{"schemaVersion":"developer.reits.tech/runner-factory-controller-bootstrap-composition/v1","status":"BOOTSTRAP_COMPOSER_IMPLEMENTED_NOT_INSTALLED","observedAt":"2026-07-20T22:00:00Z","scope":{"mode":"TEST_ONLY_COMPOSITION_NO_LISTENER","configurationInput":"VERIFIED_RESOLVED_BUNDLE_ONLY","readers":5,"attestationVerifiers":1,"componentFactories":6,"singleUseBundle":true,"reverseCleanup":true,"externalReadPolicy":"NO_READ_DURING_COMPOSITION","mutationPolicy":"NO_WRITE_NO_LISTENER_NO_LIFECYCLE_ADAPTER"},"truth":{"productionCompositions":0,"productionComponentsConstructed":0,"configuredReaderBindings":0,"configuredAttestationVerifiers":0,"runtimeBootstrapReceipts":0,"runtimeProjections":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"composer":"ops/runner-factory/controller-bootstrap-composition.mjs","configurationLoader":"ops/runner-factory/controller-runtime-configuration.mjs","snapshotCoordinator":"ops/runner-factory/reconciliation-snapshot-coordinator.mjs","runtimeAssembly":"ops/runner-factory/controller-runtime-assembly.mjs","serviceRuntime":"ops/runner-factory/service-config.mjs","fixtureRegistry":"ops/runner-factory/controller-bootstrap-composition-fixtures.json","verifier":"scripts/verify-runner-factory-controller-bootstrap-composition.mjs","productionEntrypoint":"UNCHANGED_UNCONFIGURED"},"operations":[{"id":"plan","guard":"positively verified, fully resolved and currently valid configuration bundle","result":"six-component digest-bound bootstrap plan without construction"},{"id":"compose","guard":"one configuration bundle may be consumed once by six exact factories","result":"opaque non-forgeable TEST_ONLY bootstrap capability"},{"id":"verify","guard":"recompute plan, component, composition and receipt digests","result":"standalone receipt integrity verdict without component access"},{"id":"project","guard":"one live capability may project exactly once","result":"five guarded readers plus one guarded attestation verifier"},{"id":"dispose","guard":"composed components close in reverse order and block future calls","result":"idempotent terminal disposal evidence"}],"components":[{"id":"ReservationReader","kind":"READ_ONLY_READER","authority":"reservation-ledger","configRefs":2,"consumer":"snapshot-coordinator"},{"id":"CapacityReader","kind":"READ_ONLY_READER","authority":"capacity-ledger","configRefs":2,"consumer":"snapshot-coordinator"},{"id":"WorkerReader","kind":"READ_ONLY_READER","authority":"ec2-worker-read-model","configRefs":2,"consumer":"snapshot-coordinator"},{"id":"RunnerReader","kind":"READ_ONLY_READER","authority":"gitea-runner-read-model","configRefs":3,"consumer":"snapshot-coordinator"},{"id":"JournalReader","kind":"READ_ONLY_READER","authority":"append-only-journal","configRefs":2,"consumer":"snapshot-coordinator"},{"id":"ReadinessAttestationVerifier","kind":"ATTESTATION_VERIFIER","authority":"root-owned-trust-store","configRefs":1,"consumer":"runtime-assembly"}],"consumers":[{"id":"snapshot-coordinator","input":"five authority-pinned read functions","proof":"one complete five-source TEST_ONLY capture"},{"id":"runtime-assembly","input":"one verify-only P-256 attestation function","proof":"one signed-gate TEST_ONLY assembly packet"},{"id":"controller-readiness","input":"receipt-backed runtime projection","proof":"one 1/11 blocked service readiness projection"}],"stateModel":[{"id":"UNPLANNED","meaning":"no configuration bundle has been verified or consumed"},{"id":"CONFIGURATION_VERIFIED","meaning":"the resolved bundle and validity window passed again"},{"id":"COMPOSING","meaning":"six factories are executing in deterministic order"},{"id":"COMPOSED","meaning":"one opaque capability owns all six TEST_ONLY components"},{"id":"PROJECTED","meaning":"guarded readers and verifier were exposed exactly once"},{"id":"DISPOSED","meaning":"all components closed in reverse and future calls are denied"},{"id":"DENIED","meaning":"configuration, factory, component, handle, receipt or cleanup failed closed"}],"invariants":["only a positively verified CONFIGURATION_RESOLVED bundle may be planned","all twelve references must be present before composition begins","the bundle must be current at the bootstrap clock and not merely internally well formed","the configuration bundle digest binds every