REITS / ARCHITECTURED05 · G04 · CUT 84
P48 · repository admitted · production held

Privileged consumer,
without invisible authority.

把离线包消费拆成可审计、可替换、可恢复的生产端口。每一次副作用都有前置 intent、原子 nonce、独立 witness 和严格逆序补偿；进程可以崩溃，证据链不能断。

global cut84 / 10420 cuts left
port surfaces514 exact methods
test cases192 / 1921,916 cumulative
real roots4824 happy + 24 crash
filesystem300 × 3write · observe · delete
journal792digest-chained entries
ambiguity108detected + recovered
nonce terminal48 / 48never released
01

CURRENT EXTERNAL RED GATE

线上可达性不等于控制器安装资格。当前共享 Portal 主机继续确定性拒绝。

DENY CURRENT EC2

四条硬冲突，任何一条都足以阻止 root:991 consumer

  • production host marker = PRESENT
  • Portal listener = 8100 / active
  • UID 991 = redis6
  • GID 991 = nginx
controller identityABSENT
root manifestABSENT
six modulesABSENT
systemd unitABSENT
controller process0
port 81100
02

FIVE-PORT TOPOLOGY

特权 consumer 不再拥有“万能对象”；每个端口只有最小方法集与单一责任。

PORT 01 / 1 METHOD

Package verifier

Cut 83 capsule → verified bytes

verifyAndDecode()
PORT 02 / 4 METHODS

Atomic nonce registry

CAS state + permanent replay burn

claim · advance · settle · inspect
PORT 03 / 2 METHODS

Recovery journal

Intent-first immutable chain

append · read
PORT 04 / 4 METHODS

Argv executor

Fixed program, byte stdin, no shell

invoke · rollback · close · counters
PORT 05 / 5 METHODS

Independent witness

Separate view of effects and restore

readback · probe · stoppedState · restoredEmpty · counters
03

PACKAGE VERIFIER

唯一接收 capsule 的端口。输出必须同时绑定 package digest、nonce、8 payload、8 argv 与零生产授权。

INPUT

Opaque Cut 83 capsule

消费者不读取打包机私钥，不接受松散文件，也不重建授权。

packageDigest + nonce + seal + payloads
OUTPUT

One-use decoded capability

真实源字节、路径、mode、digest 与 argv plan 保持同一内容地址。

8 artifacts · 8 operations · reverse plan
FORBIDDEN

No authority upgrade

productionInstallAuthorized 与 livePermitConsumed 必须继续为 false。

hostContacts=0 · hostMutations=0
04

PUBLIC-KEY RESOLVER

私钥永不进入 consumer；key id 解析与 P-256 验签通过可替换边界组合。

resolve(keyId)opaque public key handle96 actual resolutions
verify(payload, seal)ECDSA P-256 / SHA-25696 real verifications
missing keyfail closed / 403never falls back
production bindingNOT CONFIGUREDfixture key only
05

ATOMIC NONCE REGISTRY

防重放从 Cut 83 的进程内 Set 升级为明确的 compare-and-swap 端口契约。

claimABSENT → CLAIMED / rev 1exact package + transaction
advanceCLAIMED → EXECUTINGexpected revision required
settleEXECUTING → TERMINALburned forever
inspectauthoritative recovery statefresh process input
06

NONCE STATE MACHINE

没有任何 recovery 路径回到 AVAILABLE；即使副作用为零，nonce 也以 ABORTED_NONCE_BURNED 结束。

ABSENTatomic claimfirst caller only
CLAIMEDrevision 1no effect window
EXECUTINGrevision 2recovery required
ROLLED_BACKnormal terminalnonce burned
RECOVEREDcrash terminalnonce burned
ABSENT ← TERMINAL：禁止。补偿完成不是允许重放；恢复的是 prior state，不是 nonce 可用性。
07

RECOVERY JOURNAL

副作用前先记录 intent；进程重启后只依赖 registry 与 journal 判定补偿，不依赖内存。

01NONCE_CLAIMEDclaim receipt bound
02EXECUTION_STARTEDCAS revision 2
03INSTALL_INTENTbefore every invoke
04INSTALL_APPLIEDafter receipt only
05READBACKstopped-state proof
06ROLLBACKprior empty proof
07SETTLEMENTterminal nonce
08TERMINALdigest-bound close
08

DIGEST CHAIN

sequence、previousEntryDigest、entryDigest 与 receiptDigest 同时约束顺序、内容和端口回执。

entry[37] {
  sequence: 37,
  stage: "INSTALL_INTENT",
  artifact: { id, targetPath, mode, contentDigest },
  previousEntryDigest: entry[36].entryDigest,
  entryDigest: sha256(canonical(transaction + stage + artifact + previous)),
  receiptDigest: sha256(canonical(fullEntry))
}
DENY sequence gap · reordered entry · wrong transaction · digest mismatch
09

ARGV EXECUTOR

唯一具备写权限的端口只接收 program、argv、stdin bytes 与 artifact descriptor；没有 shell 字符串。

program = /usr/local/libexec/reits-runner-factory/install-stopped-state-artifact
argv    = ["write-atomic", "--target", path, "--mode", mode,
           "--owner", "991:991", "--digest", contentDigest]
stdin   = PAYLOAD_BYTES
shell   = false

300 actual invokes · 300 atomic writes · 300 reverse deletes · 0 shell strings
10

