{"schemaVersion":"developer.reits.tech/runner-factory-controller-runtime-configuration/v1","status":"CONFIGURATION_LOADER_IMPLEMENTED_NOT_INSTALLED","observedAt":"2026-07-20T21:30:00Z","scope":{"mode":"ROOT_OWNED_MANIFEST_AND_REFERENCE_RESOLUTION_ONLY","manifestPath":"/etc/reits-runner-factory/controller-runtime.json","owner":"root","group":"reits-runner-factory","fileMode":"0640","maxBytes":65536,"configRefs":11,"keyRefs":1,"resolutionMaxAgeSeconds":300,"secretPolicy":"SECRETREF_ONLY_NO_SECRET_VALUE","mutationPolicy":"NO_INSTALL_NO_ADAPTER_CONSTRUCTION_NO_WRITE"},"truth":{"manifestInstalled":false,"productionFileReads":0,"configuredConfigRefs":0,"configuredKeyRefs":0,"runtimeConfigurationBundles":0,"runtimeAdaptersConstructed":0,"controllerListeners":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"mutationsExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"loader":"ops/runner-factory/controller-runtime-configuration.mjs","assembly":"ops/runner-factory/controller-runtime-assembly.mjs","fixtureRegistry":"ops/runner-factory/controller-runtime-configuration-fixtures.json","verifier":"scripts/verify-runner-factory-controller-runtime-configuration.mjs","productionManifest":"NOT_INSTALLED","productionConfigStore":"NOT_CONFIGURED","productionTrustStore":"NOT_CONFIGURED"},"operations":[{"id":"loadManifest","guard":"O_NOFOLLOW, exact path, root:service ownership, 0640, one link, stable inode and bounded bytes","result":"canonical manifest plus file proof"},{"id":"resolveConfigRefs","guard":"eleven ordered typed references from one root-owned store","result":"safe values or exact missing list without secret material"},{"id":"resolveKeyRef","guard":"one pinned verify-only P-256 trust descriptor","result":"public-key fingerprint metadata or blocked configuration"},{"id":"prepare","guard":"manifest plan and all resolution metadata are fresh and digest-bound","result":"resolved or blocked immutable configuration bundle"},{"id":"verify","guard":"recompute file, reference-set, resolution, assembly-plan and bundle digests","result":"local integrity verdict without constructing adapters"}],"referenceTypes":[{"kind":"DYNAMODB_TABLE_ARN","count":3,"constraint":"ap-southeast-2 and exact reviewed table name"},{"kind":"IAM_ROLE_ARN","count":4,"constraint":"exact read-only role suffix without wildcard"},{"kind":"AWS_REGION","count":1,"constraint":"ap-southeast-2"},{"kind":"HTTPS_ORIGIN","count":1,"constraint":"https://gitea.reits.tech"},{"kind":"SECRET_REF","count":1,"constraint":"opaque SecretRef only; never a credential value"},{"kind":"ROOT_AGENT_SOCKET","count":1,"constraint":"exact /run read-only agent socket"},{"kind":"ECDSA_P256_SHA256","count":1,"constraint":"VERIFY_ONLY metadata and pinned SPKI digest"}],"stateModel":[{"id":"UNLOADED","meaning":"no production manifest or reference has been read"},{"id":"FILE_VERIFIED","meaning":"path, ownership, mode, link count and same-descriptor metadata passed"},{"id":"MANIFEST_VALIDATED","meaning":"canonical JSON passed the runtime assembly manifest planner"},{"id":"REFERENCES_PARTIAL","meaning":"one or more typed references are absent and activation remains blocked"},{"id":"CONFIGURATION_RESOLVED","meaning":"eleven ConfigRefs and one KeyRef are fresh, typed and digest-bound"},{"id":"DENIED_INTEGRITY","meaning":"file, encoding, manifest, reference, time or digest contract failed"}],"invariants":["only /etc/reits-runner-factory/controller-runtime.json may be opened","the production driver opens with O_NOFOLLOW and O_CLOEXEC","the manifest must be a regular file rather than a symlink, directory or device","the file owner is root and the group is the dedicated reits-runner-factory identity","the file mode is exactly 0640 and the hard-link count is exactly one","the manifest is non-empty and bounded to 65536 bytes","before and after metadata from the same open descriptor must match exactly","the verified byte length must equal the file size metadata","the file is strict UTF-8 without NUL bytes","the file is canonical JSON with exactly one trailing newline","the parsed manifest must pass the existing runtime assembly planner","the file proof binds path, inode, device, mtime, size and content digest","the manifest contains exactly eleven ordered ConfigRefs","every ConfigRef has one expected semantic type and no generic fallback","DynamoDB and IAM ARNs are exact-suffix and wildcard-free","the Gitea origin is HTTPS and pinned to gitea.reits.tech","the credential configuration resolves only to a SecretRef, never a credential value","the root-agent socket is pinned beneath /run/reits-runner-factory","the readiness KeyRef resolves to VERIFY_ONLY P-256 metadata without private material","all resolution metadata is no older than five minutes and never from the future","missing references produce BLOCKED_CONFIGURATION rather than a partial runtime adapter","file, reference-set, resolution, assembly-plan and bundle digests are independently recomputed","bundle verification never constructs a reader, signer, credential or listener","production installation, reads, adapters, writes, mutations and paid resources remain zero"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":36,"resolvedBundles":2,"blockedBundles":5,"deniedInputs":29,"configRefs":11,"keyRefs":1,"referenceTypes":7,"deterministicReplays":1,"tamperedBundlesDenied":1,"secretValuesRecorded":0,"externalWritesExecuted":0,"mutationsExecuted":0},"failureClasses":[{"code":"RF_RUNTIME_CONFIG_PATH|FILE_READ|FILE_METADATA|FILE_SIZE|TOCTOU","effect":"deny