controller-disposable-host-no-shell-executor-contract.json","receiptStatus":"FIXTURE_NO_SHELL_EXECUTION_RETIRED","verdict":"FIXTURE_DRIVER_ONLY_NO_PAID_HOST_AUTHORITY","verification":"POSITIVE_AUTHORITATIVE_CALLBACK_PLUS_EXACT_SHAPE","launchAuthority":"NONE"},"prerequisiteSlots":[{"ordinal":1,"slot":"USER_COST_AUTHORIZATION_RECEIPT","authority":"USER_COST_OWNER","signerKeyId":"fixture-p256-user-cost-owner","liveSatisfied":false},{"ordinal":2,"slot":"LIVE_QUOTE_SOURCE_QUALIFICATION","authority":"FINOPS_QUOTE_AUTHORITY","signerKeyId":"fixture-p256-finops-quote-authority","liveSatisfied":false},{"ordinal":3,"slot":"DURABLE_HOST_CLAIM_STORE_QUALIFICATION","authority":"DURABLE_CAPACITY_OWNER","signerKeyId":"fixture-p256-durable-capacity-owner","liveSatisfied":false},{"ordinal":4,"slot":"PRODUCTION_NO_SHELL_DRIVER_QUALIFICATION","authority":"EXECUTION_SECURITY_OWNER","signerKeyId":"fixture-p256-execution-security-owner","liveSatisfied":false},{"ordinal":5,"slot":"INDEPENDENT_WATCHDOG_QUALIFICATION","authority":"INDEPENDENT_RETIREMENT_OWNER","signerKeyId":"fixture-p256-independent-retirement-owner","liveSatisfied":false},{"ordinal":6,"slot":"ISOLATED_NONPRODUCTION_NETWORK_QUALIFICATION","authority":"NETWORK_PLATFORM_OWNER","signerKeyId":"fixture-p256-network-platform-owner","liveSatisfied":false},{"ordinal":7,"slot":"IMMUTABLE_IMAGE_PACKAGE_QUALIFICATION","authority":"EXECUTION_SECURITY_OWNER","signerKeyId":"fixture-p256-execution-security-owner","liveSatisfied":false},{"ordinal":8,"slot":"RETIREMENT_DRILL_QUALIFICATION","authority":"INDEPENDENT_RETIREMENT_OWNER","signerKeyId":"fixture-p256-independent-retirement-owner","liveSatisfied":false}],"authorityTopology":[{"authority":"USER_COST_OWNER","slots":1,"mayLaunch":false},{"authority":"FINOPS_QUOTE_AUTHORITY","slots":1,"mayLaunch":false},{"authority":"DURABLE_CAPACITY_OWNER","slots":1,"mayLaunch":false},{"authority":"EXECUTION_SECURITY_OWNER","slots":2,"mayLaunch":false},{"authority":"NETWORK_PLATFORM_OWNER","slots":1,"mayLaunch":false},{"authority":"INDEPENDENT_RETIREMENT_OWNER","slots":2,"mayLaunch":false}],"manifestGuardrails":{"requestValiditySeconds":30,"qualificationValiditySeconds":86400,"maximumMilliUsdCeiling":500,"quoteMaxAgeSeconds":300,"retirementSlaSeconds":120,"claimStore":"DURABLE_CONDITIONAL_GENERATION_FENCED_REQUIRED_NOT_CONFIGURED","driverSurface":"NO_SHELL_CLOSED_TYPED_PORTS_REQUIRED_NOT_CONFIGURED","networkIngress":"NONE","networkEgress":"DEFAULT_DENY","liveQuoteFetched":false,"productionConfigured":false},"stateModel":["UNTRUSTED","EXECUTOR_RECEIPT_VERIFIED","SUBJECT_BOUND","COST_AUTHORITY_VERIFIED_FIXTURE_ONLY","QUOTE_SOURCE_QUALIFIED_FIXTURE_ONLY","DURABLE_CLAIM_STORE_QUALIFIED_FIXTURE_ONLY","NO_SHELL_DRIVER_QUALIFIED_FIXTURE_ONLY","RETIREMENT_AUTHORITY_QUALIFIED_FIXTURE_ONLY","ISOLATED_NETWORK_QUALIFIED_FIXTURE_ONLY","IMMUTABLE_PACKAGE_QUALIFIED_FIXTURE_ONLY","RETIREMENT_DRILL_QUALIFIED_FIXTURE_ONLY","PREREQUISITES_ADMITTED_TEST_ONLY","DENIED_OR_DISPOSED"],"truth":{"userCostAuthorizationsObserved":0,"livePriceQuotesObserved":0,"durableClaimStoresConfigured":0,"productionDriversConfigured":0,"independentRetirementDriversConfigured":0,"productionHostRuns":0,"productionHostClaims":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"selectedDenialTrace":{"fixtureId":"RFDHRP-64","mutation":"MANIFEST_LAUNCH_AUTHORITY","expected":"DENY","reason":"A prerequisite dossier that claims AWS host-launch authority is rejected even when all eight fixture qualification receipts are otherwise digest-valid."},"invariants":["The production Controller composition root never imports this evaluator.","Only an exact retired no-shell fixture receipt may enter prerequisite admission.","Contained and rolled-back fixture executor receipts cannot enter prerequisite admission.","The upstream executor receipt must be positively verified by its authoritative boundary.","False upstream verification denies without falling back to local digest trust.","Upstream verifier exceptions fail closed and never become launch authority.","The upstream receipt identity is deterministically recomputed before trust.","The upstream receipt must prove one claim and one complete retirement.","The upstream receipt must prove the fixture session was sealed.","The upstream receipt must prove both host and root-volume retirement.","The upstream receipt cannot report shell commands or spawned processes.","The upstream receipt cannot report host contact or package loading.","The upstream receipt cannot carry paid-host authorization.","Every upstream production, external and mutation counter remains zero.","Exactly eight prerequisite slots are supplied in canonical order.","Every prerequisite receipt binds the exact upstream executor receipt digest.","Every prerequisite receipt is exact-shape and digest-bound.","Every prerequisite receipt is positively verified by the qualification boundary.","False qualification verification denies the entire dossier.","Qualification verifier exceptions deny the entire dossier.","Qualification receipts are valid for no more than twenty-four hours.","Qualification receipts must be live at the evaluator clock instant.","All qualification decisions remain QUALIFIED_FIXTURE_ONLY.","No qualification receipt may claim observed live evidence.","No qualification receipt may claim a production configuration.","The user cost slot is owned only by USER_COST_OWNER.","The quote-source slot is owned only by FINOPS_QUOTE_AUTHORITY.","The durable-claim slot is owned only by DURABLE_CAPACITY_OWNER.","Driver and immutable-package slots share the reviewed execution-security owner.","Watchdog and retirement-drill slots share the independent retirement owner.","The isolated-network slot is owned only by NETWORK_PLATFORM_OWNER.","Six distinct authority identities cover the eight prerequisite slots.","A shared slot owner never gains host-launch or billing authority.","The manifest binds all eight qualification receipt digests in canonical order.","The manifest maximum is an authorization ceiling, not a live price quote.","The synthetic maximum cannot exceed five hundred milli-USD.","The quote source is a fixture-qualified reference and is never fetched here.","A future live quote must be no older than three hundred seconds.","Durable conditional generation-fenced claim storage remains required and unconfigured.","The production driver requirement remains a closed typed no-shell surface.","The manifest shell surface remains NONE.","The watchdog requirement uses credentials separate from execution authority.","The target network requires no ingress and default-deny egress.","The immutable image and execution package are digest-bound prerequisites.","Retirement requires both instance and root-volume proof within one hundred twenty seconds.","The manifest cannot claim production configuration or live observation.","The manifest carries no launch, billing or promotion authority.","The request is valid for at most thirty seconds.","The request binds the upstream digest, manifest digest and canonical slot list.","The request nonce differs from the upstream executor nonce.","A request nonce can prepare at most one opaque admission handle.","Opaque handles are identity-bound in a WeakMap and cannot be reconstructed.","Each opaque handle is one-shot and cannot admit twice.","Disposed handles cannot admit and repeated disposal is idempotent.","The terminal admission identity binds upstream, manifest, nonce and request time.","Terminal receipt verification is deterministic and safe to replay.","The terminal receipt qualifies eight fixture prerequisite shapes and zero production prerequisites.","No user cost authorization or live price quote is observed by this evaluator.","No durable store or production execution/retirement driver is configured here.","No host, package, process, service, listener, route or proxy is contacted or created.","External reads, writes, mutations and paid resources remain zero.","Port 8110, public ingress, host launch, billing and promotion remain outside this evaluator."],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":84,"acceptedOutcomes":10,"deniedOutcomes":74,"executorReceiptsVerified":62,"qualificationSignaturesVerified":368,"admissionReceiptsVerified":3,"disposedHandles":1,"userCostAuthorizationsObserved":0,"livePriceQuotesObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"productionPrerequisites":["A user-controlled, scope-bound and expiring cost authorization receipt must be supplied outside this fixture evaluator.","A reviewed live pricing source must be queried and its fresh signed quote bound to the exact host request.","A durable conditional-write claim store with generation fencing and recovery tests must be configured.","A production no-shell driver must implement only the reviewed typed ports and carry no generic command surface.","An independently credentialed deadline watchdog must retain authority to retire the instance and root volume.","A dedicated nonproduction network must prove no public ingress and reviewed default-deny egress policy.","The selected immutable image must be scanned, signed, region-available and bound to the candidate package.","The execution package must be immutable, size-bounded, signature-verified and free of secret or executable injection fields.","Retirement drills must prove instance and root-volume deletion under success, timeout, crash and ambiguous API outcomes.","FinOps alerts, budget ceilings, billing tags and an independent spend reconciliation path must be operational.","Runtime audit evidence must enter the durable signed journal without giving the Controller promotion authority.","A separately approved live-evidence collection change must prove all prerequisites before any paid host may be launched."],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-real-prerequisites-admission-fixtures/v1","mode":"FIXTURE_PREREQUISITE_VALIDATION_ONLY_NO_LAUNCH_NO_BILLING","cases":[{"id":"RFDHRP-01","mutation":"PREPARE_BASELINE","expected":"ACCEPT"},{"id":"RFDHRP-02","mutation":"ADMIT_BASELINE","expected":"ACCEPT"},{"id":"RFDHRP-03","mutation":"VERIFY_RECEIPT","expected":"ACCEPT"},{"id":"RFDHRP-04","mutation":"VERIFY_REPLAY","expected":"ACCEPT"},{"id":"RFDHRP-05","mutation":"DISPOSE_REPLAY","expected":"ACCEPT"},{"id":"RFDHRP-06","mutation":"REQUEST_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHRP-07","mutation":"MAXIMUM_COST_ZERO_EDGE","expected":"ACCEPT"},{"id":"RFDHRP-08","mutation":"MAXIMUM_COST_CAP_EDGE","expected":"ACCEPT"},{"id":"RFDHRP-09","mutation":"QUALIFICATION_VALIDITY_EDGE","expected":"ACCEPT"},{"id":"RFDHRP-10","mutation":"ADMISSION_OBSERVED_AT_EDGE","expected":"ACCEPT"},{"id":"RFDHRP-11","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHRP-12","mutation":"UPSTREAM_SCHEMA","expected":"DENY"},{"id":"RFDHRP-13","mutation":"UPSTREAM_STATUS","expected":"DENY"},{"id":"RFDHRP-14","mutation":"UPSTREAM_VERDICT","expected":"DENY"},{"id":"RFDHRP-15","mutation":"UPSTREAM_MODE","expected":"DENY"},{"id":"RFDHRP-16","mutation":"UPSTREAM_RECEIPT_DIGEST","expected":"DENY"},{"id":"RFDHRP-17","mutation":"UPSTREAM_ID","expected":"DENY"},{"id":"RFDHRP-18","mutation":"UPSTREAM_FAILURE","expected":"DENY"},{"id":"RFDHRP-19","mutation":"UPSTREAM_CLAIMS","expected":"DENY"},{"id":"RFDHRP-20","mutation":"UPSTREAM_RETIREMENT","expected":"DENY"},{"id":"RFDHRP-21","mutation":"UPSTREAM_SHELL_COUNT","expected":"DENY"},{"id":"RFDHRP-22","mutation":"UPSTREAM_PROCESS_COUNT","expected":"DENY"},{"id":"RFDHRP-23","mutation":"UPSTREAM_HOST_CONTACT","expected":"DENY"},{"id":"RFDHRP-24","mutation":"UPSTREAM_PACKAGE_LOAD","expected":"DENY"},{"id":"RFDHRP-25","mutation":"UPSTREAM_PAID_AUTHORITY","expected":"DENY"},{"id":"RFDHRP-26","mutation":"UPSTREAM_PRODUCTION_RUN","expected":"DENY"},{"id":"RFDHRP-27","mutation":"UPSTREAM_EXTERNAL_READ","expected":"DENY"},{"id":"RFDHRP-28","mutation":"UPSTREAM_LAUNCH_AUTHORITY","expected":"DENY"},{"id":"RFDHRP-29","mutation":"UPSTREAM_EXTRA_KEY","expected":"DENY"},{"id":"RFDHRP-30","mutation":"UPSTREAM_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHRP-31","mutation":"UPSTREAM_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHRP-32","mutation":"QUALIFICATION_COUNT","expected":"DENY"},{"id":"RFDHRP-33","mutation":"QUALIFICATION_ORDER","expected":"DENY"},{"id":"RFDHRP-34","mutation":"QUALIFICATION_SLOT","expected":"DENY"},{"id":"RFDHRP-35","mutation":"QUALIFICATION_DECISION","expected":"DENY"},{"id":"RFDHRP-36","mutation":"QUALIFICATION_AUTHORITY","expected":"DENY"},{"id":"RFDHRP-37","mutation":"QUALIFICATION_SIGNER","expected":"DENY"},{"id":"RFDHRP-38","mutation":"QUALIFICATION_MODE","expected":"DENY"},{"id":"RFDHRP-39","mutation":"QUALIFICATION_SUBJECT","expected":"DENY"},{"id":"RFDHRP-40","mutation":"QUALIFICATION_OBSERVED_LIVE","expected":"DENY"},{"id":"RFDHRP-41","mutation":"QUALIFICATION_PRODUCTION_CONFIGURED","expected":"DENY"},{"id":"RFDHRP-42","mutation":"QUALIFICATION_NOT_YET_VALID","expected":"DENY"},{"id":"RFDHRP-43","mutation":"QUALIFICATION_EXPIRED","expected":"DENY"},{"id":"RFDHRP-44","mutation":"QUALIFICATION_DIGEST","expected":"DENY"},{"id":"RFDHRP-45","mutation":"QUALIFICATION_EXTRA_KEY","expected":"DENY"},{"id":"RFDHRP-46","mutation":"QUALIFICATION_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHRP-47","mutation":"QUALIFICATION_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHRP-48","mutation":"MANIFEST_SUBJECT","expected":"DENY"},{"id":"RFDHRP-49","mutation":"MANIFEST_MAX_COST_NEGATIVE","expected":"DENY"},{"id":"RFDHRP-50","mutation":"MANIFEST_MAX_COST_OVER_CAP","expected":"DENY"},{"id":"RFDHRP-51","mutation":"MANIFEST_QUOTE_MODE","expected":"DENY"},{"id":"RFDHRP-52","mutation":"MANIFEST_QUOTE_AGE","expected":"DENY"},{"id":"RFDHRP-53","mutation":"MANIFEST_CLAIM_STORE","expected":"DENY"},{"id":"RFDHRP-54","mutation":"MANIFEST_GENERATION_FENCE","expected":"DENY"},{"id":"RFDHRP-55","mutation":"MANIFEST_DRIVER_SURFACE","expected":"DENY"},{"id":"RFDHRP-56","mutation":"MANIFEST_SHELL_SURFACE","expected":"DENY"},{"id":"RFDHRP-57","mutation":"MANIFEST_WATCHDOG_CREDENTIALS","expected":"DENY"},{"id":"RFDHRP-58","mutation":"MANIFEST_NETWORK_INGRESS","expected":"DENY"},{"id":"RFDHRP-59","mutation":"MANIFEST_NETWORK_EGRESS","expected":"DENY"},{"id":"RFDHRP-60","mutation":"MANIFEST_ROOT_VOLUME","expected":"DENY"},{"id":"RFDHRP-61","mutation":"MANIFEST_QUALIFICATION_DIGESTS","expected":"DENY"},{"id":"RFDHRP-62","mutation":"MANIFEST_PRODUCTION_CONFIGURED","expected":"DENY"},{"id":"RFDHRP-63","mutation":"MANIFEST_LIVE_OBSERVED","expected":"DENY"},{"id":"RFDHRP-64","mutation":"MANIFEST_LAUNCH_AUTHORITY","expected":"DENY"},{"id":"RFDHRP-65","mutation":"MANIFEST_BILLING_AUTHORITY","expected":"DENY"},{"id":"RFDHRP-66","mutation":"MANIFEST_PROMOTION_AUTHORITY","expected":"DENY"},{"id":"RFDHRP-67","mutation":"MANIFEST_DIGEST","expected":"DENY"},{"id":"RFDHRP-68","mutation":"MANIFEST_EXTRA_KEY","expected":"DENY"},{"id":"RFDHRP-69","mutation":"REQUEST_SCHEMA","expected":"DENY"},{"id":"RFDHRP-70","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHRP-71","mutation":"REQUEST_MODE","expected":"DENY"},{"id":"RFDHRP-72","mutation":"REQUEST_SUBJECT","expected":"DENY"},{"id":"RFDHRP-73","mutation":"REQUEST_MANIFEST","expected":"DENY"},{"id":"RFDHRP-74","mutation":"REQUEST_SLOT_ORDER","expected":"DENY"},{"id":"RFDHRP-75","mutation":"REQUEST_NONCE_INVALID","expected":"DENY"},{"id":"RFDHRP-76","mutation":"REQUEST_EXPIRED","expected":"DENY"},{"id":"RFDHRP-77","mutation":"REQUEST_WINDOW_LONG","expected":"DENY"},{"id":"RFDHRP-78","mutation":"REQUEST_REPLAY","expected":"DENY"},{"id":"RFDHRP-79","mutation":"RECONSTRUCTED_HANDLE","expected":"DENY"},{"id":"RFDHRP-80","mutation":"DISPOSED_HANDLE","expected":"DENY"},{"id":"RFDHRP-81","mutation":"ADMIT_REPLAY","expected":"DENY"},{"id":"RFDHRP-82","mutation":"RECEIPT_LIVE_QUOTE","expected":"DENY"},{"id":"RFDHRP-83","mutation":"RECEIPT_PAID_RESOURCE","expected":"DENY"},{"id":"RFDHRP-84","mutation":"RECEIPT_DIGEST","expected":"DENY"}]}},"disposableHostLiveEvidenceCollectionAuthorization":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-authorization-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_AUTHORIZATION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T11:00:00Z","scope":{"mode":"FIXTURE_AUTHORIZATION_SHAPE_ONLY_NO_LIVE_READ_NO_LAUNCH","input":"POSITIVELY_VERIFIED_TEST_ONLY_REAL_HOST_PREREQUISITES_ADMISSION_RECEIPT","output":"LIVE_EVIDENCE_COLLECTION_AUTHORIZATION_ENVELOPE_TEST_ONLY","liveEvidenceCollected":false,"liveQuoteRead":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","paidHostAuthorizationPresent":false,"launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"operations":["prepare","authorize","verify","dispose"],"upstream":{"contract":"controller-disposable-host-real-prerequisites-admission-contract.json","receiptStatus":"REAL_HOST_PREREQUISITES_ADMITTED_TEST_ONLY","verdict":"ELIGIBLE_FOR_SEPARATELY_APPROVED_LIVE_EVIDENCE_COLLECTION_ONLY","verification":"POSITIVE_AUTHORITATIVE_CALLBACK_PLUS_EXACT_SHAPE_AND_IDENTITY","launchAuthority":"NONE"},"evidenceSlots":[{"ordinal":1,"slot":"USER_COST_AUTHORIZATION","authority":"USER_COST_OWNER","signerKeyId":"fixture-p256-user-cost-owner","observedLive":false},{"ordinal":2,"slot":"FRESH_SIGNED_PRICE_QUOTE","authority":"FINOPS_QUOTE_AUTHORITY","signerKeyId":"fixture-p256-finops-quote-authority","observedLive":false},{"ordinal":3,"slot":"DURABLE_CLAIM_RESERVATION","authority":"DURABLE_CAPACITY_OWNER","signerKeyId":"fixture-p256-durable-capacity-owner","observedLive":false},{"ordinal":4,"slot":"NO_SHELL_DRIVER_RELEASE","authority":"EXECUTION_SECURITY_OWNER","signerKeyId":"fixture-p256-execution-security-owner","observedLive":false},{"ordinal":5,"slot":"INDEPENDENT_WATCHDOG_ESCROW","authority":"INDEPENDENT_RETIREMENT_OWNER","signerKeyId":"fixture-p256-independent-retirement-owner","observedLive":false},{"ordinal":6,"slot":"ISOLATED_NETWORK_LEASE","authority":"NETWORK_PLATFORM_OWNER","signerKeyId":"fixture-p256-network-platform-owner","observedLive":false},{"ordinal":7,"slot":"IMMUTABLE_IMAGE_PACKAGE_ATTESTATION","authority":"SUPPLY_CHAIN_OWNER","signerKeyId":"fixture-p256-supply-chain-owner","observedLive":false},{"ordinal":8,"slot":"RETIREMENT_DRILL_WITNESS","authority":"INDEPENDENT_RETIREMENT_OWNER","signerKeyId":"fixture-p256-independent-retirement-owner","observedLive":false},{"ordinal":9,"slot":"INCIDENT_RESPONSE_WINDOW","authority":"INCIDENT_COMMANDER","signerKeyId":"fixture-p256-incident-commander","observedLive":false}],"authorityTopology":[{"authority":"USER_COST_OWNER","slots":1,"mayLaunch":false},{"authority":"FINOPS_QUOTE_AUTHORITY","slots":1,"mayLaunch":false},{"authority":"DURABLE_CAPACITY_OWNER","slots":1,"mayLaunch":false},{"authority":"EXECUTION_SECURITY_OWNER","slots":1,"mayLaunch":false},{"authority":"INDEPENDENT_RETIREMENT_OWNER","slots":2,"mayLaunch":false},{"authority":"NETWORK_PLATFORM_OWNER","slots":1,"mayLaunch":false},{"authority":"SUPPLY_CHAIN_OWNER","slots":1,"mayLaunch":false},{"authority":"INCIDENT_COMMANDER","slots":1,"mayLaunch":false}],"collectionGuardrails":{"requestValiditySeconds":30,"authorizationShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"quoteMaxAgeSeconds":300,"collectionWindowSeconds":600,"retirementSlaSeconds":120,"environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","liveQuoteRead":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_VERIFIED","SCOPE_INTENT_BOUND","COST_SHAPE_VERIFIED","QUOTE_SHAPE_VERIFIED","CLAIM_SHAPE_VERIFIED","DRIVER_SHAPE_VERIFIED","WATCHDOG_SHAPE_VERIFIED","NETWORK_SHAPE_VERIFIED","SUPPLY_CHAIN_SHAPE_VERIFIED","RETIREMENT_SHAPE_VERIFIED","INCIDENT_WINDOW_SHAPE_VERIFIED","AUTHORIZED_TEST_ONLY","DENIED_OR_DISPOSED"],"truth":{"productionAuthorizationsObserved":0,"userCostAuthorizationsObserved":0,"livePriceQuotesObserved":0,"durableClaimReservationsObserved":0,"productionDriversObserved":0,"watchdogEscrowsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"selectedDenialTrace":{"fixtureId":"RFDHLEC-75","mutation":"SCOPE_HOST_LAUNCH_PERMITTED","expected":"DENY","reason":"A collection scope that claims host-launch permission is rejected even when all nine fixture authorization shapes are otherwise digest-valid."},"invariants":["The production Controller composition root never imports this evaluator.","Only an exact real-host prerequisites admission receipt may enter this boundary.","The upstream receipt remains explicitly TEST_ONLY.","The upstream receipt must be positively verified by its authoritative boundary.","False upstream verification denies without local-digest fallback.","Upstream verifier exceptions fail closed.","The upstream admission identity is deterministically recomputed.","The upstream receipt proves eight fixture prerequisites and no production prerequisites.","Every upstream production and side-effect counter remains zero.","The upstream receipt carries no launch, billing or promotion authority.","Exactly nine authorization-shape slots are supplied in canonical order.","Every authorization-shape receipt has an exact bounded shape.","Every authorization-shape receipt binds the exact upstream admission digest.","Every authorization-shape receipt binds the scope intent digest.","Every authorization-shape receipt is positively verified by its boundary.","False authorization-shape verification denies the full envelope.","Authorization-shape verifier exceptions deny the full envelope.","Authorization-shape receipts are valid for no more than one hour.","Authorization-shape receipts must be live at the evaluator clock instant.","Every authorization shape has FIXTURE_ONLY origin.","No authorization shape may claim observed live evidence.","No authorization shape may claim production configuration.","No authorization shape may claim external authority verification.","The user-cost slot is owned only by USER_COST_OWNER.","The quote slot is owned only by FINOPS_QUOTE_AUTHORITY.","The claim-reservation slot is owned only by DURABLE_CAPACITY_OWNER.","The driver-release slot is owned only by EXECUTION_SECURITY_OWNER.","Watchdog and retirement evidence are owned by the independent retirement owner.","The network lease is owned only by NETWORK_PLATFORM_OWNER.","The immutable supply-chain attestation is owned only by SUPPLY_CHAIN_OWNER.","The incident window is owned only by INCIDENT_COMMANDER.","Eight distinct authority identities cover the nine authorization shapes.","A shared retirement owner never gains launch authority.","The collection scope binds the exact upstream admission receipt.","The immutable scope intent is calculated before evidence receipts are issued.","The final scope binds all nine evidence receipt digests in canonical order.","At most one future evidence host may be requested.","The synthetic cost ceiling cannot exceed five hundred milli-USD.","No live price quote is read by this evaluator.","A future signed quote must be no older than three hundred seconds.","The future evidence collection window is capped at six hundred seconds.","The future retirement SLA is one hundred twenty seconds.","The isolated target permits no ingress.","The isolated target requires default-deny allowlisted egress.","The scope shell surface remains NONE.","The immutable image and package are digest-bound.","Every live-observation flag remains false.","The collection scope cannot claim production configuration.","The collection scope cannot permit host launch.","The collection scope cannot permit billing.","The collection scope cannot permit promotion.","The request is valid for at most thirty seconds.","The request binds the upstream receipt, final scope and ordered slot list.","The request nonce differs from the upstream admission nonce.","A request nonce can prepare at most one opaque handle.","Opaque handles are WeakMap-bound and cannot be reconstructed.","A reconstructed handle is rejected.","Each opaque handle can authorize at most once.","Disposed handles cannot authorize.","Repeated disposal is idempotent.","The terminal authorization identity binds upstream, scope, nonce and request time.","Terminal receipt verification is deterministic and replay-safe.","The output remains an authorization envelope for fixture shapes only.","The verdict requires a separate user-confirmed live collection transaction.","All production authorization and evidence counters remain zero.","The evaluator performs no network, pricing, host, package, process, external-write, mutation or paid-resource operation."],"productionPrerequisites":["A real user-signed cost authorization with exact amount, scope and expiry.","A fresh signed provider quote from a qualified source, verified within three hundred seconds.","A durable conditional claim reservation with generation fencing.","A production no-shell driver release qualified against the exact image and package.","Independent watchdog credentials escrowed outside execution authority.","An isolated nonproduction network lease with zero ingress and reviewed egress allowlist.","A signed immutable image attestation from the supply-chain owner.","A signed immutable execution-package attestation.","A witnessed instance and root-volume retirement drill within one hundred twenty seconds.","A staffed incident-response window with an accountable incident commander.","Metrics, paging and immutable audit storage for the evidence window.","A durable single-host budget ledger preventing concurrent or replayed spend.","A separate explicit user-confirmed live collection transaction; this envelope cannot launch it."],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":92,"acceptedOutcomes":12,"deniedOutcomes":80,"upstreamReceiptsVerified":72,"evidenceSignaturesVerified":254,"authorizationReceiptsVerified":3,"authorizedEnvelopes":10,"disposedHandles":2,"productionAuthorizationsObserved":0,"userCostAuthorizationsObserved":0,"livePriceQuotesObserved":0,"productionHostRuns":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-authorization-fixtures/v1","mode":"FIXTURE_AUTHORIZATION_SHAPE_ONLY_NO_LIVE_READ_NO_LAUNCH","networkRequestsExecuted":0,"pricingReadsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFDHLEC-01","mutation":"PREPARE_BASELINE","expected":"ACCEPT"},{"id":"RFDHLEC-02","mutation":"AUTHORIZE_BASELINE","expected":"ACCEPT"},{"id":"RFDHLEC-03","mutation":"VERIFY_RECEIPT","expected":"ACCEPT"},{"id":"RFDHLEC-04","mutation":"VERIFY_REPLAY","expected":"ACCEPT"},{"id":"RFDHLEC-05","mutation":"DISPOSE_REPLAY","expected":"ACCEPT"},{"id":"RFDHLEC-06","mutation":"REQUEST_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHLEC-07","mutation":"MAXIMUM_COST_ZERO_EDGE","expected":"ACCEPT"},{"id":"RFDHLEC-08","mutation":"MAXIMUM_COST_CAP_EDGE","expected":"ACCEPT"},{"id":"RFDHLEC-09","mutation":"EVIDENCE_VALIDITY_EDGE","expected":"ACCEPT"},{"id":"RFDHLEC-10","mutation":"AUTHORIZATION_OBSERVED_AT_EDGE","expected":"ACCEPT"},{"id":"RFDHLEC-11","mutation":"DISPOSE_AFTER_AUTHORIZE","expected":"ACCEPT"},{"id":"RFDHLEC-12","mutation":"INDEPENDENT_SCOPE_CLONE","expected":"ACCEPT"},{"id":"RFDHLEC-13","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHLEC-14","mutation":"PRICING_CLIENT_KEY","expected":"DENY"},{"id":"RFDHLEC-15","mutation":"UPSTREAM_SCHEMA","expected":"DENY"},{"id":"RFDHLEC-16","mutation":"UPSTREAM_STATUS","expected":"DENY"},{"id":"RFDHLEC-17","mutation":"UPSTREAM_VERDICT","expected":"DENY"},{"id":"RFDHLEC-18","mutation":"UPSTREAM_MODE","expected":"DENY"},{"id":"RFDHLEC-19","mutation":"UPSTREAM_ID","expected":"DENY"},{"id":"RFDHLEC-20","mutation":"UPSTREAM_RECEIPT_DIGEST","expected":"DENY"},{"id":"RFDHLEC-21","mutation":"UPSTREAM_PREREQUISITE_COUNT","expected":"DENY"},{"id":"RFDHLEC-22","mutation":"UPSTREAM_QUALIFICATION_COUNT","expected":"DENY"},{"id":"RFDHLEC-23","mutation":"UPSTREAM_FIXTURE_QUALIFIED","expected":"DENY"},{"id":"RFDHLEC-24","mutation":"UPSTREAM_PRODUCTION_SATISFIED","expected":"DENY"},{"id":"RFDHLEC-25","mutation":"UPSTREAM_MAX_COST","expected":"DENY"},{"id":"RFDHLEC-26","mutation":"UPSTREAM_QUOTE_AGE","expected":"DENY"},{"id":"RFDHLEC-27","mutation":"UPSTREAM_RETIREMENT_SLA","expected":"DENY"},{"id":"RFDHLEC-28","mutation":"UPSTREAM_USER_COST_OBSERVED","expected":"DENY"},{"id":"RFDHLEC-29","mutation":"UPSTREAM_LIVE_QUOTE_OBSERVED","expected":"DENY"},{"id":"RFDHLEC-30","mutation":"UPSTREAM_HOST_RUN","expected":"DENY"},{"id":"RFDHLEC-31","mutation":"UPSTREAM_EXTERNAL_READ","expected":"DENY"},{"id":"RFDHLEC-32","mutation":"UPSTREAM_PAID_RESOURCE","expected":"DENY"},{"id":"RFDHLEC-33","mutation":"UPSTREAM_LAUNCH_AUTHORITY","expected":"DENY"},{"id":"RFDHLEC-34","mutation":"UPSTREAM_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHLEC-35","mutation":"UPSTREAM_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHLEC-36","mutation":"EVIDENCE_COUNT","expected":"DENY"},{"id":"RFDHLEC-37","mutation":"EVIDENCE_ORDER","expected":"DENY"},{"id":"RFDHLEC-38","mutation":"EVIDENCE_SLOT","expected":"DENY"},{"id":"RFDHLEC-39","mutation":"EVIDENCE_DECISION","expected":"DENY"},{"id":"RFDHLEC-40","mutation":"EVIDENCE_AUTHORITY","expected":"DENY"},{"id":"RFDHLEC-41","mutation":"EVIDENCE_SIGNER","expected":"DENY"},{"id":"RFDHLEC-42","mutation":"EVIDENCE_MODE","expected":"DENY"},{"id":"RFDHLEC-43","mutation":"EVIDENCE_SUBJECT","expected":"DENY"},{"id":"RFDHLEC-44","mutation":"EVIDENCE_SCOPE","expected":"DENY"},{"id":"RFDHLEC-45","mutation":"EVIDENCE_ORIGIN","expected":"DENY"},{"id":"RFDHLEC-46","mutation":"EVIDENCE_OBSERVED_LIVE","expected":"DENY"},{"id":"RFDHLEC-47","mutation":"EVIDENCE_PRODUCTION_CONFIGURED","expected":"DENY"},{"id":"RFDHLEC-48","mutation":"EVIDENCE_EXTERNAL_AUTHORITY","expected":"DENY"},{"id":"RFDHLEC-49","mutation":"EVIDENCE_NOT_YET_VALID","expected":"DENY"},{"id":"RFDHLEC-50","mutation":"EVIDENCE_EXPIRED","expected":"DENY"},{"id":"RFDHLEC-51","mutation":"EVIDENCE_DIGEST","expected":"DENY"},{"id":"RFDHLEC-52","mutation":"EVIDENCE_EXTRA_KEY","expected":"DENY"},{"id":"RFDHLEC-53","mutation":"EVIDENCE_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHLEC-54","mutation":"EVIDENCE_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHLEC-55","mutation":"SCOPE_SCHEMA","expected":"DENY"},{"id":"RFDHLEC-56","mutation":"SCOPE_UPSTREAM","expected":"DENY"},{"id":"RFDHLEC-57","mutation":"SCOPE_REGION","expected":"DENY"},{"id":"RFDHLEC-58","mutation":"SCOPE_ENVIRONMENT","expected":"DENY"},{"id":"RFDHLEC-59","mutation":"SCOPE_HOST_COUNT_ZERO","expected":"DENY"},{"id":"RFDHLEC-60","mutation":"SCOPE_HOST_COUNT_TWO","expected":"DENY"},{"id":"RFDHLEC-61","mutation":"SCOPE_MAX_COST_NEGATIVE","expected":"DENY"},{"id":"RFDHLEC-62","mutation":"SCOPE_MAX_COST_OVER","expected":"DENY"},{"id":"RFDHLEC-63","mutation":"SCOPE_CURRENCY","expected":"DENY"},{"id":"RFDHLEC-64","mutation":"SCOPE_QUOTE_AGE","expected":"DENY"},{"id":"RFDHLEC-65","mutation":"SCOPE_COLLECTION_WINDOW","expected":"DENY"},{"id":"RFDHLEC-66","mutation":"SCOPE_RETIREMENT_SLA","expected":"DENY"},{"id":"RFDHLEC-67","mutation":"SCOPE_NETWORK_INGRESS","expected":"DENY"},{"id":"RFDHLEC-68","mutation":"SCOPE_NETWORK_EGRESS","expected":"DENY"},{"id":"RFDHLEC-69","mutation":"SCOPE_SHELL_SURFACE","expected":"DENY"},{"id":"RFDHLEC-70","mutation":"SCOPE_IMAGE_DIGEST","expected":"DENY"},{"id":"RFDHLEC-71","mutation":"SCOPE_PACKAGE_DIGEST","expected":"DENY"},{"id":"RFDHLEC-72","mutation":"SCOPE_EVIDENCE_DIGESTS","expected":"DENY"},{"id":"RFDHLEC-73","mutation":"SCOPE_LIVE_OBSERVED","expected":"DENY"},{"id":"RFDHLEC-74","mutation":"SCOPE_PRODUCTION_CONFIGURED","expected":"DENY"},{"id":"RFDHLEC-75","mutation":"SCOPE_HOST_LAUNCH_PERMITTED","expected":"DENY"},{"id":"RFDHLEC-76","mutation":"SCOPE_BILLING_PERMITTED","expected":"DENY"},{"id":"RFDHLEC-77","mutation":"SCOPE_PROMOTION_PERMITTED","expected":"DENY"},{"id":"RFDHLEC-78","mutation":"SCOPE_EXTRA_KEY","expected":"DENY"},{"id":"RFDHLEC-79","mutation":"REQUEST_SCHEMA","expected":"DENY"},{"id":"RFDHLEC-80","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHLEC-81","mutation":"REQUEST_MODE","expected":"DENY"},{"id":"RFDHLEC-82","mutation":"REQUEST_UPSTREAM","expected":"DENY"},{"id":"RFDHLEC-83","mutation":"REQUEST_SCOPE","expected":"DENY"},{"id":"RFDHLEC-84","mutation":"REQUEST_SLOT_ORDER","expected":"DENY"},{"id":"RFDHLEC-85","mutation":"REQUEST_NONCE_INVALID","expected":"DENY"},{"id":"RFDHLEC-86","mutation":"REQUEST_EXPIRED","expected":"DENY"},{"id":"RFDHLEC-87","mutation":"REQUEST_WINDOW_LONG","expected":"DENY"},{"id":"RFDHLEC-88","mutation":"REQUEST_REPLAY","expected":"DENY"},{"id":"RFDHLEC-89","mutation":"RECONSTRUCTED_HANDLE","expected":"DENY"},{"id":"RFDHLEC-90","mutation":"DISPOSED_HANDLE","expected":"DENY"},{"id":"RFDHLEC-91","mutation":"AUTHORIZE_REPLAY","expected":"DENY"},{"id":"RFDHLEC-92","mutation":"RECEIPT_LIVE_QUOTE","expected":"DENY"}]}},"disposableHostLiveEvidenceCollectionTransactionIntent":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-transaction-intent-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_TRANSACTION_INTENT_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T11:05:00Z","scope":{"mode":"FIXTURE_TRANSACTION_INTENT_ONLY_NO_LIVE_READ_NO_LAUNCH_NO_BILLING","input":"POSITIVELY_VERIFIED_TEST_ONLY_LIVE_EVIDENCE_COLLECTION_AUTHORIZATION_RECEIPT","output":"LIVE_COLLECTION_TRANSACTION_INTENT_PREPARED_TEST_ONLY","verdict":"REQUIRES_REAL_USER_SIGNATURE_AND_EXECUTION_TIME_REVALIDATION","realUserConfirmed":false,"liveEvidenceCollected":false,"liveQuoteRead":false,"budgetHeld":false,"hostClaimCreated":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-authorization-receipt/v1","status":"LIVE_EVIDENCE_COLLECTION_AUTHORIZATION_ENVELOPE_TEST_ONLY","verdict":"REQUIRES_SEPARATE_USER_CONFIRMED_LIVE_COLLECTION_TRANSACTION","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"authorization