{"schemaVersion":"developer.reits.tech/runner-factory-controller-activation-executor/v1","status":"ACTIVATION_EXECUTOR_DRY_RUN_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T05:00:00Z","scope":{"mode":"TEST_ONLY_RUNBOOK_NO_EXECUTOR","input":"LISTENER_CANDIDATE_WINDOW_PREFLIGHT_ROLLBACK_GUARD_CONFIRMATIONS","output":"OPAQUE_ONE_SHOT_ACTIVATION_RUNBOOK","endpoint":"127.0.0.1:8110","requestValiditySeconds":60,"maintenanceWindowSeconds":900,"rollbackDeadlineSeconds":60,"networkAuthority":"NONE","deploymentAuthority":"NONE"},"truth":{"productionActivationPlanReceipts":0,"productionMaintenanceWindows":0,"productionRuntimeConfirmations":0,"productionPreflightReceipts":0,"productionRollbackGuards":0,"activationExecutorsConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"requirements":[{"id":"listener-candidate","count":1,"proof":"authority-verified unexpired listener candidate with zero activation authority"},{"id":"plan-request","count":1,"proof":"PLAN_ACTIVATION_ONLY bound to exact release, host, config, unit and loopback target"},{"id":"maintenance-window","count":1,"proof":"signed open change window no longer than 15 minutes"},{"id":"preflight","count":1,"proof":"signed stopped-state proof for 8110, unit, proxy, portal 8100 and rollback"},{"id":"rollback-guard","count":1,"proof":"signed 60-second health/readiness/identity/bind/proxy trigger policy"},{"id":"runtime-confirmations","count":2,"proof":"distinct change owner and incident commander confirmations"},{"id":"nonce","count":1,"proof":"single-use scope-bound activation-planning nonce"},{"id":"expiry","count":1,"proof":"earliest upstream expiry with a 60-second request maximum"}],"operations":[{"id":"prepare","guard":"verify upstream authority, exact stopped state, window, guard and separation of duties","result":"opaque dry-run handle only"},{"id":"verify","guard":"reconstruct runbook identity and zero-authority truth","result":"boolean receipt validation"},{"id":"project","guard":"consume one live capability exactly once","result":"frozen eight-step runbook with no executor"},{"id":"dispose","guard":"revoke retained runbook state","result":"idempotent disposal receipt"}],"stateModel":[{"id":"UNTRUSTED","meaning":"the packet has no activation-planning standing"},{"id":"CANDIDATE_BOUND","meaning":"the authoritative listener candidate is current and unmodified"},{"id":"WINDOW_OPEN","meaning":"the signed change window is open and no longer than 15 minutes"},{"id":"STOPPED_STATE_PROVEN","meaning":"8110, unit, service, proxy and route are absent while portal 8100 is healthy"},{"id":"ROLLBACK_GUARDED","meaning":"the complete fail trigger set has a 60-second recovery deadline"},{"id":"TWO_PERSON_CONFIRMED","meaning":"two different subjects confirm the same dry-run scope"},{"id":"RUNBOOK_CANDIDATE","meaning":"one opaque fixture-only zero-executor capability exists"},{"id":"PROJECTED_OR_DISPOSED","meaning":"the capability cannot be consumed again"},{"id":"DENIED","meaning":"any drift fails closed without install, start, listener or mutation"}],"runbookSteps":[{"order":1,"id":"VERIFY_CANDIDATE","mode":"NO_EXECUTOR"},{"order":2,"id":"VERIFY_WINDOW","mode":"NO_EXECUTOR"},{"order":3,"id":"SNAPSHOT_ROLLBACK","mode":"NO_EXECUTOR"},{"order":4,"id":"INSTALL_UNIT","mode":"NO_EXECUTOR"},{"order":5,"id":"START_LOOPBACK","mode":"NO_EXECUTOR"},{"order":6,"id":"PROBE_HEALTH","mode":"NO_EXECUTOR"},{"order":7,"id":"AUTO_ROLLBACK","mode":"NO_EXECUTOR"},{"order":8,"id":"SEAL_RECEIPT","mode":"NO_EXECUTOR"}],"rollbackTriggers":["START_ERROR","READINESS_TIMEOUT","IDENTITY_DRIFT","UNEXPECTED_BIND","PROXY_DRIFT"],"invariants":["the upstream listener candidate is exact, digest-bound, unexpired and positively verified by its authority","fixture-only listener authority can produce only a fixture-only dry-run runbook","the listener candidate carries activationAuthorized=false and listenerStartAuthorized=false","release identity is unchanged from the listener candidate","rollback release is unchanged from the listener candidate and remains distinct","controller identity is unchanged from the listener candidate","host identity is unchanged from the listener candidate","manifest digest is unchanged from the listener candidate","configuration digest is unchanged from the listener candidate","systemd unit digest is unchanged from the listener candidate","the only request action is PLAN_ACTIVATION_ONLY","service user is exactly reits-runner-factory","service unit is exactly reits-runner-factory-controller.service","bind host is exactly 127.0.0.1 and port is exactly 8110","public route and reverse proxy requests are always false","the plan request window is no longer than 60 seconds","the maintenance window is signed, currently open