{"schemaVersion":"developer.reits.tech/runner-factory-controller-listener-authorization/v1","status":"LISTENER_AUTHORIZATION_BOUNDARY_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T04:00:00Z","scope":{"mode":"TEST_ONLY_CANDIDATE_AUTHORIZATION_NO_ACTIVATION","input":"ADMISSION_ROLLBACK_WEBHOOK_DRILLS_OWNER_APPROVALS","output":"OPAQUE_ONE_SHOT_LISTENER_CANDIDATE","endpoint":"127.0.0.1:8110","validitySeconds":120,"networkAuthority":"NONE","deploymentAuthority":"NONE"},"truth":{"productionListenerAuthorizationReceipts":0,"productionOwnerApprovals":0,"productionRollbackRehearsals":0,"productionNegativeWebhookRehearsals":0,"productionOperationalDrills":0,"controllerListeners":0,"listenerStarts":0,"publicRoutes":0,"reverseProxyRoutes":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"paidResourcesCreated":false,"deploymentPermitted":false},"requirements":[{"id":"admission","count":1,"proof":"authority-verified unexpired production-evidence admission receipt"},{"id":"request","count":1,"proof":"exact release, host, config, unit and loopback endpoint request"},{"id":"rollback","count":1,"proof":"signed distinct-target rollback rehearsal within 300 seconds"},{"id":"negative-webhook","count":1,"proof":"signed rejection proof for unsigned, invalid and stale deliveries"},{"id":"operational-drills","count":2,"proof":"ordered rollback and incident drill receipts"},{"id":"owner-approvals","count":4,"proof":"security, runtime, cost and operations approvals"},{"id":"nonce","count":1,"proof":"single-use scope-bound authorization nonce"},{"id":"expiry","count":1,"proof":"earliest upstream expiry with a 120-second maximum"}],"operations":[{"id":"authorize","guard":"verify every exact digest, signature, owner and time boundary","result":"opaque candidate handle only"},{"id":"verify","guard":"reconstruct the candidate receipt identity and authority truth","result":"boolean receipt validation"},{"id":"project","guard":"consume one live capability exactly once","result":"frozen non-executable listener plan"},{"id":"dispose","guard":"revoke retained candidate state","result":"idempotent disposal receipt"}],"stateModel":[{"id":"UNTRUSTED","meaning":"the packet has no listener-candidate standing"},{"id":"ADMISSION_BOUND","meaning":"the exact upstream admission digest is current"},{"id":"TARGET_BOUND","meaning":"release, host, config, unit and loopback endpoint match"},{"id":"RECOVERY_PROVEN","meaning":"rollback, negative webhook and two drills pass"},{"id":"OWNERS_APPROVED","meaning":"four independent approvals bind the same scope and nonce"},{"id":"CANDIDATE","meaning":"one opaque, two-minute, fixture-only capability exists"},{"id":"PROJECTED_OR_DISPOSED","meaning":"the capability cannot be consumed again"},{"id":"DENIED","meaning":"any drift fails closed without activation or mutation"}],"invariants":["the upstream admission receipt is exact, digest-bound, unexpired and positively verified by its authority","fixture-only admission can produce only a fixture-only listener candidate","release identity is unchanged from the admission receipt","rollback release is valid and distinct from the active release","controller identity is unchanged from the admission receipt","host identity is unchanged from the admission receipt","manifest digest is unchanged from the admission receipt","configuration digest is exact and scope-bound","systemd unit digest is exact and scope-bound","service user is exactly reits-runner-factory","service unit is exactly reits-runner-factory-controller.service","bind host is exactly 127.0.0.1","port is exactly 8110","public route is always false","reverse proxy is always false","the request window is no longer than 120 seconds","the candidate expires at the earliest upstream expiry","the nonce is format-checked and single-use","rollback evidence binds the exact release, target, host and configuration","rollback restore time is at most 300 seconds","unsigned webhook delivery is rejected","invalid webhook signature is rejected","stale webhook delivery is rejected","negative webhook rehearsal accepts zero requests and performs zero writes","rollback and incident drills are both required in canonical order","drills report PASS, no data loss and zero external writes","security, runtime, cost and operations owners are all required","each owner signs APPROVE_CANDIDATE_ONLY for the same scope and nonce","eight evidence signatures must verify positively","secret-like and executable fields are structurally rejected","the candidate handle is opaque, one-shot and WeakMap-backed","the projected plan exposes no function and zero executable steps","activationAuthorized and listenerStartAuthorized remain false","listener starts, external reads, writes and mutations remain zero","no paid resource or public route can be created","the production entrypoint remains unconfigured and port 8110 remains absent"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":53,"acceptedOutcomes":6,"deniedOutcomes":47,"fixtureEvidenceSignaturesVerified":132,"plansProjected":3,"productionListenerAuthorizationReceipts":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["replace fixture admission with a live target-host admission receipt","exercise rollback on the exact signed production release pair","run negative webhook tests against the stopped loopback service harness","complete incident and rollback drills with retained evidence","collect independent security, runtime, cost and operations signatures","issue a live 120-second nonce only inside the approved maintenance window","rerun verification on the target host without starting the service","obtain a separate activation executor implementation and review","activate