{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-execution-envelope-authorizer-contract/v1","status":"DISPOSABLE_HOST_EXECUTION_ENVELOPE_AUTHORIZER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T09:00:00.000Z","scope":{"mode":"EXECUTION_ENVELOPE_AUTHORIZATION_ONLY_NO_HOST_LAUNCH","input":"SEALED_FIXTURE_DOSSIER_PLUS_INDEPENDENT_COST_RUNTIME_AND_RETIREMENT_APPROVALS","output":"TEST_ONLY_NO_LAUNCH_EXECUTION_ENVELOPE_AUTHORIZATION","hostContacted":false,"hostProvisioned":false,"packageLoaded":false,"driverExecuted":false,"watchdogStarted":false,"pricingQuoteFetched":false,"approvalAuthorityConfigured":false,"launchAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"operations":["prepare","authorize","verify","dispose"],"upstream":{"contract":"controller-disposable-host-conformance-dossier-sealer-contract.json","receiptStatus":"DISPOSABLE_HOST_CONFORMANCE_DOSSIER_SEALED_TEST_ONLY","verdict":"CONFORMANT_FIXTURE_ONLY","verification":"ASYMMETRIC_VERIFY_ONLY_FIXTURE","contractDigest":"SHA256_PINNED_AT_VERIFIER_RUNTIME"},"approvalTopology":[{"ordinal":1,"authority":"INDEPENDENT_COST_OWNER","signerKeyId":"fixture-p256-cost-owner","decision":"synthetic estimate is inside a 500 milli-USD test ceiling"},{"ordinal":2,"authority":"INDEPENDENT_RUNTIME_OWNER","signerKeyId":"fixture-p256-runtime-owner","decision":"900-second isolated non-production run and 120-second cleanup boundary"},{"ordinal":3,"authority":"INDEPENDENT_RETIREMENT_WATCHDOG","signerKeyId":"fixture-p256-retirement-watchdog","decision":"instance and root-volume retirement proof is mandatory"}],"budgetEnvelope":{"currency":"USD","pricingBasis":"SYNTHETIC_FIXTURE_NOT_LIVE_QUOTE","estimatedMilliUsd":140,"approvedMaximumMilliUsd":500,"livePriceReads":0,"billingWrites":0,"paidResourcesCreated":false},"runtimeEnvelope":{"environment":"NON_PRODUCTION_CONFORMANCE","region":"ap-southeast-2","platform":"linux/amd64","maxRunSeconds":900,"maxCleanupSeconds":120,"productionConnectivity":false,"publicNetwork":false,"artifactDelivery":"PRESTAGED_IMMUTABLE_IMAGE","commandSurface":"NONE_IN_AUTHORIZATION_LAYER","secretSurface":"CONFIGREFS_ONLY_NOT_RESOLVED"},"packageBindings":["sealed dossier receipt","immutable image","target-host driver artifact","Controller service bundle","twelve-phase conformance plan bundle","independent watchdog bundle","deny-by-default network policy","instance-and-volume cleanup policy"],"stateModel":["UNTRUSTED","DOSSIER_BOUND","COST_APPROVED_TEST_ONLY","RUNTIME_APPROVED_TEST_ONLY","RETIREMENT_RESERVED_TEST_ONLY","PACKAGE_MANIFEST_BOUND","PREPARED","AUTHORIZED_TEST_ONLY_NO_LAUNCH","VERIFIED","DISPOSED","DENIED"],"truth":{"productionHostRuns":0,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"selectedDenialTrace":{"fixtureId":"RFDHEA-31","mutation":"COST_ESTIMATE_OVER_MAX","expected":"DENY","reason":"A synthetic estimate above the independently approved maximum cannot mint an execution envelope."},"invariants":["the upstream dossier receipt must match its exact v1 schema","the upstream dossier receipt digest is recalculated before trust","the upstream dossier contract digest is pinned exactly","the upstream dossier is positively verified by an injected authority","the upstream dossier verdict remains fixture-conformant only","the upstream dossier grants no promotion authority","the upstream production host, package, driver, service and listener counters remain zero","cost approval is bound to the exact dossier receipt digest","cost approval is issued only by the independent cost owner","cost approval uses a dedicated P-256 fixture signer","cost approval uses USD milli-units without floating-point arithmetic","the synthetic estimated cost is non-negative","the synthetic estimated cost cannot exceed the approved maximum","the approved maximum cannot exceed 500 milli-USD","the pricing basis explicitly denies a live quote claim","cost approval must be live at authorization time","runtime approval is bound to the exact dossier receipt digest","runtime approval is issued only by the independent runtime owner","runtime approval fixes the non-production conformance environment","runtime approval fixes ap-southeast-2 and Linux amd64","runtime approval fixes the run deadline at 900 seconds","runtime approval fixes cleanup at 120 seconds","runtime approval forbids production connectivity and public networking","runtime approval must be live at authorization