and no longer than 15 minutes","the maintenance change identifier is format constrained","preflight proves port 8110 is absent","preflight proves the Controller unit is not installed","preflight proves the Controller service is not active","preflight proves no proxy or public route is configured","preflight proves the existing portal on 8100 is healthy","preflight proves the exact rollback release is present","preflight requires at least one GiB of disk headroom","rollback deadline is no longer than 60 seconds","rollback probes are exactly /healthz and /readyz","rollback requires two healthy probes","start error, readiness timeout, identity drift, unexpected bind and proxy drift all trigger rollback","the rollback guard itself exposes no executor","change owner and incident commander are both required in canonical order","change owner and incident commander must be different subjects","both subjects sign CONFIRM_DRY_RUN_ONLY for the same scope and nonce","five evidence signatures must verify positively","the nonce is format-checked and single-use","secret-like and executable fields are structurally rejected","the runbook handle is opaque, one-shot and WeakMap-backed","the projected runbook contains eight declarative NO_EXECUTOR steps","the projected runbook exposes no function and zero executable steps","activation, unit install, service start and listener start remain false","external reads, writes, mutations, paid resources, proxy and public routes remain zero","the production entrypoint remains unconfigured and port 8110 remains absent"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":68,"acceptedOutcomes":6,"deniedOutcomes":62,"fixtureEvidenceSignaturesVerified":110,"runbooksProjected":3,"productionActivationPlanReceipts":0,"activationExecutorsConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["replace the fixture listener candidate with an authority-verified target-host candidate","open an approved production maintenance window with an immutable change identifier","capture signed target-host preflight while 8110, unit, service, proxy and route are absent","prove portal 8100 health and the exact rollback release before any install action","collect different change owner and incident commander subjects for the exact scope","implement a separately reviewed least-privilege executor without shell interpolation","implement an independently testable rollback executor and 60-second watchdog","exercise install, start, health, readiness and every rollback trigger on a non-production host","obtain a new authority receipt before activation; this dry-run runbook can never be promoted"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-activation-executor-fixtures/v1","fixedTime":"2026-07-21T05:00:00.000Z","cases":[{"id":"RFAE-01","profile":"prepare","expected":"ACCEPT","outcome":"RUNBOOK_PREPARED"},{"id":"RFAE-02","profile":"project","expected":"ACCEPT","outcome":"RUNBOOK_PROJECTED"},{"id":"RFAE-03","profile":"verify-receipt","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFAE-04","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFAE-05","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFAE-06","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFAE-07","profile":"missing-verifier","expected":"DENY","errorCode":"RF_ACTIVATION_DEPENDENCIES"},{"id":"RFAE-08","profile":"invalid-clock","expected":"DENY","errorCode":"RF_ACTIVATION_CLOCK"},{"id":"RFAE-09","profile":"candidate-status","expected":"DENY","errorCode":"RF_ACTIVATION_CANDIDATE"},{"id":"RFAE-10","profile":"candidate-expired","expected":"DENY","errorCode":"RF_ACTIVATION_CANDIDATE"},{"id":"RFAE-11","profile":"candidate-digest","expected":"DENY","errorCode":"RF_ACTIVATION_CANDIDATE_DIGEST"},{"id":"RFAE-12","profile":"candidate-provenance","expected":"DENY","errorCode":"RF_ACTIVATION_CANDIDATE_PROVENANCE"},{"id":"RFAE-13","profile":"request-action","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-14","profile":"request-release","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-15","profile":"request-rollback","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-16","profile":"request-controller","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-17","profile":"request-host","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-18","profile":"request-manifest","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-19","profile":"request-config","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-20","profile":"request-unit","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-21","profile":"request-user","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-22","profile":"request-bind","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-23","profile":"request