{"schemaVersion":"developer.reits.tech/runner-isolation-qualification/v1","status":"T04_REPOSITORY_IMPLEMENTED_LIVE_EXECUTION_BLOCKED","observedAt":"2026-07-24T08:28:35Z","program":{"acceptedKnives":4,"totalKnives":36,"currentOrdinal":5,"currentKnife":"D05","remainingIncludingCurrent":32,"remainingAfterCurrentAcceptance":31},"task":{"id":"D05-T04","title":"Deploy and qualify isolated Linux runners across the 18-repository gate set","owner":"Platform SRE + Security + QA","repositoryImplementationComplete":true,"liveExecutionStarted":false,"liveExecutionAdmitted":false,"productionAccepted":false,"nextTask":"D05-T05","nextTaskTitle":"Restore an independent native Mac runner","nextTaskBlocked":true},"planBinding":{"planId":"D05-T04-18-REPOSITORY-ISOLATION-V1","path":"ops/gitea-runner/qualification-plan.json","sha256":"e498834da01c4011411c75f2aa2c4ec4ca8b80bae166e80957a9d6ce88cec25a","registry":"data/ci-registry.json","workflowPath":".gitea/workflows/reits-minimum-ci.yml","gateContext":"REITS Minimum CI / gate (push)","exactRevisionRequired":true},"preconditions":[{"id":"T01","label":"Runner credential firebreak","repositoryState":"IMPLEMENTED","liveState":"NOT_QUALIFIED","satisfied":false},{"id":"T02","label":"Independent AWS validation identity","repositoryState":"IMPLEMENTED","liveState":"ROLE_ABSENT","satisfied":false},{"id":"T03","label":"Product Owner + FinOps cost approval","repositoryState":"IMPLEMENTED","liveState":"0_OF_2_SIGNATURES","satisfied":false},{"id":"SCOPE","label":"Shared repository runner scope","repositoryState":"GAP_EXPOSED_AND_FAIL_CLOSED","liveState":"OWNER_DECISION_REQUIRED","satisfied":false}],"scopeModel":{"coreRepositories":18,"reitsOrganizationRepositories":17,"sharedExternalRepositories":1,"reitsOrganization":{"scope":"organization:reits","targetLanes":2,"targetRepositories":17,"onlineLanesObserved":0},"sharedExternal":{"repository":"jx-im/im-media-send-kit","nativeMinimumRunner":"macos-latest","linuxGateRunner":"ubuntu-latest","currentTemplateCoverage":false,"decision":"OWNER_RESOLUTION_REQUIRED","allowedResolutions":[{"id":"MOVE","label":"Transfer repository to reits","impact":"Existing two reits organization lanes can cover the Linux gate."},{"id":"ADD","label":"Approve separate jx-im ephemeral lane","impact":"Requires a new cost quote, authority receipt and isolated scope."},{"id":"REMOVE","label":"Remove from the core-18 contract","impact":"Requires Product and QA approval plus D04 registry and branch-protection revision."}]}},"liveSummary":{"repositoriesObserved":18,"rawGateSuccess":9,"rawGateCancelled":9,"qualifiedIsolationReceipts":0,"reitsOrganizationRunnersOnline":0,"jxImOrganizationRunnersOnline":0,"adversarialProbeReceipts":0,"retirementReplacementReceipts":0,"trustedSignatures":0},"repositoryMatrix":[{"ordinal":1,"repository":"reits/data-sources","revision":"8987dc1ef058a6d7e8b9ceaa866ba4395ab08a40","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:50Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":2,"repository":"reits/im-core","revision":"4c4ce6e17b91c7c2a97a7e07ebc2cc322b0a61f6","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 6s","rawGateObservedAt":"2026-07-23T16:41:38Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":3,"repository":"jx-im/im-media-send-kit","revision":"d5f0e3e5d65886c0ad9654f4ef30468a0e7b089f","nativeMinimumRunner":"macos-latest","scope":"SHARED_EXTERNAL_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-21T09:15:49Z","qualificationState":"CANCELLED_SCOPE_UNRESOLVED","qualifiedReceipt":false},{"ordinal":4,"repository":"reits/im-ui","revision":"ebee6f3a4e9747c90f1d5c6a8d4b892220ac2a0d","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 1m25s","rawGateObservedAt":"2026-07-20T20:29:23Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":5,"repository":"reits/matrix-quant-im-ios","revision":"e4813fd23765df41b56efd23e61750738c6dd420","nativeMinimumRunner":"macos-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 8s","rawGateObservedAt":"2026-07-23T19:02:15Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":6,"repository":"reits/matrix-x-chat-ios","revision":"ad40fafbc804a5aa3dbb5298d2d9b66a735e6bba","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:50Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":7,"repository":"reits/matrixantai-backtest","revision":"6257ce04cb4612502a3e1ce8cc1bd1d479a7e5f7","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 5s","rawGateObservedAt":"2026-07-20T20:19:08Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":8,"repository":"reits/matrixantai-sim","revision":"b238cb6b2c6de5a33006622287386242225abde0","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 7s","rawGateObservedAt":"2026-07-20T20:19:00Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":9,"repository":"reits/miniapp-open-platform","revision":"41d67048b745fe224dac673268d8b712d2ef2a4f","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 5s","rawGateObservedAt":"2026-07-23T11:51:45Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":10,"repository":"reits/opensdk","revision":"40d9219d607c60482c1ab11c4951296d29b22f22","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-21T09:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":11,"repository":"reits/public-booking-platform","revision":"6a38c3df682ea225d296ec9ec50a1407f26ac7d8","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:50Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":12,"repository":"reits/quant-platform","revision":"cbb20515d59db8a456da8c2030b0c4090051195a","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 