{"schemaVersion":"developer.reits.tech/runner-factory-controller-runtime-assembly/v1","status":"ASSEMBLY_VERIFIER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T21:00:00Z","scope":{"mode":"READINESS_RECEIPT_ONLY_NO_ADAPTER_CONSTRUCTION","readerBindings":5,"readinessGates":11,"serviceBind":"127.0.0.1:8110","serviceMode":"EVIDENCE_ONLY","attestationMaxAgeSeconds":300,"secretPolicy":"CONFIGREF_AND_KEYREF_ONLY","mutationPolicy":"NO_RUNTIME_INSTALL_NO_SOURCE_CALL_NO_WRITE"},"truth":{"manifestInstalled":false,"runtimeIdentityConfigured":false,"configuredReaderBindings":0,"verifiedReadinessGates":0,"readinessReady":false,"runtimeReadinessReceipts":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"assembly":"ops/runner-factory/controller-runtime-assembly.mjs","configuration":"ops/runner-factory/service-config.mjs","fixtureRegistry":"ops/runner-factory/controller-runtime-assembly-fixtures.json","verifier":"scripts/verify-runner-factory-controller-runtime-assembly.mjs","productionManifest":"NOT_INSTALLED","productionAttestationVerifier":"NOT_CONFIGURED"},"operations":[{"id":"plan","guard":"exact service identity, five ordered readers and reference-only configuration","result":"immutable assembly plan and manifest digest"},{"id":"assemble","guard":"fresh dedicated-host identity plus zero to eleven verified gate attestations","result":"blocked or ready receipt without constructing an adapter"},{"id":"verify","guard":"recompute plan, identity, receipt and packet digests and reverify attestations","result":"local integrity verdict with no external call"},{"id":"toControllerRuntime","guard":"only a verified packet may project ordered readiness gates","result":"receipt-backed service readiness snapshot"}],"readerBindings":[{"source":"Reservation","authority":"reservation-ledger","driver":"dynamodb-consistent-get","permission":"dynamodb:GetItem","configuration":["table ARN ref","IAM role ARN ref"]},{"source":"Capacity","authority":"capacity-ledger","driver":"dynamodb-consistent-get","permission":"dynamodb:GetItem","configuration":["table ARN ref","IAM role ARN ref"]},{"source":"Worker","authority":"ec2-worker-read-model","driver":"ec2-describe","permission":"ec2:DescribeInstances+ec2:DescribeVolumes","configuration":["region ref","IAM role ARN ref"]},{"source":"Runner","authority":"gitea-runner-read-model","driver":"gitea-root-agent-composite","permission":"gitea:read-runner+read-job+agent:read","configuration":["Gitea origin ref","credential ref","agent socket ref"]},{"source":"Journal","authority":"append-only-journal","driver":"dynamodb-consistent-query","permission":"dynamodb:Query","configuration":["table ARN ref","IAM role ARN ref"]}],"readinessGates":["RF_READY_DEDICATED_HOST","RF_READY_SERVICE_IDENTITY","RF_READY_WEBHOOK_SECRET","RF_READY_RESERVATION_STORE","RF_READY_RECEIPT_SIGNER","RF_READY_TOKEN_BROKER","RF_READY_WORKER_PROVIDER","RF_READY_GITEA_CONTROL","RF_READY_CAPACITY_CONTROLLER","RF_READY_AUDIT_SINK","RF_READY_OWNER_APPROVAL"],"stateModel":[{"id":"MANIFEST_PLANNED","meaning":"service, reader and attestation boundaries have one digest"},{"id":"IDENTITY_BOUND","meaning":"fresh dedicated-host and non-login service identity matches the manifest"},{"id":"GATES_PARTIAL","meaning":"one or more required attestations remain missing and readiness stays blocked"},{"id":"READY_VERIFIED","meaning":"all eleven fresh attestations verify under the pinned key reference"},{"id":"DENIED_INTEGRITY","meaning":"identity, scope, time, signature, shape or digest verification failed"}],"invariants":["readiness cannot be enabled by environment booleans or caller-provided gate flags","one manifest binds one production controller identity and one immutable assembly identifier","the service identity is a dedicated non-login user with an exact UID and GID","the manifest only permits loopback port 8110 in EVIDENCE_ONLY mode","the runtime host must attest dedicated control-plane use and no production workload sharing","runtime identity freshness is bounded by the manifest attestation age","exactly five ordered source-reader descriptors exist without wildcard fallback","every reader is strongly consistent and has read-only least-privilege operations","reader configuration uses ConfigRef values and never embeds credentials or secret material","the attestation verifier key is an exact KeyRef and cannot be supplied inline","exactly eleven named readiness gates exist and unknown gate names are denied","gate readiness comes from the presence of a verified attestation rather than a boolean field","every attestation binds controller, manifest, runtime identity and evidence digest","every attestation is fresh, unexpired and verified by the injected pinned verifier","duplicate gate attestations are denied instead of last-write-wins replacement","partial evidence produces BLOCKED_CONFIGURATION with an exact missing-gate list","READY_VERIFIED requires eleven of eleven verified attestations","plan, identity, readiness receipt and packet digests are independently recomputed","a runtime projection can only be derived from a fully verified assembly packet","assembly owns no install, listener, source call, adapter