an untrusted path, link, owner, mode, size or changing descriptor"},{"code":"RF_RUNTIME_CONFIG_ENCODING|JSON|CANONICAL|MANIFEST","effect":"deny malformed bytes or a manifest outside the assembly contract"},{"code":"RF_RUNTIME_CONFIG_REF_SET|RESOLVER|RESOLUTION|RESOLUTION_TIME","effect":"deny missing inventory, unsafe type/source/value or stale ConfigRef metadata"},{"code":"RF_RUNTIME_CONFIG_KEY_REF|KEY_RESOLVER|KEY|KEY_TIME","effect":"deny an unpinned, signing-capable, private or stale trust descriptor"},{"code":"RF_RUNTIME_CONFIG_BUNDLE|FILE_PROOF|MISSING|STATUS|DIGEST","effect":"deny any bundle truth or digest inconsistency"}],"productionPrerequisites":["install the reviewed canonical manifest as root:reits-runner-factory mode 0640","provision the eleven exact ConfigRef records in a root-owned read-only store","provision the verify-only KeyRef descriptor and pinned public SPKI digest","bind ConfigRef resolution to read-only IAM roles and the root-agent socket ACL","attach the verified configuration bundle to Controller boot before readiness evaluation","issue the eleven readiness attestations only after live configuration checks","install and supervise the Controller on its dedicated host while keeping loopback-only bind","obtain security, runtime and cost owner approvals before activation"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-controller-runtime-configuration-fixtures/v1","fixedTime":"2026-07-20T21:30:00.000Z","cases":[{"id":"RFRC-01","profile":"complete","expected":"PREPARE","status":"CONFIGURATION_RESOLVED","resolved":12},{"id":"RFRC-02","profile":"deterministic-replay","expected":"PREPARE","status":"CONFIGURATION_RESOLVED","resolved":12},{"id":"RFRC-03","profile":"one-config-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":11},{"id":"RFRC-04","profile":"five-config-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":7},{"id":"RFRC-05","profile":"all-config-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":1},{"id":"RFRC-06","profile":"key-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":11},{"id":"RFRC-07","profile":"all-references-missing","expected":"PREPARE","status":"BLOCKED_CONFIGURATION","resolved":0},{"id":"RFRC-08","profile":"wrong-path","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_PATH"},{"id":"RFRC-09","profile":"symlink","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-10","profile":"wrong-owner","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-11","profile":"wrong-group","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-12","profile":"permissive-mode","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-13","profile":"hard-link","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-14","profile":"oversize","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-15","profile":"empty","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_METADATA"},{"id":"RFRC-16","profile":"size-mismatch","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_FILE_SIZE"},{"id":"RFRC-17","profile":"nul-byte","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_ENCODING"},{"id":"RFRC-18","profile":"invalid-utf8","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_ENCODING"},{"id":"RFRC-19","profile":"invalid-json","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_JSON"},{"id":"RFRC-20","profile":"noncanonical-json","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_CANONICAL"},{"id":"RFRC-21","profile":"inode-drift","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_TOCTOU"},{"id":"RFRC-22","profile":"mtime-drift","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_TOCTOU"},{"id":"RFRC-23","profile":"manifest-invalid","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_MANIFEST"},{"id":"RFRC-24","profile":"resolver-wrong-ref","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-25","profile":"resolver-wrong-kind","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-26","profile":"wrong-table-arn","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-27","profile":"wildcard-role","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-28","profile":"wrong-region","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-29","profile":"http-origin","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-30","profile":"inline-credential","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-31","profile":"wrong-socket","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION"},{"id":"RFRC-32","profile":"stale-config","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_RESOLUTION_TIME"},{"id":"RFRC-33","profile":"key-sign-usage","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_KEY"},{"id":"RFRC-34","profile":"key-private-material","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_KEY"},{"id":"RFRC-35","profile":"key-bad-fingerprint","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_KEY"},{"id":"RFRC-36","profile":"key-stale","expected":"DENY","errorCode":"RF_RUNTIME_CONFIG_KEY_TIME"}]},"discovery":{"controller":"/api/runner-factory/controller","runtimeAssembly":"/api/runner-factory/controller/runtime-assembly","workbench":"/release-foundation#runtime-configuration","schema":"/schemas/runner-factory-controller-runtime-configuration.v1.schema.json"}}