component plan","the manifest and assembly-plan digests remain unchanged across bootstrap","exactly five read-only Reader components and one attestation verifier are required","factory names and ordering are closed rather than caller extensible","Reservation Reader receives exactly its table and read-role references","Capacity Reader receives exactly its table and read-role references","Worker Reader receives exactly its region and read-role references","Runner Reader receives only origin, opaque SecretRef and root-agent socket references","Journal Reader receives exactly its table and read-role references","the attestation verifier receives verify-only public trust metadata without private material","configuration values are represented publicly only by a configuration digest","all constructed components must identify as TEST_ONLY","Reader components expose only read and dispose callables","the verifier component exposes only verify and dispose callables","no component may expose a listen, server, start, write or mutation surface","one bundle digest may create only one bootstrap capability","a bootstrap capability cannot be forged from its public fields","a capability may project dependencies exactly once","projected calls are guarded by the live capability state","partial factory failure disposes every completed component in reverse order","terminal disposal attempts every component in reverse order","post-disposal Reader and verifier calls are denied","plan, component, composition and receipt digests are independently recomputed","composition performs zero external reads, writes, mutations and listener starts","the production service entrypoint remains unconfigured and production truth remains zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":45,"acceptedOutcomes":7,"deniedOutcomes":38,"snapshotIntegrations":1,"assemblyIntegrations":1,"readinessProjections":1,"replayedBundlesDenied":1,"forgedHandlesDenied":1,"postDisposeCallsDenied":1,"reverseCleanupCases":6,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"listenerStarts":0},"failureClasses":[{"code":"RF_BOOTSTRAP_CONFIGURATION_VERIFY|CONFIGURATION_BLOCKED|CONFIGURATION_TIME|CONFIGURATION_BINDING","effect":"deny unverified, partial, expired, future or rebound configuration"},{"code":"RF_BOOTSTRAP_FACTORY|FACTORY_SET|COMPONENT","effect":"deny missing factories, constructor failures and components with excess authority"},{"code":"RF_BOOTSTRAP_REPLAY|HANDLE","effect":"deny bundle reuse, projected capability reuse and forged handles"},{"code":"RF_BOOTSTRAP_PLAN|RECEIPT|DIGEST","effect":"deny component inventory, plan, composition or receipt drift"},{"code":"RF_BOOTSTRAP_CLEANUP|DISPOSED","effect":"deny ambiguous cleanup and every call after terminal disposal"},{"code":"RF_RECON_SOURCE_*|RF_ASSEMBLY_SIGNATURE","effect":"downstream readers and verifier remain fail closed after projection"}],"productionPrerequisites":["install the reviewed root-owned runtime manifest and resolve all twelve references","implement five production read-only factories with exact IAM and network boundaries","implement the production P-256 public-key verifier without signing authority","prove constructor and disposal behavior for every real SDK and root-agent client","bind the projected readers to the production snapshot coordinator","bind the projected verifier to runtime assembly before readiness evaluation","issue a dedicated host and service identity receipt for the Controller process","install and supervise the loopback-only Controller only after all eleven Gates attest","obtain security, runtime and cost owner approvals before activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-bootstrap-composition-fixtures/v1","fixedTime":"2026-07-20T22:00:00.000Z","cases":[{"id":"RFBC-01","profile":"compose-and-project","expected":"ACCEPT","outcome":"COMPOSED_TEST_ONLY"},{"id":"RFBC-02","profile":"deterministic-plan","expected":"ACCEPT","outcome":"BOOTSTRAP_PLAN_READY_TEST_ONLY"},{"id":"RFBC-03","profile":"snapshot-integration","expected":"ACCEPT","outcome":"COMPLETE"},{"id":"RFBC-04","profile":"assembly-integration","expected":"ACCEPT","outcome":"BLOCKED_CONFIGURATION_1_OF_11"},{"id":"RFBC-05","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFBC-06","