{"schemaVersion":"developer.reits.tech/runner-factory-reconciliation-planner/v1","status":"PLANNER_IMPLEMENTED_NOT_CONFIGURED","observedAt":"2026-07-20T19:30:00Z","scope":{"mode":"READ_ONLY_CROSS_PORT_RECONCILIATION","sources":5,"sourceWindowSeconds":300,"mutationPolicy":"PLAN_ONLY_NO_EXTERNAL_ACTION","failureMode":"FREEZE_AND_PAGE_PLAN"},"truth":{"runtimeSourcesConfigured":0,"schedulerIntegrated":false,"metricsExporterConfigured":false,"pagingProviderConfigured":false,"readinessGateSatisfied":false,"liveReports":0,"runtimeContainments":0,"pagesSent":0,"mutationsExecuted":0,"externalReadsExecuted":0,"externalWritesExecuted":0,"secretValuesRecorded":0,"paidResourcesCreated":false,"deploymentPermitted":false},"implementation":{"planner":"ops/runner-factory/reconciliation-planner.mjs","fixtureRegistry":"ops/runner-factory/reconciliation-planner-fixtures.json","verifier":"scripts/verify-runner-factory-reconciliation-planner.mjs","runtimeSourceReader":"NOT_CONFIGURED","metricExporter":"NOT_CONFIGURED","pagingProvider":"NOT_CONFIGURED"},"operations":[{"id":"assess","guard":"exact bounded five-source snapshot and no secret-like keys","result":"deterministic SAFE or CONTAIN report"},{"id":"summarize","guard":"one to 1000 verified reports","result":"bounded severity and containment totals"},{"id":"buildMetrics","guard":"fixed metric names and controller-only label","result":"eight low-cardinality gauge samples"},{"id":"buildPage","guard":"CONTAIN report only; stable category dedupe","result":"identifier-free PLANNED_NOT_SENT page"}],"sourceReads":[{"id":"Reservation","boundary":"consistent dual-row reservation state, lease and terminal reason"},{"id":"Capacity","boundary":"consistent pool/slot state, exact scope and fenced generation"},{"id":"Worker","boundary":"instance lifecycle, root-volume retirement and exact job binding"},{"id":"Runner","boundary":"Gitea state plus root-agent credential and local-state proof"},{"id":"Journal","boundary":"consistent head, exact scope, receipt count and immutable terminal state"}],"stateMachine":[{"from":"SNAPSHOT","condition":"all sources exact and prelaunch","to":"HEALTHY_PRELAUNCH"},{"from":"SNAPSHOT","condition":"worker bootstrap and no runner","to":"HEALTHY_BOOTSTRAP"},{"from":"SNAPSHOT","condition":"active reservation, occupied slot, live worker, sealed runner authority","to":"HEALTHY_IN_FLIGHT"},{"from":"SNAPSHOT","condition":"complete reservation, replacement, double retirement and success journal","to":"HEALTHY_COMPLETE"},{"from":"SNAPSHOT","condition":"failed reservation, no live resources and failure journal","to":"HEALTHY_FAILED"},{"from":"SNAPSHOT","condition":"pool already frozen","to":"CONTAINED_FROZEN"},{"from":"SNAPSHOT","condition":"source unavailable or unknown","to":"SOURCE_UNAVAILABLE"},{"from":"SNAPSHOT","condition":"any cross-source plan/job mismatch","to":"SCOPE_MISMATCH"},{"from":"SNAPSHOT","condition":"expired lease or stale open journal","to":"STALE_CONTROL_STATE"},{"from":"SNAPSHOT","condition":"orphan worker/runner or credential authority remains live","to":"ORPHAN_AUTHORITY"},{"from":"SNAPSHOT","condition":"capacity, retirement or journal terminal contradiction","to":"TERMINAL_CONFLICT"},{"from":"SNAPSHOT","condition":"no exact safe state matches","to":"UNCLASSIFIED_DRIFT"}],"invariants":["reconciliation reads reservation, capacity, worker, runner and journal as separate authorities","every observed non-absent authority binds the exact plan and job scope","unavailable or unknown source data can never produce a safe verdict","an expired active lease cannot remain schedulable","a live worker without an active