receipt + seven factor receipts + transaction scope + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"test-only transaction-intent receipt","sideEffect":"NONE"},{"id":"verify","input":"transaction-intent receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"factorSlots":[{"ordinal":1,"slot":"USER_CONFIRMATION_CHALLENGE","authority":"USER_COST_OWNER","signerKeyId":"fixture-p256-user-cost-owner","observedLive":false},{"ordinal":2,"slot":"FRESH_QUOTE_REVALIDATION","authority":"FINOPS_QUOTE_AUTHORITY","signerKeyId":"fixture-p256-finops-quote-authority","observedLive":false},{"ordinal":3,"slot":"DURABLE_BUDGET_HOLD_PROPOSAL","authority":"DURABLE_CAPACITY_OWNER","signerKeyId":"fixture-p256-durable-capacity-owner","observedLive":false},{"ordinal":4,"slot":"IDEMPOTENT_HOST_CLAIM_PROPOSAL","authority":"DURABLE_CAPACITY_OWNER","signerKeyId":"fixture-p256-durable-capacity-owner","observedLive":false},{"ordinal":5,"slot":"WATCHDOG_ARMING_PLAN","authority":"INDEPENDENT_RETIREMENT_OWNER","signerKeyId":"fixture-p256-independent-retirement-owner","observedLive":false},{"ordinal":6,"slot":"INCIDENT_WINDOW_CONFIRMATION","authority":"INCIDENT_COMMANDER","signerKeyId":"fixture-p256-incident-commander","observedLive":false},{"ordinal":7,"slot":"EXECUTION_TIME_POLICY_REVALIDATION","authority":"EXECUTION_SECURITY_OWNER","signerKeyId":"fixture-p256-execution-security-owner","observedLive":false}],"authorityTopology":[{"authority":"USER_COST_OWNER","slots":1,"mayExecute":false},{"authority":"FINOPS_QUOTE_AUTHORITY","slots":1,"mayExecute":false},{"authority":"DURABLE_CAPACITY_OWNER","slots":2,"mayExecute":false},{"authority":"INDEPENDENT_RETIREMENT_OWNER","slots":1,"mayExecute":false},{"authority":"INCIDENT_COMMANDER","slots":1,"mayExecute":false},{"authority":"EXECUTION_SECURITY_OWNER","slots":1,"mayExecute":false}],"transactionGuardrails":{"requestValiditySeconds":30,"factorShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"quoteMaxAgeSeconds":300,"collectionWindowSeconds":600,"retirementSlaSeconds":120,"environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","confirmationMethod":"DETACHED_USER_SIGNATURE_REQUIRED_NOT_PRESENT","realUserSignatureObserved":false,"liveQuoteRead":false,"budgetHoldCreated":false,"hostClaimCreated":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_VERIFIED","INTENT_SCOPE_BOUND","CONFIRMATION_CHALLENGE_SHAPE_VERIFIED","QUOTE_REVALIDATION_SHAPE_VERIFIED","BUDGET_HOLD_SHAPE_VERIFIED","HOST_CLAIM_SHAPE_VERIFIED","WATCHDOG_ARMING_SHAPE_VERIFIED","INCIDENT_WINDOW_SHAPE_VERIFIED","POLICY_REVALIDATION_SHAPE_VERIFIED","INTENT_PREPARED_TEST_ONLY","INTENT_RECEIPT_VERIFIED","DENIED_OR_DISPOSED"],"invariants":["The upstream receipt must have the exact authorization-receipt shape.","The upstream receipt must remain test-only and no-launch.","The upstream receipt requires a positive authoritative callback.","The upstream receipt must be unexpired at preparation time.","The upstream receipt must report zero production authorizations.","The upstream host maximum must remain one.","The upstream cost ceiling must not exceed five hundred milli-USD.","Exactly seven factor receipts are required.","Factor receipts are ordered by the canonical slot registry.","Every factor binds its exact authority identity.","Every factor binds its exact signer key identity.","Every factor requires a positive authoritative callback.","Every factor reports observedLive false.","Every factor reports realUserSignatureObserved false.","Every factor reports productionConfigured false.","Every factor validity window is no longer than one hour.","Every factor binds the exact upstream receipt digest.","Every factor binds the exact transaction intent scope digest.","The final scope binds all ordered factor receipt digests.","The transaction intent scope has an exact closed shape.","The transaction type is disposable-host live-evidence collection only.","The region remains the fixture region.","The environment remains isolated nonproduction and unprovisioned.","Network ingress is none.","Network egress is default deny with an allowlist required.","The shell surface is none.","The confirmation method explicitly requires an absent detached user signature.","The confirmation challenge is digest-bound.","The budget-hold proposal is digest-bound.","The host claim key uses a deterministic namespaced digest.","The driver package is immutable and digest-bound.","The intent scope digest excludes only downstream factor bindings.","The final scope digest binds the intent and ordered factors.","All live, executable, launch, billing and promotion booleans remain false.","The request has an exact closed shape.","The request action may only prepare a test-only intent.","The request mode forbids live reads, launch and billing.","The request binds the exact upstream receipt digest.","The request binds the exact final transaction scope digest.","The request preserves canonical factor ordering.","The request nonce is a bounded namespaced digest.","The request nonce differs from the upstream nonce.","The request validity window is no longer than thirty seconds.","A nonce cannot prepare twice.","Handles are opaque WeakMap-backed capabilities.","A reconstructed handle cannot project an intent.","A handle projects at most once.","An expired prepared handle cannot project an intent.","Projection exposes no command, callback, client or function.","The intent receipt has an exact closed shape.","The intent identifier is deterministically digest-derived.","The intent receipt status remains test-only.","The intent verdict requires a real user signature and execution-time revalidation.","Real user confirmations observed remain zero.","Live price quotes observed remain zero.","Durable budget holds observed remain zero.","Durable claim reservations observed remain zero.","Production drivers observed remain zero.","Watchdog armings observed remain zero.","Incident windows observed remain zero.","Execution-time policy revalidations observed remain zero.","Production host claims and runs remain zero.","Processes and host contacts remain zero.","Package loads remain zero.","Pricing reads remain zero.","Systemd units, services and listeners remain zero.","Public and reverse-proxy routes remain zero.","External reads, writes and mutations remain zero.","Paid resources created remains false.","The production Controller composition root does not import this evaluator."],"productionPrerequisites":["A real detached user signature over the exact challenge, cost ceiling, scope and expiry.","A fresh provider quote revalidated at transaction execution time.","A durable conditional budget hold with generation fencing and automatic release.","A durable idempotent host claim bound to the exact transaction intent.","A production no-shell driver qualified for the exact image and package.","Independent watchdog credentials armed outside execution authority.","An isolated nonproduction network lease with no ingress and reviewed egress.","A signed immutable image attestation.","A signed immutable execution-package attestation.","A witnessed instance and root-volume retirement drill within one hundred twenty seconds.","A staffed incident-response window with an accountable incident commander.","Execution-time policy revalidation against the exact current production policy digest.","Immutable audit storage, metrics and paging for confirmation through retirement.","A separate explicit execution authorization after all real evidence is freshly reverified."],"selectedDenialTrace":{"fixtureId":"RFDHLECTI-78","mutation":"SCOPE_USER_CONFIRMED","expected":"DENY","reason":"A caller cannot turn the test-only transaction intent into user confirmation by setting userConfirmed=true, even when every fixture factor remains digest-valid."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":96,"acceptedOutcomes":12,"deniedOutcomes":84,"upstreamReceiptsVerified":73,"factorSignaturesVerified":205,"intentReceiptsVerified":3,"projectedIntents":12,"disposedHandles":2,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionHostRuns":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"realUserConfirmationsObserved":0,"userCostAuthorizationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"policyRevalidationsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-transaction-intent-fixtures/v1","description":"Deterministic fixture-only transaction-intent cases. No real user signature, quote, budget hold, claim, host, process, network client, billing or paid resource is used.","mode":"FIXTURE_TRANSACTION_INTENT_ONLY_NO_LIVE_READ_NO_LAUNCH_NO_BILLING","cases":[{"id":"RFDHLECTI-01","mutation":"PREPARE_BASELINE","expected":"ACCEPT"},{"id":"RFDHLECTI-02","mutation":"PROJECT_BASELINE","expected":"ACCEPT"},{"id":"RFDHLECTI-03","mutation":"VERIFY_RECEIPT","expected":"ACCEPT"},{"id":"RFDHLECTI-04","mutation":"VERIFY_REPLAY","expected":"ACCEPT"},{"id":"RFDHLECTI-05","mutation":"DISPOSE_REPLAY","expected":"ACCEPT"},{"id":"RFDHLECTI-06","mutation":"REQUEST_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHLECTI-07","mutation":"MAXIMUM_COST_ZERO_EDGE","expected":"ACCEPT"},{"id":"RFDHLECTI-08","mutation":"MAXIMUM_COST_CAP_EDGE","expected":"ACCEPT"},{"id":"RFDHLECTI-09","mutation":"FACTOR_VALIDITY_EDGE","expected":"ACCEPT"},{"id":"RFDHLECTI-10","mutation":"PROJECT_OBSERVED_AT_EDGE","expected":"ACCEPT"},{"id":"RFDHLECTI-11","mutation":"DISPOSE_AFTER_PROJECT","expected":"ACCEPT"},{"id":"RFDHLECTI-12","mutation":"INDEPENDENT_SCOPE_CLONE","expected":"ACCEPT"},{"id":"RFDHLECTI-13","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHLECTI-14","mutation":"PRICING_CLIENT_KEY","expected":"DENY"},{"id":"RFDHLECTI-15","mutation":"CHARGE_ACCOUNT_KEY","expected":"DENY"},{"id":"RFDHLECTI-16","mutation":"UPSTREAM_SCHEMA","expected":"DENY"},{"id":"RFDHLECTI-17","mutation":"UPSTREAM_STATUS","expected":"DENY"},{"id":"RFDHLECTI-18","mutation":"UPSTREAM_VERDICT","expected":"DENY"},{"id":"RFDHLECTI-19","mutation":"UPSTREAM_MODE","expected":"DENY"},{"id":"RFDHLECTI-20","mutation":"UPSTREAM_ID","expected":"DENY"},{"id":"RFDHLECTI-21","mutation":"UPSTREAM_RECEIPT_DIGEST","expected":"DENY"},{"id":"RFDHLECTI-22","mutation":"UPSTREAM_EVIDENCE_COUNT","expected":"DENY"},{"id":"RFDHLECTI-23","mutation":"UPSTREAM_SHAPES_VERIFIED","expected":"DENY"},{"id":"RFDHLECTI-24","mutation":"UPSTREAM_PRODUCTION_AUTH","expected":"DENY"},{"id":"RFDHLECTI-25","mutation":"UPSTREAM_HOST_COUNT","expected":"DENY"},{"id":"RFDHLECTI-26","mutation":"UPSTREAM_MAX_COST","expected":"DENY"},{"id":"RFDHLECTI-27","mutation":"UPSTREAM_QUOTE_AGE","expected":"DENY"},{"id":"RFDHLECTI-28","mutation":"UPSTREAM_COLLECTION_WINDOW","expected":"DENY"},{"id":"RFDHLECTI-29","mutation":"UPSTREAM_RETIREMENT_SLA","expected":"DENY"},{"id":"RFDHLECTI-30","mutation":"UPSTREAM_USER_COST","expected":"DENY"},{"id":"RFDHLECTI-31","mutation":"UPSTREAM_LIVE_QUOTE","expected":"DENY"},{"id":"RFDHLECTI-32","mutation":"UPSTREAM_HOST_RUN","expected":"DENY"},{"id":"RFDHLECTI-33","mutation":"UPSTREAM_HOST_CONTACT","expected":"DENY"},{"id":"RFDHLECTI-34","mutation":"UPSTREAM_PRICING_READ","expected":"DENY"},{"id":"RFDHLECTI-35","mutation":"UPSTREAM_PAID_RESOURCE","expected":"DENY"},{"id":"RFDHLECTI-36","mutation":"UPSTREAM_EXPIRED","expected":"DENY"},{"id":"RFDHLECTI-37","mutation":"UPSTREAM_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHLECTI-38","mutation":"UPSTREAM_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHLECTI-39","mutation":"FACTOR_COUNT","expected":"DENY"},{"id":"RFDHLECTI-40","mutation":"FACTOR_ORDER","expected":"DENY"},{"id":"RFDHLECTI-41","mutation":"FACTOR_SLOT","expected":"DENY"},{"id":"RFDHLECTI-42","mutation":"FACTOR_DECISION","expected":"DENY"},{"id":"RFDHLECTI-43","mutation":"FACTOR_AUTHORITY","expected":"DENY"},{"id":"RFDHLECTI-44","mutation":"FACTOR_SIGNER","expected":"DENY"},{"id":"RFDHLECTI-45","mutation":"FACTOR_MODE","expected":"DENY"},{"id":"RFDHLECTI-46","mutation":"FACTOR_SUBJECT","expected":"DENY"},{"id":"RFDHLECTI-47","mutation":"FACTOR_SCOPE","expected":"DENY"},{"id":"RFDHLECTI-48","mutation":"FACTOR_OBSERVED_LIVE","expected":"DENY"},{"id":"RFDHLECTI-49","mutation":"FACTOR_USER_SIGNATURE","expected":"DENY"},{"id":"RFDHLECTI-50","mutation":"FACTOR_PRODUCTION_CONFIGURED","expected":"DENY"},{"id":"RFDHLECTI-51","mutation":"FACTOR_NOT_YET_VALID","expected":"DENY"},{"id":"RFDHLECTI-52","mutation":"FACTOR_EXPIRED","expected":"DENY"},{"id":"RFDHLECTI-53","mutation":"FACTOR_VALIDITY_LONG","expected":"DENY"},{"id":"RFDHLECTI-54","mutation":"FACTOR_DIGEST","expected":"DENY"},{"id":"RFDHLECTI-55","mutation":"FACTOR_EXTRA_KEY","expected":"DENY"},{"id":"RFDHLECTI-56","mutation":"FACTOR_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHLECTI-57","mutation":"FACTOR_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHLECTI-58","mutation":"SCOPE_SCHEMA","expected":"DENY"},{"id":"RFDHLECTI-59","mutation":"SCOPE_UPSTREAM","expected":"DENY"},{"id":"RFDHLECTI-60","mutation":"SCOPE_TRANSACTION_TYPE","expected":"DENY"},{"id":"RFDHLECTI-61","mutation":"SCOPE_ENVIRONMENT","expected":"DENY"},{"id":"RFDHLECTI-62","mutation":"SCOPE_HOST_COUNT_ZERO","expected":"DENY"},{"id":"RFDHLECTI-63","mutation":"SCOPE_HOST_COUNT_TWO","expected":"DENY"},{"id":"RFDHLECTI-64","mutation":"SCOPE_MAX_COST_NEGATIVE","expected":"DENY"},{"id":"RFDHLECTI-65","mutation":"SCOPE_MAX_COST_OVER","expected":"DENY"},{"id":"RFDHLECTI-66","mutation":"SCOPE_QUOTE_AGE","expected":"DENY"},{"id":"RFDHLECTI-67","mutation":"SCOPE_COLLECTION_WINDOW","expected":"DENY"},{"id":"RFDHLECTI-68","mutation":"SCOPE_RETIREMENT_SLA","expected":"DENY"},{"id":"RFDHLECTI-69","mutation":"SCOPE_NETWORK_INGRESS","expected":"DENY"},{"id":"RFDHLECTI-70","mutation":"SCOPE_NETWORK_EGRESS","expected":"DENY"},{"id":"RFDHLECTI-71","mutation":"SCOPE_SHELL_SURFACE","expected":"DENY"},{"id":"RFDHLECTI-72","mutation":"SCOPE_CONFIRMATION_METHOD","expected":"DENY"},{"id":"RFDHLECTI-73","mutation":"SCOPE_CHALLENGE_DIGEST","expected":"DENY"},{"id":"RFDHLECTI-74","mutation":"SCOPE_BUDGET_DIGEST","expected":"DENY"},{"id":"RFDHLECTI-75","mutation":"SCOPE_CLAIM_KEY","expected":"DENY"},{"id":"RFDHLECTI-76","mutation":"SCOPE_DRIVER_DIGEST","expected":"DENY"},{"id":"RFDHLECTI-77","mutation":"SCOPE_FACTOR_DIGESTS","expected":"DENY"},{"id":"RFDHLECTI-78","mutation":"SCOPE_USER_CONFIRMED","expected":"DENY"},{"id":"RFDHLECTI-79","mutation":"SCOPE_TRANSACTION_EXECUTABLE","expected":"DENY"},{"id":"RFDHLECTI-80","mutation":"SCOPE_HOST_LAUNCH_PERMITTED","expected":"DENY"},{"id":"RFDHLECTI-81","mutation":"SCOPE_BILLING_PERMITTED","expected":"DENY"},{"id":"RFDHLECTI-82","mutation":"REQUEST_SCHEMA","expected":"DENY"},{"id":"RFDHLECTI-83","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHLECTI-84","mutation":"REQUEST_MODE","expected":"DENY"},{"id":"RFDHLECTI-85","mutation":"REQUEST_UPSTREAM","expected":"DENY"},{"id":"RFDHLECTI-86","mutation":"REQUEST_SCOPE","expected":"DENY"},{"id":"RFDHLECTI-87","mutation":"REQUEST_SLOT_ORDER","expected":"DENY"},{"id":"RFDHLECTI-88","mutation":"REQUEST_NONCE_INVALID","expected":"DENY"},{"id":"RFDHLECTI-89","mutation":"REQUEST_EXPIRED","expected":"DENY"},{"id":"RFDHLECTI-90","mutation":"REQUEST_WINDOW_LONG","expected":"DENY"},{"id":"RFDHLECTI-91","mutation":"REQUEST_REPLAY","expected":"DENY"},{"id":"RFDHLECTI-92","mutation":"RECONSTRUCTED_HANDLE","expected":"DENY"},{"id":"RFDHLECTI-93","mutation":"DISPOSED_HANDLE","expected":"DENY"},{"id":"RFDHLECTI-94","mutation":"PROJECT_REPLAY","expected":"DENY"},{"id":"RFDHLECTI-95","mutation":"EXPIRED_HANDLE","expected":"DENY"},{"id":"RFDHLECTI-96","mutation":"RECEIPT_USER_CONFIRMATION","expected":"DENY"}],"networkRequestsExecuted":0,"pricingReadsExecuted":0,"userConfirmationsExecuted":0,"budgetHoldsExecuted":0,"hostClaimsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false}},"disposableHostLiveEvidenceCollectionDetachedUserConfirmation":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-detached-user-confirmation-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_DETACHED_USER_CONFIRMATION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T12:05:00Z","scope":{"mode":"FIXTURE_DETACHED_SIGNATURE_VERIFICATION_ONLY_NO_LIVE_READ_NO_HOLD_NO_CLAIM","input":"POSITIVELY_VERIFIED_TEST_ONLY_TRANSACTION_INTENT_RECEIPT","output":"DETACHED_USER_CONFIRMATION_VERIFIED_FIXTURE_ONLY","verdict":"REQUIRES_FRESH_QUOTE_BUDGET_HOLD_HOST_CLAIM_AND_EXECUTION_AUTHORIZATION","fixtureDetachedSignatureVerified":true,"realIdentityVerified":false,"realUserConfirmed":false,"liveQuoteRead":false,"budgetHeld":false,"hostClaimCreated":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-transaction-intent-receipt/v1","status":"LIVE_COLLECTION_TRANSACTION_INTENT_PREPARED_TEST_ONLY","verdict":"REQUIRES_REAL_USER_SIGNATURE_AND_EXECUTION_TIME_REVALIDATION","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"transaction-intent receipt + challenge + detached-signature descriptor + five proof receipts + confirmation scope + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only detached-confirmation receipt","sideEffect":"NONE"},{"id":"verify","input":"detached-confirmation receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"proofSlots":[{"ordinal":1,"slot":"IDENTITY_BINDING_ATTESTATION","authority":"USER_IDENTITY_AUTHORITY","signerKeyId":"fixture-p256-user-identity-authority","observedLive":false},{"ordinal":2,"slot":"CONSENT_PRESENTATION_ATTESTATION","authority":"CONSENT_EXPERIENCE_OWNER","signerKeyId":"fixture-p256-consent-experience-owner","observedLive":false},{"ordinal":3,"slot":"REAUTHENTICATION_FRESHNESS_ATTESTATION","authority":"USER_IDENTITY_AUTHORITY","signerKeyId":"fixture-p256-user-identity-authority","observedLive":false},{"ordinal":4,"slot":"DETACHED_CHALLENGE_SIGNATURE_ATTESTATION","authority":"FIXTURE_USER_PRINCIPAL","signerKeyId":"fixture-p256-user-principal","observedLive":false},{"ordinal":5,"slot":"CONFIRMATION_POLICY_REVALIDATION","authority":"CONFIRMATION_SECURITY_OWNER","signerKeyId":"fixture-p256-confirmation-security-owner","observedLive":false}],"authorityTopology":[{"authority":"USER_IDENTITY_AUTHORITY","slots":2,"mayConfirm":false,"mayExecute":false},{"authority":"CONSENT_EXPERIENCE_OWNER","slots":1,"mayConfirm":false,"mayExecute":false},{"authority":"FIXTURE_USER_PRINCIPAL","slots":1,"mayConfirm":false,"mayExecute":false},{"authority":"CONFIRMATION_SECURITY_OWNER","slots":1,"mayConfirm":false,"mayExecute":false}],"confirmationGuardrails":{"requestValiditySeconds":30,"challengeValiditySeconds":120,"signatureValiditySeconds":120,"proofShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"collectionWindowSeconds":600,"retirementSlaSeconds":120,"identityMode":"OPAQUE_FIXTURE_SUBJECT_ONLY","signatureAlgorithm":"ECDSA_P256_SHA256","signatureOrigin":"FIXTURE_ONLY","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","realIdentityVerified":false,"realUserSignatureObserved":false,"liveQuoteRead":false,"budgetHoldCreated":false,"hostClaimCreated":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_VERIFIED","CHALLENGE_BOUND","SIGNATURE_DESCRIPTOR_VERIFIED","FIXTURE_SIGNATURE_POSITIVELY_VERIFIED","IDENTITY_BINDING_PROOF_VERIFIED","CONSENT_PRESENTATION_PROOF_VERIFIED","REAUTHENTICATION_PROOF_VERIFIED","SIGNATURE_ATTESTATION_VERIFIED","CONFIRMATION_POLICY_PROOF_VERIFIED","CONFIRMATION_SCOPE_BOUND","CONFIRMATION_PREPARED_FIXTURE_ONLY","CONFIRMATION_RECEIPT_VERIFIED","DENIED_OR_DISPOSED"],"invariants":["Only the exact unexpired LIVE_COLLECTION_TRANSACTION_INTENT_PREPARED_TEST_ONLY receipt is accepted.","The upstream transaction-intent receipt must pass an authoritative positive verifier callback.","The upstream receipt requestedAt, observedAt and expiresAt ordering must contain the current clock.","The upstream status, verdict and fixture-only mode cannot be upgraded by callers.","The upstream receipt must report zero real user confirmations.","The upstream receipt must report zero live price quotes.","The upstream receipt must report zero durable budget holds.","The upstream receipt must report zero durable host claims.","The upstream receipt must report zero production host runs and paid resources.","The challenge digest must bind every challenge field using canonical SHA-256.","The challenge identity is deterministically derived from upstream, transaction scope, subject and issue time.","The user subject is an opaque fixture reference and cannot contain email or production identity data.","The displayed purpose is fixed to one disposable-host live-evidence collection fixture.","The confirmation challenge is bounded to one host.","The confirmation challenge cost ceiling is an integer from zero through 500 milli-USD.","The confirmation challenge currency is exactly USD.","The challenge collection window is exactly 600 seconds.","The challenge retirement SLA is exactly 120 seconds.","The confirmation challenge is single-use.","The challenge must retain userConfirmed=false.","The challenge must retain realUserSignatureObserved=false.","The challenge cannot claim an external confirmation URL was opened.","The confirmation challenge validity is no longer than 120 seconds.","The detached-signature descriptor accepts no unknown fields.","The detached-signature algorithm is exactly ECDSA_P256_SHA256.","The detached-signature signer key is the fixture user-principal key.","The signature descriptor binds the exact confirmation challenge digest.","Only a signature artifact digest is admitted; raw signature or private-key material is prohibited.","The detached-signature origin is FIXTURE_ONLY.","The signature descriptor must retain observedLive=false.","The signature descriptor must retain realUserSignatureObserved=false.","The signature descriptor must retain productionConfigured=false.","The detached-signature descriptor validity is no longer than 120 seconds.","The detached signature artifact must pass an authoritative positive verifier callback.","Exactly five ordered confirmation proof receipts are required.","Confirmation proof slot order is immutable.","Each proof slot is owned by its exact authority.","Each proof slot is pinned to its exact fixture signer.","Every proof decision is VERIFIED_FIXTURE_SHAPE_ONLY.","Every proof mode denies live confirmation authority.","Every proof binds the exact upstream transaction-intent receipt digest.","Every proof binds the exact confirmation challenge digest.","Every proof binds the exact detached-signature artifact digest.","Every proof evidence origin is FIXTURE_ONLY.","Every proof retains observedLive=false.","Every proof retains realIdentityVerified=false.","Every proof retains productionConfigured=false.","Every proof validity window is no longer than 3600 seconds.","Every proof receipt must have a valid canonical SHA-256 digest.","Every proof receipt must pass an authoritative positive verifier callback.","The confirmation scope accepts no unknown fields.","The confirmation scope binds the exact upstream receipt digest.","The confirmation scope binds the upstream transaction scope digest.","The confirmation scope binds the exact challenge digest.","The confirmation scope binds the exact signature artifact digest.","The confirmation scope binds all five ordered proof receipt digests.","The scope may record only one fixture detached-signature verification.","The confirmation scope must retain realUserConfirmed=false.","The confirmation scope must retain liveQuoteRevalidated=false.","The confirmation scope must retain budgetHeld=false.","The confirmation scope must retain hostClaimCreated=false.","The confirmation scope must retain transactionExecutable=false.","The confirmation scope must retain hostLaunchPermitted=false.","The confirmation scope must retain billingPermitted=false.","The confirmation scope must retain promotionPermitted=false.","The confirmation scope digest must validate after all ordered bindings are frozen.","The request accepts no unknown fields.","The request action and fixture-only mode are exact constants.","The request binds upstream, challenge, signature descriptor, confirmation scope and ordered proof slots.","The request nonce has a fixed digest form and can be prepared only once.","The request validity window is no longer than 30 seconds.","Only a WeakMap-backed opaque handle can project the confirmation receipt.","Projection is one-shot, disposal is idempotent and receipt verification is deterministic.","Secrets, raw signatures, payment clients, pricing clients, host providers, shell material, production composition imports and all external side effects are prohibited."],"productionPrerequisites":["A production identity provider binding the exact authenticated subject to the confirmation session.","A reviewed public-key registration and rotation policy for real user signing keys.","A real detached signature over the exact challenge digest, cost ceiling, scope and expiry.","An accessible consent presentation that shows host count, maximum cost, collection window and retirement SLA.","A fresh phishing-resistant reauthentication proof bound to the same user and challenge.","A durable one-time challenge store with replay fencing and automatic expiry.","A privacy review proving confirmation artifacts contain no unnecessary identity or credential material.","A fresh provider quote revalidated only after real confirmation succeeds.","A durable conditional budget hold with generation fencing and automatic release.","A durable idempotent host claim bound to the exact confirmed scope.","A production no-shell driver plus independently armed watchdog.","An isolated nonproduction network lease and signed immutable image/package attestations.","A witnessed instance and root-volume retirement drill within one hundred twenty seconds.","A staffed incident-response window, immutable audit storage, metrics and paging.","A separate explicit execution authorization after all real evidence is freshly reverified."],"selectedDenialTrace":{"fixtureId":"RFDHLEDUC-48","mutation":"CHALLENGE_USER_CONFIRMED","expected":"DENY","reason":"A caller cannot convert fixture detached-signature verification into real user confirmation by setting userConfirmed=true, even when the upstream intent, artifact digest and five proof shapes remain valid."