{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-no-shell-executor-contract/v1","status":"DISPOSABLE_HOST_NO_SHELL_EXECUTOR_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T10:00:00Z","scope":{"mode":"IN_MEMORY_TYPED_PORT_DRIVER_NO_HOST","input":"AUTHORIZED_TEST_ONLY_NO_LAUNCH_ENVELOPE","output":"RETIRED_ROLLED_BACK_OR_CONTAINED_FIXTURE_SESSION_RECEIPT","driverMode":"CLOSED_TYPED_PORTS_ONLY","hostContacted":false,"packageLoaded":false,"processSpawned":false,"shellSurface":"NONE","paidHostAuthorizationPresent":false,"userCostAuthorizationReceiptObserved":false,"launchAuthority":"NONE","promotionAuthority":"NONE","productionEntrypointWired":false},"operations":["prepare","execute","verify","dispose"],"upstream":{"contract":"controller-disposable-host-execution-envelope-authorizer-contract.json","receiptStatus":"DISPOSABLE_HOST_EXECUTION_ENVELOPE_AUTHORIZED_TEST_ONLY","verdict":"ELIGIBLE_FOR_SEPARATELY_APPROVED_FIXTURE_EXECUTOR_ONLY","verification":"ASYMMETRIC_VERIFY_ONLY_FIXTURE","launchAuthority":"NONE"},"authorityTopology":[{"authority":"FIXTURE_NO_SHELL_EXECUTOR","signerKeyId":"fixture-p256-no-shell-executor","ports":5,"mayRetire":false},{"authority":"INDEPENDENT_RETIREMENT_WATCHDOG","signerKeyId":"fixture-p256-independent-retirement-watchdog","ports":3,"mayOpenSession":false}],"hostClaim":{"strategy":"DETERMINISTIC_DIGEST_FROM_AUTHORIZATION_PACKAGE_AND_DOSSIER","idempotencyKey":"hostClaimKey","maximumClaimsPerEnvelope":1,"fixtureClaimsOnly":true,"awsClientTokenDerived":false,"durableClaimStoreConfigured":false},"deadlineEnvelope":{"requestValiditySeconds":30,"maxRunSeconds":900,"maxCleanupSeconds":120,"watchdogAuthority":"INDEPENDENT_RETIREMENT_WATCHDOG","deadlineDriverConfigured":false,"runtimeClockConfigured":false},"typedPorts":[{"ordinal":1,"operation":"CLAIM_HOST","method":"claimHost","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"derive one fixture-only host claim","shell":false},{"ordinal":2,"operation":"BIND_EXECUTION_PACKAGE","method":"bindPackage","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"bind without loading package bytes","shell":false},{"ordinal":3,"operation":"START_DEADLINE_WATCHDOG","method":"startDeadlineWatchdog","authority":"INDEPENDENT_RETIREMENT_WATCHDOG","effect":"reserve fixture deadline observation","shell":false},{"ordinal":4,"operation":"ATTEST_ISOLATION","method":"attestIsolation","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"prove modeled network and credential closure","shell":false},{"ordinal":5,"operation":"OPEN_FIXTURE_SESSION","method":"openSession","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"open an in-memory typed session only","shell":false},{"ordinal":6,"operation":"SEAL_FIXTURE_SESSION","method":"sealSession","authority":"FIXTURE_NO_SHELL_EXECUTOR","effect":"seal fixture evidence without a spawned process","shell":false},{"ordinal":7,"operation":"RETIRE_FIXTURE_HOST","method":"retireHost","authority":"INDEPENDENT_RETIREMENT_WATCHDOG","effect":"retire modeled instance and root volume","shell":false},{"ordinal":8,"operation":"VERIFY_RETIREMENT","method":"verifyRetirement","authority":"INDEPENDENT_RETIREMENT_WATCHDOG","effect":"positively verify terminal retirement","shell":false}],"forwardPhases":["CLAIM_HOST","BIND_EXECUTION_PACKAGE","START_DEADLINE_WATCHDOG","ATTEST_ISOLATION","OPEN_FIXTURE_SESSION","SEAL_FIXTURE_SESSION","RETIRE_FIXTURE_HOST","VERIFY_RETIREMENT"],"compensationPhases":["RETIRE_FIXTURE_HOST","VERIFY_RETIREMENT"],"stateModel":["UNTRUSTED","ENVELOPE_VERIFIED","REQUEST_BOUND","HOST_CLAIMED_FIXTURE_ONLY","PACKAGE_BOUND_NOT_LOADED","WATCHDOG_RESERVED_FIXTURE_ONLY","ISOLATION_ATTESTED_FIXTURE_ONLY","SESSION_OPEN_IN_MEMORY","SESSION_SEALED_IN_MEMORY","HOST_RETIREMENT_REQUESTED_FIXTURE_ONLY","RETIREMENT_VERIFIED_FIXTURE_ONLY","ROLLED_BACK_OR_CONTAINED"],"truth":{"productionExecutorsConfigured":0,"productionHostRuns":0,"productionHostClaims":0,"productionCandidatePackages":0,"productionDriversConfigured":0,"systemdUnitsInstalled":0,"controllerServicesStarted":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"selectedDenialTrace":{"fixtureId":"RFDHNS-69","mutation":"STEP_SHELL_SURFACE","expected":"DENY","reason":"A typed fixture step that exposes BASH is rejected before it can become trusted executor evidence."