6s","rawGateObservedAt":"2026-07-23T17:14:48Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":13,"repository":"reits/reits-auth","revision":"ca7694128287621adcbf1637fbaf720831d42624","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":14,"repository":"reits/reits-bbs","revision":"9c6b70599b66b526c341ef90d4aa53c4e77e8774","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":15,"repository":"reits/reits-info-portal","revision":"6d175fbdedf8c1c156d63aec8b7b6f829f5b794a","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-23T15:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":16,"repository":"reits/reits-knowledge","revision":"7577d3d64699fccc1316a9345ae2ffa097e1be4c","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 6s","rawGateObservedAt":"2026-07-23T19:40:02Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false},{"ordinal":17,"repository":"reits/reits-media","revision":"4e76349c14e155a55d059bdb2bff0c2d8c886a7e","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"failure","rawGateDescription":"Has been cancelled","rawGateObservedAt":"2026-07-21T09:15:49Z","qualificationState":"CANCELLED_NO_ELIGIBLE_ORGANIZATION_LANE","qualifiedReceipt":false},{"ordinal":18,"repository":"reits/trading-data-source","revision":"70b8242facafe95773cfc6f2ce108bfa5bdcdf04","nativeMinimumRunner":"ubuntu-latest","scope":"REITS_ORGANIZATION","rawGateStatus":"success","rawGateDescription":"Successful in 7s","rawGateObservedAt":"2026-07-20T20:18:34Z","qualificationState":"SUCCESS_RUNNER_IDENTITY_NOT_QUALIFIED","qualifiedReceipt":false}],"adversarialProbes":[{"id":"P01","title":"Runner credential unreadable","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P02","title":"Host Docker socket absent","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P03","title":"IMDS and task credentials unreachable","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P04","title":"Production network unreachable","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P05","title":"Direct and unlisted egress denied","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P06","title":"Cloud authority absent","target":"DENY","observed":"NOT_RUN","receipt":false},{"id":"P07","title":"Previous job residue absent on replacement","target":"PASS","observed":"NOT_RUN","receipt":false}],"acceptanceContract":{"requiredExactGateReceipts":18,"observedExactGateReceipts":0,"requiredQualifiedRunnerIdentities":2,"observedQualifiedRunnerIdentities":0,"requiredAdversarialProbeReceipts":7,"observedAdversarialProbeReceipts":0,"requiredRetirementReplacementReceipts":2,"observedRetirementReplacementReceipts":0,"requiredSignatureRoles":["PLATFORM_SRE","SECURITY","QA"],"observedSignatures":0,"maximumReceiptAgeHours":24,"exactPlanDigestRequired":true,"rawCiSuccessIsQualification":false,"allConditionsRequired":true},"controls":[{"id":"Q01","title":"Exact 18-repository revision binding","state":"IMPLEMENTED","mechanism":"Every gate receipt must match the owner, repository, revision and gate context in the immutable plan."},{"id":"Q02","title":"Runner identity provenance","state":"IMPLEMENTED_PENDING_LIVE_EVIDENCE","mechanism":"A green CI status is rejected unless it binds the job to an admitted ephemeral runner and instance."},{"id":"Q03","title":"Seven hostile probes","state":"IMPLEMENTED_PENDING_EXECUTION","mechanism":"Credential, socket, metadata, production route, egress, cloud authority and residue boundaries all need operator-trusted receipts."},{"id":"Q04","title":"One job, one machine","state":"IMPLEMENTED_PENDING_REPLACEMENT","mechanism":"Two old-to-new instance transitions must prove retirement, local destruction and clean replacement."},{"id":"Q05","title":"17 + 1 scope partition","state":"FAIL_CLOSED_OWNER_DECISION_REQUIRED","mechanism":"The current reits organization token cannot authorize jx-im/im-media-send-kit; the verifier refuses 18/18 until its scope is resolved."},{"id":"Q06","title":"Independent three-role acceptance","state":"IMPLEMENTED_PENDING_KEYS","mechanism":"Platform SRE, Security and QA must sign the same receipt using distinct Ed25519 keys."}],"liveEvidence":{"planVerified":true,"repositoriesFetched":18,"giteaReadOnlyRequests":20,"giteaMutationCalls":0,"awsMutationCalls":0,"paidResourcesCreated":0,"runnerStacksCreated":0,"organizationRunnersOnline":0,"qualificationReceiptsAccepted":0,"scopeResolutionReceipts":0,"d05GateG01Satisfied":false},"invariants":{"rawGateSuccessPromotesG01":false,"repositoryPlanAuthorizesSpend":false,"repositoryPlanAuthorizesGiteaMutation":false,"sharedRepositorySilentlyExcluded":false,"d05Accepted":false,"programAdvanced":false},"sources":[{"label":"Gitea Actions runner isolation documentation","url":"https://docs.gitea.com/usage/actions/act-runner"},{"label":"Gitea Actions execution design","url":"https://docs.gitea.com/usage/actions/design"},{"label":"REITs CI registry","path":"data/ci-registry.json"}],"boundary":"D05-T04 repository engineering is complete, including the exact 18-repository matrix, seven hostile probes, one-job replacement contract, signed receipt verifier and the newly exposed 17+1 scope gap. Live execution is not admitted: T02 is absent, T03 is unsigned, both organizations have zero online organization runners, the shared jx-im repository has no approved lane, qualified receipts remain 0/18, G01 remains false, D05 remains 0/11 and implementation remains 4/36."}