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":100,"acceptedOutcomes":14,"deniedOutcomes":86,"upstreamReceiptsVerified":80,"detachedSignaturesVerified":51,"proofSignaturesVerified":162,"confirmationReceiptsVerified":3,"projectedConfirmations":14,"disposedHandles":2,"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionHostRuns":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"policyRevalidationsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-detached-user-confirmation-fixtures/v1","description":"Deterministic fixture-only detached-signature confirmation cases. No real identity, user confirmation, live quote, budget hold, claim, host, process, network client, billing or paid resource is used.","mode":"FIXTURE_DETACHED_SIGNATURE_VERIFICATION_ONLY_NO_LIVE_READ_NO_HOLD_NO_CLAIM","cases":[{"id":"RFDHLEDUC-01","mutation":"PREPARE_BASELINE","expected":"ACCEPT"},{"id":"RFDHLEDUC-02","mutation":"PROJECT_BASELINE","expected":"ACCEPT"},{"id":"RFDHLEDUC-03","mutation":"VERIFY_RECEIPT","expected":"ACCEPT"},{"id":"RFDHLEDUC-04","mutation":"VERIFY_REPLAY","expected":"ACCEPT"},{"id":"RFDHLEDUC-05","mutation":"DISPOSE_REPLAY","expected":"ACCEPT"},{"id":"RFDHLEDUC-06","mutation":"REQUEST_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHLEDUC-07","mutation":"MAXIMUM_COST_ZERO_EDGE","expected":"ACCEPT"},{"id":"RFDHLEDUC-08","mutation":"MAXIMUM_COST_CAP_EDGE","expected":"ACCEPT"},{"id":"RFDHLEDUC-09","mutation":"CHALLENGE_VALIDITY_EDGE","expected":"ACCEPT"},{"id":"RFDHLEDUC-10","mutation":"SIGNATURE_VALIDITY_EDGE","expected":"ACCEPT"},{"id":"RFDHLEDUC-11","mutation":"PROOF_VALIDITY_EDGE","expected":"ACCEPT"},{"id":"RFDHLEDUC-12","mutation":"PROJECT_OBSERVED_AT_EDGE","expected":"ACCEPT"},{"id":"RFDHLEDUC-13","mutation":"DISPOSE_AFTER_PROJECT","expected":"ACCEPT"},{"id":"RFDHLEDUC-14","mutation":"INDEPENDENT_SCOPE_CLONE","expected":"ACCEPT"},{"id":"RFDHLEDUC-15","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHLEDUC-16","mutation":"PRICING_CLIENT_KEY","expected":"DENY"},{"id":"RFDHLEDUC-17","mutation":"BUDGET_CLIENT_KEY","expected":"DENY"},{"id":"RFDHLEDUC-18","mutation":"HOST_PROVIDER_KEY","expected":"DENY"},{"id":"RFDHLEDUC-19","mutation":"CHARGE_ACCOUNT_KEY","expected":"DENY"},{"id":"RFDHLEDUC-20","mutation":"UPSTREAM_SCHEMA","expected":"DENY"},{"id":"RFDHLEDUC-21","mutation":"UPSTREAM_STATUS","expected":"DENY"},{"id":"RFDHLEDUC-22","mutation":"UPSTREAM_VERDICT","expected":"DENY"},{"id":"RFDHLEDUC-23","mutation":"UPSTREAM_MODE","expected":"DENY"},{"id":"RFDHLEDUC-24","mutation":"UPSTREAM_RECEIPT_DIGEST","expected":"DENY"},{"id":"RFDHLEDUC-25","mutation":"UPSTREAM_FACTOR_COUNT","expected":"DENY"},{"id":"RFDHLEDUC-26","mutation":"UPSTREAM_FACTORS_VERIFIED","expected":"DENY"},{"id":"RFDHLEDUC-27","mutation":"UPSTREAM_REAL_CONFIRMATION","expected":"DENY"},{"id":"RFDHLEDUC-28","mutation":"UPSTREAM_HOST_COUNT","expected":"DENY"},{"id":"RFDHLEDUC-29","mutation":"UPSTREAM_MAX_COST","expected":"DENY"},{"id":"RFDHLEDUC-30","mutation":"UPSTREAM_LIVE_QUOTE","expected":"DENY"},{"id":"RFDHLEDUC-31","mutation":"UPSTREAM_BUDGET_HOLD","expected":"DENY"},{"id":"RFDHLEDUC-32","mutation":"UPSTREAM_HOST_CLAIM","expected":"DENY"},{"id":"RFDHLEDUC-33","mutation":"UPSTREAM_HOST_RUN","expected":"DENY"},{"id":"RFDHLEDUC-34","mutation":"UPSTREAM_PAID_RESOURCE","expected":"DENY"},{"id":"RFDHLEDUC-35","mutation":"UPSTREAM_EXPIRED","expected":"DENY"},{"id":"RFDHLEDUC-36","mutation":"UPSTREAM_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHLEDUC-37","mutation":"UPSTREAM_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHLEDUC-38","mutation":"CHALLENGE_SCHEMA","expected":"DENY"},{"id":"RFDHLEDUC-39","mutation":"CHALLENGE_UPSTREAM","expected":"DENY"},{"id":"RFDHLEDUC-40","mutation":"CHALLENGE_ID","expected":"DENY"},{"id":"RFDHLEDUC-41","mutation":"CHALLENGE_TRANSACTION_SCOPE","expected":"DENY"},{"id":"RFDHLEDUC-42","mutation":"CHALLENGE_PURPOSE","expected":"DENY"},{"id":"RFDHLEDUC-43","mutation":"CHALLENGE_SUBJECT_REF","expected":"DENY"},{"id":"RFDHLEDUC-44","mutation":"CHALLENGE_HOST_COUNT","expected":"DENY"},{"id":"RFDHLEDUC-45","mutation":"CHALLENGE_MAX_COST_OVER","expected":"DENY"},{"id":"RFDHLEDUC-46","mutation":"CHALLENGE_CURRENCY","expected":"DENY"},{"id":"RFDHLEDUC-47","mutation":"CHALLENGE_SINGLE_USE_FALSE","expected":"DENY"},{"id":"RFDHLEDUC-48","mutation":"CHALLENGE_USER_CONFIRMED","expected":"DENY"},{"id":"RFDHLEDUC-49","mutation":"CHALLENGE_REAL_SIGNATURE","expected":"DENY"},{"id":"RFDHLEDUC-50","mutation":"CHALLENGE_EXTERNAL_URL","expected":"DENY"},{"id":"RFDHLEDUC-51","mutation":"CHALLENGE_NOT_YET_VALID","expected":"DENY"},{"id":"RFDHLEDUC-52","mutation":"CHALLENGE_EXPIRED","expected":"DENY"},{"id":"RFDHLEDUC-53","mutation":"CHALLENGE_DIGEST","expected":"DENY"},{"id":"RFDHLEDUC-54","mutation":"CHALLENGE_EXTRA_KEY","expected":"DENY"},{"id":"RFDHLEDUC-55","mutation":"SIGNATURE_SCHEMA","expected":"DENY"},{"id":"RFDHLEDUC-56","mutation":"SIGNATURE_ALGORITHM","expected":"DENY"},{"id":"RFDHLEDUC-57","mutation":"SIGNATURE_KEY","expected":"DENY"},{"id":"RFDHLEDUC-58","mutation":"SIGNATURE_CHALLENGE","expected":"DENY"},{"id":"RFDHLEDUC-59","mutation":"SIGNATURE_ARTIFACT_DIGEST","expected":"DENY"},{"id":"RFDHLEDUC-60","mutation":"SIGNATURE_ORIGIN","expected":"DENY"},{"id":"RFDHLEDUC-61","mutation":"SIGNATURE_OBSERVED_LIVE","expected":"DENY"},{"id":"RFDHLEDUC-62","mutation":"SIGNATURE_REAL_OBSERVED","expected":"DENY"},{"id":"RFDHLEDUC-63","mutation":"SIGNATURE_PRODUCTION_CONFIGURED","expected":"DENY"},{"id":"RFDHLEDUC-64","mutation":"SIGNATURE_EXPIRED","expected":"DENY"},{"id":"RFDHLEDUC-65","mutation":"SIGNATURE_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHLEDUC-66","mutation":"SIGNATURE_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHLEDUC-67","mutation":"PROOF_COUNT","expected":"DENY"},{"id":"RFDHLEDUC-68","mutation":"PROOF_ORDER","expected":"DENY"},{"id":"RFDHLEDUC-69","mutation":"PROOF_SLOT","expected":"DENY"},{"id":"RFDHLEDUC-70","mutation":"PROOF_DECISION","expected":"DENY"},{"id":"RFDHLEDUC-71","mutation":"PROOF_AUTHORITY","expected":"DENY"},{"id":"RFDHLEDUC-72","mutation":"PROOF_SIGNER","expected":"DENY"},{"id":"RFDHLEDUC-73","mutation":"PROOF_MODE","expected":"DENY"},{"id":"RFDHLEDUC-74","mutation":"PROOF_UPSTREAM","expected":"DENY"},{"id":"RFDHLEDUC-75","mutation":"PROOF_CHALLENGE","expected":"DENY"},{"id":"RFDHLEDUC-76","mutation":"PROOF_SIGNATURE","expected":"DENY"},{"id":"RFDHLEDUC-77","mutation":"PROOF_OBSERVED_LIVE","expected":"DENY"},{"id":"RFDHLEDUC-78","mutation":"PROOF_REAL_IDENTITY","expected":"DENY"},{"id":"RFDHLEDUC-79","mutation":"PROOF_PRODUCTION_CONFIGURED","expected":"DENY"},{"id":"RFDHLEDUC-80","mutation":"PROOF_EXPIRED","expected":"DENY"},{"id":"RFDHLEDUC-81","mutation":"PROOF_DIGEST","expected":"DENY"},{"id":"RFDHLEDUC-82","mutation":"PROOF_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHLEDUC-83","mutation":"PROOF_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHLEDUC-84","mutation":"REQUEST_SCHEMA","expected":"DENY"},{"id":"RFDHLEDUC-85","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHLEDUC-86","mutation":"REQUEST_MODE","expected":"DENY"},{"id":"RFDHLEDUC-87","mutation":"REQUEST_UPSTREAM","expected":"DENY"},{"id":"RFDHLEDUC-88","mutation":"REQUEST_CHALLENGE","expected":"DENY"},{"id":"RFDHLEDUC-89","mutation":"REQUEST_SIGNATURE","expected":"DENY"},{"id":"RFDHLEDUC-90","mutation":"REQUEST_SCOPE","expected":"DENY"},{"id":"RFDHLEDUC-91","mutation":"REQUEST_SLOT_ORDER","expected":"DENY"},{"id":"RFDHLEDUC-92","mutation":"REQUEST_NONCE_INVALID","expected":"DENY"},{"id":"RFDHLEDUC-93","mutation":"REQUEST_EXPIRED","expected":"DENY"},{"id":"RFDHLEDUC-94","mutation":"REQUEST_WINDOW_LONG","expected":"DENY"},{"id":"RFDHLEDUC-95","mutation":"REQUEST_REPLAY","expected":"DENY"},{"id":"RFDHLEDUC-96","mutation":"RECONSTRUCTED_HANDLE","expected":"DENY"},{"id":"RFDHLEDUC-97","mutation":"DISPOSED_HANDLE","expected":"DENY"},{"id":"RFDHLEDUC-98","mutation":"PROJECT_REPLAY","expected":"DENY"},{"id":"RFDHLEDUC-99","mutation":"EXPIRED_HANDLE","expected":"DENY"},{"id":"RFDHLEDUC-100","mutation":"RECEIPT_REAL_CONFIRMATION","expected":"DENY"}],"networkRequestsExecuted":0,"pricingReadsExecuted":0,"realIdentityVerificationsExecuted":0,"userConfirmationsExecuted":0,"budgetHoldsExecuted":0,"hostClaimsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false}},"disposableHostLiveEvidenceCollectionQuoteBudgetClaimTransactionPlan":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-quote-budget-claim-transaction-plan-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_QUOTE_BUDGET_CLAIM_TRANSACTION_PLAN_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T13:05:00Z","scope":{"mode":"FIXTURE_QUOTE_BUDGET_CLAIM_PLAN_ONLY_NO_PROVIDER_READ_NO_DURABLE_WRITE_NO_HOST_CLAIM","input":"POSITIVELY_VERIFIED_FIXTURE_DETACHED_USER_CONFIRMATION_RECEIPT","output":"QUOTE_BUDGET_CLAIM_TRANSACTION_PLAN_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_REAL_CONFIRMATION_LIVE_QUOTE_DURABLE_HOLD_CLAIM_COMMIT_AND_EXECUTION_AUTHORIZATION","fixturePlanStepsVerified":5,"realIdentityVerified":false,"realUserConfirmed":false,"liveQuoteRead":false,"budgetHoldCreated":false,"hostClaimCreated":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-detached-user-confirmation-receipt/v1","status":"DETACHED_USER_CONFIRMATION_VERIFIED_FIXTURE_ONLY","verdict":"REQUIRES_FRESH_QUOTE_BUDGET_HOLD_HOST_CLAIM_AND_EXECUTION_AUTHORIZATION","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"detached-confirmation receipt + economic scope + five plan-step receipts + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only quote/budget/claim transaction-plan receipt","sideEffect":"NONE"},{"id":"verify","input":"quote/budget/claim transaction-plan receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"planSteps":[{"ordinal":1,"step":"FRESH_PRICE_QUOTE_READ_PLAN","authority":"PRICING_AUTHORITY","signerKeyId":"fixture-p256-pricing-authority","effect":"DESCRIBE_FRESH_PROVIDER_QUOTE","observedLive":false},{"ordinal":2,"step":"QUOTE_FRESHNESS_REVALIDATION_PLAN","authority":"COST_POLICY_OWNER","signerKeyId":"fixture-p256-cost-policy-owner","effect":"REVALIDATE_QUOTE_AGE_AND_SCOPE","observedLive":false},{"ordinal":3,"step":"CONDITIONAL_BUDGET_HOLD_PLAN","authority":"BUDGET_AUTHORITY","signerKeyId":"fixture-p256-budget-authority","effect":"CONDITIONALLY_CREATE_BUDGET_HOLD","observedLive":false},{"ordinal":4,"step":"IDEMPOTENT_HOST_CLAIM_PLAN","authority":"CAPACITY_AUTHORITY","signerKeyId":"fixture-p256-capacity-authority","effect":"IDEMPOTENTLY_CREATE_HOST_CLAIM","observedLive":false},{"ordinal":5,"step":"HOLD_AND_CLAIM_COMPENSATION_PLAN","authority":"RESERVATION_SAFETY_OWNER","signerKeyId":"fixture-p256-reservation-safety-owner","effect":"RELEASE_HOLD_AND_CLAIM_ON_FAILURE","observedLive":false}],"authorityTopology":[{"authority":"PRICING_AUTHORITY","steps":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayExecute":false},{"authority":"COST_POLICY_OWNER","steps":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayExecute":false},{"authority":"BUDGET_AUTHORITY","steps":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayExecute":false},{"authority":"CAPACITY_AUTHORITY","steps":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayExecute":false},{"authority":"RESERVATION_SAFETY_OWNER","steps":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayExecute":false}],"transactionGuardrails":{"requestValiditySeconds":30,"planShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"currency":"USD","quoteMaxAgeSeconds":300,"holdTtlSeconds":900,"claimTtlSeconds":900,"collectionWindowSeconds":600,"retirementSlaSeconds":120,"atomicOrdering":"QUOTE_THEN_HOLD_THEN_CLAIM","failurePolicy":"RELEASE_HOLD_AND_CLAIM_OR_CONTAIN","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","realIdentityVerified":false,"realUserConfirmed":false,"liveQuoteRead":false,"budgetHoldCreated":false,"hostClaimCreated":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_VERIFIED","ECONOMIC_SCOPE_BOUND","QUOTE_READ_PLAN_VERIFIED","QUOTE_FRESHNESS_PLAN_VERIFIED","BUDGET_HOLD_PLAN_VERIFIED","HOST_CLAIM_PLAN_VERIFIED","COMPENSATION_PLAN_VERIFIED","ORDERING_FROZEN","IDEMPOTENCY_BOUND","ATOMICITY_POLICY_BOUND","ROLLBACK_POLICY_BOUND","PLAN_PREPARED_FIXTURE_ONLY","PLAN_RECEIPT_VERIFIED","DENIED_OR_DISPOSED"],"invariants":["Only the exact unexpired DETACHED_USER_CONFIRMATION_VERIFIED_FIXTURE_ONLY receipt is accepted.","The upstream detached-confirmation receipt must pass an authoritative positive verifier callback.","The upstream receipt identity must be deterministically derived from its bound intent, challenge, scope, nonce and request time.","The upstream receipt status, verdict and fixture-only mode cannot be upgraded by callers.","The upstream receipt must contain exactly five confirmation proof slots and five receipt digests.","The upstream receipt must report one fixture detached-signature verification and five fixture proof verifications.","The upstream receipt must report zero real user confirmations.","The upstream receipt must report zero live quotes, durable budget holds and durable host claims.","The upstream receipt must report zero production host runs and paid resources.","The upstream requestedAt, observedAt and expiresAt ordering must contain the current clock.","The economic scope accepts no unknown fields.","The economic scope binds the exact upstream detached-confirmation receipt digest.","The economic scope binds the exact upstream confirmation scope digest.","The economic scope is bounded to one host.","The maximum cost ceiling is an integer from zero through 500 milli-USD.","The transaction currency is exactly USD.","The maximum quote age is exactly 300 seconds.","The planned budget-hold TTL is exactly 900 seconds.","The planned host-claim TTL is exactly 900 seconds.","The collection window is exactly 600 seconds.","The retirement SLA is exactly 120 seconds.","The only permitted ordering is QUOTE_THEN_HOLD_THEN_CLAIM.","The only permitted failure policy is RELEASE_HOLD_AND_CLAIM_OR_CONTAIN.","The economic scope must retain liveQuoteRead=false.","The economic scope must retain budgetHoldCreated=false.","The economic scope must retain hostClaimCreated=false.","The economic scope must retain transactionExecutable=false.","The scope must deny launch, billing and promotion authority.","Exactly five ordered plan-step receipts are required.","Plan-step order and ordinal values are immutable.","Every plan step is owned by its exact independent authority.","Every plan step is pinned to its exact fixture signer key.","Every plan step uses its exact allowlisted effect description.","Every plan decision is PLAN_VERIFIED_FIXTURE_ONLY.","Every plan mode denies provider reads, durable writes and host claims.","Every plan step binds the exact upstream confirmation receipt digest.","Every plan step binds the exact economic scope digest.","The first predecessor is the upstream receipt digest.","Every later predecessor is the immediately previous plan-step receipt digest.","Every plan step binds a digest-only idempotency key.","Every plan-step evidence origin is FIXTURE_ONLY.","Every plan step retains effectExecuted=false.","Every plan step retains providerReadExecuted=false.","Every plan step retains durableWriteExecuted=false.","Every plan step retains hostClaimExecuted=false.","Every plan step retains productionConfigured=false.","Every plan-step validity window is no longer than 3600 seconds.","Every plan-step receipt must have a valid canonical SHA-256 digest.","Every plan-step receipt must pass an authoritative positive verifier callback.","The request accepts no unknown fields.","The request action and fixture-only plan mode are exact constants.","The request binds the exact upstream confirmation receipt digest.","The request binds the exact economic scope digest.","The request binds all five ordered plan-step names.","The request binds all five ordered plan-step receipt digests.","The request nonce has a fixed digest form and can be prepared only once.","The request validity window is no longer than 30 seconds.","Only a WeakMap-backed opaque handle can project the plan receipt.","Projection is one-shot and an expired handle is rejected.","Disposal is idempotent and receipt verification is deterministic.","The projected receipt reports exactly five fixture plan steps.","The projected receipt reports zero real identity verifications.","The projected receipt reports zero real user confirmations.","The projected receipt reports zero live provider quotes.","The projected receipt reports zero durable budget holds.","The projected receipt reports zero durable host claims.","The projected receipt reports zero production drivers and watchdog armings.","The projected receipt reports zero network leases and image attestations.","The projected receipt reports zero retirement drills and incident windows.","The projected receipt reports zero production host runs and host claims.","The projected receipt reports zero processes, host contacts and package loads.","The projected receipt reports zero pricing reads and external reads.","The projected receipt reports zero external writes and mutations.","The projected receipt reports zero services, listeners, proxies and public routes.","The projected receipt grants no transaction, launch, billing or promotion authority.","The projected receipt cannot claim a paid resource.","Provider, pricing, budget, capacity, payment and host clients are prohibited from the packet.","Secrets, raw credentials, commands, shells, executable callbacks and production composition imports are prohibited."],"productionPrerequisites":["A real production identity and user-confirmation receipt bound to the exact transaction scope.","A reviewed provider-pricing adapter with explicit read-only IAM and regional SKU allowlists.","A fresh signed provider quote returned after real confirmation and no older than three hundred seconds.","An independent cost-policy verifier binding currency, quantity, maximum cost and expiry.","A durable budget ledger with generation fencing and an immutable account/project scope.","A conditional budget-hold write with one idempotency key and no double reservation.","Automatic budget-hold expiry plus a witnessed manual and automatic release drill.","A durable capacity ledger with generation fencing and one-host global-limit enforcement.","An idempotent host claim bound to quote, hold, confirmation and exact release identity.","An atomic coordinator that never creates a claim before the quote and budget hold are valid.","A compensation coordinator that releases both hold and claim or enters a paged contained state.","A production no-shell driver plus an independently armed watchdog.","An isolated nonproduction network lease and signed immutable image/package attestations.","A witnessed instance and root-volume retirement drill within one hundred twenty seconds.","Immutable audit storage, transaction metrics, paging and a staffed incident-response window.","A separate explicit execution authorization after quote, hold and claim are freshly reverified."],"selectedDenialTrace":{"fixtureId":"RFDHLEQBCP-55","mutation":"SCOPE_BUDGET_HOLD_CREATED","expected":"DENY","reason":"A caller cannot turn a fixture transaction plan into a durable budget reservation by setting budgetHoldCreated=true; no quote, hold, claim or execution capability is issued."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":104,"acceptedOutcomes":14,"deniedOutcomes":90,"upstreamReceiptsVerified":81,"planStepReceiptsVerified":172,"planReceiptsVerified":3,"projectedPlans":17,"disposedHandles":2,"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionHostRuns":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"policyRevalidationsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-quote-budget-claim-transaction-plan-fixtures/v1","description":"Deterministic fixture-only quote, budget-hold and host-claim transaction-plan cases. No real identity, user confirmation, provider quote read, durable write, host claim, host launch, billing or paid resource is used.","networkRequestsExecuted":0,"pricingReadsExecuted":0,"realIdentityVerificationsExecuted":0,"userConfirmationsExecuted":0,"budgetHoldsExecuted":0,"hostClaimsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFDHLEQBCP-01","expected":"ACCEPT","mutation":"PREPARE_BASELINE"},{"id":"RFDHLEQBCP-02","expected":"ACCEPT","mutation":"PROJECT_BASELINE"},{"id":"RFDHLEQBCP-03","expected":"ACCEPT","mutation":"VERIFY_RECEIPT"},{"id":"RFDHLEQBCP-04","expected":"ACCEPT","mutation":"VERIFY_REPLAY"},{"id":"RFDHLEQBCP-05","expected":"ACCEPT","mutation":"DISPOSE_REPLAY"},{"id":"RFDHLEQBCP-06","expected":"ACCEPT","mutation":"REQUEST_WINDOW_EDGE"},{"id":"RFDHLEQBCP-07","expected":"ACCEPT","mutation":"MAX_COST_ZERO_EDGE"},{"id":"RFDHLEQBCP-08","expected":"ACCEPT","mutation":"MAX_COST_CAP_EDGE"},{"id":"RFDHLEQBCP-09","expected":"ACCEPT","mutation":"STEP_VALIDITY_EDGE"},{"id":"RFDHLEQBCP-10","expected":"ACCEPT","mutation":"PROJECT_OBSERVED_AT_EDGE"},{"id":"RFDHLEQBCP-11","expected":"ACCEPT","mutation":"DISPOSE_AFTER_PROJECT"},{"id":"RFDHLEQBCP-12","expected":"ACCEPT","mutation":"INDEPENDENT_SCOPE_CLONE"},{"id":"RFDHLEQBCP-13","expected":"ACCEPT","mutation":"UPSTREAM_COST_ZERO_EDGE"},{"id":"RFDHLEQBCP-14","expected":"ACCEPT","mutation":"QUOTE_MAX_AGE_EXACT"},{"id":"RFDHLEQBCP-15","expected":"DENY","mutation":"EXECUTABLE_KEY"},{"id":"RFDHLEQBCP-16","expected":"DENY","mutation":"PRICING_CLIENT_KEY"},{"id":"RFDHLEQBCP-17","expected":"DENY","mutation":"BUDGET_CLIENT_KEY"},{"id":"RFDHLEQBCP-18","expected":"DENY","mutation":"CAPACITY_CLIENT_KEY"},{"id":"RFDHLEQBCP-19","expected":"DENY","mutation":"HOST_PROVIDER_KEY"},{"id":"RFDHLEQBCP-20","expected":"DENY","mutation":"PAYMENT_CLIENT_KEY"},{"id":"RFDHLEQBCP-21","expected":"DENY","mutation":"READ_PRICE_KEY"},{"id":"RFDHLEQBCP-22","expected":"DENY","mutation":"CLAIM_HOST_KEY"},{"id":"RFDHLEQBCP-23","expected":"DENY","mutation":"UPSTREAM_SCHEMA"},{"id":"RFDHLEQBCP-24","expected":"DENY","mutation":"UPSTREAM_STATUS"},{"id":"RFDHLEQBCP-25","expected":"DENY","mutation":"UPSTREAM_VERDICT"},{"id":"RFDHLEQBCP-26","expected":"DENY","mutation":"UPSTREAM_MODE"},{"id":"RFDHLEQBCP-27","expected":"DENY","mutation":"UPSTREAM_RECEIPT_DIGEST"},{"id":"RFDHLEQBCP-28","expected":"DENY","mutation":"UPSTREAM_PROOF_COUNT"},{"id":"RFDHLEQBCP-29","expected":"DENY","mutation":"UPSTREAM_PROOFS_VERIFIED"},{"id":"RFDHLEQBCP-30","expected":"DENY","mutation":"UPSTREAM_REAL_CONFIRMATION"},{"id":"RFDHLEQBCP-31","expected":"DENY","mutation":"UPSTREAM_HOST_COUNT"},{"id":"RFDHLEQBCP-32","expected":"DENY","mutation":"UPSTREAM_MAX_COST"},{"id":"RFDHLEQBCP-33","expected":"DENY","mutation":"UPSTREAM_LIVE_QUOTE"},{"id":"RFDHLEQBCP-34","expected":"DENY","mutation":"UPSTREAM_BUDGET_HOLD"},{"id":"RFDHLEQBCP-35","expected":"DENY","mutation":"UPSTREAM_HOST_CLAIM"},{"id":"RFDHLEQBCP-36","expected":"DENY","mutation":"UPSTREAM_HOST_RUN"},{"id":"RFDHLEQBCP-37","expected":"DENY","mutation":"UPSTREAM_PAID_RESOURCE"},{"id":"RFDHLEQBCP-38","expected":"DENY","mutation":"UPSTREAM_EXPIRED"},{"id":"RFDHLEQBCP-39","expected":"DENY","mutation":"UPSTREAM_VERIFIER_FALSE"},{"id":"RFDHLEQBCP-40","expected":"DENY","mutation":"UPSTREAM_VERIFIER_THROW"},{"id":"RFDHLEQBCP-41","expected":"DENY","mutation":"SCOPE_SCHEMA"},{"id":"RFDHLEQBCP-42","expected":"DENY","mutation":"SCOPE_UPSTREAM"},{"id":"RFDHLEQBCP-43","expected":"DENY","mutation":"SCOPE_CONFIRMATION_SCOPE"},{"id":"RFDHLEQBCP-44","expected":"DENY","mutation":"SCOPE_HOST_COUNT"},{"id":"RFDHLEQBCP-45","expected":"DENY","mutation":"SCOPE_MAX_COST_OVER"},{"id":"RFDHLEQBCP-46","expected":"DENY","mutation":"SCOPE_CURRENCY"},{"id":"RFDHLEQBCP-47","expected":"DENY","mutation":"SCOPE_QUOTE_AGE"},{"id":"RFDHLEQBCP-48","expected":"DENY","mutation":"SCOPE_HOLD_TTL"},{"id":"RFDHLEQBCP-49","expected":"DENY","mutation":"SCOPE_CLAIM_TTL"},{"id":"RFDHLEQBCP-50","expected":"DENY","mutation":"SCOPE_COLLECTION_WINDOW"},{"id":"RFDHLEQBCP-51","expected":"DENY","mutation":"SCOPE_RETIREMENT_SLA"},{"id":"RFDHLEQBCP-52","expected":"DENY","mutation":"SCOPE_ORDERING"},{"id":"RFDHLEQBCP-53","expected":"DENY","mutation":"SCOPE_FAILURE_POLICY"},{"id":"RFDHLEQBCP-54","expected":"DENY","mutation":"SCOPE_LIVE_QUOTE"},{"id":"RFDHLEQBCP-55","expected":"DENY","mutation":"SCOPE_BUDGET_HOLD_CREATED"},{"id":"RFDHLEQBCP-56","expected":"DENY","mutation":"SCOPE_HOST_CLAIM_CREATED"},{"id":"RFDHLEQBCP-57","expected":"DENY","mutation":"SCOPE_EXECUTABLE"},{"id":"RFDHLEQBCP-58","expected":"DENY","mutation":"SCOPE_LAUNCH"},{"id":"RFDHLEQBCP-59","expected":"DENY","mutation":"SCOPE_BILLING"},{"id":"RFDHLEQBCP-60","expected":"DENY","mutation":"SCOPE_PROMOTION"},{"id":"RFDHLEQBCP-61","expected":"DENY","mutation":"SCOPE_DIGEST"},{"id":"RFDHLEQBCP-62","expected":"DENY","mutation":"STEP_COUNT"},{"id":"RFDHLEQBCP-63","expected":"DENY","mutation":"STEP_ORDER"},{"id":"RFDHLEQBCP-64","expected":"DENY","mutation":"STEP_ORDINAL"},{"id":"RFDHLEQBCP-65","expected":"DENY","mutation":"STEP_NAME"},{"id":"RFDHLEQBCP-66","expected":"DENY","mutation":"STEP_DECISION"},{"id":"RFDHLEQBCP-67","expected":"DENY","mutation":"STEP_AUTHORITY"},{"id":"RFDHLEQBCP-68","expected":"DENY","mutation":"STEP_SIGNER"},{"id":"RFDHLEQBCP-69","expected":"DENY","mutation":"STEP_MODE"},{"id":"RFDHLEQBCP-70","expected":"DENY","mutation":"STEP_EFFECT"},{"id":"RFDHLEQBCP-71","expected":"DENY","mutation":"STEP_UPSTREAM"},{"id":"RFDHLEQBCP-72","expected":"DENY","mutation":"STEP_SCOPE"},{"id":"RFDHLEQBCP-73","expected":"DENY","mutation":"STEP_PREDECESSOR"},{"id":"RFDHLEQBCP-74","expected":"DENY","mutation":"STEP_IDEMPOTENCY"},{"id":"RFDHLEQBCP-75","expected":"DENY","mutation":"STEP_ORIGIN"},{"id":"RFDHLEQBCP-76","expected":"DENY","mutation":"STEP_EFFECT_EXECUTED"},{"id":"RFDHLEQBCP-77","expected":"DENY","mutation":"STEP_PROVIDER_READ"},{"id":"RFDHLEQBCP-78","expected":"DENY","mutation":"STEP_DURABLE_WRITE"},{"id":"RFDHLEQBCP-79","expected":"DENY","mutation":"STEP_HOST_CLAIM"},{"id":"RFDHLEQBCP-80","expected":"DENY","mutation":"STEP_PRODUCTION_CONFIGURED"},{"id":"RFDHLEQBCP-81","expected":"DENY","mutation":"STEP_EXPIRED"},{"id":"RFDHLEQBCP-82","expected":"DENY","mutation":"STEP_WINDOW_LONG"},{"id":"RFDHLEQBCP-83","expected":"DENY","mutation":"STEP_DIGEST"},{"id":"RFDHLEQBCP-84","expected":"DENY","mutation":"STEP_VERIFIER_FALSE"},{"id":"RFDHLEQBCP-85","expected":"DENY","mutation":"STEP_VERIFIER_THROW"},{"id":"RFDHLEQBCP-86","expected":"DENY","mutation":"REQUEST_SCHEMA"},{"id":"RFDHLEQBCP-87","expected":"DENY","mutation":"REQUEST_ACTION"},{"id":"RFDHLEQBCP-88","expected":"DENY","mutation":"REQUEST_MODE"},{"id":"RFDHLEQBCP-89","expected":"DENY","mutation":"REQUEST_UPSTREAM"},{"id":"RFDHLEQBCP-90","expected":"DENY","mutation":"REQUEST_SCOPE"},{"id":"RFDHLEQBCP-91","expected":"DENY","mutation":"REQUEST_STEP_ORDER"},{"id":"RFDHLEQBCP-92","expected":"DENY","mutation":"REQUEST_DIGESTS"},{"id":"RFDHLEQBCP-93","expected":"DENY","mutation":"REQUEST_NONCE_INVALID"},{"id":"RFDHLEQBCP-94","expected":"DENY","mutation":"REQUEST_EXPIRED"},{"id":"RFDHLEQBCP-95","expected":"DENY","mutation":"REQUEST_WINDOW_LONG"},{"id":"RFDHLEQBCP-96","expected":"DENY","mutation":"REQUEST_REPLAY"},{"id":"RFDHLEQBCP-97","expected":"DENY","mutation":"RECONSTRUCTED_HANDLE"},{"id":"RFDHLEQBCP-98","expected":"DENY","mutation":"DISPOSED_HANDLE"},{"id":"RFDHLEQBCP-99","expected":"DENY","mutation":"PROJECT_REPLAY"},{"id":"RFDHLEQBCP-100","expected":"DENY","mutation":"EXPIRED_HANDLE"},{"id":"RFDHLEQBCP-101","expected":"DENY","mutation":"RECEIPT_LIVE_QUOTE"},{"id":"RFDHLEQBCP-102","expected":"DENY","mutation":"RECEIPT_BUDGET_HOLD"},{"id":"RFDHLEQBCP-103","expected":"DENY","mutation":"RECEIPT_HOST_CLAIM"},{"id":"RFDHLEQBCP-104","expected":"DENY","mutation":"RECEIPT_EXECUTABLE"}]}},"disposableHostLiveEvidenceCollectionAtomicTransactionCommitAdmission":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-atomic-transaction-commit-admission-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_ATOMIC_TRANSACTION_COMMIT_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T13:10:00Z","scope":{"mode":"FIXTURE_ATOMIC_COMMIT_ADMISSION_ONLY_NO_PROVIDER_READ_NO_DURABLE_WRITE_NO_HOST_CLAIM","input":"POSITIVELY_VERIFIED_FIXTURE_QUOTE_BUDGET_CLAIM_TRANSACTION_PLAN_RECEIPT","output":"ATOMIC_TRANSACTION_COMMIT_ADMISSION_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_REAL_CONFIRMATION_LIVE_QUOTE_DURABLE_HOLD_CLAIM_AND_SEPARATE_EXECUTION_AUTHORIZATION","fixtureAdmissionShapesVerified":5,"realIdentityVerified":false,"realUserConfirmed":false,"liveQuoteRead":false,"budgetHoldCreated":false,"hostClaimCreated":false,"atomicCoordinatorConfigured":false,"transactionCommitted":false,"executionAuthorized":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-quote-budget-claim-transaction-plan-receipt/v1","status":"QUOTE_BUDGET_CLAIM_TRANSACTION_PLAN_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_REAL_CONFIRMATION_LIVE_QUOTE_DURABLE_HOLD_CLAIM_COMMIT_AND_EXECUTION_AUTHORIZATION","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"transaction-plan receipt + commit-admission dossier + five admission-shape receipts + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only atomic commit-admission receipt","sideEffect":"NONE"},{"id":"verify","input":"atomic commit-admission receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"admissionSlots":[{"ordinal":1,"slot":"DETACHED_REAL_CONFIRMATION_RECEIPT_ADMISSION","authority":"IDENTITY_CONFIRMATION_AUTHORITY","signerKeyId":"fixture-p256-identity-confirmation-authority","requiredBinding":"BIND_REAL_CONFIRMATION_TO_EXACT_SCOPE","observedLive":false},{"ordinal":2,"slot":"FRESH_PROVIDER_QUOTE_RECEIPT_ADMISSION","authority":"PRICING_AUTHORITY","signerKeyId":"fixture-p256-pricing-authority","requiredBinding":"BIND_FRESH_QUOTE_TO_REGION_SKU_AND_CEILING","observedLive":false},{"ordinal":3,"slot":"DURABLE_BUDGET_HOLD_RECEIPT_ADMISSION","authority":"BUDGET_AUTHORITY","signerKeyId":"fixture-p256-budget-authority","requiredBinding":"BIND_DURABLE_HOLD_TO_QUOTE_AND_SCOPE","observedLive":false},{"ordinal":4,"slot":"DURABLE_HOST_CLAIM_RECEIPT_ADMISSION","authority":"CAPACITY_AUTHORITY","signerKeyId":"fixture-p256-capacity-authority","requiredBinding":"BIND_DURABLE_CLAIM_TO_QUOTE_HOLD_AND_SCOPE","observedLive":false},{"ordinal":5,"slot":"ATOMIC_COORDINATOR_COMPENSATION_RECEIPT_ADMISSION","authority":"TRANSACTION_SAFETY_OWNER","signerKeyId":"fixture-p256-transaction-safety-owner","requiredBinding":"PROVE_ORDERED_COMMIT_AND_COMPENSATION_READINESS","observedLive":false}],"authorityTopology":[{"authority":"IDENTITY_CONFIRMATION_AUTHORITY","slots":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayCommit":false,"mayExecute":false},{"authority":"PRICING_AUTHORITY","slots":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayCommit":false,"mayExecute":false},{"authority":"BUDGET_AUTHORITY","slots":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayCommit":false,"mayExecute":false},{"authority":"CAPACITY_AUTHORITY","slots":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayCommit":false,"mayExecute":false},{"authority":"TRANSACTION_SAFETY_OWNER","slots":1,"mayReadProvider":false,"mayReserveBudget":false,"mayClaimHost":false,"mayCommit":false,"mayExecute":false}],"transactionGuardrails":{"requestValiditySeconds":30,"admissionShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"currency":"USD","quoteMaxAgeSeconds":300,"holdTtlSeconds":900,"claimTtlSeconds":900,"commitOrdering":"CONFIRMATION_THEN_QUOTE_THEN_HOLD_THEN_CLAIM_THEN_COMMIT","failurePolicy":"RELEASE_HOLD_AND_CLAIM_OR_CONTAIN","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","realIdentityVerified":false,"realUserConfirmed":false,"liveQuoteRead":false,"budgetHoldCreated":false,"hostClaimCreated":false,"transactionCommitted":false,"executionAuthorized":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_PLAN_VERIFIED","COMMIT_DOSSIER_BOUND","CONFIRMATION_RECEIPT_SHAPE_VERIFIED","QUOTE_RECEIPT_SHAPE_VERIFIED","BUDGET_HOLD_RECEIPT_SHAPE_VERIFIED","HOST_CLAIM_RECEIPT_SHAPE_VERIFIED","COORDINATOR_COMPENSATION_SHAPE_VERIFIED","ORDERING_FROZEN","IDEMPOTENCY_BOUND","ATOMICITY_POLICY_BOUND","COMPENSATION_POLICY_BOUND","ADMISSION_PREPARED_FIXTURE_ONLY","ADMISSION_RECEIPT_PROJECTED","ADMISSION_RECEIPT_VERIFIED","DENIED_OR_DISPOSED"],"invariants":["Only the exact unexpired fixture quote/budget/claim transaction-plan receipt is accepted.","The upstream transaction-plan receipt must pass an authoritative positive verifier callback.","The upstream plan identity is deterministically derived from confirmation, economic scope, nonce and request time.","The upstream status, verdict and fixture-only mode cannot be upgraded by callers.","The upstream receipt must retain exactly five plan steps and five plan receipt digests.","The upstream receipt must report zero real confirmation, quote, hold, claim and execution effects.","The upstream host count and cost ceiling remain bounded to one host and 500 milli-USD.","The upstream currency, quote age and hold/claim TTL values are exact constants.","The upstream receipt must contain the current clock within its validity window.","The upstream receipt must have a valid canonical SHA-256 digest.","The commit-admission dossier accepts no unknown fields.","The dossier binds the exact upstream transaction-plan receipt digest.","The dossier binds the exact confirmation scope digest.","The dossier binds the exact economic scope digest.","The dossier is bounded to exactly one host.","The dossier cost ceiling is an integer from zero through 500 milli-USD.","The dossier currency is exactly USD.","The dossier maximum quote age is exactly 300 seconds.","The dossier budget-hold TTL is exactly 900 seconds.","The dossier host-claim TTL is exactly 900 seconds.","The only commit order is CONFIRMATION_THEN_QUOTE_THEN_HOLD_THEN_CLAIM_THEN_COMMIT.","The only failure policy is RELEASE_HOLD_AND_CLAIM_OR_CONTAIN.","The dossier must retain realConfirmationReceiptPresent=false.","The dossier must retain liveQuoteReceiptPresent=false.","The dossier must retain durableBudgetHoldReceiptPresent=false.","The dossier must retain durableHostClaimReceiptPresent=false.","The dossier must retain atomicCoordinatorConfigured=false.","The dossier must retain compensationVerified=false.","The dossier must retain transactionCommitPermitted=false.","The dossier must retain executionPermitted=false.","Exactly five ordered commit-admission shape receipts are required.","Admission-slot order and ordinal values are immutable.","Every admission slot is owned by its exact independent authority.","Every admission slot is pinned to its exact fixture signer key.","Every admission slot uses its exact allowlisted required binding.","Every admission decision is ADMISSION_SHAPE_VERIFIED_FIXTURE_ONLY.","Every admission mode denies real receipts and durable effects.","Every admission slot binds the exact upstream transaction-plan receipt digest.","Every admission slot binds the exact commit-admission dossier digest.","The first admission predecessor is the upstream transaction-plan receipt digest.","Every later admission predecessor is the immediately previous slot receipt digest.","Every admission slot binds a digest-only idempotency key.","Every admission-slot evidence origin is FIXTURE_ONLY.","Every admission slot retains liveReceiptPresent=false.","Every admission slot retains effectExecuted=false.","Every admission slot retains durableWriteExecuted=false.","Every admission slot retains hostClaimExecuted=false.","Every admission slot retains transactionCommitted=false.","Every admission slot retains productionConfigured=false.","Every admission-slot validity window is no longer than 3600 seconds.","Every admission-slot receipt must have a valid canonical SHA-256 digest.","Every admission-slot receipt must pass an authoritative positive verifier callback.","The request accepts no unknown fields.","The request action and fixture-only admission mode are exact constants.","The request binds the exact upstream transaction-plan receipt digest.","The request binds the exact commit-admission dossier digest.","The request binds all five ordered admission-slot names.","The request binds all five ordered admission-slot receipt digests.","The request nonce has a fixed digest form and can be prepared only once.","The request validity window is no longer than 30 seconds.","Only a WeakMap-backed opaque handle can project the admission receipt.","Projection is one-shot.","An expired handle cannot project an admission receipt.","Disposal is idempotent.","Projected receipt verification is deterministic and side-effect free.","The projected receipt reports exactly five fixture admission shapes.","The projected receipt preserves one-host and 500 milli-USD maximum bounds.","The projected receipt reports zero real identity verifications.","The projected receipt reports zero real user confirmations.","The projected receipt reports zero live provider quotes.","The projected receipt reports zero durable budget holds.","The projected receipt reports zero durable host claims.","The projected receipt reports zero atomic coordinators.","The projected receipt reports zero verified compensation receipts.","The projected receipt reports zero transaction commits.","The projected receipt reports zero execution authorizations.","The projected receipt reports zero processes, host contacts and package loads.","The projected receipt reports zero pricing reads, external reads, writes and mutations.","The projected receipt reports zero services, listeners, proxies and public routes.","The projected receipt grants no transaction, launch, billing or promotion authority.","The projected receipt cannot claim a paid resource.","Provider, pricing, budget, capacity, payment, transaction and host clients plus secrets, commands and production imports are prohibited."],"productionPrerequisites":["A real production identity and detached user-confirmation receipt bound to the exact transaction scope.","A reviewed provider-pricing adapter with explicit read-only IAM and regional SKU allowlists.","A fresh signed provider quote no older than three hundred seconds and bound to currency, region, SKU and quantity.","An independent cost-policy verifier that rejects scope, ceiling, expiry and exchange-rate drift.","A durable budget ledger with generation fencing and immutable account/project ownership.","A conditional budget-hold write with one idempotency key and no double reservation.","Automatic hold expiry plus witnessed manual and automatic budget-release drills.","A durable capacity ledger with generation fencing and one-host global-limit enforcement.","An idempotent host claim bound to confirmation, quote, hold, release and region.","An atomic coordinator that orders confirmation, quote, hold, claim and commit without partial success.","A compensation coordinator that releases hold and claim or enters a paged contained state.","Immutable transaction receipts with pinned asymmetric verification and replay retention.","A production no-shell driver plus an independently armed retirement watchdog.","An isolated nonproduction network lease and signed immutable image/package attestations.","A witnessed instance and root-volume retirement drill within one hundred twenty seconds.","Immutable audit storage, metrics, paging and a staffed incident-response window.","A separate explicit execution authorization after all live receipts are freshly reverified."],"selectedDenialTrace":{"fixtureId":"RFDHLEATCA-059","mutation":"DOSSIER_COMMIT_PERMITTED","expected":"DENY","reason":"A caller cannot turn a fixture-only admission dossier into a committed transaction by setting transactionCommitPermitted=true; no quote, hold, claim, commit or execution capability is issued."