only after an auditable production receipt and immediate rollback guard exist"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-listener-authorization-fixtures/v1","fixedTime":"2026-07-21T04:00:00.000Z","cases":[{"id":"RFLA-01","profile":"authorize","expected":"ACCEPT","outcome":"CANDIDATE_AUTHORIZED"},{"id":"RFLA-02","profile":"project","expected":"ACCEPT","outcome":"PLAN_PROJECTED"},{"id":"RFLA-03","profile":"verify-receipt","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFLA-04","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFLA-05","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFLA-06","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFLA-07","profile":"missing-verifier","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DEPENDENCIES"},{"id":"RFLA-08","profile":"invalid-clock","expected":"DENY","errorCode":"RF_LISTENER_AUTH_CLOCK"},{"id":"RFLA-09","profile":"admission-status","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ADMISSION"},{"id":"RFLA-10","profile":"admission-expired","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ADMISSION"},{"id":"RFLA-11","profile":"admission-digest","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ADMISSION_DIGEST"},{"id":"RFLA-12","profile":"request-public-bind","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-13","profile":"request-port","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-14","profile":"request-public-route","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-15","profile":"request-proxy","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-16","profile":"request-release","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-17","profile":"request-rollback-self","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-18","profile":"request-controller","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-19","profile":"request-host","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-20","profile":"request-manifest","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-21","profile":"request-unit","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-22","profile":"request-user","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-23","profile":"request-expired","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-24","profile":"request-long-window","expected":"DENY","errorCode":"RF_LISTENER_AUTH_REQUEST"},{"id":"RFLA-25","profile":"secret-material","expected":"DENY","errorCode":"RF_LISTENER_AUTH_SECRET"},{"id":"RFLA-26","profile":"rollback-release","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK"},{"id":"RFLA-27","profile":"rollback-target","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK"},{"id":"RFLA-28","profile":"rollback-slow","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK"},{"id":"RFLA-29","profile":"rollback-config","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK"},{"id":"RFLA-30","profile":"rollback-signature","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ROLLBACK_SIGNATURE"},{"id":"RFLA-31","profile":"webhook-unsigned","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK"},{"id":"RFLA-32","profile":"webhook-invalid","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK"},{"id":"RFLA-33","profile":"webhook-stale","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK"},{"id":"RFLA-34","profile":"webhook-accepted","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK"},{"id":"RFLA-35","profile":"webhook-signature","expected":"DENY","errorCode":"RF_LISTENER_AUTH_WEBHOOK_SIGNATURE"},{"id":"RFLA-36","profile":"drill-missing","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL_SET"},{"id":"RFLA-37","profile":"drill-order","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL"},{"id":"RFLA-38","profile":"drill-fail","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL"},{"id":"RFLA-39","profile":"drill-data-loss","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL"},{"id":"RFLA-40","profile":"drill-signature","expected":"DENY","errorCode":"RF_LISTENER_AUTH_DRILL_SIGNATURE"},{"id":"RFLA-41","profile":"approval-missing","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL_SET"},{"id":"RFLA-42","profile":"approval-order","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL"},{"id":"RFLA-43","profile":"approval-decision","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL"},{"id":"RFLA-44","profile":"approval-scope","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL"},{"id":"RFLA-45","profile":"approval-nonce","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL"},{"id":"RFLA-46","profile":"approval-signature","expected":"DENY","errorCode":"RF_LISTENER_AUTH_APPROVAL_SIGNATURE"},{"id":"RFLA-47","profile":"forged-handle","expected":"DENY","errorCode":"RF_LISTENER_AUTH_HANDLE"},{"id":"RFLA-48","profile":"project-replay","expected":"DENY","errorCode":"RF_LISTENER_AUTH_HANDLE"},{"id":"RFLA-49","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_LISTENER_AUTH_HANDLE"},{"id":"RFLA-50","profile":"receipt-status","expected":"DENY","errorCode":"RF_LISTENER_AUTH_RECEIPT"},{"id":"RFLA-51","profile":"receipt-digest","expected":"DENY","errorCode":"RF_LISTENER_AUTH_RECEIPT_DIGEST"},{"id":"RFLA-52","profile":"nonce-replay","expected":"DENY","errorCode":"RF_LISTENER_AUTH_NONCE"},{"id":"RFLA-53","profile":"admission-provenance","expected":"DENY","errorCode":"RF_LISTENER_AUTH_ADMISSION_PROVENANCE"}]},"discovery":{"controller":"/api/runner-factory/controller","productionEvidenceAdmission":"/api/runner-factory/controller/production-evidence-admission","workbench":"/release-foundation#listener-authorization","schema":"/schemas/runner-factory-controller-listener-authorization.v1.schema.json"}}