-port","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-24","profile":"request-route","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-25","profile":"request-proxy","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-26","profile":"request-expired","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-27","profile":"request-long-window","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-28","profile":"request-nonce","expected":"DENY","errorCode":"RF_ACTIVATION_REQUEST"},{"id":"RFAE-29","profile":"secret-material","expected":"DENY","errorCode":"RF_ACTIVATION_EXECUTABLE_MATERIAL"},{"id":"RFAE-30","profile":"window-change-id","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-31","profile":"window-status","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-32","profile":"window-release","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-33","profile":"window-host","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-34","profile":"window-not-open","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-35","profile":"window-too-long","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW"},{"id":"RFAE-36","profile":"window-signature","expected":"DENY","errorCode":"RF_ACTIVATION_WINDOW_SIGNATURE"},{"id":"RFAE-37","profile":"preflight-release","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-38","profile":"preflight-rollback","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-39","profile":"preflight-controller","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-40","profile":"preflight-port-present","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-41","profile":"preflight-service-installed","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-42","profile":"preflight-service-active","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-43","profile":"preflight-proxy","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-44","profile":"preflight-route","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-45","profile":"preflight-portal-unhealthy","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-46","profile":"preflight-rollback-missing","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-47","profile":"preflight-disk","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-48","profile":"preflight-config","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-49","profile":"preflight-unit","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT"},{"id":"RFAE-50","profile":"preflight-signature","expected":"DENY","errorCode":"RF_ACTIVATION_PREFLIGHT_SIGNATURE"},{"id":"RFAE-51","profile":"guard-deadline","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_GUARD"},{"id":"RFAE-52","profile":"guard-paths","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_GUARD"},{"id":"RFAE-53","profile":"guard-triggers","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_GUARD"},{"id":"RFAE-54","profile":"guard-executor","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_GUARD"},{"id":"RFAE-55","profile":"guard-signature","expected":"DENY","errorCode":"RF_ACTIVATION_ROLLBACK_SIGNATURE"},{"id":"RFAE-56","profile":"confirmation-missing","expected":"DENY","errorCode":"RF_ACTIVATION_CONFIRMATION_SET"},{"id":"RFAE-57","profile":"confirmation-same-subject","expected":"DENY","errorCode":"RF_ACTIVATION_SEPARATION_OF_DUTIES"},{"id":"RFAE-58","profile":"confirmation-decision","expected":"DENY","errorCode":"RF_ACTIVATION_CONFIRMATION"},{"id":"RFAE-59","profile":"confirmation-scope","expected":"DENY","errorCode":"RF_ACTIVATION_CONFIRMATION"},{"id":"RFAE-60","profile":"confirmation-signature","expected":"DENY","errorCode":"RF_ACTIVATION_CONFIRMATION_SIGNATURE"},{"id":"RFAE-61","profile":"forged-handle","expected":"DENY","errorCode":"RF_ACTIVATION_HANDLE"},{"id":"RFAE-62","profile":"project-replay","expected":"DENY","errorCode":"RF_ACTIVATION_HANDLE"},{"id":"RFAE-63","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_ACTIVATION_HANDLE"},{"id":"RFAE-64","profile":"receipt-status","expected":"DENY","errorCode":"RF_ACTIVATION_RECEIPT"},{"id":"RFAE-65","profile":"receipt-digest","expected":"DENY","errorCode":"RF_ACTIVATION_RECEIPT_DIGEST"},{"id":"RFAE-66","profile":"nonce-replay","expected":"DENY","errorCode":"RF_ACTIVATION_NONCE"},{"id":"RFAE-67","profile":"clock-rollback","expected":"DENY","errorCode":"RF_ACTIVATION_CLOCK_ROLLBACK"},{"id":"RFAE-68","profile":"expired-before-project","expected":"DENY","errorCode":"RF_ACTIVATION_EXPIRED"}]},"discovery":{"controller":"/api/runner-factory/controller","listenerAuthorization":"/api/runner-factory/controller/listener-authorization","workbench":"/release-foundation#activation-executor","schema":"/schemas/runner-factory-controller-activation-executor.v1.schema.json"}}