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":108,"acceptedOutcomes":16,"deniedOutcomes":92,"upstreamReceiptsVerified":80,"admissionSlotReceiptsVerified":162,"admissionReceiptsVerified":3,"projectedAdmissions":16,"disposedHandles":2,"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"atomicCoordinatorsObserved":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"atomicCoordinatorsObserved":0,"compensationReceiptsObserved":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"pricingReadsExecuted":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"transactionCommitPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-atomic-transaction-commit-admission-fixtures/v1","description":"Deterministic fixture-only atomic transaction commit-admission cases. No real confirmation, provider quote, durable hold, capacity claim, transaction commit, host launch, billing or paid resource is used.","mode":"FIXTURE_ATOMIC_COMMIT_ADMISSION_ONLY_NO_PROVIDER_READ_NO_DURABLE_WRITE_NO_HOST_CLAIM","networkRequestsExecuted":0,"pricingReadsExecuted":0,"realIdentityVerificationsExecuted":0,"userConfirmationsExecuted":0,"budgetHoldsExecuted":0,"hostClaimsExecuted":0,"transactionCommitsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFDHLEATCA-001","expected":"ACCEPT","mutation":"PREPARE_BASELINE"},{"id":"RFDHLEATCA-002","expected":"ACCEPT","mutation":"PROJECT_BASELINE"},{"id":"RFDHLEATCA-003","expected":"ACCEPT","mutation":"VERIFY_RECEIPT"},{"id":"RFDHLEATCA-004","expected":"ACCEPT","mutation":"VERIFY_REPLAY"},{"id":"RFDHLEATCA-005","expected":"ACCEPT","mutation":"DISPOSE_REPLAY"},{"id":"RFDHLEATCA-006","expected":"ACCEPT","mutation":"REQUEST_WINDOW_EDGE"},{"id":"RFDHLEATCA-007","expected":"ACCEPT","mutation":"COST_ZERO_EDGE"},{"id":"RFDHLEATCA-008","expected":"ACCEPT","mutation":"COST_CAP_EDGE"},{"id":"RFDHLEATCA-009","expected":"ACCEPT","mutation":"SLOT_VALIDITY_EDGE"},{"id":"RFDHLEATCA-010","expected":"ACCEPT","mutation":"PROJECT_OBSERVED_AT_EDGE"},{"id":"RFDHLEATCA-011","expected":"ACCEPT","mutation":"DISPOSE_AFTER_PROJECT"},{"id":"RFDHLEATCA-012","expected":"ACCEPT","mutation":"INDEPENDENT_DOSSIER_CLONE"},{"id":"RFDHLEATCA-013","expected":"ACCEPT","mutation":"UPSTREAM_COST_ZERO_EDGE"},{"id":"RFDHLEATCA-014","expected":"ACCEPT","mutation":"QUOTE_AGE_EXACT"},{"id":"RFDHLEATCA-015","expected":"ACCEPT","mutation":"HOLD_TTL_EXACT"},{"id":"RFDHLEATCA-016","expected":"ACCEPT","mutation":"CLAIM_TTL_EXACT"},{"id":"RFDHLEATCA-017","expected":"DENY","mutation":"EXECUTABLE_KEY"},{"id":"RFDHLEATCA-018","expected":"DENY","mutation":"RECEIPT_TRANSACTION_COMMITTED"},{"id":"RFDHLEATCA-019","expected":"DENY","mutation":"PRICING_CLIENT_KEY"},{"id":"RFDHLEATCA-020","expected":"DENY","mutation":"BUDGET_CLIENT_KEY"},{"id":"RFDHLEATCA-021","expected":"DENY","mutation":"CAPACITY_CLIENT_KEY"},{"id":"RFDHLEATCA-022","expected":"DENY","mutation":"HOST_PROVIDER_KEY"},{"id":"RFDHLEATCA-023","expected":"DENY","mutation":"PAYMENT_CLIENT_KEY"},{"id":"RFDHLEATCA-024","expected":"DENY","mutation":"COMMIT_TRANSACTION_KEY"},{"id":"RFDHLEATCA-025","expected":"DENY","mutation":"UPSTREAM_SCHEMA"},{"id":"RFDHLEATCA-026","expected":"DENY","mutation":"UPSTREAM_STATUS"},{"id":"RFDHLEATCA-027","expected":"DENY","mutation":"UPSTREAM_VERDICT"},{"id":"RFDHLEATCA-028","expected":"DENY","mutation":"UPSTREAM_MODE"},{"id":"RFDHLEATCA-029","expected":"DENY","mutation":"UPSTREAM_ID"},{"id":"RFDHLEATCA-030","expected":"DENY","mutation":"UPSTREAM_DIGEST"},{"id":"RFDHLEATCA-031","expected":"DENY","mutation":"UPSTREAM_STEP_COUNT"},{"id":"RFDHLEATCA-032","expected":"DENY","mutation":"UPSTREAM_PLAN_VERIFIED"},{"id":"RFDHLEATCA-033","expected":"DENY","mutation":"UPSTREAM_HOST_COUNT"},{"id":"RFDHLEATCA-034","expected":"DENY","mutation":"UPSTREAM_COST_OVER"},{"id":"RFDHLEATCA-035","expected":"DENY","mutation":"UPSTREAM_CURRENCY"},{"id":"RFDHLEATCA-036","expected":"DENY","mutation":"UPSTREAM_QUOTE_AGE"},{"id":"RFDHLEATCA-037","expected":"DENY","mutation":"UPSTREAM_HOLD_TTL"},{"id":"RFDHLEATCA-038","expected":"DENY","mutation":"UPSTREAM_CLAIM_TTL"},{"id":"RFDHLEATCA-039","expected":"DENY","mutation":"UPSTREAM_REAL_CONFIRMATION"},{"id":"RFDHLEATCA-040","expected":"DENY","mutation":"UPSTREAM_LIVE_QUOTE"},{"id":"RFDHLEATCA-041","expected":"DENY","mutation":"UPSTREAM_BUDGET_HOLD"},{"id":"RFDHLEATCA-042","expected":"DENY","mutation":"UPSTREAM_HOST_CLAIM"},{"id":"RFDHLEATCA-043","expected":"DENY","mutation":"UPSTREAM_TRANSACTION_AUTHORITY"},{"id":"RFDHLEATCA-044","expected":"DENY","mutation":"UPSTREAM_HOST_RUN"},{"id":"RFDHLEATCA-045","expected":"DENY","mutation":"UPSTREAM_PAID_RESOURCE"},{"id":"RFDHLEATCA-046","expected":"DENY","mutation":"UPSTREAM_EXPIRED"},{"id":"RFDHLEATCA-047","expected":"DENY","mutation":"UPSTREAM_VERIFIER_FALSE"},{"id":"RFDHLEATCA-048","expected":"DENY","mutation":"UPSTREAM_VERIFIER_THROW"},{"id":"RFDHLEATCA-049","expected":"DENY","mutation":"DOSSIER_SCHEMA"},{"id":"RFDHLEATCA-050","expected":"DENY","mutation":"DOSSIER_UPSTREAM"},{"id":"RFDHLEATCA-051","expected":"DENY","mutation":"DOSSIER_CONFIRMATION_SCOPE"},{"id":"RFDHLEATCA-052","expected":"DENY","mutation":"DOSSIER_ECONOMIC_SCOPE"},{"id":"RFDHLEATCA-053","expected":"DENY","mutation":"DOSSIER_HOST_COUNT"},{"id":"RFDHLEATCA-054","expected":"DENY","mutation":"DOSSIER_COST_OVER"},{"id":"RFDHLEATCA-055","expected":"DENY","mutation":"DOSSIER_CURRENCY"},{"id":"RFDHLEATCA-056","expected":"DENY","mutation":"DOSSIER_QUOTE_AGE"},{"id":"RFDHLEATCA-057","expected":"DENY","mutation":"DOSSIER_HOLD_TTL"},{"id":"RFDHLEATCA-058","expected":"DENY","mutation":"DOSSIER_CLAIM_TTL"},{"id":"RFDHLEATCA-059","expected":"DENY","mutation":"DOSSIER_COMMIT_PERMITTED"},{"id":"RFDHLEATCA-060","expected":"DENY","mutation":"DOSSIER_ORDERING"},{"id":"RFDHLEATCA-061","expected":"DENY","mutation":"DOSSIER_FAILURE_POLICY"},{"id":"RFDHLEATCA-062","expected":"DENY","mutation":"DOSSIER_REAL_CONFIRMATION"},{"id":"RFDHLEATCA-063","expected":"DENY","mutation":"DOSSIER_LIVE_QUOTE"},{"id":"RFDHLEATCA-064","expected":"DENY","mutation":"DOSSIER_BUDGET_HOLD"},{"id":"RFDHLEATCA-065","expected":"DENY","mutation":"DOSSIER_HOST_CLAIM"},{"id":"RFDHLEATCA-066","expected":"DENY","mutation":"DOSSIER_COORDINATOR"},{"id":"RFDHLEATCA-067","expected":"DENY","mutation":"DOSSIER_COMPENSATION"},{"id":"RFDHLEATCA-068","expected":"DENY","mutation":"DOSSIER_EXECUTION_PERMITTED"},{"id":"RFDHLEATCA-069","expected":"DENY","mutation":"DOSSIER_DIGEST"},{"id":"RFDHLEATCA-070","expected":"DENY","mutation":"SLOT_COUNT"},{"id":"RFDHLEATCA-071","expected":"DENY","mutation":"SLOT_ORDER"},{"id":"RFDHLEATCA-072","expected":"DENY","mutation":"SLOT_ORDINAL"},{"id":"RFDHLEATCA-073","expected":"DENY","mutation":"SLOT_NAME"},{"id":"RFDHLEATCA-074","expected":"DENY","mutation":"SLOT_DECISION"},{"id":"RFDHLEATCA-075","expected":"DENY","mutation":"SLOT_AUTHORITY"},{"id":"RFDHLEATCA-076","expected":"DENY","mutation":"SLOT_SIGNER"},{"id":"RFDHLEATCA-077","expected":"DENY","mutation":"SLOT_MODE"},{"id":"RFDHLEATCA-078","expected":"DENY","mutation":"SLOT_BINDING"},{"id":"RFDHLEATCA-079","expected":"DENY","mutation":"SLOT_UPSTREAM"},{"id":"RFDHLEATCA-080","expected":"DENY","mutation":"SLOT_DOSSIER"},{"id":"RFDHLEATCA-081","expected":"DENY","mutation":"SLOT_PREDECESSOR"},{"id":"RFDHLEATCA-082","expected":"DENY","mutation":"SLOT_IDEMPOTENCY"},{"id":"RFDHLEATCA-083","expected":"DENY","mutation":"SLOT_ORIGIN"},{"id":"RFDHLEATCA-084","expected":"DENY","mutation":"SLOT_LIVE_RECEIPT"},{"id":"RFDHLEATCA-085","expected":"DENY","mutation":"SLOT_EFFECT"},{"id":"RFDHLEATCA-086","expected":"DENY","mutation":"SLOT_DURABLE_WRITE"},{"id":"RFDHLEATCA-087","expected":"DENY","mutation":"SLOT_HOST_CLAIM"},{"id":"RFDHLEATCA-088","expected":"DENY","mutation":"SLOT_COMMIT"},{"id":"RFDHLEATCA-089","expected":"DENY","mutation":"SLOT_PRODUCTION_CONFIGURED"},{"id":"RFDHLEATCA-090","expected":"DENY","mutation":"SLOT_EXPIRED"},{"id":"RFDHLEATCA-091","expected":"DENY","mutation":"SLOT_WINDOW_LONG"},{"id":"RFDHLEATCA-092","expected":"DENY","mutation":"SLOT_DIGEST"},{"id":"RFDHLEATCA-093","expected":"DENY","mutation":"SLOT_VERIFIER_FALSE"},{"id":"RFDHLEATCA-094","expected":"DENY","mutation":"SLOT_VERIFIER_THROW"},{"id":"RFDHLEATCA-095","expected":"DENY","mutation":"REQUEST_SCHEMA"},{"id":"RFDHLEATCA-096","expected":"DENY","mutation":"REQUEST_ACTION"},{"id":"RFDHLEATCA-097","expected":"DENY","mutation":"REQUEST_MODE"},{"id":"RFDHLEATCA-098","expected":"DENY","mutation":"REQUEST_UPSTREAM"},{"id":"RFDHLEATCA-099","expected":"DENY","mutation":"REQUEST_DOSSIER"},{"id":"RFDHLEATCA-100","expected":"DENY","mutation":"REQUEST_SLOT_ORDER"},{"id":"RFDHLEATCA-101","expected":"DENY","mutation":"REQUEST_DIGESTS"},{"id":"RFDHLEATCA-102","expected":"DENY","mutation":"REQUEST_NONCE_INVALID"},{"id":"RFDHLEATCA-103","expected":"DENY","mutation":"REQUEST_EXPIRED"},{"id":"RFDHLEATCA-104","expected":"DENY","mutation":"REQUEST_WINDOW_LONG"},{"id":"RFDHLEATCA-105","expected":"DENY","mutation":"REQUEST_REPLAY"},{"id":"RFDHLEATCA-106","expected":"DENY","mutation":"RECONSTRUCTED_HANDLE"},{"id":"RFDHLEATCA-107","expected":"DENY","mutation":"DISPOSED_HANDLE"},{"id":"RFDHLEATCA-108","expected":"DENY","mutation":"PROJECT_REPLAY"}]}},"disposableHostLiveEvidenceCollectionTransactionCommitExecutionAuthorizationHandoff":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-transaction-commit-execution-authorization-handoff-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_TRANSACTION_COMMIT_EXECUTION_AUTHORIZATION_HANDOFF_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T15:10:00Z","scope":{"mode":"FIXTURE_EXECUTION_HANDOFF_ONLY_NO_COMMIT_NO_SETTLEMENT_NO_GRANT_NO_HOST_START","input":"POSITIVELY_VERIFIED_FIXTURE_ATOMIC_TRANSACTION_COMMIT_ADMISSION_RECEIPT","output":"TRANSACTION_COMMIT_EXECUTION_AUTHORIZATION_HANDOFF_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_GENUINE_COMMIT_SETTLEMENT_ACTIVE_CLAIM_POLICY_REVALIDATION_AND_SEPARATE_EXECUTION_GRANT","fixtureHandoffShapesVerified":5,"realTransactionCommitReceiptPresent":false,"durableBudgetSettlementPresent":false,"activeHostLeasePresent":false,"executionPolicyRevalidated":false,"executionGrantPresent":false,"transactionCommitted":false,"executionAuthorized":false,"hostStarted":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-atomic-transaction-commit-admission-receipt/v1","status":"ATOMIC_TRANSACTION_COMMIT_ADMISSION_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_REAL_CONFIRMATION_LIVE_QUOTE_DURABLE_HOLD_CLAIM_AND_SEPARATE_EXECUTION_AUTHORIZATION","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"atomic commit-admission receipt + execution-handoff dossier + five handoff-shape receipts + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only execution-authorization handoff receipt","sideEffect":"NONE"},{"id":"verify","input":"execution-authorization handoff receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"handoffSlots":[{"ordinal":1,"slot":"GENUINE_TRANSACTION_COMMIT_RECEIPT_ADMISSION","authority":"TRANSACTION_LEDGER_AUTHORITY","signerKeyId":"fixture-p256-transaction-ledger-authority","requiredBinding":"BIND_COMMIT_TO_ADMITTED_DOSSIER_AND_ATOMIC_OUTCOME","observedLive":false},{"ordinal":2,"slot":"BUDGET_HOLD_SETTLEMENT_RECEIPT_ADMISSION","authority":"BUDGET_AUTHORITY","signerKeyId":"fixture-p256-budget-settlement-authority","requiredBinding":"BIND_SETTLEMENT_TO_COMMIT_AND_EXACT_COST","observedLive":false},{"ordinal":3,"slot":"HOST_CLAIM_ACTIVATION_RECEIPT_ADMISSION","authority":"CAPACITY_AUTHORITY","signerKeyId":"fixture-p256-host-lease-authority","requiredBinding":"BIND_ACTIVE_LEASE_TO_COMMIT_SETTLEMENT_AND_ONE_HOST","observedLive":false},{"ordinal":4,"slot":"EXECUTION_POLICY_REVALIDATION_RECEIPT_ADMISSION","authority":"EXECUTION_POLICY_AUTHORITY","signerKeyId":"fixture-p256-execution-policy-authority","requiredBinding":"REVALIDATE_IMAGE_NETWORK_WATCHDOG_RETIREMENT_AND_INCIDENT_WINDOW","observedLive":false},{"ordinal":5,"slot":"EXECUTION_AUTHORITY_GRANT_RECEIPT_ADMISSION","authority":"EXECUTION_AUTHORITY","signerKeyId":"fixture-p256-execution-authority","requiredBinding":"BIND_ONE_SHOT_GRANT_TO_ALL_PREDECESSOR_RECEIPTS","observedLive":false}],"authorityTopology":[{"authority":"TRANSACTION_LEDGER_AUTHORITY","slots":1,"mayCommit":false,"maySettleBudget":false,"mayActivateLease":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"BUDGET_AUTHORITY","slots":1,"mayCommit":false,"maySettleBudget":false,"mayActivateLease":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"CAPACITY_AUTHORITY","slots":1,"mayCommit":false,"maySettleBudget":false,"mayActivateLease":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"EXECUTION_POLICY_AUTHORITY","slots":1,"mayCommit":false,"maySettleBudget":false,"mayActivateLease":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"EXECUTION_AUTHORITY","slots":1,"mayCommit":false,"maySettleBudget":false,"mayActivateLease":false,"mayAuthorizeExecution":false,"mayStartHost":false}],"executionGuardrails":{"requestValiditySeconds":30,"handoffShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"currency":"USD","executionOrdering":"COMMIT_THEN_SETTLE_HOLD_THEN_ACTIVATE_CLAIM_THEN_REVALIDATE_POLICY_THEN_AUTHORIZE_EXECUTION","failurePolicy":"REVOKE_GRANT_RELEASE_SETTLEMENT_AND_CLAIM_OR_CONTAIN","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","transactionCommitReceiptPresent":false,"budgetSettlementReceiptPresent":false,"hostLeaseActivationReceiptPresent":false,"executionPolicyRevalidationReceiptPresent":false,"executionGrantReceiptPresent":false,"transactionCommitted":false,"executionHandoffPermitted":false,"executionAuthorized":false,"hostStarted":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_ATOMIC_ADMISSION_VERIFIED","EXECUTION_HANDOFF_DOSSIER_BOUND","COMMIT_RECEIPT_SHAPE_VERIFIED","BUDGET_SETTLEMENT_SHAPE_VERIFIED","HOST_LEASE_ACTIVATION_SHAPE_VERIFIED","EXECUTION_POLICY_REVALIDATION_SHAPE_VERIFIED","EXECUTION_GRANT_SHAPE_VERIFIED","COMMIT_BEFORE_GRANT_ORDER_FROZEN","PREDECESSOR_CHAIN_BOUND","IDEMPOTENCY_BOUND","COMPENSATION_POLICY_BOUND","AUTHORITY_SEPARATION_BOUND","HANDOFF_PREPARED_FIXTURE_ONLY","HANDOFF_RECEIPT_PROJECTED","HANDOFF_RECEIPT_VERIFIED","DENIED_OR_DISPOSED"],"invariants":["Only the exact unexpired fixture atomic transaction commit-admission receipt is accepted.","The upstream atomic admission receipt must pass an authoritative positive verifier callback.","The upstream admission identity is deterministically derived from plan, dossier, nonce and request time.","The upstream status, verdict and fixture-only mode cannot be upgraded by callers.","The upstream receipt must retain exactly five admission slots and five receipt digests.","The upstream receipt must report exactly five fixture admission shapes.","The upstream receipt must report zero real confirmation, quote, hold, claim, commit and execution effects.","The upstream host count and cost ceiling remain bounded to one host and 500 milli-USD.","The upstream currency, quote age and hold/claim TTL values are exact constants.","The upstream receipt must remain within its validity window.","The upstream receipt must have a valid canonical SHA-256 digest.","The execution-handoff dossier accepts no unknown fields.","The dossier binds the exact upstream atomic admission receipt digest.","The dossier binds the exact confirmation scope digest.","The dossier binds the exact economic scope digest.","The dossier is bounded to exactly one host.","The dossier cost ceiling is an integer from zero through 500 milli-USD.","The dossier currency is exactly USD.","A genuine transaction commit receipt is always required.","A durable budget settlement receipt is always required.","An active host-lease receipt is always required.","A fresh execution-policy revalidation receipt is always required.","A separate execution-authority grant receipt is always required.","The dossier must retain transactionCommitReceiptPresent=false.","The dossier must retain budgetSettlementReceiptPresent=false.","The dossier must retain hostLeaseActivationReceiptPresent=false.","The dossier must retain executionPolicyRevalidationReceiptPresent=false.","The dossier must retain executionGrantReceiptPresent=false.","The dossier must retain transactionCommitPermitted=false.","The dossier must retain executionHandoffPermitted=false.","The dossier must retain executionPermitted=false.","The only execution order is commit, settlement, lease activation, policy revalidation, then execution authorization.","The only failure policy revokes any grant and releases settlement and claim or contains the transaction.","Exactly five ordered execution-handoff shape receipts are required.","Handoff-slot order and ordinal values are immutable.","Every handoff slot is owned by its exact independent authority.","Every handoff slot is pinned to its exact fixture signer key.","Every handoff slot uses its exact allowlisted required binding.","Every handoff decision is HANDOFF_SHAPE_VERIFIED_FIXTURE_ONLY.","Every handoff mode denies real commits and execution grants.","Every handoff slot binds the exact upstream atomic admission receipt digest.","Every handoff slot binds the exact execution-handoff dossier digest.","The first handoff predecessor is the upstream atomic admission receipt digest.","Every later handoff predecessor is the immediately previous slot receipt digest.","Every handoff slot binds a digest-only idempotency key.","Every handoff-slot evidence origin is FIXTURE_ONLY.","Every handoff slot retains liveReceiptPresent=false.","Every handoff slot retains effectExecuted=false.","Every handoff slot retains durableWriteExecuted=false.","Every handoff slot retains hostClaimExecuted=false.","Every handoff slot retains transactionCommitted=false.","Every handoff slot retains executionAuthorized=false.","Every handoff slot retains hostStarted=false.","Every handoff slot retains productionConfigured=false.","Every handoff-slot validity window is no longer than 3600 seconds.","Every handoff-slot receipt must have a valid canonical SHA-256 digest.","Every handoff-slot receipt must pass an authoritative positive verifier callback.","The request accepts no unknown fields.","The request action and fixture-only handoff mode are exact constants.","The request binds the exact upstream atomic admission receipt digest.","The request binds the exact execution-handoff dossier digest.","The request binds all five ordered handoff-slot names.","The request binds all five ordered handoff-slot receipt digests.","The request nonce has a fixed digest form and can be prepared only once.","The request validity window is no longer than 30 seconds.","Only a WeakMap-backed opaque handle can project the handoff receipt.","Projection is one-shot.","An expired handle cannot project a handoff receipt.","Disposal is idempotent.","Projected receipt verification is deterministic and side-effect free.","The projected receipt reports exactly five fixture handoff shapes.","The projected receipt preserves one-host and 500 milli-USD maximum bounds.","The projected receipt reports zero genuine transaction commit receipts.","The projected receipt reports zero durable budget settlements.","The projected receipt reports zero active host leases.","The projected receipt reports zero execution-policy revalidations.","The projected receipt reports zero execution-authority grants.","The projected receipt reports zero transaction commits.","The projected receipt reports zero execution authorizations.","The projected receipt reports zero host runs, claims and processes.","The projected receipt reports zero external reads, writes and mutations.","The projected receipt reports zero services, listeners, proxies and public routes.","The projected receipt grants no transaction, launch, billing or promotion authority.","The projected receipt cannot claim a paid resource.","No fixture receipt or boolean flag can be promoted into a genuine commit or execution grant.","Provider, pricing, budget, capacity, payment, transaction, execution and host clients plus secrets, commands and production imports are prohibited."],"productionPrerequisites":["A genuine immutable atomic transaction-commit receipt bound to the admitted dossier and exact predecessor chain.","A pinned asymmetric transaction-ledger verification key with rotation and revocation evidence.","A durable budget settlement receipt that binds the final provider cost and original hold generation.","Automatic and manual settlement reversal drills with immutable compensation receipts.","A durable active host lease bound to the committed transaction, capacity generation and one-host ceiling.","Lease expiry and ambiguous activation handling that cannot leak a capacity slot.","Fresh revalidation of immutable image and package attestations before execution authorization.","Fresh revalidation of the isolated network lease and default-deny egress policy.","An independently armed retirement watchdog with witnessed timeout behavior.","A staffed incident-response window and immutable paging route for the execution period.","A separate execution-policy authority that cannot commit transactions or launch hosts.","A separate execution authority that cannot price, settle budget or claim capacity.","A one-shot execution grant bound to every predecessor receipt digest and exact job attempt.","Grant expiry, replay denial, revocation and post-consumption destruction evidence.","A production no-shell driver that consumes only the one-shot execution grant.","An isolated nonproduction host with no reusable cloud, Gitea or runner credential.","A witnessed host and root-volume retirement drill within one hundred twenty seconds.","Immutable audit storage, metrics, rollback proof and owner approval for the complete handoff."],"selectedDenialTrace":{"fixtureId":"RFDHLETCEAH-111","mutation":"DOSSIER_EXECUTION_HANDOFF_PERMITTED","expected":"DENY","reason":"A caller cannot turn five fixture-only receipt shapes into an execution handoff by setting executionHandoffPermitted=true; no commit, settlement, lease, grant or host capability is issued."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":112,"acceptedOutcomes":18,"deniedOutcomes":94,"upstreamReceiptsVerified":84,"handoffSlotReceiptsVerified":177,"handoffReceiptsVerified":3,"projectedHandoffs":19,"disposedHandles":2,"realTransactionCommitReceiptsObserved":0,"durableBudgetSettlementsObserved":0,"activeHostLeasesObserved":0,"executionPolicyRevalidationsObserved":0,"executionAuthorityGrantsObserved":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"realIdentityVerificationsObserved":0,"realUserConfirmationsObserved":0,"livePriceQuotesObserved":0,"durableBudgetHoldsObserved":0,"durableClaimReservationsObserved":0,"atomicCoordinatorsObserved":0,"compensationReceiptsObserved":0,"realTransactionCommitReceiptsObserved":0,"durableBudgetSettlementsObserved":0,"activeHostLeasesObserved":0,"executionPolicyRevalidationsObserved":0,"executionAuthorityGrantsObserved":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"transactionCommitPermitted":false,"executionHandoffPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-transaction-commit-execution-authorization-handoff-fixtures/v1","description":"Deterministic fixture-only transaction-commit to execution-authorization handoff cases. No real commit, settlement, lease activation, execution grant, host launch, billing or paid resource is used.","mode":"FIXTURE_EXECUTION_HANDOFF_ONLY_NO_COMMIT_NO_SETTLEMENT_NO_GRANT_NO_HOST_START","networkRequestsExecuted":0,"pricingReadsExecuted":0,"realIdentityVerificationsExecuted":0,"userConfirmationsExecuted":0,"budgetHoldsExecuted":0,"budgetSettlementsExecuted":0,"hostClaimsExecuted":0,"hostLeaseActivationsExecuted":0,"transactionCommitsExecuted":0,"executionAuthorizationsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFDHLETCEAH-001","expected":"ACCEPT","mutation":"PREPARE_BASELINE"},{"id":"RFDHLETCEAH-002","expected":"ACCEPT","mutation":"PROJECT_BASELINE"},{"id":"RFDHLETCEAH-003","expected":"ACCEPT","mutation":"VERIFY_RECEIPT"},{"id":"RFDHLETCEAH-004","expected":"ACCEPT","mutation":"VERIFY_REPLAY"},{"id":"RFDHLETCEAH-005","expected":"ACCEPT","mutation":"DISPOSE_REPLAY"},{"id":"RFDHLETCEAH-006","expected":"ACCEPT","mutation":"REQUEST_WINDOW_EDGE"},{"id":"RFDHLETCEAH-007","expected":"ACCEPT","mutation":"COST_ZERO_EDGE"},{"id":"RFDHLETCEAH-008","expected":"ACCEPT","mutation":"COST_CAP_EDGE"},{"id":"RFDHLETCEAH-009","expected":"ACCEPT","mutation":"SLOT_VALIDITY_EDGE"},{"id":"RFDHLETCEAH-010","expected":"ACCEPT","mutation":"PROJECT_OBSERVED_AT_EDGE"},{"id":"RFDHLETCEAH-011","expected":"ACCEPT","mutation":"DISPOSE_AFTER_PROJECT"},{"id":"RFDHLETCEAH-012","expected":"ACCEPT","mutation":"INDEPENDENT_DOSSIER_CLONE"},{"id":"RFDHLETCEAH-013","expected":"ACCEPT","mutation":"UPSTREAM_COST_ZERO_EDGE"},{"id":"RFDHLETCEAH-014","expected":"ACCEPT","mutation":"QUOTE_AGE_EXACT"},{"id":"RFDHLETCEAH-015","expected":"ACCEPT","mutation":"HOLD_TTL_EXACT"},{"id":"RFDHLETCEAH-016","expected":"ACCEPT","mutation":"CLAIM_TTL_EXACT"},{"id":"RFDHLETCEAH-017","expected":"DENY","mutation":"EXECUTABLE_KEY"},{"id":"RFDHLETCEAH-018","expected":"DENY","mutation":"RECEIPT_TRANSACTION_COMMITTED"},{"id":"RFDHLETCEAH-019","expected":"DENY","mutation":"PRICING_CLIENT_KEY"},{"id":"RFDHLETCEAH-020","expected":"DENY","mutation":"BUDGET_CLIENT_KEY"},{"id":"RFDHLETCEAH-021","expected":"DENY","mutation":"CAPACITY_CLIENT_KEY"},{"id":"RFDHLETCEAH-022","expected":"DENY","mutation":"HOST_PROVIDER_KEY"},{"id":"RFDHLETCEAH-023","expected":"DENY","mutation":"PAYMENT_CLIENT_KEY"},{"id":"RFDHLETCEAH-024","expected":"DENY","mutation":"COMMIT_TRANSACTION_KEY"},{"id":"RFDHLETCEAH-025","expected":"DENY","mutation":"UPSTREAM_SCHEMA"},{"id":"RFDHLETCEAH-026","expected":"DENY","mutation":"UPSTREAM_STATUS"},{"id":"RFDHLETCEAH-027","expected":"DENY","mutation":"UPSTREAM_VERDICT"},{"id":"RFDHLETCEAH-028","expected":"DENY","mutation":"UPSTREAM_MODE"},{"id":"RFDHLETCEAH-029","expected":"DENY","mutation":"UPSTREAM_ID"},{"id":"RFDHLETCEAH-030","expected":"DENY","mutation":"UPSTREAM_DIGEST"},{"id":"RFDHLETCEAH-031","expected":"DENY","mutation":"UPSTREAM_STEP_COUNT"},{"id":"RFDHLETCEAH-032","expected":"DENY","mutation":"UPSTREAM_PLAN_VERIFIED"},{"id":"RFDHLETCEAH-033","expected":"DENY","mutation":"UPSTREAM_HOST_COUNT"},{"id":"RFDHLETCEAH-034","expected":"DENY","mutation":"UPSTREAM_COST_OVER"},{"id":"RFDHLETCEAH-035","expected":"DENY","mutation":"UPSTREAM_CURRENCY"},{"id":"RFDHLETCEAH-036","expected":"DENY","mutation":"UPSTREAM_QUOTE_AGE"},{"id":"RFDHLETCEAH-037","expected":"DENY","mutation":"UPSTREAM_HOLD_TTL"},{"id":"RFDHLETCEAH-038","expected":"DENY","mutation":"UPSTREAM_CLAIM_TTL"},{"id":"RFDHLETCEAH-039","expected":"DENY","mutation":"UPSTREAM_REAL_CONFIRMATION"},{"id":"RFDHLETCEAH-040","expected":"DENY","mutation":"UPSTREAM_LIVE_QUOTE"},{"id":"RFDHLETCEAH-041","expected":"DENY","mutation":"UPSTREAM_BUDGET_HOLD"},{"id":"RFDHLETCEAH-042","expected":"DENY","mutation":"UPSTREAM_HOST_CLAIM"},{"id":"RFDHLETCEAH-043","expected":"DENY","mutation":"UPSTREAM_TRANSACTION_AUTHORITY"},{"id":"RFDHLETCEAH-044","expected":"DENY","mutation":"UPSTREAM_HOST_RUN"},{"id":"RFDHLETCEAH-045","expected":"DENY","mutation":"UPSTREAM_PAID_RESOURCE"},{"id":"RFDHLETCEAH-046","expected":"DENY","mutation":"UPSTREAM_EXPIRED"},{"id":"RFDHLETCEAH-047","expected":"DENY","mutation":"UPSTREAM_VERIFIER_FALSE"},{"id":"RFDHLETCEAH-048","expected":"DENY","mutation":"UPSTREAM_VERIFIER_THROW"},{"id":"RFDHLETCEAH-049","expected":"DENY","mutation":"DOSSIER_SCHEMA"},{"id":"RFDHLETCEAH-050","expected":"DENY","mutation":"DOSSIER_UPSTREAM"},{"id":"RFDHLETCEAH-051","expected":"DENY","mutation":"DOSSIER_CONFIRMATION_SCOPE"},{"id":"RFDHLETCEAH-052","expected":"DENY","mutation":"DOSSIER_ECONOMIC_SCOPE"},{"id":"RFDHLETCEAH-053","expected":"DENY","mutation":"DOSSIER_HOST_COUNT"},{"id":"RFDHLETCEAH-054","expected":"DENY","mutation":"DOSSIER_COST_OVER"},{"id":"RFDHLETCEAH-055","expected":"DENY","mutation":"DOSSIER_CURRENCY"},{"id":"RFDHLETCEAH-056","expected":"DENY","mutation":"DOSSIER_QUOTE_AGE"},{"id":"RFDHLETCEAH-057","expected":"DENY","mutation":"DOSSIER_HOLD_TTL"},{"id":"RFDHLETCEAH-058","expected":"DENY","mutation":"DOSSIER_CLAIM_TTL"},{"id":"RFDHLETCEAH-059","expected":"DENY","mutation":"DOSSIER_COMMIT_PERMITTED"},{"id":"RFDHLETCEAH-060","expected":"DENY","mutation":"DOSSIER_ORDERING"},{"id":"RFDHLETCEAH-061","expected":"DENY","mutation":"DOSSIER_FAILURE_POLICY"},{"id":"RFDHLETCEAH-062","expected":"DENY","mutation":"DOSSIER_REAL_CONFIRMATION"},{"id":"RFDHLETCEAH-063","expected":"DENY","mutation":"DOSSIER_LIVE_QUOTE"},{"id":"RFDHLETCEAH-064","expected":"DENY","mutation":"DOSSIER_BUDGET_HOLD"},{"id":"RFDHLETCEAH-065","expected":"DENY","mutation":"DOSSIER_HOST_CLAIM"},{"id":"RFDHLETCEAH-066","expected":"DENY","mutation":"DOSSIER_COORDINATOR"},{"id":"RFDHLETCEAH-067","expected":"DENY","mutation":"DOSSIER_COMPENSATION"},{"id":"RFDHLETCEAH-068","expected":"DENY","mutation":"DOSSIER_EXECUTION_PERMITTED"},{"id":"RFDHLETCEAH-069","expected":"DENY","mutation":"DOSSIER_DIGEST"},{"id":"RFDHLETCEAH-070","expected":"DENY","mutation":"SLOT_COUNT"},{"id":"RFDHLETCEAH-071","expected":"DENY","mutation":"SLOT_ORDER"},{"id":"RFDHLETCEAH-072","expected":"DENY","mutation":"SLOT_ORDINAL"},{"id":"RFDHLETCEAH-073","expected":"DENY","mutation":"SLOT_NAME"},{"id":"RFDHLETCEAH-074","expected":"DENY","mutation":"SLOT_DECISION"},{"id":"RFDHLETCEAH-075","expected":"DENY","mutation":"SLOT_AUTHORITY"},{"id":"RFDHLETCEAH-076","expected":"DENY","mutation":"SLOT_SIGNER"},{"id":"RFDHLETCEAH-077","expected":"DENY","mutation":"SLOT_MODE"},{"id":"RFDHLETCEAH-078","expected":"DENY","mutation":"SLOT_BINDING"},{"id":"RFDHLETCEAH-079","expected":"DENY","mutation":"SLOT_UPSTREAM"},{"id":"RFDHLETCEAH-080","expected":"DENY","mutation":"SLOT_DOSSIER"},{"id":"RFDHLETCEAH-081","expected":"DENY","mutation":"SLOT_PREDECESSOR"},{"id":"RFDHLETCEAH-082","expected":"DENY","mutation":"SLOT_IDEMPOTENCY"},{"id":"RFDHLETCEAH-083","expected":"DENY","mutation":"SLOT_ORIGIN"},{"id":"RFDHLETCEAH-084","expected":"DENY","mutation":"SLOT_LIVE_RECEIPT"},{"id":"RFDHLETCEAH-085","expected":"DENY","mutation":"SLOT_EFFECT"},{"id":"RFDHLETCEAH-086","expected":"DENY","mutation":"SLOT_DURABLE_WRITE"},{"id":"RFDHLETCEAH-087","expected":"DENY","mutation":"SLOT_HOST_CLAIM"},{"id":"RFDHLETCEAH-088","expected":"DENY","mutation":"SLOT_COMMIT"},{"id":"RFDHLETCEAH-089","expected":"DENY","mutation":"SLOT_PRODUCTION_CONFIGURED"},{"id":"RFDHLETCEAH-090","expected":"DENY","mutation":"SLOT_EXPIRED"},{"id":"RFDHLETCEAH-091","expected":"DENY","mutation":"SLOT_WINDOW_LONG"},{"id":"RFDHLETCEAH-092","expected":"DENY","mutation":"SLOT_DIGEST"},{"id":"RFDHLETCEAH-093","expected":"DENY","mutation":"SLOT_VERIFIER_FALSE"},{"id":"RFDHLETCEAH-094","expected":"DENY","mutation":"SLOT_VERIFIER_THROW"},{"id":"RFDHLETCEAH-095","expected":"DENY","mutation":"REQUEST_SCHEMA"},{"id":"RFDHLETCEAH-096","expected":"DENY","mutation":"REQUEST_ACTION"},{"id":"RFDHLETCEAH-097","expected":"DENY","mutation":"REQUEST_MODE"},{"id":"RFDHLETCEAH-098","expected":"DENY","mutation":"REQUEST_UPSTREAM"},{"id":"RFDHLETCEAH-099","expected":"DENY","mutation":"REQUEST_DOSSIER"},{"id":"RFDHLETCEAH-100","expected":"DENY","mutation":"REQUEST_SLOT_ORDER"},{"id":"RFDHLETCEAH-101","expected":"DENY","mutation":"REQUEST_DIGESTS"},{"id":"RFDHLETCEAH-102","expected":"DENY","mutation":"REQUEST_NONCE_INVALID"},{"id":"RFDHLETCEAH-103","expected":"DENY","mutation":"REQUEST_EXPIRED"},{"id":"RFDHLETCEAH-104","expected":"DENY","mutation":"REQUEST_WINDOW_LONG"},{"id":"RFDHLETCEAH-105","expected":"DENY","mutation":"REQUEST_REPLAY"},{"id":"RFDHLETCEAH-106","expected":"DENY","mutation":"RECONSTRUCTED_HANDLE"},{"id":"RFDHLETCEAH-107","expected":"DENY","mutation":"DISPOSED_HANDLE"},{"id":"RFDHLETCEAH-108","expected":"DENY","mutation":"PROJECT_REPLAY"},{"id":"RFDHLETCEAH-109","expected":"ACCEPT","mutation":"HANDOFF_ORDER_EXACT"},{"id":"RFDHLETCEAH-110","expected":"ACCEPT","mutation":"POLICY_REVALIDATION_REQUIRED_EXACT"},{"id":"RFDHLETCEAH-111","expected":"DENY","mutation":"DOSSIER_EXECUTION_HANDOFF_PERMITTED"},{"id":"RFDHLETCEAH-112","expected":"DENY","mutation":"RECEIPT_EXECUTION_AUTHORIZED"}]}},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityTrustRevocationAdmission":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-trust-revocation-admission-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_TRUST_REVOCATION_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T16:00:00Z","scope":{"mode":"FIXTURE_AUTHORITY_TRUST_REVOCATION_ONLY_NO_KEY_CREATION_NO_GRANT_NO_REVOCATION_NO_HOST_START","input":"POSITIVELY_VERIFIED_FIXTURE_TRANSACTION_COMMIT_EXECUTION_AUTHORIZATION_HANDOFF_RECEIPT","output":"EXECUTION_AUTHORIZATION_AUTHORITY_TRUST_REVOCATION_ADMISSION_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_PRODUCTION_INTERFACES_PINNED_KEYS_REVOCATION_COMPENSATION_EXPIRY_AND_IMMUTABLE_AUDIT_EVIDENCE","fixtureTrustShapesVerified":6,"productionInterfaceManifestPresent":false,"pinnedProductionKeysPresent":false,"rotationRevocationDrillsPresent":false,"compensationDrillsPresent":false,"leaseGrantExpiryDrillsPresent":false,"immutableAuditWitnessPresent":false,"keyMaterialCreated":false,"executionGrantIssued":false,"hostStarted":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-transaction-commit-execution-authorization-handoff-receipt/v1","status":"TRANSACTION_COMMIT_EXECUTION_AUTHORIZATION_HANDOFF_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_GENUINE_COMMIT_SETTLEMENT_ACTIVE_CLAIM_POLICY_REVALIDATION_AND_SEPARATE_EXECUTION_GRANT","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"execution-handoff