reservation is an orphan","a live runner without a live exact worker is an orphan","registered or online runner authority must already be sealed from untrusted code","available capacity with a live worker is an overcommit risk","occupied capacity after worker termination is stranded until replacement proof","worker termination is incomplete until root-volume deletion is proved","runner retirement is incomplete until both Gitea and local state are absent","success journal state requires a completed reservation","failure journal state requires a failed reservation","an open journal older than five minutes is stale","any unclassified cross-source combination fails closed","metrics use fixed names and no repository, job, runner, instance or plan labels","page plans contain only verdict, severity, digest and category dedupe identity","the planner performs zero mutations, external reads, writes or page deliveries"],"metricSeries":["reits_rf_reconciliation_reports","reits_rf_reconciliation_safe","reits_rf_reconciliation_contained","reits_rf_reconciliation_freeze_required","reits_rf_reconciliation_page_p0","reits_rf_reconciliation_page_p1","reits_rf_reconciliation_page_p2","reits_rf_reconciliation_unclassified"],"verification":{"status":"PASS_FIXTURE_ONLY","fixtures":32,"safeOutcomes":7,"containedOutcomes":24,"deniedInputs":1,"freezePlans":23,"pagePlans":24,"metricSeries":8,"highCardinalityLabels":0,"secretValuesRecorded":0,"mutationsExecuted":0,"externalCallsExecuted":0},"failureClasses":[{"code":"SOURCE_UNAVAILABLE","owner":"platform-oncall","containment":"freeze scheduling and retry consistent reads"},{"code":"SCOPE_MISMATCH","owner":"security-oncall","containment":"freeze, preserve evidence and deny all automatic cleanup"},{"code":"ORPHAN_WORKER|CAPACITY_*","owner":"platform-oncall","containment":"freeze and require terminal Worker plus root-volume proof"},{"code":"ORPHAN_RUNNER|CREDENTIAL_*","owner":"security-oncall","containment":"freeze and require Gitea plus root-agent deletion proof"},{"code":"SUCCESS_CONFLICT|FAILURE_CONFLICT|JOURNAL_STALE","owner":"platform-and-security","containment":"preserve both chains and require manual reconciliation"},{"code":"UNCLASSIFIED_DRIFT","owner":"platform-oncall","containment":"freeze because absence of a known-safe state is unsafe"}],"productionPrerequisites":["strongly consistent read-only identities for all five authoritative sources","bounded snapshot coordinator with skew, timeout and partial-read controls","scheduler freeze integration that cannot be bypassed by webhook admission","separate approved executors for termination, deletion, sealing and lease recovery","Prometheus-compatible exporter with the fixed eight-series label policy","paging provider, dedupe window, escalation policy, owner and recovery runbook","security, platform, reliability and cost-owner approval"],"fixtureRegistry":{"schemaVersion":"developer.reits.tech/runner-factory-reconciliation-planner-fixtures/v1","fixedTime":"2026-07-20T19:30:00.000Z","cases":[{"id":"RFR-01","profile":"healthy-prelaunch","expected":"SAFE","verdict":"HEALTHY_PRELAUNCH","severity":"P3","freezeRequired":false},{"id":"RFR-02","profile":"healthy-bootstrap","expected":"SAFE","verdict":"HEALTHY_BOOTSTRAP","severity":"P3","freezeRequired":false},{"id":"RFR-03","profile":"healthy-registered","expected":"SAFE","verdict":"HEALTHY_IN_FLIGHT","severity":"P3","freezeRequired":false},{"id":"RFR-04","profile":"healthy-online","expected":"SAFE","verdict":"HEALTHY_IN_FLIGHT","severity":"P3","freezeRequired":false},{"id":"RFR-05","profile":"healthy-complete","expected":"SAFE","verdict":"HEALTHY_COMPLETE","severity":"P3","freezeRequired":false},{"id":"RFR-06","profile":"healthy-failed","expected":"SAFE","verdict":"HEALTHY_FAILED","severity":"P3","freezeRequired":false},{"id":"RFR-07","profile":"deterministic-replay","expected":"SAFE","verdict":"HEALTHY_COMPLETE","severity":"P3","freezeRequired":false},{"id":"RFR-08","profile":"already-frozen","expected":"CONTAIN","verdict":"CONTAINED_FROZEN","severity":"P1","freezeRequired":false},{"id":"RFR-09","profile":"reservation-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-10","profile":"capacity-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-11","profile":"worker-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-12","profile":"runner-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-13","profile":"journal-unavailable","expected":"CONTAIN","verdict":"SOURCE_UNAVAILABLE","severity":"P1","freezeRequired":true},{"id":"RFR-14","profile":"reservation-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-15","profile":"capacity-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-16","profile":"worker-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-17","profile":"runner-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-18","profile":"journal-scope-mismatch","expected":"CONTAIN","verdict":"SCOPE_MISMATCH","severity":"P0","freezeRequired":true},{"id":"RFR-19","profile":"lease-expired","expected":"CONTAIN","verdict":"LEASE_EXPIRED","severity":"P2","freezeRequired":true},{"id":"RFR-20","profile":"orphan-worker","expected":"CONTAIN","verdict":"ORPHAN_WORKER","severity":"P0","freezeRequired":true},{"id":"RFR-21","profile":"orphan-runner","expected":"CONTAIN","verdict":"ORPHAN_RUNNER","severity":"P0","freezeRequired":true},{"id":"RFR-22","profile":"credential-authority-live","expected":"CONTAIN","verdict":"CREDENTIAL_AUTHORITY_LIVE","severity":"P0","freezeRequired":true},{"id":"RFR-23","profile":"capacity-overcommit","expected":"CONTAIN","verdict":"CAPACITY_OVERCOMMIT_RISK","severity":"P0","freezeRequired":true},{"id":"RFR-24","profile":"capacity-stranded","expected":"CONTAIN","verdict":"CAPACITY_STRANDED","severity":"P1","freezeRequired":true},{"id":"RFR-25","profile":"termination-unproven","expected":"CONTAIN","verdict":"TERMINATION_UNPROVEN","severity":"P1","freezeRequired":true},{"id":"RFR-26","profile":"runner-retirement-unproven","expected":"CONTAIN","verdict":"RUNNER_RETIREMENT_UNPROVEN","severity":"P1","freezeRequired":true},{"id":"RFR-27","profile":"success-conflict","expected":"CONTAIN","verdict":"SUCCESS_CONFLICT","severity":"P0","freezeRequired":true},{"id":"RFR-28","profile":"failure-conflict","expected":"CONTAIN","verdict":"FAILURE_CONFLICT","severity":"P1","freezeRequired":true},{"id":"RFR-29","profile":"journal-stale","expected":"CONTAIN","verdict":"JOURNAL_STALE","severity":"P2","freezeRequired":true},{"id":"RFR-30","profile":"capacity-generation-invalid","expected":"CONTAIN","verdict":"CAPACITY_GENERATION_INVALID","severity":"P1","freezeRequired":true},{"id":"RFR-31","profile":"unclassified-drift","expected":"CONTAIN","verdict":"UNCLASSIFIED_DRIFT","severity":"P1","freezeRequired":true},{"id":"RFR-32","profile":"secret-like-field","expected":"DENY","errorCode":"RF_RECON_INPUT_SECRET"}]},"discovery":{"lifecycle":"/api/runner-factory","controller":"/api/runner-factory/controller","workbench":"/release-foundation#runtime-reconciliation","schema":"/schemas/runner-factory-reconciliation-planner.v1.schema.json","snapshotCoordinator":"/api/runner-factory/reconciliation/snapshot-coordinator","snapshotCoordinatorSchema":"/schemas/runner-factory-reconciliation-snapshot-coordinator.v1.schema.json"}}