time","retirement reservation is bound to the exact dossier receipt digest","retirement reservation is issued by an independent watchdog authority","retirement reservation requires all eight terminal assertions","retirement reservation requires instance retirement","retirement reservation requires root-volume retirement","retirement reservation must be live at authorization time","cost, runtime and retirement use three distinct signer identities","all three approval signatures are positively verified","a false approval-verifier result fails closed","an approval-verifier exception fails closed","the package manifest is exact-shape and immutable","the package manifest binds the dossier, release and candidate","the package manifest binds the immutable image and six policy/artifact digests","artifact delivery remains prestaged and immutable","the authorization layer exposes no command surface","the authorization layer resolves no secret values","manifest run, cleanup and cost limits equal their independent approvals","the package manifest grants no launch authority","the production entrypoint is not wired","the request binds the dossier, three approvals and package manifest","the request lives no longer than sixty seconds","the request nonce is single-use","secret-like, executable, client and provisioning fields are rejected recursively","the opaque handle is WeakMap-backed, one-shot and disposable","authorization cannot contact or provision a host","authorization cannot load a package or execute a driver","authorization cannot start a watchdog, service, listener, proxy or route","the authorization receipt is eligible only for a separately approved fixture executor","the production Controller entrypoint does not import the authorizer","all production, external-write and paid-resource counters remain zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":76,"acceptedOutcomes":8,"deniedOutcomes":68,"dossierReceiptsVerified":65,"approvalSignaturesVerified":62,"authorizedEnvelopes":5,"authorizationReceiptsVerified":3,"disposedHandles":1,"productionHostRuns":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["obtain explicit user authorization for paid disposable non-production compute","replace synthetic cost evidence with a reviewed immutable pricing quote source","create a dedicated non-production account and VPC with no production connectivity","build and sign the prestaged immutable conformance image and all package artifacts","configure independent cost, runtime and retirement signing authorities","implement and syscall-review a separate host executor with no shell surface","configure a durable monotonic execution journal and independent watchdog runtime","execute the package on one disposable host under the exact cost and time envelope","capture independent process, port, proxy, unit, snapshot, lock, instance and volume retirement proof","review the resulting real-host dossier before any production activation discussion"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-execution-envelope-authorizer-fixtures/v1","mode":"EXECUTION_ENVELOPE_AUTHORIZATION_ONLY_NO_HOST_LAUNCH","cases":[{"id":"RFDHEA-01","mutation":"AUTHORIZE_BASELINE","expected":"ACCEPT"},{"id":"RFDHEA-02","mutation":"AUTHORIZE_SECOND_NONCE","expected":"ACCEPT"},{"id":"RFDHEA-03","mutation":"AUTHORIZE_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHEA-04","mutation":"VERIFY_AUTHORIZATION_RECEIPT","expected":"ACCEPT"},{"id":"RFDHEA-05","mutation":"VERIFY_AUTHORIZATION_RECEIPT_REPLAY","expected":"ACCEPT"},{"id":"RFDHEA-06","mutation":"DISPOSE_AND_REPLAY","expected":"ACCEPT"},{"id":"RFDHEA-07","mutation":"PREPARE_ONLY","expected":"ACCEPT"},{"id":"RFDHEA-08","mutation":"PREPARE_SECOND","expected":"ACCEPT"},{"id":"RFDHEA-09","mutation":"DOSSIER_DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHEA-10","mutation":"APPROVAL_DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHEA-11","mutation":"CONTRACT_DIGEST_INVALID","expected":"DENY"},{"id":"RFDHEA-12","mutation":"DOSSIER_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHEA-13","mutation":"DOSSIER_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHEA-14","mutation":"APPROVAL_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHEA-15","mutation":"APPROVAL_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHEA-16","mutation":"CLOCK_INVALID","expected":"DENY"},{"id":"RFDHEA-17","