receipt + trust dossier + six trust-shape receipts + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only authority-trust admission receipt","sideEffect":"NONE"},{"id":"verify","input":"authority-trust admission receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"trustSlots":[{"ordinal":1,"slot":"PRODUCTION_AUTHORITY_INTERFACE_MANIFEST_ADMISSION","authority":"INTERFACE_REGISTRY_AUTHORITY","signerKeyId":"fixture-p256-interface-registry-authority","requiredBinding":"BIND_VERSIONED_INTERFACES_TO_SEPARATE_AUTHORITIES_AND_EFFECT_ALLOWLISTS","observedLive":false},{"ordinal":2,"slot":"PINNED_SIGNING_KEY_CUSTODY_ADMISSION","authority":"KEY_CUSTODY_AUTHORITY","signerKeyId":"fixture-p256-key-custody-authority","requiredBinding":"BIND_PINNED_PUBLIC_KEYS_TO_OWNER_ROTATION_AND_REVOCATION_POLICY","observedLive":false},{"ordinal":3,"slot":"KEY_ROTATION_AND_GRANT_REVOCATION_DRILL_ADMISSION","authority":"REVOCATION_AUTHORITY","signerKeyId":"fixture-p256-revocation-authority","requiredBinding":"BIND_ROTATION_AND_REVOCATION_DRILLS_TO_KEY_AND_GRANT_GENERATIONS","observedLive":false},{"ordinal":4,"slot":"SETTLEMENT_LEASE_COMPENSATION_DRILL_ADMISSION","authority":"COMPENSATION_AUTHORITY","signerKeyId":"fixture-p256-compensation-authority","requiredBinding":"BIND_COMPENSATION_DRILLS_TO_SETTLEMENT_LEASE_AND_AMBIGUOUS_OUTCOMES","observedLive":false},{"ordinal":5,"slot":"LEASE_AND_EXECUTION_GRANT_EXPIRY_DRILL_ADMISSION","authority":"EXPIRY_WATCHDOG_AUTHORITY","signerKeyId":"fixture-p256-expiry-watchdog-authority","requiredBinding":"BIND_EXPIRY_DRILLS_TO_LEASE_GRANT_AND_ONE_SHOT_CONSUMPTION","observedLive":false},{"ordinal":6,"slot":"IMMUTABLE_AUDIT_WITNESS_ADMISSION","authority":"AUDIT_WITNESS_AUTHORITY","signerKeyId":"fixture-p256-audit-witness-authority","requiredBinding":"BIND_IMMUTABLE_WITNESS_TO_COMPLETE_PREDECESSOR_CHAIN_AND_TERMINAL_OUTCOME","observedLive":false}],"authorityTopology":[{"authority":"INTERFACE_REGISTRY_AUTHORITY","slots":1,"mayCreateKey":false,"mayRotateKey":false,"mayRevokeGrant":false,"mayWriteAudit":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"KEY_CUSTODY_AUTHORITY","slots":1,"mayCreateKey":false,"mayRotateKey":false,"mayRevokeGrant":false,"mayWriteAudit":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"REVOCATION_AUTHORITY","slots":1,"mayCreateKey":false,"mayRotateKey":false,"mayRevokeGrant":false,"mayWriteAudit":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"COMPENSATION_AUTHORITY","slots":1,"mayCreateKey":false,"mayRotateKey":false,"mayRevokeGrant":false,"mayWriteAudit":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"EXPIRY_WATCHDOG_AUTHORITY","slots":1,"mayCreateKey":false,"mayRotateKey":false,"mayRevokeGrant":false,"mayWriteAudit":false,"mayAuthorizeExecution":false,"mayStartHost":false},{"authority":"AUDIT_WITNESS_AUTHORITY","slots":1,"mayCreateKey":false,"mayRotateKey":false,"mayRevokeGrant":false,"mayWriteAudit":false,"mayAuthorizeExecution":false,"mayStartHost":false}],"trustGuardrails":{"requestValiditySeconds":30,"trustShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"currency":"USD","trustOrdering":"INTERFACES_THEN_KEYS_THEN_ROTATION_REVOCATION_THEN_COMPENSATION_THEN_EXPIRY_THEN_AUDIT_WITNESS","failurePolicy":"REVOKE_AND_EXPIRE_GRANTS_RELEASE_SETTLEMENT_AND_LEASE_OR_CONTAIN","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","productionInterfaceManifestPresent":false,"pinnedProductionKeysPresent":false,"rotationRevocationDrillsPresent":false,"compensationDrillsPresent":false,"leaseGrantExpiryDrillsPresent":false,"immutableAuditWitnessPresent":false,"authorityTrustPermitted":false,"executionAuthorized":false,"hostStarted":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_EXECUTION_HANDOFF_VERIFIED","AUTHORITY_TRUST_DOSSIER_BOUND","INTERFACE_MANIFEST_SHAPE_VERIFIED","KEY_CUSTODY_SHAPE_VERIFIED","ROTATION_REVOCATION_SHAPE_VERIFIED","COMPENSATION_DRILL_SHAPE_VERIFIED","LEASE_GRANT_EXPIRY_SHAPE_VERIFIED","IMMUTABLE_AUDIT_WITNESS_SHAPE_VERIFIED","TRUST_ORDER_FROZEN","PREDECESSOR_CHAIN_BOUND","IDEMPOTENCY_BOUND","FAILURE_POLICY_BOUND","AUTHORITY_SEPARATION_BOUND","TRUST_ADMISSION_PREPARED_FIXTURE_ONLY","TRUST_ADMISSION_RECEIPT_PROJECTED","TRUST_ADMISSION_RECEIPT_VERIFIED","DENIED_OR_DISPOSED"],"invariants":["Only the exact unexpired fixture execution-handoff receipt is accepted.","The upstream execution-handoff receipt must pass an authoritative positive verifier callback.","The upstream handoff identity is deterministically derived from its predecessor, dossier, nonce and request time.","The upstream status, verdict and fixture-only mode cannot be upgraded by callers.","The upstream receipt must retain exactly five handoff slots and five receipt digests.","The upstream receipt must report exactly five fixture handoff shapes.","The upstream receipt must report zero real commit, settlement, lease, grant and execution effects.","The upstream host count and cost ceiling remain bounded to one host and 500 milli-USD.","The upstream currency is exactly USD.","The upstream receipt must remain within its validity window.","The upstream receipt must have a valid canonical SHA-256 digest.","The authority-trust dossier accepts no unknown fields.","The dossier binds the exact upstream execution-handoff receipt digest.","The dossier binds the exact confirmation scope digest.","The dossier binds the exact economic scope digest.","The dossier is bounded to exactly one host.","The dossier cost ceiling is an integer from zero through 500 milli-USD.","A versioned production authority-interface manifest is always required.","Pinned production signing-key custody evidence is always required.","Key rotation and grant revocation drill evidence is always required.","Settlement and lease compensation drill evidence is always required.","Lease and execution-grant expiry drill evidence is always required.","An immutable audit witness is always required.","The dossier must retain productionInterfaceManifestPresent=false.","The dossier must retain pinnedProductionKeysPresent=false.","The dossier must retain rotationRevocationDrillsPresent=false.","The dossier must retain compensationDrillsPresent=false.","The dossier must retain leaseGrantExpiryDrillsPresent=false.","The dossier must retain immutableAuditWitnessPresent=false.","The dossier must retain authorityTrustPermitted=false.","The dossier must retain executionHandoffPermitted=false.","The dossier must retain executionPermitted=false.","The only trust order is interfaces, keys, rotation/revocation, compensation, expiry, then audit witness.","The only failure policy revokes and expires grants, releases settlement and lease, or contains the transaction.","Exactly six ordered authority-trust shape receipts are required.","Trust-slot order and ordinal values are immutable.","Every trust slot is owned by its exact independent authority.","Every trust slot is pinned to its exact fixture signer key.","Every trust slot uses its exact allowlisted required binding.","Every trust decision is AUTHORITY_TRUST_SHAPE_VERIFIED_FIXTURE_ONLY.","Every trust mode denies keys, grants and audit writes.","Every trust slot binds the exact upstream execution-handoff receipt digest.","Every trust slot binds the exact authority-trust dossier digest.","The first trust predecessor is the upstream execution-handoff receipt digest.","Every later trust predecessor is the immediately previous slot receipt digest.","Every trust slot binds a digest-only idempotency key.","Every trust-slot evidence origin is FIXTURE_ONLY.","Every trust slot retains liveEvidencePresent=false.","Every trust slot retains keyMaterialCreated=false.","Every trust slot retains keyRotated=false.","Every trust slot retains keyRevoked=false.","Every trust slot retains compensationExecuted=false.","Every trust slot retains leaseOrGrantExpired=false.","Every trust slot retains auditWriteExecuted=false.","Every trust slot retains effectExecuted=false.","Every trust slot retains hostStarted=false.","Every trust slot retains productionConfigured=false.","Every trust-slot validity window is no longer than 3600 seconds.","Every trust-slot receipt must have a valid canonical SHA-256 digest.","Every trust-slot receipt must pass an authoritative positive verifier callback.","The request accepts no unknown fields.","The request action and fixture-only trust mode are exact constants.","The request binds the exact upstream execution-handoff receipt digest.","The request binds the exact authority-trust dossier digest.","The request binds all six ordered trust-slot names.","The request binds all six ordered trust-slot receipt digests.","The request nonce has a fixed digest form and can be prepared only once.","The request validity window is no longer than 30 seconds.","Only a WeakMap-backed opaque handle can project the trust-admission receipt.","Projection is one-shot.","An expired handle cannot project a trust-admission receipt.","Disposal is idempotent.","Projected receipt verification is deterministic and side-effect free.","The projected receipt reports exactly six fixture trust shapes.","The projected receipt preserves one-host and 500 milli-USD maximum bounds.","The projected receipt reports zero production authority interfaces and pinned production keys.","The projected receipt reports zero key rotation and grant revocation drills.","The projected receipt reports zero compensation, lease-expiry and grant-expiry drills.","The projected receipt reports zero immutable audit witnesses.","The projected receipt creates, rotates and revokes zero keys.","The projected receipt revokes zero grants and executes zero compensations.","The projected receipt expires zero leases and writes zero audit entries.","The projected receipt reports zero transaction commits and execution authorizations.","The projected receipt reports zero host runs, claims and processes.","The projected receipt reports zero external reads, writes and mutations.","The projected receipt reports zero services, listeners, proxies and public routes.","The projected receipt grants no transaction, launch, billing or promotion authority.","The projected receipt cannot claim a paid resource.","No fixture receipt, key identifier or boolean flag can be promoted into production authority trust.","Key, KMS, audit, provider, budget, capacity, payment, transaction, execution and host clients plus secrets, commands and production imports are prohibited."],"productionPrerequisites":["Versioned production interface manifests for transaction, budget, capacity, policy, execution and audit authorities.","Separate least-privilege runtime identities with no authority owning the complete execution chain.","Explicit read, write and effect allowlists plus typed failure contracts for every production interface.","A pinned transaction-ledger verification key with owner and generation evidence.","A pinned budget-settlement verification key with owner and generation evidence.","A pinned capacity-lease verification key with owner and generation evidence.","A pinned execution-policy verification key with owner and generation evidence.","A pinned execution-grant verification key with owner and generation evidence.","A pinned immutable-audit witness key isolated from transaction and execution authorities.","Witnessed signing-key rotation drills with overlap, cutover and old-generation denial.","Witnessed emergency key-revocation drills with bounded propagation time.","Witnessed one-shot grant revocation and replay-denial drills.","Automatic and manual budget-settlement reversal drills with immutable receipts.","Lease release, expiry and ambiguous-activation drills that cannot leak capacity.","Grant expiry, post-consumption destruction and stale-generation denial drills.","Immutable append-only audit storage with retention, access and integrity policy.","Independent audit-chain continuity and terminal-outcome witness verification.","Incident response, containment, rollback and recovery proof for authority compromise.","Owner approval for an isolated no-shell production driver that consumes only the one-shot grant."],"selectedDenialTrace":{"fixtureId":"RFDHLEAATRA-115","mutation":"DOSSIER_AUTHORITY_TRUST_PERMITTED","expected":"DENY","reason":"A caller cannot turn six fixture-only trust shapes into production authority trust by setting authorityTrustPermitted=true; no key, grant, revocation, audit write or host capability is issued."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":116,"acceptedOutcomes":20,"deniedOutcomes":96,"upstreamReceiptsVerified":89,"trustSlotReceiptsVerified":236,"trustReceiptsVerified":3,"projectedAdmissions":22,"disposedHandles":2,"productionAuthorityInterfacesObserved":0,"pinnedProductionKeysObserved":0,"keyRotationDrillsObserved":0,"grantRevocationDrillsObserved":0,"compensationDrillsObserved":0,"leaseExpiryDrillsObserved":0,"grantExpiryDrillsObserved":0,"immutableAuditWitnessesObserved":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"productionAuthorityInterfacesObserved":0,"pinnedProductionKeysObserved":0,"keyRotationDrillsObserved":0,"grantRevocationDrillsObserved":0,"compensationDrillsObserved":0,"leaseExpiryDrillsObserved":0,"grantExpiryDrillsObserved":0,"immutableAuditWitnessesObserved":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"authorityTrustPermitted":false,"executionHandoffPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-trust-revocation-admission-fixtures/v1","description":"Deterministic fixture-only authority-interface, key-custody, revocation, compensation, expiry and immutable-audit admission cases. No key, grant, revocation, audit write, host launch, billing or paid resource is created.","mode":"FIXTURE_AUTHORITY_TRUST_REVOCATION_ONLY_NO_KEY_CREATION_NO_GRANT_NO_REVOCATION_NO_HOST_START","networkRequestsExecuted":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"transactionCommitsExecuted":0,"executionAuthorizationsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFDHLEAATRA-001","expected":"ACCEPT","mutation":"PREPARE_BASELINE"},{"id":"RFDHLEAATRA-002","expected":"ACCEPT","mutation":"PROJECT_BASELINE"},{"id":"RFDHLEAATRA-003","expected":"ACCEPT","mutation":"VERIFY_RECEIPT"},{"id":"RFDHLEAATRA-004","expected":"ACCEPT","mutation":"VERIFY_REPLAY"},{"id":"RFDHLEAATRA-005","expected":"ACCEPT","mutation":"DISPOSE_REPLAY"},{"id":"RFDHLEAATRA-006","expected":"ACCEPT","mutation":"REQUEST_WINDOW_EDGE"},{"id":"RFDHLEAATRA-007","expected":"ACCEPT","mutation":"COST_ZERO_EDGE"},{"id":"RFDHLEAATRA-008","expected":"ACCEPT","mutation":"COST_CAP_EDGE"},{"id":"RFDHLEAATRA-009","expected":"ACCEPT","mutation":"SLOT_VALIDITY_EDGE"},{"id":"RFDHLEAATRA-010","expected":"ACCEPT","mutation":"PROJECT_OBSERVED_AT_EDGE"},{"id":"RFDHLEAATRA-011","expected":"ACCEPT","mutation":"DISPOSE_AFTER_PROJECT"},{"id":"RFDHLEAATRA-012","expected":"ACCEPT","mutation":"INDEPENDENT_DOSSIER_CLONE"},{"id":"RFDHLEAATRA-013","expected":"ACCEPT","mutation":"UPSTREAM_COST_ZERO_EDGE"},{"id":"RFDHLEAATRA-014","expected":"ACCEPT","mutation":"QUOTE_AGE_EXACT"},{"id":"RFDHLEAATRA-015","expected":"ACCEPT","mutation":"HOLD_TTL_EXACT"},{"id":"RFDHLEAATRA-016","expected":"ACCEPT","mutation":"CLAIM_TTL_EXACT"},{"id":"RFDHLEAATRA-017","expected":"DENY","mutation":"EXECUTABLE_KEY"},{"id":"RFDHLEAATRA-018","expected":"DENY","mutation":"RECEIPT_TRANSACTION_COMMITTED"},{"id":"RFDHLEAATRA-019","expected":"DENY","mutation":"PRICING_CLIENT_KEY"},{"id":"RFDHLEAATRA-020","expected":"DENY","mutation":"BUDGET_CLIENT_KEY"},{"id":"RFDHLEAATRA-021","expected":"DENY","mutation":"CAPACITY_CLIENT_KEY"},{"id":"RFDHLEAATRA-022","expected":"DENY","mutation":"HOST_PROVIDER_KEY"},{"id":"RFDHLEAATRA-023","expected":"DENY","mutation":"PAYMENT_CLIENT_KEY"},{"id":"RFDHLEAATRA-024","expected":"DENY","mutation":"COMMIT_TRANSACTION_KEY"},{"id":"RFDHLEAATRA-025","expected":"DENY","mutation":"UPSTREAM_SCHEMA"},{"id":"RFDHLEAATRA-026","expected":"DENY","mutation":"UPSTREAM_STATUS"},{"id":"RFDHLEAATRA-027","expected":"DENY","mutation":"UPSTREAM_VERDICT"},{"id":"RFDHLEAATRA-028","expected":"DENY","mutation":"UPSTREAM_MODE"},{"id":"RFDHLEAATRA-029","expected":"DENY","mutation":"UPSTREAM_ID"},{"id":"RFDHLEAATRA-030","expected":"DENY","mutation":"UPSTREAM_DIGEST"},{"id":"RFDHLEAATRA-031","expected":"DENY","mutation":"UPSTREAM_STEP_COUNT"},{"id":"RFDHLEAATRA-032","expected":"DENY","mutation":"UPSTREAM_PLAN_VERIFIED"},{"id":"RFDHLEAATRA-033","expected":"DENY","mutation":"UPSTREAM_HOST_COUNT"},{"id":"RFDHLEAATRA-034","expected":"DENY","mutation":"UPSTREAM_COST_OVER"},{"id":"RFDHLEAATRA-035","expected":"DENY","mutation":"UPSTREAM_CURRENCY"},{"id":"RFDHLEAATRA-036","expected":"DENY","mutation":"UPSTREAM_QUOTE_AGE"},{"id":"RFDHLEAATRA-037","expected":"DENY","mutation":"UPSTREAM_HOLD_TTL"},{"id":"RFDHLEAATRA-038","expected":"DENY","mutation":"UPSTREAM_CLAIM_TTL"},{"id":"RFDHLEAATRA-039","expected":"DENY","mutation":"UPSTREAM_REAL_CONFIRMATION"},{"id":"RFDHLEAATRA-040","expected":"DENY","mutation":"UPSTREAM_LIVE_QUOTE"},{"id":"RFDHLEAATRA-041","expected":"DENY","mutation":"UPSTREAM_BUDGET_HOLD"},{"id":"RFDHLEAATRA-042","expected":"DENY","mutation":"UPSTREAM_HOST_CLAIM"},{"id":"RFDHLEAATRA-043","expected":"DENY","mutation":"UPSTREAM_TRANSACTION_AUTHORITY"},{"id":"RFDHLEAATRA-044","expected":"DENY","mutation":"UPSTREAM_HOST_RUN"},{"id":"RFDHLEAATRA-045","expected":"DENY","mutation":"UPSTREAM_PAID_RESOURCE"},{"id":"RFDHLEAATRA-046","expected":"DENY","mutation":"UPSTREAM_EXPIRED"},{"id":"RFDHLEAATRA-047","expected":"DENY","mutation":"UPSTREAM_VERIFIER_FALSE"},{"id":"RFDHLEAATRA-048","expected":"DENY","mutation":"UPSTREAM_VERIFIER_THROW"},{"id":"RFDHLEAATRA-049","expected":"DENY","mutation":"DOSSIER_SCHEMA"},{"id":"RFDHLEAATRA-050","expected":"DENY","mutation":"DOSSIER_UPSTREAM"},{"id":"RFDHLEAATRA-051","expected":"DENY","mutation":"DOSSIER_CONFIRMATION_SCOPE"},{"id":"RFDHLEAATRA-052","expected":"DENY","mutation":"DOSSIER_ECONOMIC_SCOPE"},{"id":"RFDHLEAATRA-053","expected":"DENY","mutation":"DOSSIER_HOST_COUNT"},{"id":"RFDHLEAATRA-054","expected":"DENY","mutation":"DOSSIER_COST_OVER"},{"id":"RFDHLEAATRA-055","expected":"DENY","mutation":"DOSSIER_CURRENCY"},{"id":"RFDHLEAATRA-056","expected":"DENY","mutation":"DOSSIER_QUOTE_AGE"},{"id":"RFDHLEAATRA-057","expected":"DENY","mutation":"DOSSIER_HOLD_TTL"},{"id":"RFDHLEAATRA-058","expected":"DENY","mutation":"DOSSIER_CLAIM_TTL"},{"id":"RFDHLEAATRA-059","expected":"DENY","mutation":"DOSSIER_COMMIT_PERMITTED"},{"id":"RFDHLEAATRA-060","expected":"DENY","mutation":"DOSSIER_ORDERING"},{"id":"RFDHLEAATRA-061","expected":"DENY","mutation":"DOSSIER_FAILURE_POLICY"},{"id":"RFDHLEAATRA-062","expected":"DENY","mutation":"DOSSIER_REAL_CONFIRMATION"},{"id":"RFDHLEAATRA-063","expected":"DENY","mutation":"DOSSIER_LIVE_QUOTE"},{"id":"RFDHLEAATRA-064","expected":"DENY","mutation":"DOSSIER_BUDGET_HOLD"},{"id":"RFDHLEAATRA-065","expected":"DENY","mutation":"DOSSIER_HOST_CLAIM"},{"id":"RFDHLEAATRA-066","expected":"DENY","mutation":"DOSSIER_COORDINATOR"},{"id":"RFDHLEAATRA-067","expected":"DENY","mutation":"DOSSIER_COMPENSATION"},{"id":"RFDHLEAATRA-068","expected":"DENY","mutation":"DOSSIER_EXECUTION_PERMITTED"},{"id":"RFDHLEAATRA-069","expected":"DENY","mutation":"DOSSIER_DIGEST"},{"id":"RFDHLEAATRA-070","expected":"DENY","mutation":"SLOT_COUNT"},{"id":"RFDHLEAATRA-071","expected":"DENY","mutation":"SLOT_ORDER"},{"id":"RFDHLEAATRA-072","expected":"DENY","mutation":"SLOT_ORDINAL"},{"id":"RFDHLEAATRA-073","expected":"DENY","mutation":"SLOT_NAME"},{"id":"RFDHLEAATRA-074","expected":"DENY","mutation":"SLOT_DECISION"},{"id":"RFDHLEAATRA-075","expected":"DENY","mutation":"SLOT_AUTHORITY"},{"id":"RFDHLEAATRA-076","expected":"DENY","mutation":"SLOT_SIGNER"},{"id":"RFDHLEAATRA-077","expected":"DENY","mutation":"SLOT_MODE"},{"id":"RFDHLEAATRA-078","expected":"DENY","mutation":"SLOT_BINDING"},{"id":"RFDHLEAATRA-079","expected":"DENY","mutation":"SLOT_UPSTREAM"},{"id":"RFDHLEAATRA-080","expected":"DENY","mutation":"SLOT_DOSSIER"},{"id":"RFDHLEAATRA-081","expected":"DENY","mutation":"SLOT_PREDECESSOR"},{"id":"RFDHLEAATRA-082","expected":"DENY","mutation":"SLOT_IDEMPOTENCY"},{"id":"RFDHLEAATRA-083","expected":"DENY","mutation":"SLOT_ORIGIN"},{"id":"RFDHLEAATRA-084","expected":"DENY","mutation":"SLOT_LIVE_RECEIPT"},{"id":"RFDHLEAATRA-085","expected":"DENY","mutation":"SLOT_EFFECT"},{"id":"RFDHLEAATRA-086","expected":"DENY","mutation":"SLOT_DURABLE_WRITE"},{"id":"RFDHLEAATRA-087","expected":"DENY","mutation":"SLOT_HOST_CLAIM"},{"id":"RFDHLEAATRA-088","expected":"DENY","mutation":"SLOT_COMMIT"},{"id":"RFDHLEAATRA-089","expected":"DENY","mutation":"SLOT_PRODUCTION_CONFIGURED"},{"id":"RFDHLEAATRA-090","expected":"DENY","mutation":"SLOT_EXPIRED"},{"id":"RFDHLEAATRA-091","expected":"DENY","mutation":"SLOT_WINDOW_LONG"},{"id":"RFDHLEAATRA-092","expected":"DENY","mutation":"SLOT_DIGEST"},{"id":"RFDHLEAATRA-093","expected":"DENY","mutation":"SLOT_VERIFIER_FALSE"},{"id":"RFDHLEAATRA-094","expected":"DENY","mutation":"SLOT_VERIFIER_THROW"},{"id":"RFDHLEAATRA-095","expected":"DENY","mutation":"REQUEST_SCHEMA"},{"id":"RFDHLEAATRA-096","expected":"DENY","mutation":"REQUEST_ACTION"},{"id":"RFDHLEAATRA-097","expected":"DENY","mutation":"REQUEST_MODE"},{"id":"RFDHLEAATRA-098","expected":"DENY","mutation":"REQUEST_UPSTREAM"},{"id":"RFDHLEAATRA-099","expected":"DENY","mutation":"REQUEST_DOSSIER"},{"id":"RFDHLEAATRA-100","expected":"DENY","mutation":"REQUEST_SLOT_ORDER"},{"id":"RFDHLEAATRA-101","expected":"DENY","mutation":"REQUEST_DIGESTS"},{"id":"RFDHLEAATRA-102","expected":"DENY","mutation":"REQUEST_NONCE_INVALID"},{"id":"RFDHLEAATRA-103","expected":"DENY","mutation":"REQUEST_EXPIRED"},{"id":"RFDHLEAATRA-104","expected":"DENY","mutation":"REQUEST_WINDOW_LONG"},{"id":"RFDHLEAATRA-105","expected":"DENY","mutation":"REQUEST_REPLAY"},{"id":"RFDHLEAATRA-106","expected":"DENY","mutation":"RECONSTRUCTED_HANDLE"},{"id":"RFDHLEAATRA-107","expected":"DENY","mutation":"DISPOSED_HANDLE"},{"id":"RFDHLEAATRA-108","expected":"DENY","mutation":"PROJECT_REPLAY"},{"id":"RFDHLEAATRA-109","expected":"ACCEPT","mutation":"HANDOFF_ORDER_EXACT"},{"id":"RFDHLEAATRA-110","expected":"ACCEPT","mutation":"POLICY_REVALIDATION_REQUIRED_EXACT"},{"id":"RFDHLEAATRA-111","expected":"DENY","mutation":"DOSSIER_EXECUTION_HANDOFF_PERMITTED"},{"id":"RFDHLEAATRA-112","expected":"DENY","mutation":"RECEIPT_EXECUTION_AUTHORIZED"},{"id":"RFDHLEAATRA-113","expected":"ACCEPT","mutation":"AUDIT_WITNESS_REQUIRED_EXACT"},{"id":"RFDHLEAATRA-114","expected":"ACCEPT","mutation":"FAILURE_POLICY_EXACT"},{"id":"RFDHLEAATRA-115","expected":"DENY","mutation":"DOSSIER_AUTHORITY_TRUST_PERMITTED"},{"id":"RFDHLEAATRA-116","expected":"DENY","mutation":"RECEIPT_AUTHORITY_TRUST_PERMITTED"}]}},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReview":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T16:30:00Z","scope":{"mode":"FIXTURE_COMPROMISE_CONTAINMENT_RECOVERY_REVIEW_ONLY_NO_QUARANTINE_NO_KEY_ACTION_NO_AUDIT_WRITE_NO_HOST_START","input":"POSITIVELY_VERIFIED_FIXTURE_EXECUTION_AUTHORIZATION_AUTHORITY_TRUST_REVOCATION_ADMISSION_RECEIPT","output":"AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_PRODUCTION_COMPROMISE_SIGNALS_QUARANTINE_GENERATION_CONTAINMENT_COMPENSATION_AUDIT_CONTINUITY_ESCALATION_AND_RECOVERY_EVIDENCE","fixtureRecoveryShapesVerified":7,"productionCompromiseSignalPresent":false,"generationQuarantined":false,"grantsAndLeasesContained":false,"settlementAndCapacityCompensated":false,"auditContinuityProven":false,"operatorEscalationApproved":false,"recoveryGenerationReadmitted":false,"keyMaterialCreated":false,"containmentReviewPermitted":false,"recoveryPermitted":false,"hostStarted":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-trust-revocation-admission-receipt/v1","status":"EXECUTION_AUTHORIZATION_AUTHORITY_TRUST_REVOCATION_ADMISSION_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_PRODUCTION_INTERFACES_PINNED_KEYS_REVOCATION_COMPENSATION_EXPIRY_AND_IMMUTABLE_AUDIT_EVIDENCE","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"authority-trust receipt + containment-recovery dossier + seven recovery-shape receipts + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only containment and recovery review receipt","sideEffect":"NONE"},{"id":"verify","input":"containment and recovery review receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"recoverySlots":[{"ordinal":1,"slot":"COMPROMISE_SIGNAL_ADMISSION","authority":"SECURITY_DETECTION_AUTHORITY","signerKeyId":"fixture-p256-security-detection-authority","requiredBinding":"BIND_SIGNALS_TO_AUTHORITY_KEY_GENERATION_AND_INCIDENT_WINDOW","observedLive":false},{"ordinal":2,"slot":"KEY_GENERATION_QUARANTINE_ADMISSION","authority":"KEY_QUARANTINE_AUTHORITY","signerKeyId":"fixture-p256-key-quarantine-authority","requiredBinding":"BIND_QUARANTINE_TO_EXACT_COMPROMISED_GENERATION_AND_SUCCESSOR_DENYLIST","observedLive":false},{"ordinal":3,"slot":"GRANT_AND_LEASE_CONTAINMENT_ADMISSION","authority":"EXECUTION_CONTAINMENT_AUTHORITY","signerKeyId":"fixture-p256-execution-containment-authority","requiredBinding":"BIND_GRANT_REVOCATION_AND_LEASE_EXPIRY_TO_AFFECTED_GENERATION","observedLive":false},{"ordinal":4,"slot":"SETTLEMENT_AND_CAPACITY_COMPENSATION_ADMISSION","authority":"COMPENSATION_RECOVERY_AUTHORITY","signerKeyId":"fixture-p256-compensation-recovery-authority","requiredBinding":"BIND_REVERSAL_AND_CAPACITY_RELEASE_TO_AMBIGUOUS_OUTCOMES","observedLive":false},{"ordinal":5,"slot":"AUDIT_CHAIN_CONTINUITY_ADMISSION","authority":"AUDIT_CONTINUITY_AUTHORITY","signerKeyId":"fixture-p256-audit-continuity-authority","requiredBinding":"BIND_PRE_AND_POST_INCIDENT_WITNESSES_WITH_NO_GAP_OR_REWRITE","observedLive":false},{"ordinal":6,"slot":"OPERATOR_ESCALATION_DECISION_ADMISSION","authority":"INCIDENT_COMMAND_AUTHORITY","signerKeyId":"fixture-p256-incident-command-authority","requiredBinding":"BIND_HUMAN_ESCALATION_TO_SEVERITY_SCOPE_AND_CONTAINMENT_DEADLINE","observedLive":false},{"ordinal":7,"slot":"RECOVERY_GENERATION_READMISSION_REVIEW","authority":"RECOVERY_ADMISSION_AUTHORITY","signerKeyId":"fixture-p256-recovery-admission-authority","requiredBinding":"BIND_SUCCESSOR_GENERATION_TO_FRESH_KEYS_DRILLS_WITNESS_AND_OWNER_APPROVAL","observedLive":false}],"authorityTopology":[{"authority":"SECURITY_DETECTION_AUTHORITY","slots":1,"mayQuarantineGeneration":false,"mayRevokeGrant":false,"mayExpireLease":false,"mayExecuteCompensation":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"KEY_QUARANTINE_AUTHORITY","slots":1,"mayQuarantineGeneration":false,"mayRevokeGrant":false,"mayExpireLease":false,"mayExecuteCompensation":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"EXECUTION_CONTAINMENT_AUTHORITY","slots":1,"mayQuarantineGeneration":false,"mayRevokeGrant":false,"mayExpireLease":false,"mayExecuteCompensation":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"COMPENSATION_RECOVERY_AUTHORITY","slots":1,"mayQuarantineGeneration":false,"mayRevokeGrant":false,"mayExpireLease":false,"mayExecuteCompensation":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"AUDIT_CONTINUITY_AUTHORITY","slots":1,"mayQuarantineGeneration":false,"mayRevokeGrant":false,"mayExpireLease":false,"mayExecuteCompensation":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"INCIDENT_COMMAND_AUTHORITY","slots":1,"mayQuarantineGeneration":false,"mayRevokeGrant":false,"mayExpireLease":false,"mayExecuteCompensation":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"RECOVERY_ADMISSION_AUTHORITY","slots":1,"mayQuarantineGeneration":false,"mayRevokeGrant":false,"mayExpireLease":false,"mayExecuteCompensation":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false}],"recoveryGuardrails":{"requestValiditySeconds":30,"recoveryShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"currency":"USD","containmentOrdering":"DETECT_THEN_QUARANTINE_GENERATION_THEN_CONTAIN_GRANTS_AND_LEASES_THEN_COMPENSATE_THEN_PROVE_AUDIT_CONTINUITY_THEN_ESCALATE_THEN_REVIEW_RECOVERY","failurePolicy":"KEEP_GENERATION_QUARANTINED_REVOKE_AND_EXPIRE_AUTHORITY_CONTAIN_OR_ESCALATE","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","productionCompromiseSignalPresent":false,"generationQuarantined":false,"grantsAndLeasesContained":false,"settlementAndCapacityCompensated":false,"auditContinuityProven":false,"operatorEscalationApproved":false,"recoveryGenerationReadmitted":false,"containmentReviewPermitted":false,"recoveryPermitted":false,"executionAuthorized":false,"hostStarted":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_AUTHORITY_TRUST_ADMISSION_VERIFIED","CONTAINMENT_RECOVERY_DOSSIER_BOUND","COMPROMISE_SIGNAL_SHAPE_VERIFIED","KEY_GENERATION_QUARANTINE_SHAPE_VERIFIED","GRANT_LEASE_CONTAINMENT_SHAPE_VERIFIED","SETTLEMENT_CAPACITY_COMPENSATION_SHAPE_VERIFIED","AUDIT_CHAIN_CONTINUITY_SHAPE_VERIFIED","OPERATOR_ESCALATION_SHAPE_VERIFIED","RECOVERY_READMISSION_SHAPE_VERIFIED","CONTAINMENT_ORDER_FROZEN","PREDECESSOR_CHAIN_BOUND","IDEMPOTENCY_BOUND","FAILURE_POLICY_BOUND","AUTHORITY_SEPARATION_BOUND","CONTAINMENT_RECOVERY_REVIEW_PREPARED_FIXTURE_ONLY","CONTAINMENT_RECOVERY_REVIEW_RECEIPT_PROJECTED","CONTAINMENT_RECOVERY_REVIEW_RECEIPT_VERIFIED","DENIED_OR_DISPOSED"],"invariants":["Only