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFBC-07","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFBC-08","profile":"blocked-configuration","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_BLOCKED"},{"id":"RFBC-09","profile":"expired-configuration","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_TIME"},{"id":"RFBC-10","profile":"future-configuration","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_TIME"},{"id":"RFBC-11","profile":"tampered-configuration","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_VERIFY"},{"id":"RFBC-12","profile":"replayed-bundle","expected":"DENY","errorCode":"RF_BOOTSTRAP_REPLAY"},{"id":"RFBC-13","profile":"forged-handle","expected":"DENY","errorCode":"RF_BOOTSTRAP_HANDLE"},{"id":"RFBC-14","profile":"project-replay","expected":"DENY","errorCode":"RF_BOOTSTRAP_HANDLE"},{"id":"RFBC-15","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_BOOTSTRAP_DISPOSED"},{"id":"RFBC-16","profile":"receipt-status-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_RECEIPT"},{"id":"RFBC-17","profile":"receipt-component-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_RECEIPT"},{"id":"RFBC-18","profile":"receipt-digest-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_DIGEST"},{"id":"RFBC-19","profile":"plan-component-order-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_PLAN"},{"id":"RFBC-20","profile":"plan-config-ref-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_PLAN"},{"id":"RFBC-21","profile":"plan-digest-tamper","expected":"DENY","errorCode":"RF_BOOTSTRAP_DIGEST"},{"id":"RFBC-22","profile":"missing-factory","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY_SET"},{"id":"RFBC-23","profile":"extra-factory","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY_SET"},{"id":"RFBC-24","profile":"non-function-factory","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY_SET"},{"id":"RFBC-25","profile":"reservation-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-26","profile":"capacity-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-27","profile":"worker-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-28","profile":"runner-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-29","profile":"journal-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-30","profile":"verifier-factory-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_FACTORY"},{"id":"RFBC-31","profile":"reader-wrong-kind","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-32","profile":"reader-wrong-mode","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-33","profile":"reader-missing-read","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-34","profile":"reader-missing-dispose","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-35","profile":"verifier-wrong-kind","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-36","profile":"verifier-wrong-mode","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-37","profile":"verifier-missing-verify","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-38","profile":"verifier-missing-dispose","expected":"DENY","errorCode":"RF_BOOTSTRAP_COMPONENT"},{"id":"RFBC-39","profile":"partial-cleanup-failure","expected":"DENY","errorCode":"RF_BOOTSTRAP_CLEANUP"},{"id":"RFBC-40","profile":"reader-bad-response","expected":"DENY","errorCode":"RF_RECON_SOURCE_IDENTITY"},{"id":"RFBC-41","profile":"verifier-false","expected":"DENY","errorCode":"RF_ASSEMBLY_SIGNATURE"},{"id":"RFBC-42","profile":"invalid-clock","expected":"DENY","errorCode":"RF_BOOTSTRAP_CLOCK"},{"id":"RFBC-43","profile":"configuration-verifier-false","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_VERIFY"},{"id":"RFBC-44","profile":"configuration-verifier-throws","expected":"DENY","errorCode":"RF_BOOTSTRAP_CONFIGURATION_VERIFY"},{"id":"RFBC-45","profile":"invalid-receipt-shape","expected":"DENY","errorCode":"RF_BOOTSTRAP_RECEIPT"}]},"discovery":{"controller":"/api/runner-factory/controller","configuration":"/api/runner-factory/controller/runtime-configuration","assembly":"/api/runner-factory/controller/runtime-assembly","snapshotCoordinator":"/api/runner-factory/reconciliation/snapshot-coordinator","workbench":"/release-foundation","schema":"/schemas/runner-factory-controller-bootstrap-composition.v1.schema.json"}}