construction, external write or mutation"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":32,"readyPackets":1,"blockedPackets":5,"deniedInputs":26,"verifiedAttestations":30,"controllerProjectionCases":6,"booleanEscalationsDenied":1,"secretValuesRecorded":0,"externalCallsExecuted":0,"mutationsExecuted":0},"failureClasses":[{"code":"RF_ASSEMBLY_MANIFEST|SERVICE|READERS","effect":"deny unsafe service or reader assembly before identity evaluation"},{"code":"RF_ASSEMBLY_IDENTITY|IDENTITY_TIME","effect":"deny shared, stale or scope-drifted controller runtime identity"},{"code":"RF_ASSEMBLY_ATTESTATION|ATTESTATION_SET|ATTESTATION_TIME","effect":"deny malformed, duplicate, unknown, stale or expired Gate evidence"},{"code":"RF_ASSEMBLY_SIGNATURE","effect":"deny when the injected pinned verifier rejects or fails"},{"code":"RF_ASSEMBLY_RECEIPT|RUNTIME|PACKET|DIGEST","effect":"deny any readiness projection or digest inconsistency"},{"code":"RF_ASSEMBLY_SECRET","effect":"deny secret-like fields before plan, receipt or packet materialization"}],"productionPrerequisites":["install one reviewed root-owned production assembly manifest","attest a dedicated control-plane host with no shared production workload","install the exact non-login reits-runner-factory service identity","resolve all five reader ConfigRefs under a read-only IAM and local-agent boundary","configure the pinned asymmetric readiness-attestation verifier","issue and verify all eleven scope-bound readiness attestations","persist and expose the readiness receipt digest through loopback health only","obtain security, runtime and cost owner approvals before any Controller activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-runtime-assembly-fixtures/v1","fixedTime":"2026-07-20T21:00:00.000Z","cases":[{"id":"RFRA-01","profile":"all-gates","expected":"ASSEMBLE","status":"READY_VERIFIED","readyCount":11},{"id":"RFRA-02","profile":"no-gates","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":0},{"id":"RFRA-03","profile":"one-gate","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":1},{"id":"RFRA-04","profile":"three-gates","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":3},{"id":"RFRA-05","profile":"five-gates","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":5},{"id":"RFRA-06","profile":"ten-gates","expected":"ASSEMBLE","status":"BLOCKED_CONFIGURATION","readyCount":10},{"id":"RFRA-07","profile":"secret-like-manifest","expected":"DENY","errorCode":"RF_ASSEMBLY_SECRET"},{"id":"RFRA-08","profile":"bad-assembly-id","expected":"DENY","errorCode":"RF_ASSEMBLY_MANIFEST"},{"id":"RFRA-09","profile":"wrong-environment","expected":"DENY","errorCode":"RF_ASSEMBLY_MANIFEST"},{"id":"RFRA-10","profile":"login-service","expected":"DENY","errorCode":"RF_ASSEMBLY_SERVICE"},{"id":"RFRA-11","profile":"shared-host-class","expected":"DENY","errorCode":"RF_ASSEMBLY_SERVICE"},{"id":"RFRA-12","profile":"wildcard-bind","expected":"DENY","errorCode":"RF_ASSEMBLY_SERVICE"},{"id":"RFRA-13","profile":"run-mode","expected":"DENY","errorCode":"RF_ASSEMBLY_SERVICE"},{"id":"RFRA-14","profile":"reader-reordered","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-15","profile":"reader-missing","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-16","profile":"wrong-reader-authority","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-17","profile":"eventual-consistency","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-18","profile":"write-permission","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-19","profile":"unknown-driver","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-20","profile":"duplicate-config-ref","expected":"DENY","errorCode":"RF_ASSEMBLY_READERS"},{"id":"RFRA-21","profile":"wrong-controller-identity","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-22","profile":"shared-production-workloads","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-23","profile":"wrong-service-user","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-24","profile":"wrong-service-uid","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-25","profile":"stale-identity","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY_TIME"},{"id":"RFRA-26","profile":"identity-manifest-drift","expected":"DENY","errorCode":"RF_ASSEMBLY_IDENTITY"},{"id":"RFRA-27","profile":"duplicate-gate","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION_SET"},{"id":"RFRA-28","profile":"unknown-gate","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFRA-29","profile":"wrong-attestation-subject","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFRA-30","profile":"wrong-attestation-issuer","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION"},{"id":"RFRA-31","profile":"expired-attestation","expected":"DENY","errorCode":"RF_ASSEMBLY_ATTESTATION_TIME"},{"id":"RFRA-32","profile":"bad-signature","expected":"DENY","errorCode":"RF_ASSEMBLY_SIGNATURE"}]},"discovery":{"controller":"/api/runner-factory/controller","snapshotCoordinator":"/api/runner-factory/reconciliation/snapshot-coordinator","workbench":"/release-foundation#runtime-assembly","schema":"/schemas/runner-factory-controller-runtime-assembly.v1.schema.json"}}