the exact unexpired fixture execution-handoff receipt is accepted.","The upstream execution-handoff receipt must pass an authoritative positive verifier callback.","The upstream handoff identity is deterministically derived from its predecessor, dossier, nonce and request time.","The upstream status, verdict and fixture-only mode cannot be upgraded by callers.","The upstream receipt must retain exactly five handoff slots and five receipt digests.","The upstream receipt must report exactly five fixture handoff shapes.","The upstream receipt must report zero real commit, settlement, lease, grant and execution effects.","The upstream host count and cost ceiling remain bounded to one host and 500 milli-USD.","The upstream currency is exactly USD.","The upstream receipt must remain within its validity window.","The upstream receipt must have a valid canonical SHA-256 digest.","The authority-trust dossier accepts no unknown fields.","The dossier binds the exact upstream execution-handoff receipt digest.","The dossier binds the exact confirmation scope digest.","The dossier binds the exact economic scope digest.","The dossier is bounded to exactly one host.","The dossier cost ceiling is an integer from zero through 500 milli-USD.","A versioned production authority-interface manifest is always required.","Pinned production signing-key custody evidence is always required.","Key rotation and grant revocation drill evidence is always required.","Settlement and lease compensation drill evidence is always required.","Lease and execution-grant expiry drill evidence is always required.","An immutable audit witness is always required.","The dossier must retain productionInterfaceManifestPresent=false.","The dossier must retain pinnedProductionKeysPresent=false.","The dossier must retain rotationRevocationDrillsPresent=false.","The dossier must retain compensationDrillsPresent=false.","The dossier must retain leaseGrantExpiryDrillsPresent=false.","The dossier must retain immutableAuditWitnessPresent=false.","The dossier must retain authorityTrustPermitted=false.","The dossier must retain executionHandoffPermitted=false.","The dossier must retain executionPermitted=false.","The only trust order is interfaces, keys, rotation/revocation, compensation, expiry, then audit witness.","The only failure policy revokes and expires grants, releases settlement and lease, or contains the transaction.","Exactly six ordered authority-trust shape receipts are required.","Trust-slot order and ordinal values are immutable.","Every trust slot is owned by its exact independent authority.","Every trust slot is pinned to its exact fixture signer key.","Every trust slot uses its exact allowlisted required binding.","Every trust decision is AUTHORITY_TRUST_SHAPE_VERIFIED_FIXTURE_ONLY.","Every trust mode denies keys, grants and audit writes.","Every trust slot binds the exact upstream execution-handoff receipt digest.","Every trust slot binds the exact authority-trust dossier digest.","The first trust predecessor is the upstream execution-handoff receipt digest.","Every later trust predecessor is the immediately previous slot receipt digest.","Every trust slot binds a digest-only idempotency key.","Every trust-slot evidence origin is FIXTURE_ONLY.","Every trust slot retains liveEvidencePresent=false.","Every trust slot retains keyMaterialCreated=false.","Every trust slot retains keyRotated=false.","Every trust slot retains keyRevoked=false.","Every trust slot retains compensationExecuted=false.","Every trust slot retains leaseOrGrantExpired=false.","Every trust slot retains auditWriteExecuted=false.","Every trust slot retains effectExecuted=false.","Every trust slot retains hostStarted=false.","Every trust slot retains productionConfigured=false.","Every trust-slot validity window is no longer than 3600 seconds.","Every trust-slot receipt must have a valid canonical SHA-256 digest.","Every trust-slot receipt must pass an authoritative positive verifier callback.","The request accepts no unknown fields.","The request action and fixture-only trust mode are exact constants.","The request binds the exact upstream execution-handoff receipt digest.","The request binds the exact authority-trust dossier digest.","The request binds all six ordered trust-slot names.","The request binds all six ordered trust-slot receipt digests.","The request nonce has a fixed digest form and can be prepared only once.","The request validity window is no longer than 30 seconds.","Only a WeakMap-backed opaque handle can project the trust-admission receipt.","Projection is one-shot.","An expired handle cannot project a trust-admission receipt.","Disposal is idempotent.","Projected receipt verification is deterministic and side-effect free.","The projected receipt reports exactly six fixture trust shapes.","The projected receipt preserves one-host and 500 milli-USD maximum bounds.","The projected receipt reports zero production authority interfaces and pinned production keys.","The projected receipt reports zero key rotation and grant revocation drills.","The projected receipt reports zero compensation, lease-expiry and grant-expiry drills.","The projected receipt reports zero immutable audit witnesses.","The projected receipt creates, rotates and revokes zero keys.","The projected receipt revokes zero grants and executes zero compensations.","The projected receipt expires zero leases and writes zero audit entries.","The projected receipt reports zero transaction commits and execution authorizations.","The projected receipt reports zero host runs, claims and processes.","The projected receipt reports zero external reads, writes and mutations.","The projected receipt reports zero services, listeners, proxies and public routes.","The projected receipt grants no transaction, launch, billing or promotion authority.","The projected receipt cannot claim a paid resource.","No fixture receipt, key identifier or boolean flag can be promoted into production authority trust.","Key, KMS, audit, provider, budget, capacity, payment, transaction, execution and host clients plus secrets, commands and production imports are prohibited.","The compromise signal must bind the exact authority, key generation and bounded incident window before any containment review can proceed.","A compromised key generation remains quarantined until grants and leases are contained and settlement plus capacity compensation is independently evidenced.","Audit-chain recovery requires gap-free pre-incident and post-incident witnesses; a rewritten or discontinuous chain is always denied.","Recovery readmission requires a successor generation, fresh pinned keys, repeated drills, immutable witnesses and independent owner approval."],"productionPrerequisites":["Versioned production interface manifests for transaction, budget, capacity, policy, execution and audit authorities.","Separate least-privilege runtime identities with no authority owning the complete execution chain.","Explicit read, write and effect allowlists plus typed failure contracts for every production interface.","A pinned transaction-ledger verification key with owner and generation evidence.","A pinned budget-settlement verification key with owner and generation evidence.","A pinned capacity-lease verification key with owner and generation evidence.","A pinned execution-policy verification key with owner and generation evidence.","A pinned execution-grant verification key with owner and generation evidence.","A pinned immutable-audit witness key isolated from transaction and execution authorities.","Witnessed signing-key rotation drills with overlap, cutover and old-generation denial.","Witnessed emergency key-revocation drills with bounded propagation time.","Witnessed one-shot grant revocation and replay-denial drills.","Automatic and manual budget-settlement reversal drills with immutable receipts.","Lease release, expiry and ambiguous-activation drills that cannot leak capacity.","Grant expiry, post-consumption destruction and stale-generation denial drills.","Immutable append-only audit storage with retention, access and integrity policy.","Independent audit-chain continuity and terminal-outcome witness verification.","Incident response, containment, rollback and recovery proof for authority compromise.","Owner approval for an isolated no-shell production driver that consumes only the one-shot grant.","Production compromise-signal intake, generation quarantine, grant and lease containment, compensation, audit-continuity, incident-command and recovery-readmission evidence from seven separated authorities."],"selectedDenialTrace":{"fixtureId":"RFDHLEAACCRR-119","mutation":"DOSSIER_RECOVERY_PERMITTED","expected":"DENY","reason":"A caller cannot turn seven fixture-only containment and recovery shapes into production recovery authority by setting recoveryPermitted=true; the compromised generation remains quarantined and no key, grant, compensation, audit write or host capability is issued."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":120,"acceptedOutcomes":22,"deniedOutcomes":98,"upstreamReceiptsVerified":98,"recoverySlotReceiptsVerified":331,"recoveryReceiptsVerified":3,"projectedReviews":25,"disposedHandles":2,"productionCompromiseSignalsObserved":0,"quarantinedKeyGenerations":0,"grantContainmentsObserved":0,"leaseContainmentsObserved":0,"settlementCompensationsObserved":0,"capacityReleasesObserved":0,"auditContinuityWitnessesObserved":0,"operatorEscalationsObserved":0,"recoveryReadmissionsObserved":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"productionCompromiseSignalsObserved":0,"quarantinedKeyGenerations":0,"grantContainmentsObserved":0,"leaseContainmentsObserved":0,"settlementCompensationsObserved":0,"capacityReleasesObserved":0,"auditContinuityWitnessesObserved":0,"operatorEscalationsObserved":0,"recoveryReadmissionsObserved":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionDriversObserved":0,"watchdogArmingsObserved":0,"networkLeasesObserved":0,"imageAttestationsObserved":0,"retirementDrillsObserved":0,"incidentWindowsObserved":0,"productionHostRuns":0,"productionHostClaims":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"containmentReviewPermitted":false,"recoveryPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-fixtures/v1","description":"Deterministic fixture-only authority-compromise containment, audit-chain continuity and recovery-review cases. No quarantine, key action, grant revocation, compensation, audit write, recovery admission, host launch, billing or paid resource is executed.","mode":"FIXTURE_COMPROMISE_CONTAINMENT_RECOVERY_REVIEW_ONLY_NO_QUARANTINE_NO_KEY_ACTION_NO_AUDIT_WRITE_NO_HOST_START","networkRequestsExecuted":0,"compromiseSignalsConsumed":0,"keyGenerationsQuarantined":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"operatorEscalationsExecuted":0,"recoveryReadmissionsExecuted":0,"transactionCommitsExecuted":0,"executionAuthorizationsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFDHLEAACCRR-001","expected":"ACCEPT","mutation":"PREPARE_BASELINE"},{"id":"RFDHLEAACCRR-002","expected":"ACCEPT","mutation":"PROJECT_BASELINE"},{"id":"RFDHLEAACCRR-003","expected":"ACCEPT","mutation":"VERIFY_RECEIPT"},{"id":"RFDHLEAACCRR-004","expected":"ACCEPT","mutation":"VERIFY_REPLAY"},{"id":"RFDHLEAACCRR-005","expected":"ACCEPT","mutation":"DISPOSE_REPLAY"},{"id":"RFDHLEAACCRR-006","expected":"ACCEPT","mutation":"REQUEST_WINDOW_EDGE"},{"id":"RFDHLEAACCRR-007","expected":"ACCEPT","mutation":"COST_ZERO_EDGE"},{"id":"RFDHLEAACCRR-008","expected":"ACCEPT","mutation":"COST_CAP_EDGE"},{"id":"RFDHLEAACCRR-009","expected":"ACCEPT","mutation":"SLOT_VALIDITY_EDGE"},{"id":"RFDHLEAACCRR-010","expected":"ACCEPT","mutation":"PROJECT_OBSERVED_AT_EDGE"},{"id":"RFDHLEAACCRR-011","expected":"ACCEPT","mutation":"DISPOSE_AFTER_PROJECT"},{"id":"RFDHLEAACCRR-012","expected":"ACCEPT","mutation":"INDEPENDENT_DOSSIER_CLONE"},{"id":"RFDHLEAACCRR-013","expected":"ACCEPT","mutation":"UPSTREAM_COST_ZERO_EDGE"},{"id":"RFDHLEAACCRR-014","expected":"ACCEPT","mutation":"QUOTE_AGE_EXACT"},{"id":"RFDHLEAACCRR-015","expected":"ACCEPT","mutation":"HOLD_TTL_EXACT"},{"id":"RFDHLEAACCRR-016","expected":"ACCEPT","mutation":"CLAIM_TTL_EXACT"},{"id":"RFDHLEAACCRR-017","expected":"DENY","mutation":"EXECUTABLE_KEY"},{"id":"RFDHLEAACCRR-018","expected":"DENY","mutation":"RECEIPT_TRANSACTION_COMMITTED"},{"id":"RFDHLEAACCRR-019","expected":"DENY","mutation":"PRICING_CLIENT_KEY"},{"id":"RFDHLEAACCRR-020","expected":"DENY","mutation":"BUDGET_CLIENT_KEY"},{"id":"RFDHLEAACCRR-021","expected":"DENY","mutation":"CAPACITY_CLIENT_KEY"},{"id":"RFDHLEAACCRR-022","expected":"DENY","mutation":"HOST_PROVIDER_KEY"},{"id":"RFDHLEAACCRR-023","expected":"DENY","mutation":"PAYMENT_CLIENT_KEY"},{"id":"RFDHLEAACCRR-024","expected":"DENY","mutation":"COMMIT_TRANSACTION_KEY"},{"id":"RFDHLEAACCRR-025","expected":"DENY","mutation":"UPSTREAM_SCHEMA"},{"id":"RFDHLEAACCRR-026","expected":"DENY","mutation":"UPSTREAM_STATUS"},{"id":"RFDHLEAACCRR-027","expected":"DENY","mutation":"UPSTREAM_VERDICT"},{"id":"RFDHLEAACCRR-028","expected":"DENY","mutation":"UPSTREAM_MODE"},{"id":"RFDHLEAACCRR-029","expected":"DENY","mutation":"UPSTREAM_ID"},{"id":"RFDHLEAACCRR-030","expected":"DENY","mutation":"UPSTREAM_DIGEST"},{"id":"RFDHLEAACCRR-031","expected":"DENY","mutation":"UPSTREAM_STEP_COUNT"},{"id":"RFDHLEAACCRR-032","expected":"DENY","mutation":"UPSTREAM_PLAN_VERIFIED"},{"id":"RFDHLEAACCRR-033","expected":"DENY","mutation":"UPSTREAM_HOST_COUNT"},{"id":"RFDHLEAACCRR-034","expected":"DENY","mutation":"UPSTREAM_COST_OVER"},{"id":"RFDHLEAACCRR-035","expected":"DENY","mutation":"UPSTREAM_CURRENCY"},{"id":"RFDHLEAACCRR-036","expected":"DENY","mutation":"UPSTREAM_QUOTE_AGE"},{"id":"RFDHLEAACCRR-037","expected":"DENY","mutation":"UPSTREAM_HOLD_TTL"},{"id":"RFDHLEAACCRR-038","expected":"DENY","mutation":"UPSTREAM_CLAIM_TTL"},{"id":"RFDHLEAACCRR-039","expected":"DENY","mutation":"UPSTREAM_REAL_CONFIRMATION"},{"id":"RFDHLEAACCRR-040","expected":"DENY","mutation":"UPSTREAM_LIVE_QUOTE"},{"id":"RFDHLEAACCRR-041","expected":"DENY","mutation":"UPSTREAM_BUDGET_HOLD"},{"id":"RFDHLEAACCRR-042","expected":"DENY","mutation":"UPSTREAM_HOST_CLAIM"},{"id":"RFDHLEAACCRR-043","expected":"DENY","mutation":"UPSTREAM_TRANSACTION_AUTHORITY"},{"id":"RFDHLEAACCRR-044","expected":"DENY","mutation":"UPSTREAM_HOST_RUN"},{"id":"RFDHLEAACCRR-045","expected":"DENY","mutation":"UPSTREAM_PAID_RESOURCE"},{"id":"RFDHLEAACCRR-046","expected":"DENY","mutation":"UPSTREAM_EXPIRED"},{"id":"RFDHLEAACCRR-047","expected":"DENY","mutation":"UPSTREAM_VERIFIER_FALSE"},{"id":"RFDHLEAACCRR-048","expected":"DENY","mutation":"UPSTREAM_VERIFIER_THROW"},{"id":"RFDHLEAACCRR-049","expected":"DENY","mutation":"DOSSIER_SCHEMA"},{"id":"RFDHLEAACCRR-050","expected":"DENY","mutation":"DOSSIER_UPSTREAM"},{"id":"RFDHLEAACCRR-051","expected":"DENY","mutation":"DOSSIER_CONFIRMATION_SCOPE"},{"id":"RFDHLEAACCRR-052","expected":"DENY","mutation":"DOSSIER_ECONOMIC_SCOPE"},{"id":"RFDHLEAACCRR-053","expected":"DENY","mutation":"DOSSIER_HOST_COUNT"},{"id":"RFDHLEAACCRR-054","expected":"DENY","mutation":"DOSSIER_COST_OVER"},{"id":"RFDHLEAACCRR-055","expected":"DENY","mutation":"DOSSIER_CURRENCY"},{"id":"RFDHLEAACCRR-056","expected":"DENY","mutation":"DOSSIER_QUOTE_AGE"},{"id":"RFDHLEAACCRR-057","expected":"DENY","mutation":"DOSSIER_HOLD_TTL"},{"id":"RFDHLEAACCRR-058","expected":"DENY","mutation":"DOSSIER_CLAIM_TTL"},{"id":"RFDHLEAACCRR-059","expected":"DENY","mutation":"DOSSIER_COMMIT_PERMITTED"},{"id":"RFDHLEAACCRR-060","expected":"DENY","mutation":"DOSSIER_ORDERING"},{"id":"RFDHLEAACCRR-061","expected":"DENY","mutation":"DOSSIER_FAILURE_POLICY"},{"id":"RFDHLEAACCRR-062","expected":"DENY","mutation":"DOSSIER_REAL_CONFIRMATION"},{"id":"RFDHLEAACCRR-063","expected":"DENY","mutation":"DOSSIER_LIVE_QUOTE"},{"id":"RFDHLEAACCRR-064","expected":"DENY","mutation":"DOSSIER_BUDGET_HOLD"},{"id":"RFDHLEAACCRR-065","expected":"DENY","mutation":"DOSSIER_HOST_CLAIM"},{"id":"RFDHLEAACCRR-066","expected":"DENY","mutation":"DOSSIER_COORDINATOR"},{"id":"RFDHLEAACCRR-067","expected":"DENY","mutation":"DOSSIER_COMPENSATION"},{"id":"RFDHLEAACCRR-068","expected":"DENY","mutation":"DOSSIER_EXECUTION_PERMITTED"},{"id":"RFDHLEAACCRR-069","expected":"DENY","mutation":"DOSSIER_DIGEST"},{"id":"RFDHLEAACCRR-070","expected":"DENY","mutation":"SLOT_COUNT"},{"id":"RFDHLEAACCRR-071","expected":"DENY","mutation":"SLOT_ORDER"},{"id":"RFDHLEAACCRR-072","expected":"DENY","mutation":"SLOT_ORDINAL"},{"id":"RFDHLEAACCRR-073","expected":"DENY","mutation":"SLOT_NAME"},{"id":"RFDHLEAACCRR-074","expected":"DENY","mutation":"SLOT_DECISION"},{"id":"RFDHLEAACCRR-075","expected":"DENY","mutation":"SLOT_AUTHORITY"},{"id":"RFDHLEAACCRR-076","expected":"DENY","mutation":"SLOT_SIGNER"},{"id":"RFDHLEAACCRR-077","expected":"DENY","mutation":"SLOT_MODE"},{"id":"RFDHLEAACCRR-078","expected":"DENY","mutation":"SLOT_BINDING"},{"id":"RFDHLEAACCRR-079","expected":"DENY","mutation":"SLOT_UPSTREAM"},{"id":"RFDHLEAACCRR-080","expected":"DENY","mutation":"SLOT_DOSSIER"},{"id":"RFDHLEAACCRR-081","expected":"DENY","mutation":"SLOT_PREDECESSOR"},{"id":"RFDHLEAACCRR-082","expected":"DENY","mutation":"SLOT_IDEMPOTENCY"},{"id":"RFDHLEAACCRR-083","expected":"DENY","mutation":"SLOT_ORIGIN"},{"id":"RFDHLEAACCRR-084","expected":"DENY","mutation":"SLOT_LIVE_RECEIPT"},{"id":"RFDHLEAACCRR-085","expected":"DENY","mutation":"SLOT_EFFECT"},{"id":"RFDHLEAACCRR-086","expected":"DENY","mutation":"SLOT_DURABLE_WRITE"},{"id":"RFDHLEAACCRR-087","expected":"DENY","mutation":"SLOT_HOST_CLAIM"},{"id":"RFDHLEAACCRR-088","expected":"DENY","mutation":"SLOT_COMMIT"},{"id":"RFDHLEAACCRR-089","expected":"DENY","mutation":"SLOT_PRODUCTION_CONFIGURED"},{"id":"RFDHLEAACCRR-090","expected":"DENY","mutation":"SLOT_EXPIRED"},{"id":"RFDHLEAACCRR-091","expected":"DENY","mutation":"SLOT_WINDOW_LONG"},{"id":"RFDHLEAACCRR-092","expected":"DENY","mutation":"SLOT_DIGEST"},{"id":"RFDHLEAACCRR-093","expected":"DENY","mutation":"SLOT_VERIFIER_FALSE"},{"id":"RFDHLEAACCRR-094","expected":"DENY","mutation":"SLOT_VERIFIER_THROW"},{"id":"RFDHLEAACCRR-095","expected":"DENY","mutation":"REQUEST_SCHEMA"},{"id":"RFDHLEAACCRR-096","expected":"DENY","mutation":"REQUEST_ACTION"},{"id":"RFDHLEAACCRR-097","expected":"DENY","mutation":"REQUEST_MODE"},{"id":"RFDHLEAACCRR-098","expected":"DENY","mutation":"REQUEST_UPSTREAM"},{"id":"RFDHLEAACCRR-099","expected":"DENY","mutation":"REQUEST_DOSSIER"},{"id":"RFDHLEAACCRR-100","expected":"DENY","mutation":"REQUEST_SLOT_ORDER"},{"id":"RFDHLEAACCRR-101","expected":"DENY","mutation":"REQUEST_DIGESTS"},{"id":"RFDHLEAACCRR-102","expected":"DENY","mutation":"REQUEST_NONCE_INVALID"},{"id":"RFDHLEAACCRR-103","expected":"DENY","mutation":"REQUEST_EXPIRED"},{"id":"RFDHLEAACCRR-104","expected":"DENY","mutation":"REQUEST_WINDOW_LONG"},{"id":"RFDHLEAACCRR-105","expected":"DENY","mutation":"REQUEST_REPLAY"},{"id":"RFDHLEAACCRR-106","expected":"DENY","mutation":"RECONSTRUCTED_HANDLE"},{"id":"RFDHLEAACCRR-107","expected":"DENY","mutation":"DISPOSED_HANDLE"},{"id":"RFDHLEAACCRR-108","expected":"DENY","mutation":"PROJECT_REPLAY"},{"id":"RFDHLEAACCRR-109","expected":"ACCEPT","mutation":"HANDOFF_ORDER_EXACT"},{"id":"RFDHLEAACCRR-110","expected":"ACCEPT","mutation":"POLICY_REVALIDATION_REQUIRED_EXACT"},{"id":"RFDHLEAACCRR-111","expected":"DENY","mutation":"DOSSIER_EXECUTION_HANDOFF_PERMITTED"},{"id":"RFDHLEAACCRR-112","expected":"DENY","mutation":"RECEIPT_EXECUTION_AUTHORIZED"},{"id":"RFDHLEAACCRR-113","expected":"ACCEPT","mutation":"AUDIT_WITNESS_REQUIRED_EXACT"},{"id":"RFDHLEAACCRR-114","expected":"ACCEPT","mutation":"FAILURE_POLICY_EXACT"},{"id":"RFDHLEAACCRR-115","expected":"DENY","mutation":"DOSSIER_AUTHORITY_TRUST_PERMITTED"},{"id":"RFDHLEAACCRR-116","expected":"DENY","mutation":"RECEIPT_AUTHORITY_TRUST_PERMITTED"},{"id":"RFDHLEAACCRR-117","expected":"ACCEPT","mutation":"AUDIT_CONTINUITY_REQUIRED_EXACT"},{"id":"RFDHLEAACCRR-118","expected":"ACCEPT","mutation":"QUARANTINE_FAILURE_POLICY_EXACT"},{"id":"RFDHLEAACCRR-119","expected":"DENY","mutation":"DOSSIER_RECOVERY_PERMITTED"},{"id":"RFDHLEAACCRR-120","expected":"DENY","mutation":"RECEIPT_RECOVERY_PERMITTED"}]}},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmission":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_SUCCESSOR_GENERATION_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T18:00:00Z","scope":{"mode":"FIXTURE_SUCCESSOR_GENERATION_ADMISSION_ONLY_NO_KEY_CREATION_NO_GRANT_NO_AUDIT_WRITE_NO_HOST_START","input":"POSITIVELY_VERIFIED_FIXTURE_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_RECEIPT","output":"SUCCESSOR_GENERATION_RECOVERY_ADMISSION_PACKET_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_PRODUCTION_SUCCESSOR_KEY_CUSTODY_REVOKED_GENERATION_PROPAGATION_CLEAN_GRANT_AUDIT_CONTINUATION_AND_OWNER_APPROVAL_EVIDENCE","fixtureAdmissionShapesVerified":5,"freshSuccessorKeyCustodyObserved":false,"revokedGenerationPropagationObserved":false,"cleanGrantIssuanceObserved":false,"auditContinuationObserved":false,"independentOwnerApprovalObserved":false,"successorGenerationAdmissionPermitted":false,"executionPermitted":false,"keyMaterialCreated":false,"hostStarted":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-receipt/v1","status":"AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_PRODUCTION_COMPROMISE_SIGNALS_QUARANTINE_GENERATION_CONTAINMENT_COMPENSATION_AUDIT_CONTINUITY_ESCALATION_AND_RECOVERY_EVIDENCE","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"recovery-review receipt + successor dossier + five admission-shape receipts + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only successor-generation admission receipt","sideEffect":"NONE"},{"id":"verify","input":"successor-generation admission receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"admissionSlots":[{"ordinal":1,"slot":"SUCCESSOR_KEY_CUSTODY_ADMISSION","authority":"SUCCESSOR_KEY_CUSTODY_AUTHORITY","signerKeyId":"fixture-p256-successor-key-custody-authority","requiredBinding":"BIND_FRESH_NON_EXPORTABLE_SUCCESSOR_KEY_TO_NEW_GENERATION_AND_OWNER","observedLive":false},{"ordinal":2,"slot":"REVOKED_GENERATION_PROPAGATION_ADMISSION","authority":"REVOCATION_PROPAGATION_AUTHORITY","signerKeyId":"fixture-p256-revocation-propagation-authority","requiredBinding":"BIND_OLD_GENERATION_DENIAL_TO_ALL_VERIFIERS_GRANTS_AND_LEASES","observedLive":false},{"ordinal":3,"slot":"CLEAN_GRANT_ISSUANCE_ADMISSION","authority":"CLEAN_GRANT_AUTHORITY","signerKeyId":"fixture-p256-clean-grant-authority","requiredBinding":"BIND_ONE_SHOT_GRANT_TO_SUCCESSOR_GENERATION_FRESH_POLICY_AND_NO_PREDECESSOR_PRIVILEGE","observedLive":false},{"ordinal":4,"slot":"AUDIT_CHAIN_CONTINUATION_ADMISSION","authority":"AUDIT_CONTINUATION_AUTHORITY","signerKeyId":"fixture-p256-audit-continuation-authority","requiredBinding":"BIND_FIRST_SUCCESSOR_EVENT_TO_INCIDENT_TERMINAL_WITNESS_WITHOUT_GAP_OR_REWRITE","observedLive":false},{"ordinal":5,"slot":"INDEPENDENT_OWNER_APPROVAL_ADMISSION","authority":"RECOVERY_OWNER_AUTHORITY","signerKeyId":"fixture-p256-recovery-owner-authority","requiredBinding":"BIND_OWNER_APPROVAL_TO_EXACT_SUCCESSOR_GENERATION_SCOPE_DRILLS_AND_EXPIRY","observedLive":false}],"authorityTopology":[{"authority":"SUCCESSOR_KEY_CUSTODY_AUTHORITY","slots":1,"mayCreateKey":false,"mayPropagateRevocation":false,"mayIssueGrant":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"REVOCATION_PROPAGATION_AUTHORITY","slots":1,"mayCreateKey":false,"mayPropagateRevocation":false,"mayIssueGrant":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"CLEAN_GRANT_AUTHORITY","slots":1,"mayCreateKey":false,"mayPropagateRevocation":false,"mayIssueGrant":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"AUDIT_CONTINUATION_AUTHORITY","slots":1,"mayCreateKey":false,"mayPropagateRevocation":false,"mayIssueGrant":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false},{"authority":"RECOVERY_OWNER_AUTHORITY","slots":1,"mayCreateKey":false,"mayPropagateRevocation":false,"mayIssueGrant":false,"mayWriteAudit":false,"mayApproveRecovery":false,"mayStartHost":false}],"admissionGuardrails":{"requestValiditySeconds":30,"admissionShapeValiditySeconds":3600,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"currency":"USD","admissionOrdering":"VERIFY_REVIEW_THEN_PROVE_SUCCESSOR_CUSTODY_THEN_PROVE_REVOKED_GENERATION_PROPAGATION_THEN_PROVE_CLEAN_GRANT_THEN_PROVE_AUDIT_CONTINUATION_THEN_REQUIRE_OWNER_APPROVAL","failurePolicy":"KEEP_PREDECESSOR_QUARANTINED_DENY_SUCCESSOR_GRANT_PRESERVE_AUDIT_CHAIN_AND_ESCALATE","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","freshSuccessorKeyCustodyObserved":false,"revokedGenerationPropagationObserved":false,"cleanGrantIssuanceObserved":false,"auditContinuationObserved":false,"independentOwnerApprovalObserved":false,"successorGenerationAdmissionPermitted":false,"executionAuthorized":false,"hostStarted":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_RECOVERY_REVIEW_VERIFIED","SUCCESSOR_GENERATION_DOSSIER_BOUND","SUCCESSOR_KEY_CUSTODY_SHAPE_VERIFIED","REVOKED_GENERATION_PROPAGATION_SHAPE_VERIFIED","CLEAN_GRANT_ISSUANCE_SHAPE_VERIFIED","AUDIT_CHAIN_CONTINUATION_SHAPE_VERIFIED","INDEPENDENT_OWNER_APPROVAL_SHAPE_VERIFIED","SUCCESSOR_ADMISSION_ORDER_FROZEN","PREDECESSOR_CHAIN_BOUND","GENERATION_FENCE_BOUND","IDEMPOTENCY_BOUND","FAILURE_POLICY_BOUND","AUTHORITY_SEPARATION_BOUND","PREDECESSOR_QUARANTINE_PRESERVED","SUCCESSOR_GENERATION_ADMISSION_PREPARED_FIXTURE_ONLY","SUCCESSOR_GENERATION_ADMISSION_RECEIPT_PROJECTED","SUCCESSOR_GENERATION_ADMISSION_RECEIPT_VERIFIED","SUCCESSOR_GENERATION_REMAINS_CLOSED","DENIED_OR_DISPOSED"],"invariantAccounting":{"inheritedFromRecoveryReview":94,"newSuccessorGenerationInvariants":4,"total":98},"invariants":["Only the exact unexpired and positively verified fixture compromise-recovery review receipt may enter successor-generation admission.","Successor key custody, predecessor-generation denial propagation, clean grant issuance, audit continuation and owner approval remain five independently signed decisions.","The predecessor generation remains quarantined until all five production receipts are verified; fixture shapes can never upgrade recovery authority.","A successor-generation admission packet never creates a key, issues a grant, writes an audit event, authorizes execution or starts a host."],"prerequisiteAccounting":{"inheritedFromRecoveryReview":20,"newSuccessorGenerationPrerequisites":5,"total":25},"productionPrerequisites":["Non-exportable successor signing-key custody evidence bound to a fresh generation, runtime identity and independent owner.","Measured old-generation denial propagation across every verifier, active grant, pending grant, lease and cached policy decision.","A clean one-shot grant issuance drill proving no predecessor privilege, replay token or stale policy survives generation change.","Gap-free audit-chain continuation from the incident terminal witness to the first successor-generation event in immutable storage.","Independent owner approval bound to the exact successor generation, scope, drill receipts, expiry and rollback decision."],"selectedDenialTrace":{"fixtureId":"RFSGRA-123","mutation":"DOSSIER_SUCCESSOR_ADMISSION_PERMITTED","expected":"DENY","reason":"A caller cannot turn five fixture-only successor-generation shapes into recovery authority by setting successorGenerationAdmissionPermitted=true; the predecessor remains quarantined and no key, grant, audit or host capability is issued."