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHEA-18","mutation":"DOSSIER_STATUS","expected":"DENY"},{"id":"RFDHEA-19","mutation":"DOSSIER_VERDICT","expected":"DENY"},{"id":"RFDHEA-20","mutation":"DOSSIER_PROMOTION","expected":"DENY"},{"id":"RFDHEA-21","mutation":"DOSSIER_PRODUCTION_HOST","expected":"DENY"},{"id":"RFDHEA-22","mutation":"DOSSIER_PACKAGE_COUNT","expected":"DENY"},{"id":"RFDHEA-23","mutation":"DOSSIER_DIGEST","expected":"DENY"},{"id":"RFDHEA-24","mutation":"DOSSIER_EXTRA_KEY","expected":"DENY"},{"id":"RFDHEA-25","mutation":"COST_SCHEMA","expected":"DENY"},{"id":"RFDHEA-26","mutation":"COST_STATUS","expected":"DENY"},{"id":"RFDHEA-27","mutation":"COST_AUTHORITY","expected":"DENY"},{"id":"RFDHEA-28","mutation":"COST_SUBJECT","expected":"DENY"},{"id":"RFDHEA-29","mutation":"COST_CURRENCY","expected":"DENY"},{"id":"RFDHEA-30","mutation":"COST_ESTIMATE_NEGATIVE","expected":"DENY"},{"id":"RFDHEA-31","mutation":"COST_ESTIMATE_OVER_MAX","expected":"DENY"},{"id":"RFDHEA-32","mutation":"COST_MAX_OVER_CAP","expected":"DENY"},{"id":"RFDHEA-33","mutation":"COST_PRICING_BASIS","expected":"DENY"},{"id":"RFDHEA-34","mutation":"COST_WINDOW","expected":"DENY"},{"id":"RFDHEA-35","mutation":"COST_SIGNER","expected":"DENY"},{"id":"RFDHEA-36","mutation":"COST_DIGEST","expected":"DENY"},{"id":"RFDHEA-37","mutation":"COST_EXTRA_KEY","expected":"DENY"},{"id":"RFDHEA-38","mutation":"RUNTIME_SCHEMA","expected":"DENY"},{"id":"RFDHEA-39","mutation":"RUNTIME_STATUS","expected":"DENY"},{"id":"RFDHEA-40","mutation":"RUNTIME_AUTHORITY","expected":"DENY"},{"id":"RFDHEA-41","mutation":"RUNTIME_SUBJECT","expected":"DENY"},{"id":"RFDHEA-42","mutation":"RUNTIME_ENVIRONMENT","expected":"DENY"},{"id":"RFDHEA-43","mutation":"RUNTIME_REGION","expected":"DENY"},{"id":"RFDHEA-44","mutation":"RUNTIME_PLATFORM","expected":"DENY"},{"id":"RFDHEA-45","mutation":"RUNTIME_MAX_RUN","expected":"DENY"},{"id":"RFDHEA-46","mutation":"RUNTIME_MAX_CLEANUP","expected":"DENY"},{"id":"RFDHEA-47","mutation":"RUNTIME_PRODUCTION_CONNECTIVITY","expected":"DENY"},{"id":"RFDHEA-48","mutation":"RUNTIME_PUBLIC_NETWORK","expected":"DENY"},{"id":"RFDHEA-49","mutation":"RUNTIME_WINDOW","expected":"DENY"},{"id":"RFDHEA-50","mutation":"RUNTIME_SIGNER","expected":"DENY"},{"id":"RFDHEA-51","mutation":"RUNTIME_DIGEST","expected":"DENY"},{"id":"RFDHEA-52","mutation":"RUNTIME_EXTRA_KEY","expected":"DENY"},{"id":"RFDHEA-53","mutation":"RETIREMENT_SCHEMA","expected":"DENY"},{"id":"RFDHEA-54","mutation":"RETIREMENT_STATUS","expected":"DENY"},{"id":"RFDHEA-55","mutation":"RETIREMENT_AUTHORITY","expected":"DENY"},{"id":"RFDHEA-56","mutation":"RETIREMENT_SUBJECT","expected":"DENY"},{"id":"RFDHEA-57","mutation":"RETIREMENT_CLEANUP","expected":"DENY"},{"id":"RFDHEA-58","mutation":"RETIREMENT_ASSERTIONS","expected":"DENY"},{"id":"RFDHEA-59","mutation":"RETIREMENT_INSTANCE","expected":"DENY"},{"id":"RFDHEA-60","mutation":"RETIREMENT_VOLUME","expected":"DENY"},{"id":"RFDHEA-61","mutation":"RETIREMENT_WINDOW","expected":"DENY"},{"id":"RFDHEA-62","mutation":"RETIREMENT_SIGNER","expected":"DENY"},{"id":"RFDHEA-63","mutation":"RETIREMENT_DIGEST","expected":"DENY"},{"id":"RFDHEA-64","mutation":"RETIREMENT_EXTRA_KEY","expected":"DENY"},{"id":"RFDHEA-65","mutation":"SHARED_APPROVAL_SIGNER","expected":"DENY"},{"id":"RFDHEA-66","mutation":"MANIFEST_SCHEMA","expected":"DENY"},{"id":"RFDHEA-67","mutation":"MANIFEST_MODE","expected":"DENY"},{"id":"RFDHEA-68","mutation":"MANIFEST_DOSSIER_DIGEST","expected":"DENY"},{"id":"RFDHEA-69","mutation":"MANIFEST_IMAGE_DIGEST","expected":"DENY"},{"id":"RFDHEA-70","mutation":"MANIFEST_COMMAND_SURFACE","expected":"DENY"},{"id":"RFDHEA-71","mutation":"MANIFEST_SECRET_SURFACE","expected":"DENY"},{"id":"RFDHEA-72","mutation":"MANIFEST_MAX_RUN","expected":"DENY"},{"id":"RFDHEA-73","mutation":"MANIFEST_MAX_COST","expected":"DENY"},{"id":"RFDHEA-74","mutation":"MANIFEST_LAUNCH_AUTHORITY","expected":"DENY"},{"id":"RFDHEA-75","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHEA-76","mutation":"REQUEST_NONCE_REPLAY","expected":"DENY"}]},"discovery":{"controller":"/api/runner-factory/controller","lifecycle":"/api/runner-factory","upstream":"/api/runner-factory/controller/disposable-host-conformance-dossier-sealer","workbench":"/release-foundation#disposable-host-execution-envelope-authorizer","schema":"/schemas/runner-factory-controller-disposable-host-execution-envelope-authorizer.v1.schema.json"}}