{"schemaVersion":"developer.reits.tech/runner-factory-controller-production-evidence-admission/v1","status":"PRODUCTION_EVIDENCE_ADMISSION_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-21T03:00:00Z","scope":{"mode":"TEST_ONLY_PRODUCTION_EVIDENCE_NO_DEPLOYMENT","input":"SIGNED_RELEASE_HOST_SERVICE_ADAPTER_GATE_EVIDENCE","output":"OPAQUE_READ_ONLY_EVIDENCE_DOSSIER","networkAuthority":"NONE","deploymentAuthority":"NONE","mutationPolicy":"VERIFY_ONLY_NO_EXTERNAL_READ_NO_WRITE_NO_LISTENER"},"truth":{"productionAdmissionReceipts":0,"productionHostReceipts":0,"productionServiceIdentityReceipts":0,"qualifiedProductionAdapters":0,"configuredReadinessGates":0,"listenerAuthorizations":0,"controllerListeners":0,"productionWebhooksAccepted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"requirements":[{"id":"release","count":1,"proof":"signed exact source, artifact, configuration and rollback identity"},{"id":"host","count":1,"proof":"dedicated control-plane host, production marker, zero Runner service and loopback bind"},{"id":"service","count":1,"proof":"non-login UID/GID, no capabilities, credential references only and hardened unit digest"},{"id":"adapters","count":6,"proof":"five READ_ONLY Readers plus one VERIFY_ONLY attestation verifier"},{"id":"gates","count":11,"proof":"ordered issuer-pinned attestations bound to the exact manifest and runtime identity"},{"id":"readiness","count":1,"proof":"READY_VERIFIED receipt that reconstructs all eleven Gate facts"}],"operations":[{"id":"admit","guard":"all 19 evidence signatures, six adapters and eleven Gates verify within five minutes","result":"opaque evidence-only admission capability"},{"id":"verify","guard":"exact zero-authority receipt shape, identity and digest","result":"standalone admission receipt verdict"},{"id":"project","guard":"live capability may project once","result":"frozen dossier with no Handler, listener or deployment function"},{"id":"dispose","guard":"admitted or projected capability","result":"evidence references are terminally revoked"}],"stateModel":[{"id":"UNVERIFIED","meaning":"candidate facts have no authority"},{"id":"VERIFYING_IDENTITIES","meaning":"release, host and service bindings are checked"},{"id":"VERIFYING_ADAPTERS","meaning":"six production implementation qualifications are checked"},{"id":"VERIFYING_GATES","meaning":"eleven attestations and readiness reconstruction are checked"},{"id":"ADMITTED_EVIDENCE_ONLY","meaning":"a non-deployable evidence capability exists in memory"},{"id":"PROJECTED","meaning":"one frozen dossier has been projected"},{"id":"DISPOSED","meaning":"the capability and retained dossier are revoked"},{"id":"DENIED","meaning":"any identity, authority, time, signature or digest drift fails closed"}],"invariants":["release identity binds one signed production source, artifact, configuration and distinct rollback target","runtime identity is no older than five minutes","the host is dedicated to the control plane and reports no shared production workloads","the immutable production marker must be present","no Runner service may be active on the Controller host","the only admissible Controller bind is 127.0.0.1:8110","the service user and group are reits-runner-factory","the service account is non-root and non-login","the service home and unit name are exact","inline secret values remain zero and only credential references are allowed","the service has no Linux capabilities and NoNewPrivileges is true","exactly five read-only Readers and one verify-only component are admitted","adapter order, authority, operation, permission and ConfigRef sets are exact","every adapter implementation and configuration evidence is digest-bound","no adapter grants external write or listener authority","adapter qualifications bind the exact release and host","exactly eleven ordered readiness attestations are required","every Gate binds the exact controller, manifest and runtime identity","the readiness issuer is pinned to the reviewed production P-256 KeyRef","every signed receipt is current and valid for at most five minutes","nineteen signatures must verify positively","the READY_VERIFIED receipt reconstructs the same eleven Gate evidence digests","the readiness receipt identity digest is derived from the exact runtime identity","the admission expiry is the earliest upstream expiry","one admission capability can project only once","forged, replayed and disposed capabilities are denied","the projected dossier contains no function or mutable authority","the admission receipt always sets deploymentAuthorized=false","the admission receipt always sets listenerAuthorized=false and handlerCreated=false","external reads, writes, mutations and listener starts remain zero","secret-like fields are structurally rejected","production webhook acceptance remains zero","the existing unconfigured production entrypoint is unchanged","port 8110 remains absent until a separate owner-approved listener receipt exists"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":56,"acceptedOutcomes":6,"deniedOutcomes":50,"fixtureEvidenceSignaturesVerified":339,"productionAdmissionReceipts":0,"productionAdaptersQualified":0,"productionReadinessGates":0,"listenerStarts":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0},"productionPrerequisites":["publish a signed Controller release unit with an exercised rollback target","provision and attest a dedicated non-production control-plane host","install the reviewed non-login service identity and hardened unit without starting it","implement and independently review the five production read adapters","install the verify-only readiness public key through a root-owned KeyRef","collect nineteen fresh signatures and all eleven Gate evidence objects","run the admission verifier on the target host with external calls still disabled","obtain a separate expiring owner-approved listener authorization","perform live negative-webhook, rollback, incident, security and cost acceptance before activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-production-evidence-admission-fixtures/v1","fixedTime":"2026-07-21T03:00:00.000Z","cases":[{"id":"RFEA-01","profile":"admit","expected":"ACCEPT","outcome":"EVIDENCE_ADMITTED"},{"id":"RFEA-02","profile":"project","expected":"ACCEPT","outcome":"DOSSIER_PROJECTED"},{"id":"RFEA-03","profile":"verify-receipt","expected":"ACCEPT","outcome":"RECEIPT_VERIFIED"},{"id":"RFEA-04","profile":"dispose-before-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFEA-05","profile":"dispose-after-project","expected":"ACCEPT","outcome":"DISPOSED"},{"id":"RFEA-06","profile":"dispose-replay","expected":"ACCEPT","outcome":"DISPOSED_REPLAY"},{"id":"RFEA-07","profile":"missing-verifier","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_DEPENDENCIES"},{"id":"RFEA-08","profile":"invalid-clock","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_CLOCK"},{"id":"RFEA-09","profile":"release-schema","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-10","profile":"release-staging","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-11","profile":"release-unsigned","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-12","profile":"release-source","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-13","profile":"release-rollback-self","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RELEASE"},{"id":"RFEA-14","profile":"identity-shared","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-15","profile":"identity-not-dedicated","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-16","profile":"identity-stale","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-17","profile":"identity-wrong-user","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-18","profile":"identity-host","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_IDENTITY"},{"id":"RFEA-19","profile":"host-shared","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-20","profile":"host-marker-missing","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-21","profile":"host-runner-active","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-22","profile":"host-bind-public","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-23","profile":"host-release","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST"},{"id":"RFEA-24","profile":"host-expired","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST_SIGNATURE"},{"id":"RFEA-25","profile":"host-signature","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HOST_SIGNATURE"},{"id":"RFEA-26","profile":"service-root","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-27","profile":"service-login","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-28","profile":"service-inline-secret","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SECRET"},{"id":"RFEA-29","profile":"service-capability","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-30","profile":"service-nnp","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-31","profile":"service-host","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-32","profile":"service-release","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE"},{"id":"RFEA-33","profile":"service-signature","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SERVICE_SIGNATURE"},{"id":"RFEA-34","profile":"adapter-missing","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER_SET"},{"id":"RFEA-35","profile":"adapter-order","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-36","profile":"adapter-mode","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-37","profile":"adapter-write","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-38","profile":"adapter-listener","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_SECRET"},{"id":"RFEA-39","profile":"adapter-config-ref","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-40","profile":"adapter-implementation","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER"},{"id":"RFEA-41","profile":"adapter-signature","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_ADAPTER_SIGNATURE"},{"id":"RFEA-42","profile":"gate-missing","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE_SET"},{"id":"RFEA-43","profile":"gate-order","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE"},{"id":"RFEA-44","profile":"gate-controller","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE"},{"id":"RFEA-45","profile":"gate-manifest","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE"},{"id":"RFEA-46","profile":"gate-signature","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE_SIGNATURE"},{"id":"RFEA-47","profile":"gate-expired","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_GATE_SIGNATURE"},{"id":"RFEA-48","profile":"readiness-blocked","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_READINESS"},{"id":"RFEA-49","profile":"readiness-identity","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_READINESS"},{"id":"RFEA-50","profile":"readiness-digest","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_READINESS_DIGEST"},{"id":"RFEA-51","profile":"readiness-gate","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_READINESS"},{"id":"RFEA-52","profile":"forged-handle","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HANDLE"},{"id":"RFEA-53","profile":"project-replay","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HANDLE"},{"id":"RFEA-54","profile":"use-after-dispose","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_HANDLE"},{"id":"RFEA-55","profile":"receipt-status","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RECEIPT"},{"id":"RFEA-56","profile":"receipt-digest","expected":"DENY","errorCode":"RF_PRODUCTION_EVIDENCE_RECEIPT_DIGEST"}]},"discovery":{"controller":"/api/runner-factory/controller","serviceRuntimeBootstrap":"/api/runner-factory/controller/service-runtime-bootstrap","workbench":"/release-foundation#production-evidence-admission","schema":"/schemas/runner-factory-controller-production-evidence-admission.v1.schema.json"}}