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":124,"acceptedOutcomes":24,"deniedOutcomes":100,"upstreamReceiptsVerified":102,"admissionSlotReceiptsVerified":252,"admissionReceiptsVerified":3,"projectedAdmissions":28,"disposedHandles":2,"successorKeyCustodyEvidenceObserved":0,"revokedGenerationPropagationEvidenceObserved":0,"cleanGrantIssuanceEvidenceObserved":0,"auditContinuationEvidenceObserved":0,"independentOwnerApprovalsObserved":0,"successorGenerationAdmissionsObserved":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsIssued":0,"grantsRevoked":0,"auditWritesExecuted":0,"transactionCommitsObserved":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"successorKeyCustodyEvidenceObserved":0,"revokedGenerationPropagationEvidenceObserved":0,"cleanGrantIssuanceEvidenceObserved":0,"auditContinuationEvidenceObserved":0,"independentOwnerApprovalsObserved":0,"successorGenerationAdmissionsObserved":0,"keysCreated":0,"grantsIssued":0,"auditWritesExecuted":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"successorGenerationAdmissionPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-fixtures/v1","description":"Deterministic fixture-only successor-generation recovery admission cases. No key creation, revoked-generation propagation, clean grant issuance, audit continuation write, owner approval, recovery admission, host launch, billing or paid resource is executed.","mode":"FIXTURE_SUCCESSOR_GENERATION_ADMISSION_ONLY_NO_KEY_CREATION_NO_GRANT_NO_AUDIT_WRITE_NO_HOST_START","networkRequestsExecuted":0,"compromiseSignalsConsumed":0,"keyGenerationsQuarantined":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"operatorEscalationsExecuted":0,"recoveryReadmissionsExecuted":0,"transactionCommitsExecuted":0,"executionAuthorizationsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFSGRA-001","expected":"ACCEPT","mutation":"PREPARE_BASELINE"},{"id":"RFSGRA-002","expected":"ACCEPT","mutation":"PROJECT_BASELINE"},{"id":"RFSGRA-003","expected":"ACCEPT","mutation":"VERIFY_RECEIPT"},{"id":"RFSGRA-004","expected":"ACCEPT","mutation":"VERIFY_REPLAY"},{"id":"RFSGRA-005","expected":"ACCEPT","mutation":"DISPOSE_REPLAY"},{"id":"RFSGRA-006","expected":"ACCEPT","mutation":"REQUEST_WINDOW_EDGE"},{"id":"RFSGRA-007","expected":"ACCEPT","mutation":"COST_ZERO_EDGE"},{"id":"RFSGRA-008","expected":"ACCEPT","mutation":"COST_CAP_EDGE"},{"id":"RFSGRA-009","expected":"ACCEPT","mutation":"SLOT_VALIDITY_EDGE"},{"id":"RFSGRA-010","expected":"ACCEPT","mutation":"PROJECT_OBSERVED_AT_EDGE"},{"id":"RFSGRA-011","expected":"ACCEPT","mutation":"DISPOSE_AFTER_PROJECT"},{"id":"RFSGRA-012","expected":"ACCEPT","mutation":"INDEPENDENT_DOSSIER_CLONE"},{"id":"RFSGRA-013","expected":"ACCEPT","mutation":"UPSTREAM_COST_ZERO_EDGE"},{"id":"RFSGRA-014","expected":"ACCEPT","mutation":"QUOTE_AGE_EXACT"},{"id":"RFSGRA-015","expected":"ACCEPT","mutation":"HOLD_TTL_EXACT"},{"id":"RFSGRA-016","expected":"ACCEPT","mutation":"CLAIM_TTL_EXACT"},{"id":"RFSGRA-017","expected":"DENY","mutation":"EXECUTABLE_KEY"},{"id":"RFSGRA-018","expected":"DENY","mutation":"RECEIPT_TRANSACTION_COMMITTED"},{"id":"RFSGRA-019","expected":"DENY","mutation":"PRICING_CLIENT_KEY"},{"id":"RFSGRA-020","expected":"DENY","mutation":"BUDGET_CLIENT_KEY"},{"id":"RFSGRA-021","expected":"DENY","mutation":"CAPACITY_CLIENT_KEY"},{"id":"RFSGRA-022","expected":"DENY","mutation":"HOST_PROVIDER_KEY"},{"id":"RFSGRA-023","expected":"DENY","mutation":"PAYMENT_CLIENT_KEY"},{"id":"RFSGRA-024","expected":"DENY","mutation":"COMMIT_TRANSACTION_KEY"},{"id":"RFSGRA-025","expected":"DENY","mutation":"UPSTREAM_SCHEMA"},{"id":"RFSGRA-026","expected":"DENY","mutation":"UPSTREAM_STATUS"},{"id":"RFSGRA-027","expected":"DENY","mutation":"UPSTREAM_VERDICT"},{"id":"RFSGRA-028","expected":"DENY","mutation":"UPSTREAM_MODE"},{"id":"RFSGRA-029","expected":"DENY","mutation":"UPSTREAM_ID"},{"id":"RFSGRA-030","expected":"DENY","mutation":"UPSTREAM_DIGEST"},{"id":"RFSGRA-031","expected":"DENY","mutation":"UPSTREAM_STEP_COUNT"},{"id":"RFSGRA-032","expected":"DENY","mutation":"UPSTREAM_PLAN_VERIFIED"},{"id":"RFSGRA-033","expected":"DENY","mutation":"UPSTREAM_HOST_COUNT"},{"id":"RFSGRA-034","expected":"DENY","mutation":"UPSTREAM_COST_OVER"},{"id":"RFSGRA-035","expected":"DENY","mutation":"UPSTREAM_CURRENCY"},{"id":"RFSGRA-036","expected":"DENY","mutation":"UPSTREAM_QUOTE_AGE"},{"id":"RFSGRA-037","expected":"DENY","mutation":"UPSTREAM_HOLD_TTL"},{"id":"RFSGRA-038","expected":"DENY","mutation":"UPSTREAM_CLAIM_TTL"},{"id":"RFSGRA-039","expected":"DENY","mutation":"UPSTREAM_REAL_CONFIRMATION"},{"id":"RFSGRA-040","expected":"DENY","mutation":"UPSTREAM_LIVE_QUOTE"},{"id":"RFSGRA-041","expected":"DENY","mutation":"UPSTREAM_BUDGET_HOLD"},{"id":"RFSGRA-042","expected":"DENY","mutation":"UPSTREAM_HOST_CLAIM"},{"id":"RFSGRA-043","expected":"DENY","mutation":"UPSTREAM_TRANSACTION_AUTHORITY"},{"id":"RFSGRA-044","expected":"DENY","mutation":"UPSTREAM_HOST_RUN"},{"id":"RFSGRA-045","expected":"DENY","mutation":"UPSTREAM_PAID_RESOURCE"},{"id":"RFSGRA-046","expected":"DENY","mutation":"UPSTREAM_EXPIRED"},{"id":"RFSGRA-047","expected":"DENY","mutation":"UPSTREAM_VERIFIER_FALSE"},{"id":"RFSGRA-048","expected":"DENY","mutation":"UPSTREAM_VERIFIER_THROW"},{"id":"RFSGRA-049","expected":"DENY","mutation":"DOSSIER_SCHEMA"},{"id":"RFSGRA-050","expected":"DENY","mutation":"DOSSIER_UPSTREAM"},{"id":"RFSGRA-051","expected":"DENY","mutation":"DOSSIER_CONFIRMATION_SCOPE"},{"id":"RFSGRA-052","expected":"DENY","mutation":"DOSSIER_ECONOMIC_SCOPE"},{"id":"RFSGRA-053","expected":"DENY","mutation":"DOSSIER_HOST_COUNT"},{"id":"RFSGRA-054","expected":"DENY","mutation":"DOSSIER_COST_OVER"},{"id":"RFSGRA-055","expected":"DENY","mutation":"DOSSIER_CURRENCY"},{"id":"RFSGRA-056","expected":"DENY","mutation":"DOSSIER_QUOTE_AGE"},{"id":"RFSGRA-057","expected":"DENY","mutation":"DOSSIER_HOLD_TTL"},{"id":"RFSGRA-058","expected":"DENY","mutation":"DOSSIER_CLAIM_TTL"},{"id":"RFSGRA-059","expected":"DENY","mutation":"DOSSIER_COMMIT_PERMITTED"},{"id":"RFSGRA-060","expected":"DENY","mutation":"DOSSIER_ORDERING"},{"id":"RFSGRA-061","expected":"DENY","mutation":"DOSSIER_FAILURE_POLICY"},{"id":"RFSGRA-062","expected":"DENY","mutation":"DOSSIER_REAL_CONFIRMATION"},{"id":"RFSGRA-063","expected":"DENY","mutation":"DOSSIER_LIVE_QUOTE"},{"id":"RFSGRA-064","expected":"DENY","mutation":"DOSSIER_BUDGET_HOLD"},{"id":"RFSGRA-065","expected":"DENY","mutation":"DOSSIER_HOST_CLAIM"},{"id":"RFSGRA-066","expected":"DENY","mutation":"DOSSIER_COORDINATOR"},{"id":"RFSGRA-067","expected":"DENY","mutation":"DOSSIER_COMPENSATION"},{"id":"RFSGRA-068","expected":"DENY","mutation":"DOSSIER_EXECUTION_PERMITTED"},{"id":"RFSGRA-069","expected":"DENY","mutation":"DOSSIER_DIGEST"},{"id":"RFSGRA-070","expected":"DENY","mutation":"SLOT_COUNT"},{"id":"RFSGRA-071","expected":"DENY","mutation":"SLOT_ORDER"},{"id":"RFSGRA-072","expected":"DENY","mutation":"SLOT_ORDINAL"},{"id":"RFSGRA-073","expected":"DENY","mutation":"SLOT_NAME"},{"id":"RFSGRA-074","expected":"DENY","mutation":"SLOT_DECISION"},{"id":"RFSGRA-075","expected":"DENY","mutation":"SLOT_AUTHORITY"},{"id":"RFSGRA-076","expected":"DENY","mutation":"SLOT_SIGNER"},{"id":"RFSGRA-077","expected":"DENY","mutation":"SLOT_MODE"},{"id":"RFSGRA-078","expected":"DENY","mutation":"SLOT_BINDING"},{"id":"RFSGRA-079","expected":"DENY","mutation":"SLOT_UPSTREAM"},{"id":"RFSGRA-080","expected":"DENY","mutation":"SLOT_DOSSIER"},{"id":"RFSGRA-081","expected":"DENY","mutation":"SLOT_PREDECESSOR"},{"id":"RFSGRA-082","expected":"DENY","mutation":"SLOT_IDEMPOTENCY"},{"id":"RFSGRA-083","expected":"DENY","mutation":"SLOT_ORIGIN"},{"id":"RFSGRA-084","expected":"DENY","mutation":"SLOT_LIVE_RECEIPT"},{"id":"RFSGRA-085","expected":"DENY","mutation":"SLOT_EFFECT"},{"id":"RFSGRA-086","expected":"DENY","mutation":"SLOT_DURABLE_WRITE"},{"id":"RFSGRA-087","expected":"DENY","mutation":"SLOT_HOST_CLAIM"},{"id":"RFSGRA-088","expected":"DENY","mutation":"SLOT_COMMIT"},{"id":"RFSGRA-089","expected":"DENY","mutation":"SLOT_PRODUCTION_CONFIGURED"},{"id":"RFSGRA-090","expected":"DENY","mutation":"SLOT_EXPIRED"},{"id":"RFSGRA-091","expected":"DENY","mutation":"SLOT_WINDOW_LONG"},{"id":"RFSGRA-092","expected":"DENY","mutation":"SLOT_DIGEST"},{"id":"RFSGRA-093","expected":"DENY","mutation":"SLOT_VERIFIER_FALSE"},{"id":"RFSGRA-094","expected":"DENY","mutation":"SLOT_VERIFIER_THROW"},{"id":"RFSGRA-095","expected":"DENY","mutation":"REQUEST_SCHEMA"},{"id":"RFSGRA-096","expected":"DENY","mutation":"REQUEST_ACTION"},{"id":"RFSGRA-097","expected":"DENY","mutation":"REQUEST_MODE"},{"id":"RFSGRA-098","expected":"DENY","mutation":"REQUEST_UPSTREAM"},{"id":"RFSGRA-099","expected":"DENY","mutation":"REQUEST_DOSSIER"},{"id":"RFSGRA-100","expected":"DENY","mutation":"REQUEST_SLOT_ORDER"},{"id":"RFSGRA-101","expected":"DENY","mutation":"REQUEST_DIGESTS"},{"id":"RFSGRA-102","expected":"DENY","mutation":"REQUEST_NONCE_INVALID"},{"id":"RFSGRA-103","expected":"DENY","mutation":"REQUEST_EXPIRED"},{"id":"RFSGRA-104","expected":"DENY","mutation":"REQUEST_WINDOW_LONG"},{"id":"RFSGRA-105","expected":"DENY","mutation":"REQUEST_REPLAY"},{"id":"RFSGRA-106","expected":"DENY","mutation":"RECONSTRUCTED_HANDLE"},{"id":"RFSGRA-107","expected":"DENY","mutation":"DISPOSED_HANDLE"},{"id":"RFSGRA-108","expected":"DENY","mutation":"PROJECT_REPLAY"},{"id":"RFSGRA-109","expected":"ACCEPT","mutation":"HANDOFF_ORDER_EXACT"},{"id":"RFSGRA-110","expected":"ACCEPT","mutation":"POLICY_REVALIDATION_REQUIRED_EXACT"},{"id":"RFSGRA-111","expected":"DENY","mutation":"DOSSIER_EXECUTION_HANDOFF_PERMITTED"},{"id":"RFSGRA-112","expected":"DENY","mutation":"RECEIPT_EXECUTION_AUTHORIZED"},{"id":"RFSGRA-113","expected":"ACCEPT","mutation":"AUDIT_WITNESS_REQUIRED_EXACT"},{"id":"RFSGRA-114","expected":"ACCEPT","mutation":"FAILURE_POLICY_EXACT"},{"id":"RFSGRA-115","expected":"DENY","mutation":"DOSSIER_AUTHORITY_TRUST_PERMITTED"},{"id":"RFSGRA-116","expected":"DENY","mutation":"RECEIPT_AUTHORITY_TRUST_PERMITTED"},{"id":"RFSGRA-117","expected":"ACCEPT","mutation":"AUDIT_CONTINUITY_REQUIRED_EXACT"},{"id":"RFSGRA-118","expected":"ACCEPT","mutation":"QUARANTINE_FAILURE_POLICY_EXACT"},{"id":"RFSGRA-119","expected":"DENY","mutation":"DOSSIER_RECOVERY_PERMITTED"},{"id":"RFSGRA-120","expected":"DENY","mutation":"RECEIPT_RECOVERY_PERMITTED"},{"id":"RFSGRA-121","mutation":"OWNER_APPROVAL_ORDER_EXACT","expected":"ACCEPT"},{"id":"RFSGRA-122","mutation":"PREDECESSOR_DENIAL_REQUIRED_EXACT","expected":"ACCEPT"},{"id":"RFSGRA-123","mutation":"DOSSIER_SUCCESSOR_ADMISSION_PERMITTED","expected":"DENY"},{"id":"RFSGRA-124","mutation":"RECEIPT_SUCCESSOR_ADMITTED","expected":"DENY"}],"successorKeyCustodyEvidenceConsumed":0,"revokedGenerationPropagationsExecuted":0,"cleanGrantsIssued":0,"auditContinuationsWritten":0,"ownerApprovalsExecuted":0,"successorGenerationAdmissionsExecuted":0}},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionCanaryReactivationAuthorization":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_SUCCESSOR_GENERATION_ADMISSION_CANARY_REACTIVATION_AUTHORIZATION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T19:00:00Z","scope":{"mode":"FIXTURE_SUCCESSOR_GENERATION_CANARY_REACTIVATION_AUTHORIZATION_ONLY_NO_GRANT_NO_HOST_START_NO_AUDIT_WRITE","input":"POSITIVELY_VERIFIED_FIXTURE_SUCCESSOR_GENERATION_RECOVERY_ADMISSION_RECEIPT","output":"SUCCESSOR_GENERATION_CANARY_REACTIVATION_AUTHORIZATION_PACKET_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_PRODUCTION_VERIFIER_FANOUT_BOUNDED_NO_SHELL_CANARY_GRANT_OBSERVATION_WINDOW_AUTOMATIC_ROLLBACK_AND_TERMINAL_AUDIT_WITNESS_EVIDENCE","fixtureAuthorizationShapesVerified":5,"verifierFanoutFrozen":false,"boundedCanaryGrantObserved":false,"observationWindowObserved":false,"automaticRollbackTriggerArmed":false,"terminalAuditWitnessObserved":false,"canaryReactivationAuthorizationPermitted":false,"executionPermitted":false,"grantIssued":false,"hostStarted":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-receipt/v1","status":"SUCCESSOR_GENERATION_RECOVERY_ADMISSION_PACKET_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_PRODUCTION_SUCCESSOR_KEY_CUSTODY_REVOKED_GENERATION_PROPAGATION_CLEAN_GRANT_AUDIT_CONTINUATION_AND_OWNER_APPROVAL_EVIDENCE","authoritativeVerificationRequired":true,"positiveBooleanRequired":true},"operations":[{"id":"prepare","input":"successor admission receipt + canary dossier + five authorization-shape receipts + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only canary reactivation authorization receipt","sideEffect":"NONE"},{"id":"verify","input":"canary reactivation authorization receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"authorizationSlots":[{"ordinal":1,"slot":"VERIFIER_FANOUT_FREEZE_AUTHORIZATION","authority":"VERIFIER_FANOUT_AUTHORITY","signerKeyId":"fixture-p256-verifier-fanout-authority","requiredBinding":"BIND_SUCCESSOR_AND_PREDECESSOR_GENERATIONS_TO_EXACT_VERIFIER_SET_AND_CACHE_EPOCH","observedLive":false},{"ordinal":2,"slot":"BOUNDED_NO_SHELL_CANARY_GRANT_AUTHORIZATION","authority":"CANARY_GRANT_AUTHORITY","signerKeyId":"fixture-p256-canary-grant-authority","requiredBinding":"BIND_SINGLE_ONE_SHOT_NO_SHELL_GRANT_TO_SUCCESSOR_GENERATION_HOST_ONE_AND_USD_CEILING","observedLive":false},{"ordinal":3,"slot":"OBSERVATION_WINDOW_AUTHORIZATION","authority":"OBSERVATION_WINDOW_AUTHORITY","signerKeyId":"fixture-p256-observation-window-authority","requiredBinding":"BIND_CANARY_HEALTH_SIGNALS_WINDOW_DURATION_AND_ABORT_THRESHOLDS","observedLive":false},{"ordinal":4,"slot":"AUTOMATIC_ROLLBACK_TRIGGER_AUTHORIZATION","authority":"ROLLBACK_TRIGGER_AUTHORITY","signerKeyId":"fixture-p256-rollback-trigger-authority","requiredBinding":"BIND_FAIL_CLOSED_TRIGGER_TO_GRANT_REVOCATION_HOST_RETIREMENT_AND_QUARANTINE_REENTRY","observedLive":false},{"ordinal":5,"slot":"TERMINAL_AUDIT_WITNESS_AUTHORIZATION","authority":"TERMINAL_AUDIT_WITNESS_AUTHORITY","signerKeyId":"fixture-p256-terminal-audit-witness-authority","requiredBinding":"BIND_CANARY_TERMINAL_OUTCOME_TO_SUCCESSOR_AUDIT_CONTINUATION_WITHOUT_GAP","observedLive":false}],"authorityTopology":[{"authority":"VERIFIER_FANOUT_AUTHORITY","slots":1,"mayFreezeVerifierFanout":false,"mayIssueGrant":false,"mayStartObservation":false,"mayArmRollback":false,"mayWriteAudit":false,"mayStartHost":false},{"authority":"CANARY_GRANT_AUTHORITY","slots":1,"mayFreezeVerifierFanout":false,"mayIssueGrant":false,"mayStartObservation":false,"mayArmRollback":false,"mayWriteAudit":false,"mayStartHost":false},{"authority":"OBSERVATION_WINDOW_AUTHORITY","slots":1,"mayFreezeVerifierFanout":false,"mayIssueGrant":false,"mayStartObservation":false,"mayArmRollback":false,"mayWriteAudit":false,"mayStartHost":false},{"authority":"ROLLBACK_TRIGGER_AUTHORITY","slots":1,"mayFreezeVerifierFanout":false,"mayIssueGrant":false,"mayStartObservation":false,"mayArmRollback":false,"mayWriteAudit":false,"mayStartHost":false},{"authority":"TERMINAL_AUDIT_WITNESS_AUTHORITY","slots":1,"mayFreezeVerifierFanout":false,"mayIssueGrant":false,"mayStartObservation":false,"mayArmRollback":false,"mayWriteAudit":false,"mayStartHost":false}],"authorizationGuardrails":{"requestValiditySeconds":30,"authorizationShapeValiditySeconds":3600,"canaryGrantTtlSeconds":300,"observationWindowSeconds":900,"rollbackTriggerDeadlineSeconds":30,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"currency":"USD","authorizationOrdering":"VERIFY_SUCCESSOR_ADMISSION_THEN_FREEZE_VERIFIER_FANOUT_THEN_BOUND_SINGLE_CANARY_GRANT_THEN_BIND_OBSERVATION_WINDOW_THEN_ARM_AUTOMATIC_ROLLBACK_THEN_REQUIRE_TERMINAL_AUDIT_WITNESS","failurePolicy":"KEEP_SUCCESSOR_GENERATION_CLOSED_DENY_CANARY_GRANT_PRESERVE_PREDECESSOR_QUARANTINE_AND_AUDIT_CHAIN_THEN_ESCALATE","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","verifierFanoutFrozen":false,"boundedCanaryGrantObserved":false,"observationWindowObserved":false,"automaticRollbackTriggerArmed":false,"terminalAuditWitnessObserved":false,"canaryReactivationAuthorizationPermitted":false,"executionAuthorized":false,"hostStarted":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_SUCCESSOR_GENERATION_ADMISSION_VERIFIED","CANARY_REACTIVATION_DOSSIER_BOUND","VERIFIER_FANOUT_FREEZE_SHAPE_VERIFIED","BOUNDED_NO_SHELL_CANARY_GRANT_SHAPE_VERIFIED","OBSERVATION_WINDOW_SHAPE_VERIFIED","AUTOMATIC_ROLLBACK_TRIGGER_SHAPE_VERIFIED","TERMINAL_AUDIT_WITNESS_SHAPE_VERIFIED","CANARY_AUTHORIZATION_ORDER_FROZEN","PREDECESSOR_CHAIN_BOUND","GENERATION_FANOUT_FENCE_BOUND","CANARY_GRANT_BOUND","OBSERVATION_ABORT_POLICY_BOUND","ROLLBACK_PATH_BOUND","IDEMPOTENCY_BOUND","AUTHORITY_SEPARATION_BOUND","CANARY_REACTIVATION_AUTHORIZATION_PREPARED_FIXTURE_ONLY","CANARY_REACTIVATION_AUTHORIZATION_RECEIPT_PROJECTED","CANARY_REACTIVATION_AUTHORIZATION_RECEIPT_VERIFIED","SUCCESSOR_GENERATION_REMAINS_CLOSED","DENIED_OR_DISPOSED"],"invariantAccounting":{"inheritedFromSuccessorGenerationAdmission":98,"newCanaryReactivationInvariants":4,"total":102},"invariants":["Only the exact unexpired and positively verified fixture successor-generation admission receipt may enter canary reactivation authorization.","Verifier fan-out, bounded no-shell grant, observation window, automatic rollback and terminal audit witness remain five independently signed decisions.","The successor generation remains closed until all five production receipts are verified; fixture shapes can never issue or activate a canary grant.","A canary reactivation authorization packet never changes verifier state, issues a grant, arms rollback, writes audit, authorizes execution or starts a host."],"prerequisiteAccounting":{"inheritedFromSuccessorGenerationAdmission":25,"newCanaryReactivationPrerequisites":5,"total":30},"productionPrerequisites":["Measured verifier fan-out evidence proving the predecessor generation is denied and the successor generation is pinned across every verifier and cache epoch.","A single one-shot no-shell canary grant bound to one successor generation, one host, USD 0.50 ceiling, five-minute TTL and no inherited privilege.","A fifteen-minute observation window bound to explicit health signals, abort thresholds, sampling cadence and accountable observation owner.","An automatic rollback trigger proving bounded grant revocation, host retirement, quarantine re-entry and completion within thirty seconds.","An immutable terminal audit witness binding success or rollback to the upstream successor admission, canary grant, observation evidence and owner decision."],"selectedDenialTrace":{"fixtureId":"RFCRAA-127","mutation":"DOSSIER_CANARY_REACTIVATION_PERMITTED","expected":"DENY","reason":"A caller cannot turn five fixture-only canary authorization shapes into reactivation authority by setting canaryReactivationAuthorizationPermitted=true; the successor generation remains closed and no grant, rollback, audit or host capability is issued."},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":128,"acceptedOutcomes":26,"deniedOutcomes":102,"upstreamReceiptsVerified":106,"authorizationSlotReceiptsVerified":267,"authorizationReceiptsVerified":3,"projectedAuthorizations":31,"disposedHandles":2,"verifierFanoutEvidenceObserved":0,"boundedCanaryGrantEvidenceObserved":0,"observationWindowEvidenceObserved":0,"automaticRollbackTriggerEvidenceObserved":0,"terminalAuditWitnessEvidenceObserved":0,"canaryReactivationAuthorizationsObserved":0,"keysCreated":0,"grantsIssued":0,"rollbackTriggersArmed":0,"auditWritesExecuted":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"truth":{"verifierFanoutEvidenceObserved":0,"boundedCanaryGrantEvidenceObserved":0,"observationWindowEvidenceObserved":0,"automaticRollbackTriggerEvidenceObserved":0,"terminalAuditWitnessEvidenceObserved":0,"canaryReactivationAuthorizationsObserved":0,"keysCreated":0,"grantsIssued":0,"rollbackTriggersArmed":0,"auditWritesExecuted":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"canaryReactivationAuthorizationPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-fixtures/v1","description":"Deterministic fixture-only successor-generation canary reactivation authorization cases. No verifier change, grant issuance, observation, rollback arming, audit write, host launch, billing or paid resource is executed.","mode":"FIXTURE_SUCCESSOR_GENERATION_CANARY_REACTIVATION_AUTHORIZATION_ONLY_NO_GRANT_NO_HOST_START_NO_AUDIT_WRITE","networkRequestsExecuted":0,"compromiseSignalsConsumed":0,"keyGenerationsQuarantined":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"operatorEscalationsExecuted":0,"recoveryReadmissionsExecuted":0,"transactionCommitsExecuted":0,"executionAuthorizationsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFCRAA-001","expected":"ACCEPT","mutation":"PREPARE_BASELINE"},{"id":"RFCRAA-002","expected":"ACCEPT","mutation":"PROJECT_BASELINE"},{"id":"RFCRAA-003","expected":"ACCEPT","mutation":"VERIFY_RECEIPT"},{"id":"RFCRAA-004","expected":"ACCEPT","mutation":"VERIFY_REPLAY"},{"id":"RFCRAA-005","expected":"ACCEPT","mutation":"DISPOSE_REPLAY"},{"id":"RFCRAA-006","expected":"ACCEPT","mutation":"REQUEST_WINDOW_EDGE"},{"id":"RFCRAA-007","expected":"ACCEPT","mutation":"COST_ZERO_EDGE"},{"id":"RFCRAA-008","expected":"ACCEPT","mutation":"COST_CAP_EDGE"},{"id":"RFCRAA-009","expected":"ACCEPT","mutation":"SLOT_VALIDITY_EDGE"},{"id":"RFCRAA-010","expected":"ACCEPT","mutation":"PROJECT_OBSERVED_AT_EDGE"},{"id":"RFCRAA-011","expected":"ACCEPT","mutation":"DISPOSE_AFTER_PROJECT"},{"id":"RFCRAA-012","expected":"ACCEPT","mutation":"INDEPENDENT_DOSSIER_CLONE"},{"id":"RFCRAA-013","expected":"ACCEPT","mutation":"UPSTREAM_COST_ZERO_EDGE"},{"id":"RFCRAA-014","expected":"ACCEPT","mutation":"QUOTE_AGE_EXACT"},{"id":"RFCRAA-015","expected":"ACCEPT","mutation":"HOLD_TTL_EXACT"},{"id":"RFCRAA-016","expected":"ACCEPT","mutation":"CLAIM_TTL_EXACT"},{"id":"RFCRAA-017","expected":"DENY","mutation":"EXECUTABLE_KEY"},{"id":"RFCRAA-018","expected":"DENY","mutation":"RECEIPT_TRANSACTION_COMMITTED"},{"id":"RFCRAA-019","expected":"DENY","mutation":"PRICING_CLIENT_KEY"},{"id":"RFCRAA-020","expected":"DENY","mutation":"BUDGET_CLIENT_KEY"},{"id":"RFCRAA-021","expected":"DENY","mutation":"CAPACITY_CLIENT_KEY"},{"id":"RFCRAA-022","expected":"DENY","mutation":"HOST_PROVIDER_KEY"},{"id":"RFCRAA-023","expected":"DENY","mutation":"PAYMENT_CLIENT_KEY"},{"id":"RFCRAA-024","expected":"DENY","mutation":"COMMIT_TRANSACTION_KEY"},{"id":"RFCRAA-025","expected":"DENY","mutation":"UPSTREAM_SCHEMA"},{"id":"RFCRAA-026","expected":"DENY","mutation":"UPSTREAM_STATUS"},{"id":"RFCRAA-027","expected":"DENY","mutation":"UPSTREAM_VERDICT"},{"id":"RFCRAA-028","expected":"DENY","mutation":"UPSTREAM_MODE"},{"id":"RFCRAA-029","expected":"DENY","mutation":"UPSTREAM_ID"},{"id":"RFCRAA-030","expected":"DENY","mutation":"UPSTREAM_DIGEST"},{"id":"RFCRAA-031","expected":"DENY","mutation":"UPSTREAM_STEP_COUNT"},{"id":"RFCRAA-032","expected":"DENY","mutation":"UPSTREAM_PLAN_VERIFIED"},{"id":"RFCRAA-033","expected":"DENY","mutation":"UPSTREAM_HOST_COUNT"},{"id":"RFCRAA-034","expected":"DENY","mutation":"UPSTREAM_COST_OVER"},{"id":"RFCRAA-035","expected":"DENY","mutation":"UPSTREAM_CURRENCY"},{"id":"RFCRAA-036","expected":"DENY","mutation":"UPSTREAM_QUOTE_AGE"},{"id":"RFCRAA-037","expected":"DENY","mutation":"UPSTREAM_HOLD_TTL"},{"id":"RFCRAA-038","expected":"DENY","mutation":"UPSTREAM_CLAIM_TTL"},{"id":"RFCRAA-039","expected":"DENY","mutation":"UPSTREAM_REAL_CONFIRMATION"},{"id":"RFCRAA-040","expected":"DENY","mutation":"UPSTREAM_LIVE_QUOTE"},{"id":"RFCRAA-041","expected":"DENY","mutation":"UPSTREAM_BUDGET_HOLD"},{"id":"RFCRAA-042","expected":"DENY","mutation":"UPSTREAM_HOST_CLAIM"},{"id":"RFCRAA-043","expected":"DENY","mutation":"UPSTREAM_TRANSACTION_AUTHORITY"},{"id":"RFCRAA-044","expected":"DENY","mutation":"UPSTREAM_HOST_RUN"},{"id":"RFCRAA-045","expected":"DENY","mutation":"UPSTREAM_PAID_RESOURCE"},{"id":"RFCRAA-046","expected":"DENY","mutation":"UPSTREAM_EXPIRED"},{"id":"RFCRAA-047","expected":"DENY","mutation":"UPSTREAM_VERIFIER_FALSE"},{"id":"RFCRAA-048","expected":"DENY","mutation":"UPSTREAM_VERIFIER_THROW"},{"id":"RFCRAA-049","expected":"DENY","mutation":"DOSSIER_SCHEMA"},{"id":"RFCRAA-050","expected":"DENY","mutation":"DOSSIER_UPSTREAM"},{"id":"RFCRAA-051","expected":"DENY","mutation":"DOSSIER_CONFIRMATION_SCOPE"},{"id":"RFCRAA-052","expected":"DENY","mutation":"DOSSIER_ECONOMIC_SCOPE"},{"id":"RFCRAA-053","expected":"DENY","mutation":"DOSSIER_HOST_COUNT"},{"id":"RFCRAA-054","expected":"DENY","mutation":"DOSSIER_COST_OVER"},{"id":"RFCRAA-055","expected":"DENY","mutation":"DOSSIER_CURRENCY"},{"id":"RFCRAA-056","expected":"DENY","mutation":"DOSSIER_QUOTE_AGE"},{"id":"RFCRAA-057","expected":"DENY","mutation":"DOSSIER_HOLD_TTL"},{"id":"RFCRAA-058","expected":"DENY","mutation":"DOSSIER_CLAIM_TTL"},{"id":"RFCRAA-059","expected":"DENY","mutation":"DOSSIER_COMMIT_PERMITTED"},{"id":"RFCRAA-060","expected":"DENY","mutation":"DOSSIER_ORDERING"},{"id":"RFCRAA-061","expected":"DENY","mutation":"DOSSIER_FAILURE_POLICY"},{"id":"RFCRAA-062","expected":"DENY","mutation":"DOSSIER_REAL_CONFIRMATION"},{"id":"RFCRAA-063","expected":"DENY","mutation":"DOSSIER_LIVE_QUOTE"},{"id":"RFCRAA-064","expected":"DENY","mutation":"DOSSIER_BUDGET_HOLD"},{"id":"RFCRAA-065","expected":"DENY","mutation":"DOSSIER_HOST_CLAIM"},{"id":"RFCRAA-066","expected":"DENY","mutation":"DOSSIER_COORDINATOR"},{"id":"RFCRAA-067","expected":"DENY","mutation":"DOSSIER_COMPENSATION"},{"id":"RFCRAA-068","expected":"DENY","mutation":"DOSSIER_EXECUTION_PERMITTED"},{"id":"RFCRAA-069","expected":"DENY","mutation":"DOSSIER_DIGEST"},{"id":"RFCRAA-070","expected":"DENY","mutation":"SLOT_COUNT"},{"id":"RFCRAA-071","expected":"DENY","mutation":"SLOT_ORDER"},{"id":"RFCRAA-072","expected":"DENY","mutation":"SLOT_ORDINAL"},{"id":"RFCRAA-073","expected":"DENY","mutation":"SLOT_NAME"},{"id":"RFCRAA-074","expected":"DENY","mutation":"SLOT_DECISION"},{"id":"RFCRAA-075","expected":"DENY","mutation":"SLOT_AUTHORITY"},{"id":"RFCRAA-076","expected":"DENY","mutation":"SLOT_SIGNER"},{"id":"RFCRAA-077","expected":"DENY","mutation":"SLOT_MODE"},{"id":"RFCRAA-078","expected":"DENY","mutation":"SLOT_BINDING"},{"id":"RFCRAA-079","expected":"DENY","mutation":"SLOT_UPSTREAM"},{"id":"RFCRAA-080","expected":"DENY","mutation":"SLOT_DOSSIER"},{"id":"RFCRAA-081","expected":"DENY","mutation":"SLOT_PREDECESSOR"},{"id":"RFCRAA-082","expected":"DENY","mutation":"SLOT_IDEMPOTENCY"},{"id":"RFCRAA-083","expected":"DENY","mutation":"SLOT_ORIGIN"},{"id":"RFCRAA-084","expected":"DENY","mutation":"SLOT_LIVE_RECEIPT"},{"id":"RFCRAA-085","expected":"DENY","mutation":"SLOT_EFFECT"},{"id":"RFCRAA-086","expected":"DENY","mutation":"SLOT_DURABLE_WRITE"},{"id":"RFCRAA-087","expected":"DENY","mutation":"SLOT_HOST_CLAIM"},{"id":"RFCRAA-088","expected":"DENY","mutation":"SLOT_COMMIT"},{"id":"RFCRAA-089","expected":"DENY","mutation":"SLOT_PRODUCTION_CONFIGURED"},{"id":"RFCRAA-090","expected":"DENY","mutation":"SLOT_EXPIRED"},{"id":"RFCRAA-091","expected":"DENY","mutation":"SLOT_WINDOW_LONG"},{"id":"RFCRAA-092","expected":"DENY","mutation":"SLOT_DIGEST"},{"id":"RFCRAA-093","expected":"DENY","mutation":"SLOT_VERIFIER_FALSE"},{"id":"RFCRAA-094","expected":"DENY","mutation":"SLOT_VERIFIER_THROW"},{"id":"RFCRAA-095","expected":"DENY","mutation":"REQUEST_SCHEMA"},{"id":"RFCRAA-096","expected":"DENY","mutation":"REQUEST_ACTION"},{"id":"RFCRAA-097","expected":"DENY","mutation":"REQUEST_MODE"},{"id":"RFCRAA-098","expected":"DENY","mutation":"REQUEST_UPSTREAM"},{"id":"RFCRAA-099","expected":"DENY","mutation":"REQUEST_DOSSIER"},{"id":"RFCRAA-100","expected":"DENY","mutation":"REQUEST_SLOT_ORDER"},{"id":"RFCRAA-101","expected":"DENY","mutation":"REQUEST_DIGESTS"},{"id":"RFCRAA-102","expected":"DENY","mutation":"REQUEST_NONCE_INVALID"},{"id":"RFCRAA-103","expected":"DENY","mutation":"REQUEST_EXPIRED"},{"id":"RFCRAA-104","expected":"DENY","mutation":"REQUEST_WINDOW_LONG"},{"id":"RFCRAA-105","expected":"DENY","mutation":"REQUEST_REPLAY"},{"id":"RFCRAA-106","expected":"DENY","mutation":"RECONSTRUCTED_HANDLE"},{"id":"RFCRAA-107","expected":"DENY","mutation":"DISPOSED_HANDLE"},{"id":"RFCRAA-108","expected":"DENY","mutation":"PROJECT_REPLAY"},{"id":"RFCRAA-109","expected":"ACCEPT","mutation":"HANDOFF_ORDER_EXACT"},{"id":"RFCRAA-110","expected":"ACCEPT","mutation":"POLICY_REVALIDATION_REQUIRED_EXACT"},{"id":"RFCRAA-111","expected":"DENY","mutation":"DOSSIER_EXECUTION_HANDOFF_PERMITTED"},{"id":"RFCRAA-112","expected":"DENY","mutation":"RECEIPT_EXECUTION_AUTHORIZED"},{"id":"RFCRAA-113","expected":"ACCEPT","mutation":"AUDIT_WITNESS_REQUIRED_EXACT"},{"id":"RFCRAA-114","expected":"ACCEPT","mutation":"FAILURE_POLICY_EXACT"},{"id":"RFCRAA-115","expected":"DENY","mutation":"DOSSIER_AUTHORITY_TRUST_PERMITTED"},{"id":"RFCRAA-116","expected":"DENY","mutation":"RECEIPT_AUTHORITY_TRUST_PERMITTED"},{"id":"RFCRAA-117","expected":"ACCEPT","mutation":"AUDIT_CONTINUITY_REQUIRED_EXACT"},{"id":"RFCRAA-118","expected":"ACCEPT","mutation":"QUARANTINE_FAILURE_POLICY_EXACT"},{"id":"RFCRAA-119","expected":"DENY","mutation":"DOSSIER_RECOVERY_PERMITTED"},{"id":"RFCRAA-120","expected":"DENY","mutation":"RECEIPT_RECOVERY_PERMITTED"},{"id":"RFCRAA-121","mutation":"OWNER_APPROVAL_ORDER_EXACT","expected":"ACCEPT"},{"id":"RFCRAA-122","mutation":"PREDECESSOR_DENIAL_REQUIRED_EXACT","expected":"ACCEPT"},{"id":"RFCRAA-123","mutation":"DOSSIER_SUCCESSOR_ADMISSION_PERMITTED","expected":"DENY"},{"id":"RFCRAA-124","mutation":"RECEIPT_SUCCESSOR_ADMITTED","expected":"DENY"},{"id":"RFCRAA-125","mutation":"VERIFIER_FANOUT_ORDER_EXACT","expected":"ACCEPT"},{"id":"RFCRAA-126","mutation":"AUTOMATIC_ROLLBACK_REQUIRED_EXACT","expected":"ACCEPT"},{"id":"RFCRAA-127","mutation":"DOSSIER_CANARY_REACTIVATION_PERMITTED","expected":"DENY"},{"id":"RFCRAA-128","mutation":"RECEIPT_CANARY_REACTIVATION_AUTHORIZED","expected":"DENY"}],"successorKeyCustodyEvidenceConsumed":0,"revokedGenerationPropagationsExecuted":0,"cleanGrantsIssued":0,"auditContinuationsWritten":0,"ownerApprovalsExecuted":0,"successorGenerationAdmissionsExecuted":0,"verifierFanoutChangesExecuted":0,"canaryGrantsIssued":0,"observationWindowsStarted":0,"rollbackTriggersArmed":0,"terminalAuditWitnessesWritten":0,"canaryReactivationAuthorizationsExecuted":0}},"disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionCanaryReactivationAuthorizationOutcomeAdjudication":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-outcome-adjudication-contract/v1","status":"DISPOSABLE_HOST_LIVE_EVIDENCE_COLLECTION_EXECUTION_AUTHORIZATION_AUTHORITY_COMPROMISE_CONTAINMENT_AUDIT_CHAIN_RECOVERY_REVIEW_SUCCESSOR_GENERATION_ADMISSION_CANARY_REACTIVATION_AUTHORIZATION_OUTCOME_ADJUDICATION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T19:00:00.000Z","scope":{"mode":"FIXTURE_CANARY_OUTCOME_ADJUDICATION_ONLY_NO_PROMOTION_NO_GRANT_WIDENING_NO_ROLLBACK_SUPPRESSION_NO_HOST_START_NO_AUDIT_WRITE","input":"POSITIVELY_VERIFIED_FIXTURE_CANARY_REACTIVATION_AUTHORIZATION_RECEIPT","output":"CANARY_OUTCOME_ADJUDICATION_PACKET_PREPARED_FIXTURE_ONLY","verdict":"REQUIRES_PRODUCTION_CANARY_OBSERVATION_TERMINAL_HEALTH_ROLLBACK_COMPLETION_AUDIT_CONTINUITY_AND_INDEPENDENT_OWNER_REVIEW_EVIDENCE","fixtureAdjudicationShapesVerified":5,"fixtureOutcomeClassesVerified":3,"outcomeClassification":"UNOBSERVED","promotionPermitted":false,"grantWideningPermitted":false,"rollbackSuppressionPermitted":false,"executionPermitted":false,"hostStarted":false,"hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","transactionAuthority":"NONE","launchAuthority":"NONE","billingAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"operations":[{"id":"prepare","input":"canary authorization receipt + outcome dossier + five adjudication-shape receipts + request","output":"opaque one-shot handle","sideEffect":"NONE"},{"id":"project","input":"exact opaque handle","output":"fixture-only canary outcome adjudication receipt","sideEffect":"NONE"},{"id":"verify","input":"canary outcome adjudication receipt","output":"deterministic boolean","sideEffect":"NONE"},{"id":"dispose","input":"opaque handle","output":"idempotent disposal boolean","sideEffect":"NONE"}],"upstream":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-receipt/v1","requiredStatus":"SUCCESSOR_GENERATION_CANARY_REACTIVATION_AUTHORIZATION_PACKET_PREPARED_FIXTURE_ONLY","requiredMode":"FIXTURE_SUCCESSOR_GENERATION_CANARY_REACTIVATION_AUTHORIZATION_ONLY_NO_GRANT_NO_HOST_START_NO_AUDIT_WRITE","requiredVerdict":"REQUIRES_PRODUCTION_VERIFIER_FANOUT_BOUNDED_NO_SHELL_CANARY_GRANT_OBSERVATION_WINDOW_AUTOMATIC_ROLLBACK_AND_TERMINAL_AUDIT_WITNESS_EVIDENCE","authoritativeVerifierRequired":true,"exactIdentityBindingRequired":true,"unexpiredReceiptRequired":true},"outcomeClasses":[{"id":"PROMOTE_DENIED","meaning":"Promotion is never an automatic result of this seam.","effectAuthority":"NONE"},{"id":"ROLLBACK_REQUIRED","meaning":"Failure, threshold breach, missing evidence or uncertainty requires the separately authorized rollback path.","effectAuthority":"NONE"},{"id":"CANARY_TERMINAL_SUCCESS_REQUIRES_OWNER_REVIEW","meaning":"A healthy terminal canary is evidence for a separate owner decision, never promotion authority.","effectAuthority":"NONE"}],"adjudicationSlots":[{"ordinal":1,"slot":"OBSERVATION_COMPLETENESS_ADJUDICATION","authority":"CANARY_OBSERVATION_ADJUDICATOR","signerKeyId":"fixture-p256-canary-observation-adjudicator","requiredBinding":"BIND_FULL_OBSERVATION_WINDOW_SIGNAL_SET_SAMPLING_CADENCE_ABORT_THRESHOLDS_AND_MISSING_DATA_POLICY","observedLive":false},{"ordinal":2,"slot":"TERMINAL_HEALTH_CLASSIFICATION_ADJUDICATION","authority":"HEALTH_CLASSIFICATION_AUTHORITY","signerKeyId":"fixture-p256-health-classification-authority","requiredBinding":"BIND_TERMINAL_HEALTH_CLASS_TO_EXACT_SIGNALS_THRESHOLDS_AND_SUCCESSOR_GENERATION","observedLive":false},{"ordinal":3,"slot":"ROLLBACK_COMPLETION_ADJUDICATION","authority":"ROLLBACK_COMPLETION_AUTHORITY","signerKeyId":"fixture-p256-rollback-completion-authority","requiredBinding":"BIND_ROLLBACK_REQUIRED_TO_GRANT_REVOCATION_HOST_RETIREMENT_QUARANTINE_REENTRY_AND_DEADLINE","observedLive":false},{"ordinal":4,"slot":"AUDIT_CONTINUITY_ADJUDICATION","authority":"AUDIT_CONTINUITY_AUTHORITY","signerKeyId":"fixture-p256-audit-continuity-authority","requiredBinding":"BIND_TERMINAL_OUTCOME_TO_UPSTREAM_AUTHORIZATION_OBSERVATION_AND_ROLLBACK_CHAIN_WITHOUT_GAP","observedLive":false},{"ordinal":5,"slot":"INDEPENDENT_OWNER_OUTCOME_REVIEW","authority":"OUTCOME_REVIEW_AUTHORITY","signerKeyId":"fixture-p256-outcome-review-authority","requiredBinding":"BIND_OWNER_REVIEW_TO_EXACT_CANARY_TERMINAL_PACKET_WITH_PROMOTION_ALWAYS_DENIED","observedLive":false}],"authorityTopology":[{"authority":"CANARY_OBSERVATION_ADJUDICATOR","slots":1,"mayClassifyOutcome":false,"mayPromote":false,"mayWidenGrant":false,"maySuppressRollback":false,"mayWriteAudit":false,"mayStartHost":false},{"authority":"HEALTH_CLASSIFICATION_AUTHORITY","slots":1,"mayClassifyOutcome":false,"mayPromote":false,"mayWidenGrant":false,"maySuppressRollback":false,"mayWriteAudit":false,"mayStartHost":false},{"authority":"ROLLBACK_COMPLETION_AUTHORITY","slots":1,"mayClassifyOutcome":false,"mayPromote":false,"mayWidenGrant":false,"maySuppressRollback":false,"mayWriteAudit":false,"mayStartHost":false},{"authority":"AUDIT_CONTINUITY_AUTHORITY","slots":1,"mayClassifyOutcome":false,"mayPromote":false,"mayWidenGrant":false,"maySuppressRollback":false,"mayWriteAudit":false,"mayStartHost":false},{"authority":"OUTCOME_REVIEW_AUTHORITY","slots":1,"mayClassifyOutcome":false,"mayPromote":false,"mayWidenGrant":false,"maySuppressRollback":false,"mayWriteAudit":false,"mayStartHost":false}],"adjudicationGuardrails":{"requestValiditySeconds":30,"adjudicationShapeValiditySeconds":3600,"observationWindowSeconds":900,"rollbackCompletionDeadlineSeconds":30,"hostCountMaximum":1,"maximumMilliUsdCeiling":500,"currency":"USD","adjudicationOrdering":"VERIFY_CANARY_AUTHORIZATION_THEN_ADJUDICATE_OBSERVATION_COMPLETENESS_THEN_CLASSIFY_TERMINAL_HEALTH_THEN_VERIFY_ROLLBACK_COMPLETION_THEN_VERIFY_AUDIT_CONTINUITY_THEN_REQUIRE_INDEPENDENT_OWNER_REVIEW","failurePolicy":"PROMOTION_ALWAYS_DENIED_ROLLBACK_REQUIRED_ON_FAILURE_OR_UNCERTAINTY_AND_SUCCESS_REQUIRES_SEPARATE_OWNER_REVIEW","environment":"isolated-nonproduction-required-not-provisioned","networkIngress":"NONE","networkEgress":"DEFAULT_DENY_ALLOWLIST_REQUIRED","shellSurface":"NONE","outcomeClassification":"UNOBSERVED","promotionPermitted":false,"grantWideningPermitted":false,"rollbackSuppressionPermitted":false,"executionAuthorized":false,"hostStarted":false,"productionConfigured":false},"stateModel":["UNTRUSTED","UPSTREAM_CANARY_REACTIVATION_AUTHORIZATION_VERIFIED","CANARY_OUTCOME_DOSSIER_BOUND","OBSERVATION_COMPLETENESS_SHAPE_VERIFIED","TERMINAL_HEALTH_CLASSIFICATION_SHAPE_VERIFIED","ROLLBACK_COMPLETION_SHAPE_VERIFIED","AUDIT_CONTINUITY_SHAPE_VERIFIED","INDEPENDENT_OWNER_OUTCOME_REVIEW_SHAPE_VERIFIED","OUTCOME_CLASSES_BOUND","ADJUDICATION_ORDER_FROZEN","PREDECESSOR_CHAIN_BOUND","OBSERVATION_GAP_POLICY_BOUND","ROLLBACK_REQUIRED_POLICY_BOUND","PROMOTION_DENIAL_BOUND","SUCCESS_OWNER_REVIEW_BOUND","IDEMPOTENCY_BOUND","AUTHORITY_SEPARATION_BOUND","CANARY_OUTCOME_ADJUDICATION_PREPARED_FIXTURE_ONLY","CANARY_OUTCOME_ADJUDICATION_RECEIPT_PROJECTED","CANARY_OUTCOME_ADJUDICATION_RECEIPT_VERIFIED","SUCCESSOR_PROMOTION_REMAINS_DENIED","DENIED_OR_DISPOSED"],"invariants":["Fixture outcome classes never constitute promotion, grant-widening, rollback-suppression, audit-write or execution authority.","Missing, partial, stale or ambiguous observation evidence always resolves to rollback required and never to success.","A terminally healthy canary can only request a separate independent owner review; it cannot promote itself.","The production Controller composition root must not import this fixture-only outcome adjudicator."],"invariantAccounting":{"inheritedFromCanaryReactivationAuthorization":102,"newOutcomeAdjudicationInvariants":4,"total":106},"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":132,"acceptedOutcomes":28,"deniedOutcomes":104,"upstreamReceiptsVerified":110,"adjudicationSlotReceiptsVerified":282,"adjudicationReceiptsVerified":3,"projectedAdjudications":34,"disposedHandles":2,"fixtureOutcomeClassesVerified":3,"canaryObservationEvidenceObserved":0,"terminalHealthEvidenceObserved":0,"rollbackCompletionEvidenceObserved":0,"auditContinuityEvidenceObserved":0,"independentOwnerOutcomeReviewsObserved":0,"outcomeAdjudicationsObserved":0,"promotionsExecuted":0,"grantWidensExecuted":0,"rollbackSuppressionsExecuted":0,"auditWritesExecuted":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"productionPrerequisites":["A complete immutable fifteen-minute canary observation packet with every required signal, sampling cadence, threshold and explicit missing-data decision.","A terminal health classification signed by an authority independent from the canary grant and bound to the exact successor generation.","A rollback completion receipt proving grant revocation, host retirement and quarantine re-entry within thirty seconds whenever rollback is required.","An immutable audit-continuity witness linking authorization, observation, classification, rollback outcome and owner review without a gap or rewrite.","An independent owner outcome review that may request a later promotion decision but carries no promotion, grant, audit or host capability."],"prerequisiteAccounting":{"inheritedFromCanaryReactivationAuthorization":30,"newOutcomeAdjudicationPrerequisites":5,"total":35},"selectedDenialTrace":{"fixtureId":"RFCOAJ-131","mutation":"DOSSIER_PROMOTION_PERMITTED","expected":"DENY","reason":"A caller cannot turn five fixture-only adjudication shapes into promotion authority by setting promotionPermitted=true; promotion remains denied and no grant, rollback suppression, audit or host capability is issued."