},"invariants":["The production Controller composition root never imports this evaluator.","The evaluator accepts only the exact test-only no-launch envelope receipt shape.","The upstream envelope must be positively verified by its authoritative boundary.","False envelope-verifier results deny rather than falling back to local trust.","Envelope-verifier exceptions deny rather than becoming retryable launch authority.","The envelope must carry launchAuthority NONE and promotionAuthority NONE.","The envelope must report every production and external side-effect counter as zero.","The envelope synthetic estimate cannot exceed its maximum or 500 milli-USD.","The request is valid for no more than thirty seconds.","The request cannot outlive the upstream authorization envelope.","The request nonce differs from the upstream envelope nonce.","A nonce can prepare at most one opaque executor handle.","Opaque handles are identity-bound in a WeakMap and cannot be reconstructed.","Each opaque handle is one-shot and cannot execute twice.","Disposed handles cannot execute and repeated dispose is idempotent.","The host claim key is deterministically derived from authorization, package and dossier identity.","One envelope can produce at most one fixture host claim in one evaluator instance.","The host claim identifier is deterministically derived from the host claim key.","No durable production host-claim store is implied by fixture idempotency.","The exact driver surface contains five executor methods and three retirement methods.","Executor and retirement drivers must be separate object identities.","Neither driver exposes a generic command, callback, spawn or shell operation.","The request binds all eight typed operations in exact order.","Every typed step returns exact-shape digest-bound evidence.","Every step receipt is positively verified before the next phase.","False step verification stops forward progress and denies the invocation.","Step-verifier exceptions stop forward progress and deny the invocation.","Malformed step evidence cannot be converted into a successful terminal receipt.","The executor authority cannot sign independent watchdog or retirement steps.","The retirement authority cannot open or seal a fixture session.","The two fixture signer identities are distinct.","The shell surface remains NONE in the request, every step and the terminal receipt.","No fixture step may report a spawned process.","No fixture step may report host contact or package loading.","The package binding phase binds identity only and never loads bytes.","The watchdog reservation precedes isolation attestation and session opening.","Isolation attestation precedes every fixture session open.","A fixture session must be sealed before normal retirement begins.","Normal success requires both host and root-volume retirement.","Retirement verification is the final successful typed phase.","A known driver failure before host claim produces a safe rolled-back receipt.","A known driver failure after host claim invokes retirement compensation.","Retirement compensation uses only retireHost and verifyRetirement typed ports.","A clean compensated failure proves the host and root volume retired.","Retirement ambiguity produces CONTAINED rather than a clean rollback claim.","A contained receipt preserves the exact failure code for audit and freeze policy.","No successful or rolled-back receipt may leave an open fixture session.","The executor accepts no paid-host authorization from this development request.","The user cost-authorization receipt digest remains null in fixture mode.","Live pricing is not read and the synthetic estimate is not treated as a quote.","Production host runs and production host claims remain zero.","Production drivers, units, services, listeners, proxies and routes remain zero.","External reads, writes and mutations remain zero.","Paid