},"truth":{"canaryObservationEvidenceObserved":0,"terminalHealthEvidenceObserved":0,"rollbackCompletionEvidenceObserved":0,"auditContinuityEvidenceObserved":0,"independentOwnerOutcomeReviewsObserved":0,"outcomeAdjudicationsObserved":0,"promotionsExecuted":0,"grantWidensExecuted":0,"rollbackSuppressionsExecuted":0,"auditWritesExecuted":0,"executionAuthorizationsObserved":0,"productionHostRuns":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"outcomeClassification":"UNOBSERVED","promotionPermitted":false,"grantWideningPermitted":false,"rollbackSuppressionPermitted":false,"executionPermitted":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-outcome-adjudication-fixtures/v1","description":"Deterministic fixture-only canary outcome adjudication cases. No promotion, grant widening, rollback suppression, audit write, host launch, billing or paid resource is executed.","mode":"FIXTURE_CANARY_OUTCOME_ADJUDICATION_ONLY_NO_PROMOTION_NO_GRANT_WIDENING_NO_ROLLBACK_SUPPRESSION_NO_HOST_START_NO_AUDIT_WRITE","networkRequestsExecuted":0,"compromiseSignalsConsumed":0,"keyGenerationsQuarantined":0,"keysCreated":0,"keysRotated":0,"keysRevoked":0,"grantsRevoked":0,"compensationsExecuted":0,"leasesExpired":0,"auditWritesExecuted":0,"operatorEscalationsExecuted":0,"recoveryReadmissionsExecuted":0,"transactionCommitsExecuted":0,"executionAuthorizationsExecuted":0,"hostLaunchesExecuted":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"cases":[{"id":"RFCOAJ-001","expected":"ACCEPT","mutation":"PREPARE_BASELINE"},{"id":"RFCOAJ-002","expected":"ACCEPT","mutation":"PROJECT_BASELINE"},{"id":"RFCOAJ-003","expected":"ACCEPT","mutation":"VERIFY_RECEIPT"},{"id":"RFCOAJ-004","expected":"ACCEPT","mutation":"VERIFY_REPLAY"},{"id":"RFCOAJ-005","expected":"ACCEPT","mutation":"DISPOSE_REPLAY"},{"id":"RFCOAJ-006","expected":"ACCEPT","mutation":"REQUEST_WINDOW_EDGE"},{"id":"RFCOAJ-007","expected":"ACCEPT","mutation":"COST_ZERO_EDGE"},{"id":"RFCOAJ-008","expected":"ACCEPT","mutation":"COST_CAP_EDGE"},{"id":"RFCOAJ-009","expected":"ACCEPT","mutation":"SLOT_VALIDITY_EDGE"},{"id":"RFCOAJ-010","expected":"ACCEPT","mutation":"PROJECT_OBSERVED_AT_EDGE"},{"id":"RFCOAJ-011","expected":"ACCEPT","mutation":"DISPOSE_AFTER_PROJECT"},{"id":"RFCOAJ-012","expected":"ACCEPT","mutation":"INDEPENDENT_DOSSIER_CLONE"},{"id":"RFCOAJ-013","expected":"ACCEPT","mutation":"UPSTREAM_COST_ZERO_EDGE"},{"id":"RFCOAJ-014","expected":"ACCEPT","mutation":"QUOTE_AGE_EXACT"},{"id":"RFCOAJ-015","expected":"ACCEPT","mutation":"HOLD_TTL_EXACT"},{"id":"RFCOAJ-016","expected":"ACCEPT","mutation":"CLAIM_TTL_EXACT"},{"id":"RFCOAJ-017","expected":"DENY","mutation":"EXECUTABLE_KEY"},{"id":"RFCOAJ-018","expected":"DENY","mutation":"RECEIPT_TRANSACTION_COMMITTED"},{"id":"RFCOAJ-019","expected":"DENY","mutation":"PRICING_CLIENT_KEY"},{"id":"RFCOAJ-020","expected":"DENY","mutation":"BUDGET_CLIENT_KEY"},{"id":"RFCOAJ-021","expected":"DENY","mutation":"CAPACITY_CLIENT_KEY"},{"id":"RFCOAJ-022","expected":"DENY","mutation":"HOST_PROVIDER_KEY"},{"id":"RFCOAJ-023","expected":"DENY","mutation":"PAYMENT_CLIENT_KEY"},{"id":"RFCOAJ-024","expected":"DENY","mutation":"COMMIT_TRANSACTION_KEY"},{"id":"RFCOAJ-025","expected":"DENY","mutation":"UPSTREAM_SCHEMA"},{"id":"RFCOAJ-026","expected":"DENY","mutation":"UPSTREAM_STATUS"},{"id":"RFCOAJ-027","expected":"DENY","mutation":"UPSTREAM_VERDICT"},{"id":"RFCOAJ-028","expected":"DENY","mutation":"UPSTREAM_MODE"},{"id":"RFCOAJ-029","expected":"DENY","mutation":"UPSTREAM_ID"},{"id":"RFCOAJ-030","expected":"DENY","mutation":"UPSTREAM_DIGEST"},{"id":"RFCOAJ-031","expected":"DENY","mutation":"UPSTREAM_STEP_COUNT"},{"id":"RFCOAJ-032","expected":"DENY","mutation":"UPSTREAM_PLAN_VERIFIED"},{"id":"RFCOAJ-033","expected":"DENY","mutation":"UPSTREAM_HOST_COUNT"},{"id":"RFCOAJ-034","expected":"DENY","mutation":"UPSTREAM_COST_OVER"},{"id":"RFCOAJ-035","expected":"DENY","mutation":"UPSTREAM_CURRENCY"},{"id":"RFCOAJ-036","expected":"DENY","mutation":"UPSTREAM_QUOTE_AGE"},{"id":"RFCOAJ-037","expected":"DENY","mutation":"UPSTREAM_HOLD_TTL"},{"id":"RFCOAJ-038","expected":"DENY","mutation":"UPSTREAM_CLAIM_TTL"},{"id":"RFCOAJ-039","expected":"DENY","mutation":"UPSTREAM_REAL_CONFIRMATION"},{"id":"RFCOAJ-040","expected":"DENY","mutation":"UPSTREAM_LIVE_QUOTE"},{"id":"RFCOAJ-041","expected":"DENY","mutation":"UPSTREAM_BUDGET_HOLD"},{"id":"RFCOAJ-042","expected":"DENY","mutation":"UPSTREAM_HOST_CLAIM"},{"id":"RFCOAJ-043","expected":"DENY","mutation":"UPSTREAM_TRANSACTION_AUTHORITY"},{"id":"RFCOAJ-044","expected":"DENY","mutation":"UPSTREAM_HOST_RUN"},{"id":"RFCOAJ-045","expected":"DENY","mutation":"UPSTREAM_PAID_RESOURCE"},{"id":"RFCOAJ-046","expected":"DENY","mutation":"UPSTREAM_EXPIRED"},{"id":"RFCOAJ-047","expected":"DENY","mutation":"UPSTREAM_VERIFIER_FALSE"},{"id":"RFCOAJ-048","expected":"DENY","mutation":"UPSTREAM_VERIFIER_THROW"},{"id":"RFCOAJ-049","expected":"DENY","mutation":"DOSSIER_SCHEMA"},{"id":"RFCOAJ-050","expected":"DENY","mutation":"DOSSIER_UPSTREAM"},{"id":"RFCOAJ-051","expected":"DENY","mutation":"DOSSIER_CONFIRMATION_SCOPE"},{"id":"RFCOAJ-052","expected":"DENY","mutation":"DOSSIER_ECONOMIC_SCOPE"},{"id":"RFCOAJ-053","expected":"DENY","mutation":"DOSSIER_HOST_COUNT"},{"id":"RFCOAJ-054","expected":"DENY","mutation":"DOSSIER_COST_OVER"},{"id":"RFCOAJ-055","expected":"DENY","mutation":"DOSSIER_CURRENCY"},{"id":"RFCOAJ-056","expected":"DENY","mutation":"DOSSIER_QUOTE_AGE"},{"id":"RFCOAJ-057","expected":"DENY","mutation":"DOSSIER_HOLD_TTL"},{"id":"RFCOAJ-058","expected":"DENY","mutation":"DOSSIER_CLAIM_TTL"},{"id":"RFCOAJ-059","expected":"DENY","mutation":"DOSSIER_COMMIT_PERMITTED"},{"id":"RFCOAJ-060","expected":"DENY","mutation":"DOSSIER_ORDERING"},{"id":"RFCOAJ-061","expected":"DENY","mutation":"DOSSIER_FAILURE_POLICY"},{"id":"RFCOAJ-062","expected":"DENY","mutation":"DOSSIER_REAL_CONFIRMATION"},{"id":"RFCOAJ-063","expected":"DENY","mutation":"DOSSIER_LIVE_QUOTE"},{"id":"RFCOAJ-064","expected":"DENY","mutation":"DOSSIER_BUDGET_HOLD"},{"id":"RFCOAJ-065","expected":"DENY","mutation":"DOSSIER_HOST_CLAIM"},{"id":"RFCOAJ-066","expected":"DENY","mutation":"DOSSIER_COORDINATOR"},{"id":"RFCOAJ-067","expected":"DENY","mutation":"DOSSIER_COMPENSATION"},{"id":"RFCOAJ-068","expected":"DENY","mutation":"DOSSIER_EXECUTION_PERMITTED"},{"id":"RFCOAJ-069","expected":"DENY","mutation":"DOSSIER_DIGEST"},{"id":"RFCOAJ-070","expected":"DENY","mutation":"SLOT_COUNT"},{"id":"RFCOAJ-071","expected":"DENY","mutation":"SLOT_ORDER"},{"id":"RFCOAJ-072","expected":"DENY","mutation":"SLOT_ORDINAL"},{"id":"RFCOAJ-073","expected":"DENY","mutation":"SLOT_NAME"},{"id":"RFCOAJ-074","expected":"DENY","mutation":"SLOT_DECISION"},{"id":"RFCOAJ-075","expected":"DENY","mutation":"SLOT_AUTHORITY"},{"id":"RFCOAJ-076","expected":"DENY","mutation":"SLOT_SIGNER"},{"id":"RFCOAJ-077","expected":"DENY","mutation":"SLOT_MODE"},{"id":"RFCOAJ-078","expected":"DENY","mutation":"SLOT_BINDING"},{"id":"RFCOAJ-079","expected":"DENY","mutation":"SLOT_UPSTREAM"},{"id":"RFCOAJ-080","expected":"DENY","mutation":"SLOT_DOSSIER"},{"id":"RFCOAJ-081","expected":"DENY","mutation":"SLOT_PREDECESSOR"},{"id":"RFCOAJ-082","expected":"DENY","mutation":"SLOT_IDEMPOTENCY"},{"id":"RFCOAJ-083","expected":"DENY","mutation":"SLOT_ORIGIN"},{"id":"RFCOAJ-084","expected":"DENY","mutation":"SLOT_LIVE_RECEIPT"},{"id":"RFCOAJ-085","expected":"DENY","mutation":"SLOT_EFFECT"},{"id":"RFCOAJ-086","expected":"DENY","mutation":"SLOT_DURABLE_WRITE"},{"id":"RFCOAJ-087","expected":"DENY","mutation":"SLOT_HOST_CLAIM"},{"id":"RFCOAJ-088","expected":"DENY","mutation":"SLOT_COMMIT"},{"id":"RFCOAJ-089","expected":"DENY","mutation":"SLOT_PRODUCTION_CONFIGURED"},{"id":"RFCOAJ-090","expected":"DENY","mutation":"SLOT_EXPIRED"},{"id":"RFCOAJ-091","expected":"DENY","mutation":"SLOT_WINDOW_LONG"},{"id":"RFCOAJ-092","expected":"DENY","mutation":"SLOT_DIGEST"},{"id":"RFCOAJ-093","expected":"DENY","mutation":"SLOT_VERIFIER_FALSE"},{"id":"RFCOAJ-094","expected":"DENY","mutation":"SLOT_VERIFIER_THROW"},{"id":"RFCOAJ-095","expected":"DENY","mutation":"REQUEST_SCHEMA"},{"id":"RFCOAJ-096","expected":"DENY","mutation":"REQUEST_ACTION"},{"id":"RFCOAJ-097","expected":"DENY","mutation":"REQUEST_MODE"},{"id":"RFCOAJ-098","expected":"DENY","mutation":"REQUEST_UPSTREAM"},{"id":"RFCOAJ-099","expected":"DENY","mutation":"REQUEST_DOSSIER"},{"id":"RFCOAJ-100","expected":"DENY","mutation":"REQUEST_SLOT_ORDER"},{"id":"RFCOAJ-101","expected":"DENY","mutation":"REQUEST_DIGESTS"},{"id":"RFCOAJ-102","expected":"DENY","mutation":"REQUEST_NONCE_INVALID"},{"id":"RFCOAJ-103","expected":"DENY","mutation":"REQUEST_EXPIRED"},{"id":"RFCOAJ-104","expected":"DENY","mutation":"REQUEST_WINDOW_LONG"},{"id":"RFCOAJ-105","expected":"DENY","mutation":"REQUEST_REPLAY"},{"id":"RFCOAJ-106","expected":"DENY","mutation":"RECONSTRUCTED_HANDLE"},{"id":"RFCOAJ-107","expected":"DENY","mutation":"DISPOSED_HANDLE"},{"id":"RFCOAJ-108","expected":"DENY","mutation":"PROJECT_REPLAY"},{"id":"RFCOAJ-109","expected":"ACCEPT","mutation":"HANDOFF_ORDER_EXACT"},{"id":"RFCOAJ-110","expected":"ACCEPT","mutation":"POLICY_REVALIDATION_REQUIRED_EXACT"},{"id":"RFCOAJ-111","expected":"DENY","mutation":"DOSSIER_EXECUTION_HANDOFF_PERMITTED"},{"id":"RFCOAJ-112","expected":"DENY","mutation":"RECEIPT_EXECUTION_AUTHORIZED"},{"id":"RFCOAJ-113","expected":"ACCEPT","mutation":"AUDIT_WITNESS_REQUIRED_EXACT"},{"id":"RFCOAJ-114","expected":"ACCEPT","mutation":"FAILURE_POLICY_EXACT"},{"id":"RFCOAJ-115","expected":"DENY","mutation":"DOSSIER_AUTHORITY_TRUST_PERMITTED"},{"id":"RFCOAJ-116","expected":"DENY","mutation":"RECEIPT_AUTHORITY_TRUST_PERMITTED"},{"id":"RFCOAJ-117","expected":"ACCEPT","mutation":"AUDIT_CONTINUITY_REQUIRED_EXACT"},{"id":"RFCOAJ-118","expected":"ACCEPT","mutation":"QUARANTINE_FAILURE_POLICY_EXACT"},{"id":"RFCOAJ-119","expected":"DENY","mutation":"DOSSIER_RECOVERY_PERMITTED"},{"id":"RFCOAJ-120","expected":"DENY","mutation":"RECEIPT_RECOVERY_PERMITTED"},{"id":"RFCOAJ-121","mutation":"OWNER_APPROVAL_ORDER_EXACT","expected":"ACCEPT"},{"id":"RFCOAJ-122","mutation":"PREDECESSOR_DENIAL_REQUIRED_EXACT","expected":"ACCEPT"},{"id":"RFCOAJ-123","mutation":"DOSSIER_SUCCESSOR_ADMISSION_PERMITTED","expected":"DENY"},{"id":"RFCOAJ-124","mutation":"RECEIPT_SUCCESSOR_ADMITTED","expected":"DENY"},{"id":"RFCOAJ-125","mutation":"VERIFIER_FANOUT_ORDER_EXACT","expected":"ACCEPT"},{"id":"RFCOAJ-126","mutation":"AUTOMATIC_ROLLBACK_REQUIRED_EXACT","expected":"ACCEPT"},{"id":"RFCOAJ-127","mutation":"DOSSIER_CANARY_REACTIVATION_PERMITTED","expected":"DENY"},{"id":"RFCOAJ-128","mutation":"RECEIPT_CANARY_REACTIVATION_AUTHORIZED","expected":"DENY"},{"id":"RFCOAJ-129","mutation":"OUTCOME_CLASSES_EXACT","expected":"ACCEPT"},{"id":"RFCOAJ-130","mutation":"SUCCESS_REQUIRES_OWNER_REVIEW_EXACT","expected":"ACCEPT"},{"id":"RFCOAJ-131","mutation":"DOSSIER_PROMOTION_PERMITTED","expected":"DENY"},{"id":"RFCOAJ-132","mutation":"RECEIPT_PROMOTION_PERMITTED","expected":"DENY"}],"successorKeyCustodyEvidenceConsumed":0,"revokedGenerationPropagationsExecuted":0,"cleanGrantsIssued":0,"auditContinuationsWritten":0,"ownerApprovalsExecuted":0,"successorGenerationAdmissionsExecuted":0,"verifierFanoutChangesExecuted":0,"canaryGrantsIssued":0,"observationWindowsStarted":0,"rollbackTriggersArmed":0,"terminalAuditWitnessesWritten":0,"canaryReactivationAuthorizationOutcomeAdjudicationsExecuted":0,"outcomeClassificationsExecuted":0,"promotionsExecuted":0,"grantWidensExecuted":0,"rollbackSuppressionsExecuted":0}},"d05AcceptanceClosure":{"schemaVersion":"developer.reits.tech/runner-factory-d05-acceptance-closure-contract/v1","status":"D05_ACCEPTANCE_CLOSURE_DOSSIER_IMPLEMENTED_FAIL_CLOSED","observedAt":"2026-07-21T20:00:00Z","mode":"EVIDENCE_DIRECTORY_ONLY_NO_ACCEPTANCE_NO_DEPLOYMENT_NO_LISTENER_NO_EXTERNAL_EFFECT","program":{"acceptedKnives":4,"totalKnives":36,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterAcceptance":31,"productUiAccepted":0,"productUiTotal":85,"controllerReadinessSatisfied":0,"controllerReadinessTotal":11,"d05Accepted":false},"operations":["ASSEMBLE_CLOSURE_DOSSIER","REVIEW_GATE_EVIDENCE","PROJECT_FAIL_CLOSED_DECISION","DISPOSE_REVIEW_PACKET"],"decisionClasses":[{"id":"D05_ACCEPTANCE_DENIED","meaning":"One or more mandatory production gates are missing, invalid, stale, non-independent or unbound.","effectAuthority":"NONE"},{"id":"D05_ACCEPTANCE_REVIEW_REQUIRED","meaning":"All gate shapes may be reviewable, but one or more accountable owners have not signed the exact dossier.","effectAuthority":"NONE"},{"id":"D05_ACCEPTANCE_ELIGIBILITY_UNOBSERVED","meaning":"The portal has not observed a complete production evidence set and cannot claim D05 eligibility or acceptance.","effectAuthority":"NONE"}],"closureGates":[{"id":"D05-G01","name":"ORGANIZATION_LINUX_RUNNER_CAPACITY","owner":"PLATFORM_SRE","requiredEvidence":"Dedicated organization or instance runner receipt with isolation and one-job retirement proof","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G02","name":"INDEPENDENT_MAC_RUNNER_LANE","owner":"MOBILE_PLATFORM","requiredEvidence":"Restored independent Mac runner identity, version, isolation and signed job receipt","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G03","name":"ROOT_OWNED_RUNTIME_CONFIGURATION","owner":"SECURITY","requiredEvidence":"Root-owned manifest, typed ConfigRef and KeyRef resolution with least-visible secret boundary","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G04","name":"REVIEWED_PRODUCTION_FACTORIES","owner":"ARCHITECTURE","requiredEvidence":"Reviewed production implementations for the six closed factories and five read-only sources","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G05","name":"ELEVEN_LIVE_READINESS_RECEIPTS","owner":"CONTROLLER_OWNER","requiredEvidence":"Eleven fresh, signature-verified readiness receipts bound to one release and configuration","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G06","name":"INDEPENDENT_LISTENER_AUTHORIZATION","owner":"RELEASE_OWNER","requiredEvidence":"Separate expiring owner authorization bound to host, release, config, endpoint and rollback","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G07","name":"HARDENED_CONTROLLER_INSTALLATION","owner":"PLATFORM_SRE","requiredEvidence":"Non-login identity, root-owned unit, hardening profile and loopback-only installation receipt","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G08","name":"LIVE_HEALTH_READINESS_NEGATIVE_WEBHOOK","owner":"QA","requiredEvidence":"Live health/readiness plus replay, signature, scope and unready webhook denial evidence","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G09","name":"EXACT_RELEASE_IDENTITY","owner":"SUPPLY_CHAIN","requiredEvidence":"Exact source, artifact, SBOM, configuration, migration and runtime identity chain","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G10","name":"INTENTIONAL_ROLLBACK_DRILL","owner":"RELEASE_ENGINEERING","requiredEvidence":"Observed intentional rollback and recovery to named immutable release units","liveReceiptsObserved":0,"status":"NOT_OBSERVED"},{"id":"D05-G11","name":"COST_RUNTIME_SECURITY_APPROVAL","owner":"PRODUCT_OWNER","requiredEvidence":"Independent cost, runtime and security approval bound to the exact closure dossier","liveReceiptsObserved":0,"status":"NOT_OBSERVED"}],"decisionSeats":[{"ordinal":1,"seat":"PLATFORM_SRE_SIGNOFF","authority":"PLATFORM_SRE","requiredBinding":"G01+G07+G10","signed":false,"mayAcceptD05":false,"mayStartController":false},{"ordinal":2,"seat":"SECURITY_SIGNOFF","authority":"SECURITY_OWNER","requiredBinding":"G03+G05+G06","signed":false,"mayAcceptD05":false,"mayStartController":false},{"ordinal":3,"seat":"ARCHITECTURE_SIGNOFF","authority":"GLOBAL_ARCHITECT","requiredBinding":"G04+G09","signed":false,"mayAcceptD05":false,"mayStartController":false},{"ordinal":4,"seat":"QA_SIGNOFF","authority":"QA_ARCHITECT","requiredBinding":"G02+G08+G10","signed":false,"mayAcceptD05":false,"mayStartController":false},{"ordinal":5,"seat":"PRODUCT_OWNER_SIGNOFF","authority":"PRODUCT_OWNER","requiredBinding":"G11+EXACT_DOSSIER","signed":false,"mayAcceptD05":false,"mayStartController":false}],"invariants":["ALL_ELEVEN_GATES_ARE_MANDATORY","NO_BOOLEAN_MAY_REPLACE_A_SIGNED_RECEIPT","ALL_RECEIPTS_BIND_ONE_EXACT_RELEASE_AND_CONFIGURATION","RUNNER_CAPACITY_AND_CONTROLLER_READINESS_ARE_SEPARATE_GATES","MAC_AND_LINUX_LANES_REQUIRE_INDEPENDENT_EVIDENCE","LISTENER_AUTHORIZATION_IS_SEPARATE_EXPIRING_AUTHORITY","HEALTH_SUCCESS_CANNOT_REPLACE_NEGATIVE_WEBHOOK_EVIDENCE","ROLLBACK_MUST_BE_INTENTIONAL_OBSERVED_AND_NAMED","SIGNERS_MUST_BE_INDEPENDENT_AND_DOSSIER_BOUND","PORT_8110_REMAINS_CLOSED_UNTIL_EXTERNAL_AUTHORIZATION","MISSING_STALE_OR_AMBIGUOUS_EVIDENCE_DENIES_ACCEPTANCE","THIS_DIRECTORY_CANNOT_ACCEPT_D05_OR_EXECUTE_ANY_EFFECT"],"selectedDenialTrace":{"fixtureId":"D05C-023","mutation":"FORGE_D05_ACCEPTED_TRUE","expected":"DENY","reason":"A caller cannot turn a 0/11 closure dossier into program acceptance by setting d05Accepted=true."},"truth":{"closureGatesSatisfied":0,"liveEvidenceReceiptsObserved":0,"independentSignaturesObserved":0,"d05AcceptanceDecisionsObserved":0,"controllerReadinessSatisfied":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"systemdUnitsInstalled":0,"productionHandlersConstructed":0,"productionWebhooksAccepted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"d05Accepted":false,"deploymentPermitted":false},"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-d05-acceptance-closure-fixtures/v1","mode":"FIXTURE_DOSSIER_VALIDATION_ONLY_NO_ACCEPTANCE_NO_DEPLOYMENT_NO_EXTERNAL_EFFECT","cases":[{"id":"D05C-001","mutation":"BASELINE_DOSSIER_SHAPE","expected":"VALID_SHAPE"},{"id":"D05C-002","mutation":"GATE_ORDER_EXACT","expected":"VALID_SHAPE"},{"id":"D05C-003","mutation":"ZERO_TRUTH_EXACT","expected":"VALID_SHAPE"},{"id":"D05C-004","mutation":"MISSING_GATE","expected":"DENY"},{"id":"D05C-005","mutation":"DUPLICATE_GATE","expected":"DENY"},{"id":"D05C-006","mutation":"REORDERED_GATE","expected":"DENY"},{"id":"D05C-007","mutation":"FORGED_LINUX_RUNNER_RECEIPT","expected":"DENY"},{"id":"D05C-008","mutation":"FORGED_MAC_RUNNER_RECEIPT","expected":"DENY"},{"id":"D05C-009","mutation":"NON_ROOT_CONFIGURATION","expected":"DENY"},{"id":"D05C-010","mutation":"UNREVIEWED_FACTORY","expected":"DENY"},{"id":"D05C-011","mutation":"PARTIAL_READINESS","expected":"DENY"},{"id":"D05C-012","mutation":"EXPIRED_LISTENER_AUTHORIZATION","expected":"DENY"},{"id":"D05C-013","mutation":"UNHARDENED_INSTALLATION","expected":"DENY"},{"id":"D05C-014","mutation":"MISSING_NEGATIVE_WEBHOOK","expected":"DENY"},{"id":"D05C-015","mutation":"RELEASE_IDENTITY_DRIFT","expected":"DENY"},{"id":"D05C-016","mutation":"UNOBSERVED_ROLLBACK","expected":"DENY"},{"id":"D05C-017","mutation":"MISSING_COST_APPROVAL","expected":"DENY"},{"id":"D05C-018","mutation":"MISSING_RUNTIME_APPROVAL","expected":"DENY"},{"id":"D05C-019","mutation":"MISSING_SECURITY_APPROVAL","expected":"DENY"},{"id":"D05C-020","mutation":"NON_INDEPENDENT_SIGNERS","expected":"DENY"},{"id":"D05C-021","mutation":"STALE_DOSSIER","expected":"DENY"},{"id":"D05C-022","mutation":"OPEN_PORT_8110","expected":"DENY"},{"id":"D05C-023","mutation":"FORGE_D05_ACCEPTED_TRUE","expected":"DENY"},{"id":"D05C-024","mutation":"ADD_EFFECT_CAPABILITY","expected":"DENY"}],"validatedShapeCases":3,"deniedCases":21,"liveEvidenceReceiptsObserved":0,"independentSignaturesObserved":0,"d05AcceptanceDecisionsObserved":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false},"verification":{"status":"PASS_DIRECTORY_ONLY","closureGates":11,"closureGatesSatisfied":0,"decisionSeats":5,"decisionClasses":3,"fixtures":24,"validatedShapeCases":3,"deniedCases":21,"controllerListeners":0,"externalWritesExecuted":0,"paidResourcesCreated":false,"d05Accepted":false}},"compensations":[{"id":"RC-01","phase":"INGRESS","failure":"signature-or-payload-denied","action":"return-denial-without-reservation","safeState":"NO_RESOURCE","runtime":"NOT_OBSERVED"},{"id":"RC-02","phase":"RESERVATION","failure":"duplicate-or-conditional-write-conflict","action":"return-existing-plan-reference","safeState":"NO_SECOND_WORKER","runtime":"NOT_OBSERVED"},{"id":"RC-03","phase":"LAUNCH","failure":"instance-launch-failed-or-ambiguous","action":"freeze-whole-pool-and-reconcile-idempotent-launch","safeState":"NO_NEW_SCHEDULING_ON_AMBIGUITY","runtime":"NOT_OBSERVED"},{"id":"RC-04","phase":"REGISTRATION","failure":"ephemeral-registration-failed","action":"revoke-secret-and-terminate-worker","safeState":"NO_LIVE_REGISTRATION_SECRET","runtime":"NOT_OBSERVED"},{"id":"RC-05","phase":"BOUNDARY","failure":"profile-detach-imds-disable-or-reboot-failed","action":"keep-runner-offline-and-terminate-worker","safeState":"NO_JOB_WITH_CLOUD_CREDENTIAL","runtime":"NOT_OBSERVED"},{"id":"RC-06","phase":"ASSIGNMENT","failure":"wrong-job-or-second-assignment","action":"revoke-runner-and-terminate-worker","safeState":"ONE_JOB_MAXIMUM","runtime":"NOT_OBSERVED"},{"id":"RC-07","phase":"EXECUTION","failure":"job-timeout-or-runner-loss","action":"terminate-worker-and-record-terminal-failure","safeState":"NO_REUSED_WORKER","runtime":"NOT_OBSERVED"},{"id":"RC-08","phase":"RETIREMENT","failure":"termination-or-replacement-receipt-missing","action":"freeze-whole-pool-and-page-operator","safeState":"POOL_FAILS_CLOSED","runtime":"NOT_OBSERVED"}],"discovery":{"lifecycle":"/api/runner-factory","workbench":"/release-foundation","schema":"/schemas/runner-factory-controller.v1.schema.json","lifecycleSchema":"/schemas/runner-factory.v1.schema.json","reservationStoreSchema":"/schemas/runner-factory-reservation-store.v1.schema.json","receiptSignerSchema":"/schemas/runner-factory-receipt-signer.v1.schema.json","tokenBrokerSchema":"/schemas/runner-factory-registration-token-broker.v1.schema.json","workerProviderSchema":"/schemas/runner-factory-worker-provider.v1.schema.json","giteaControlPlaneSchema":"/schemas/runner-factory-gitea-control-plane.v1.schema.json","capacityControllerSchema":"/schemas/runner-factory-capacity-controller.v1.schema.json","auditSinkSchema":"/schemas/runner-factory-audit-sink.v1.schema.json","reconciliationPlannerSchema":"/schemas/runner-factory-reconciliation-planner.v1.schema.json","snapshotCoordinatorSchema":"/schemas/runner-factory-reconciliation-snapshot-coordinator.v1.schema.json","runtimeAssembly":"/api/runner-factory/controller/runtime-assembly","runtimeAssemblySchema":"/schemas/runner-factory-controller-runtime-assembly.v1.schema.json","runtimeConfiguration":"/api/runner-factory/controller/runtime-configuration","runtimeConfigurationSchema":"/schemas/runner-factory-controller-runtime-configuration.v1.schema.json","bootstrapComposition":"/api/runner-factory/controller/bootstrap-composition","bootstrapCompositionSchema":"/schemas/runner-factory-controller-bootstrap-composition.v1.schema.json","serviceRuntimeBootstrap":"/api/runner-factory/controller/service-runtime-bootstrap","serviceRuntimeBootstrapSchema":"/schemas/runner-factory-controller-service-runtime-bootstrap.v1.schema.json","productionEvidenceAdmission":"/api/runner-factory/controller/production-evidence-admission","productionEvidenceAdmissionSchema":"/schemas/runner-factory-controller-production-evidence-admission.v1.schema.json","listenerAuthorization":"/api/runner-factory/controller/listener-authorization","listenerAuthorizationSchema":"/schemas/runner-factory-controller-listener-authorization.v1.schema.json","activationExecutor":"/api/runner-factory/controller/activation-executor","activationExecutorSchema":"/schemas/runner-factory-controller-activation-executor.v1.schema.json","activationTransaction":"/api/runner-factory/controller/activation-transaction","activationTransactionSchema":"/schemas/runner-factory-controller-activation-transaction-executor.v1.schema.json","targetHostDriverQualification":"/api/runner-factory/controller/target-host-driver-qualification","targetHostDriverQualificationSchema":"/schemas/runner-factory-controller-target-host-driver-qualification.v1.schema.json","disposableHostConformanceAdmission":"/api/runner-factory/controller/disposable-host-conformance-admission","disposableHostConformanceAdmissionSchema":"/schemas/runner-factory-controller-disposable-host-conformance-admission.v1.schema.json","disposableHostConformanceDossierSealer":"/api/runner-factory/controller/disposable-host-conformance-dossier-sealer","disposableHostConformanceDossierSealerSchema":"/schemas/runner-factory-controller-disposable-host-conformance-dossier-sealer.v1.schema.json","disposableHostExecutionEnvelopeAuthorizer":"/api/runner-factory/controller/disposable-host-execution-envelope-authorizer","disposableHostExecutionEnvelopeAuthorizerSchema":"/schemas/runner-factory-controller-disposable-host-execution-envelope-authorizer.v1.schema.json","disposableHostNoShellExecutor":"/api/runner-factory/controller/disposable-host-no-shell-executor","disposableHostNoShellExecutorSchema":"/schemas/runner-factory-controller-disposable-host-no-shell-executor.v1.schema.json","disposableHostRealPrerequisitesAdmission":"/api/runner-factory/controller/disposable-host-real-prerequisites-admission","disposableHostRealPrerequisitesAdmissionSchema":"/schemas/runner-factory-controller-disposable-host-real-prerequisites-admission.v1.schema.json","disposableHostLiveEvidenceCollectionAuthorization":"/api/runner-factory/controller/disposable-host-live-evidence-collection-authorization","disposableHostLiveEvidenceCollectionAuthorizationSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-authorization.v1.schema.json","disposableHostLiveEvidenceCollectionTransactionIntent":"/api/runner-factory/controller/disposable-host-live-evidence-collection-transaction-intent","disposableHostLiveEvidenceCollectionTransactionIntentSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-transaction-intent.v1.schema.json","disposableHostLiveEvidenceCollectionDetachedUserConfirmation":"/api/runner-factory/controller/disposable-host-live-evidence-collection-detached-user-confirmation","disposableHostLiveEvidenceCollectionDetachedUserConfirmationSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-detached-user-confirmation.v1.schema.json","disposableHostLiveEvidenceCollectionQuoteBudgetClaimTransactionPlan":"/api/runner-factory/controller/disposable-host-live-evidence-collection-quote-budget-claim-transaction-plan","disposableHostLiveEvidenceCollectionQuoteBudgetClaimTransactionPlanSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-quote-budget-claim-transaction-plan.v1.schema.json","disposableHostLiveEvidenceCollectionAtomicTransactionCommitAdmission":"/api/runner-factory/controller/disposable-host-live-evidence-collection-atomic-transaction-commit-admission","disposableHostLiveEvidenceCollectionAtomicTransactionCommitAdmissionSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-atomic-transaction-commit-admission.v1.schema.json","disposableHostLiveEvidenceCollectionTransactionCommitExecutionAuthorizationHandoff":"/api/runner-factory/controller/disposable-host-live-evidence-collection-transaction-commit-execution-authorization-handoff","disposableHostLiveEvidenceCollectionTransactionCommitExecutionAuthorizationHandoffSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-transaction-commit-execution-authorization-handoff.v1.schema.json","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityTrustRevocationAdmission":"/api/runner-factory/controller/disposable-host-live-evidence-collection-execution-authorization-authority-trust-revocation-admission","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityTrustRevocationAdmissionSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-execution-authorization-authority-trust-revocation-admission.v1.schema.json","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReview":"/api/runner-factory/controller/disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review.v1.schema.json","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmission":"/api/runner-factory/controller/disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission.v1.schema.json","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionCanaryReactivationAuthorization":"/api/runner-factory/controller/disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionCanaryReactivationAuthorizationSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization.v1.schema.json","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionCanaryReactivationAuthorizationOutcomeAdjudication":"/api/runner-factory/controller/disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-outcome-adjudication","disposableHostLiveEvidenceCollectionExecutionAuthorizationAuthorityCompromiseContainmentAuditChainRecoveryReviewSuccessorGenerationAdmissionCanaryReactivationAuthorizationOutcomeAdjudicationSchema":"/schemas/runner-factory-controller-disposable-host-live-evidence-collection-execution-authorization-authority-compromise-containment-audit-chain-recovery-review-successor-generation-admission-canary-reactivation-authorization-outcome-adjudication.v1.schema.json","d05AcceptanceClosure":"/api/runner-factory/controller/d05-acceptance-closure","d05AcceptanceClosureSchema":"/schemas/runner-factory-controller-d05-acceptance-closure.v1.schema.json"}}