resources remain absent and deployment remains forbidden.","Terminal receipts are digest-bound to authorization, claim key, nonce and request time.","Terminal receipt verification is deterministic and safe to replay.","Fixture calls and fixture claims never increment production truth counters.","Port 8110 and every public ingress path remain outside this evaluator."],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":80,"acceptedOutcomes":12,"deniedOutcomes":68,"envelopeReceiptsVerified":53,"stepSignaturesVerified":68,"retiredSessions":5,"rolledBackSessions":5,"containedSessions":1,"executorReceiptsVerified":3,"disposedHandles":1,"shellCommandsAccepted":0,"processesSpawned":0,"hostContacts":0,"packageLoads":0,"productionHostRuns":0,"pricingReadsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["A user must explicitly authorize a reviewed real cost ceiling and quote source for a paid disposable host.","A durable idempotent host-claim store with generation fencing must be deployed and recovery-drilled.","A reviewed no-shell production worker driver must implement the exact closed typed-port interface.","An independently owned deadline and retirement driver must be deployed with separate credentials.","A dedicated non-production VPC, subnet, security group and deny-by-default egress policy must exist.","An immutable image and every execution-package digest must be staged and re-verified on the target host.","The job credential, cloud credential and registration secret closures must be observed on a real disposable host.","Instance and root-volume retirement must be independently observed within the 120-second cleanup deadline.","Ambiguous launch, timeout and retirement drills must prove whole-pool freeze without orphaned capacity.","Controller 0/11 production readiness gates must pass with signed runtime evidence and rollback proof.","An explicit change window must authorize production wiring while port 8110, proxy and public routes remain separately controlled."],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-disposable-host-no-shell-executor-fixtures/v1","mode":"IN_MEMORY_TYPED_PORT_DRIVER_NO_HOST","cases":[{"id":"RFDHNS-01","mutation":"PREPARE_BASELINE","expected":"ACCEPT"},{"id":"RFDHNS-02","mutation":"EXECUTE_BASELINE","expected":"ACCEPT"},{"id":"RFDHNS-03","mutation":"VERIFY_RECEIPT","expected":"ACCEPT"},{"id":"RFDHNS-04","mutation":"VERIFY_RECEIPT_REPLAY","expected":"ACCEPT"},{"id":"RFDHNS-05","mutation":"DISPOSE_AND_REPLAY","expected":"ACCEPT"},{"id":"RFDHNS-06","mutation":"REQUEST_WINDOW_EDGE","expected":"ACCEPT"},{"id":"RFDHNS-07","mutation":"CLAIM_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-08","mutation":"BIND_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-09","mutation":"WATCHDOG_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-10","mutation":"OPEN_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-11","mutation":"SEAL_DRIVER_FAIL_SAFE","expected":"ACCEPT"},{"id":"RFDHNS-12","mutation":"RETIREMENT_DRIVER_FAIL_CONTAINED","expected":"ACCEPT"},{"id":"RFDHNS-13","mutation":"ENVELOPE_DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHNS-14","mutation":"STEP_DEPENDENCY_MISSING","expected":"DENY"},{"id":"RFDHNS-15","mutation":"EXECUTOR_DRIVER_MISSING","expected":"DENY"},{"id":"RFDHNS-16","mutation":"RETIREMENT_DRIVER_MISSING","expected":"DENY"},{"id":"RFDHNS-17","mutation":"SHARED_DRIVER","expected":"DENY"},{"id":"RFDHNS-18","mutation":"CLOCK_INVALID","expected":"DENY"},{"id":"RFDHNS-19","mutation":"EXECUTABLE_KEY","expected":"DENY"},{"id":"RFDHNS-20","mutation":"ENVELOPE_SCHEMA","expected":"DENY"},{"id":"RFDHNS-21","mutation":"ENVELOPE_STATUS","expected":"DENY"},{"id":"RFDHNS-22","mutation":"ENVELOPE_VERDICT","expected":"DENY"},{"id":"RFDHNS-23","mutation":"ENVELOPE_MODE","expected":"DENY"},{"id":"RFDHNS-24","mutation":"ENVELOPE_AUTHORIZATION_ID","expected":"DENY"},{"id":"RFDHNS-25","mutation":"ENVELOPE_DIGEST","expected":"DENY"},{"id":"RFDHNS-26","mutation":"ENVELOPE_COST_OVER_CAP","expected":"DENY"},{"id":"RFDHNS-27","mutation":"ENVELOPE_MAX_RUN","expected":"DENY"},{"id":"RFDHNS-28","mutation":"ENVELOPE_MAX_CLEANUP","expected":"DENY"},{"id":"RFDHNS-29","mutation":"ENVELOPE_ELIGIBILITY","expected":"DENY"},{"id":"RFDHNS-30","mutation":"ENVELOPE_PRODUCTION_RUN","expected":"DENY"},{"id":"RFDHNS-31","mutation":"ENVELOPE_PRODUCTION_CLAIM","expected":"DENY"},{"id":"RFDHNS-32","mutation":"ENVELOPE_PRODUCTION_PACKAGE","expected":"DENY"},{"id":"RFDHNS-33","mutation":"ENVELOPE_PRODUCTION_DRIVER","expected":"DENY"},{"id":"RFDHNS-34","mutation":"ENVELOPE_PRODUCTION_SERVICE","expected":"DENY"},{"id":"RFDHNS-35","mutation":"ENVELOPE_EXTERNAL_WRITE","expected":"DENY"},{"id":"RFDHNS-36","mutation":"ENVELOPE_PAID_RESOURCE","expected":"DENY"},{"id":"RFDHNS-37","mutation":"ENVELOPE_LAUNCH_AUTHORITY","expected":"DENY"},{"id":"RFDHNS-38","mutation":"ENVELOPE_EXPIRED","expected":"DENY"},{"id":"RFDHNS-39","mutation":"ENVELOPE_EXTRA_KEY","expected":"DENY"},{"id":"RFDHNS-40","mutation":"REQUEST_SCHEMA","expected":"DENY"},{"id":"RFDHNS-41","mutation":"REQUEST_ACTION","expected":"DENY"},{"id":"RFDHNS-42","mutation":"REQUEST_MODE","expected":"DENY"},{"id":"RFDHNS-43","mutation":"REQUEST_RECEIPT_DIGEST","expected":"DENY"},{"id":"RFDHNS-44","mutation":"REQUEST_HOST_CLAIM_KEY","expected":"DENY"},{"id":"RFDHNS-45","mutation":"REQUEST_TYPED_OPERATIONS","expected":"DENY"},{"id":"RFDHNS-46","mutation":"REQUEST_MAX_RUN","expected":"DENY"},{"id":"RFDHNS-47","mutation":"REQUEST_MAX_CLEANUP","expected":"DENY"},{"id":"RFDHNS-48","mutation":"REQUEST_SHELL_SURFACE","expected":"DENY"},{"id":"RFDHNS-49","mutation":"REQUEST_PAID_AUTHORITY","expected":"DENY"},{"id":"RFDHNS-50","mutation":"REQUEST_USER_COST_RECEIPT","expected":"DENY"},{"id":"RFDHNS-51","mutation":"REQUEST_ENVELOPE_NONCE","expected":"DENY"},{"id":"RFDHNS-52","mutation":"REQUEST_NONCE_INVALID","expected":"DENY"},{"id":"RFDHNS-53","mutation":"REQUEST_EXPIRED","expected":"DENY"},{"id":"RFDHNS-54","mutation":"REQUEST_WINDOW_LONG","expected":"DENY"},{"id":"RFDHNS-55","mutation":"REQUEST_EXTRA_KEY","expected":"DENY"},{"id":"RFDHNS-56","mutation":"REQUEST_RELEASE_DRIFT","expected":"DENY"},{"id":"RFDHNS-57","mutation":"ENVELOPE_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHNS-58","mutation":"ENVELOPE_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHNS-59","mutation":"STEP_VERIFIER_FALSE","expected":"DENY"},{"id":"RFDHNS-60","mutation":"STEP_VERIFIER_THROW","expected":"DENY"},{"id":"RFDHNS-61","mutation":"HANDLE_FORGED","expected":"DENY"},{"id":"RFDHNS-62","mutation":"HANDLE_REPLAY","expected":"DENY"},{"id":"RFDHNS-63","mutation":"HANDLE_DISPOSED","expected":"DENY"},{"id":"RFDHNS-64","mutation":"EXECUTE_EXPIRED","expected":"DENY"},{"id":"RFDHNS-65","mutation":"STEP_OPERATION","expected":"DENY"},{"id":"RFDHNS-66","mutation":"STEP_AUTHORITY","expected":"DENY"},{"id":"RFDHNS-67","mutation":"STEP_SIGNER","expected":"DENY"},{"id":"RFDHNS-68","mutation":"STEP_HOST_CLAIM_ID","expected":"DENY"},{"id":"RFDHNS-69","mutation":"STEP_SHELL_SURFACE","expected":"DENY"},{"id":"RFDHNS-70","mutation":"STEP_PROCESS_SPAWNED","expected":"DENY"},{"id":"RFDHNS-71","mutation":"STEP_HOST_CONTACTED","expected":"DENY"},{"id":"RFDHNS-72","mutation":"STEP_PACKAGE_LOADED","expected":"DENY"},{"id":"RFDHNS-73","mutation":"STEP_WATCHDOG_FACT","expected":"DENY"},{"id":"RFDHNS-74","mutation":"STEP_ISOLATION_FACT","expected":"DENY"},{"id":"RFDHNS-75","mutation":"STEP_SESSION_OPEN_FACT","expected":"DENY"},{"id":"RFDHNS-76","mutation":"STEP_SESSION_SEALED_FACT","expected":"DENY"},{"id":"RFDHNS-77","mutation":"STEP_HOST_RETIRED_FACT","expected":"DENY"},{"id":"RFDHNS-78","mutation":"STEP_ROOT_VOLUME_FACT","expected":"DENY"},{"id":"RFDHNS-79","mutation":"STEP_OBSERVED_AT","expected":"DENY"},{"id":"RFDHNS-80","mutation":"STEP_DIGEST","expected":"DENY"}]},"discovery":{"controller":"/api/runner-factory/controller","lifecycle":"/api/runner-factory","upstream":"/api/runner-factory/controller/disposable-host-execution-envelope-authorizer","workbench":"/release-foundation#disposable-host-no-shell-executor","schema":"/schemas/runner-factory-controller-disposable-host-no-shell-executor.v1.schema.json"}}