PROGRAM ALLOWLIST

允许的不是“命令模式”，而是逐字段相等的单一操作。

Path

只能是八条固定绝对路径；/tmp、相对路径和反向跳转均拒绝。

Mode

identity 0600、manifest 0640、modules 0440；0777 无法到达 executor。

Owner

仅描述 991:991 目标；仓库候选不 chown、不获得 root，也不伪造所有权证明。

11

INDEPENDENT WITNESS

写端口不能自证成功。读回、模糊路径探测、停止态和 prior-empty 都由独立只读视图确认。

readbacklstat + read + statmode/digest/inode stable
probepresent | absentambiguous outcome recovery
stoppedStateunit=0 socket=0 pid=0process/listener/8110 = 0
restoredEmptyroot entries = 0prior state proof
12

TRANSACTION TIMELINE

十五个可追责步骤从验签走到 terminal；journal 在副作用边界前后形成明确夹层。

13

EIGHT ARTIFACTS

真实源字节、路径、mode 与回滚顺序沿用 Cut 82/83，不在 consumer 端重新解释。

#ArtifactTarget pathModeOwnerHappy writesCrash writes
14

24 COMPLETE RUNS

每次完整端口组合都经过真实 capsule 验签、真实文件写入、独立读回、严格回滚和 terminal nonce burn。

24 / 24 PASS

Complete five-port transaction

192writes
192readbacks
192deletes
504journal entries
REAL CRYPTO

Package verifier composition

48verifier calls
96key resolves
96P-256 verifies
0private keys in consumer
15

EIGHT CRASH CUTPOINTS

每个“写入已经发生、executor receipt 尚未返回”的位置重复三次，覆盖 1–8 个部分写入。

16

AMBIGUOUS-WRITE RECOVERY

fresh consumer 通过 intent 列表逐路径 probe；不把“没有 applied receipt”误判成“没有写入”。

1 · REOPENnew candidate, same durable ports
2 · INSPECTnonce = EXECUTING
3 · REPLAY JOURNALverify sequence + digest chain
4 · PROBE INTENTS108 present writes found
5 · COMPENSATE108 reverse deletes
6 · BURN TERMINALRECOVERED_ROLLED_BACK
17

REVERSE COMPENSATION

补偿顺序严格等于已记录 intent 的倒序；删除后 witness 必须证明根目录恢复为空。

Recovery classRegistryJournal truthActionTerminal
before effectsCLAIMEDno intentsafe rollback + empty proofABORTED_NONCE_BURNED
ambiguous invokeEXECUTINGintent, no appliedprobe + reverse deleteRECOVERED_ROLLED_BACK
known appliedEXECUTINGapplied receiptread + reverse deleteRECOVERED_ROLLED_BACK
replayTERMINALclosed chaindenyUNCHANGED_BURNED
18

TERMINAL RECEIPTS

终态回执不会宣称生产安装；它证明端口事务、恢复与零副作用边界。

VERIFIED

RECOVERED_ROLLED_BACK

nonceBurned
true
priorStateRestored
true
stoppedStateObserved
true
productionInstallAuthorized
false
productionHostMutations
0
receipt {
  transactionId, packageDigest, nonce,
  terminalState, journalEntries, nonceRevision,
  argvInvocations, independentObservations, rollbackDeletes,
  recoveryRequired, ambiguousWritesRecovered,
  nonceBurned: true,
  priorStateRestored: true,
  productionInstallationObserved: false,
  receiptDigest
}
19

STOPPED-STATE FIREWALL

本刀只验证安装事务与恢复，不安装 unit、不启动进程、不打开 listener。

0systemd units
0socket units
0PID files
0root processes
0service starts
0listeners
08110 calls
0host contacts
20

P48A–F SUBGATES

六个仓库子门全部闭环；live P48 仍单独保持红色。

P48A · PACKAGE

package verifier + public-key resolver + one-use decode

BOUND
P48B · NONCE

atomic CAS and terminal burn without release

BOUND
P48C · JOURNAL

intent-first digest chain

BOUND
P48D · EXECUTOR

fixed program and argv-only writes

BOUND
P48E · WITNESS

independent ambiguity and restore proof

BOUND
P48F · RECOVERY

fresh-process compensation at all cutpoints

BOUND
21

192-CASE EXECUTABLE QA LAB

选择 suite 或搜索 case id 查看确定性结果；所有生产效应计数都为零。

Select a QA caseAll 192 deterministic checks passed with productionHostMutations=0.
22

88 / 89 QUALITY GATES

88 个仓库与 sandbox gate 有证据；唯一未满足项是 live P48。

23

VISIBLE INTEGRATION DEBT

候选实现不掩盖生产缺口；每个缺口都有独立 owner 与所需证据。

DEDICATED HOSTTARGET_HOST_QUALIFIER需要可达、签名、非共享的 staging 控制面主机。
LIVE PERMITCHANGE_AUTHORITY需要一次性四方安装许可；当前 0。
PRODUCTION KEY RESOLVERSECURITY REVIEWER当前只有 fixture P-256；生产解析器未配置。
DURABLE NONCE + JOURNALAUDIT OWNER端口契约已验证，持久实现与灾备证据仍缺。
PRIVILEGED CONSUMERINSTALLATION OWNER需要 out-of-band 安装且只暴露固定 argv。
ROOT:991 LIVE RECOVERYPLATFORM SRE共享 EC2 身份冲突；必须在专用机获得现场终态回执。
CUT 85 / 104 · 20 CUTS REMAIN

CUT 85 HANDOFF — production adapter configuration bundle qualification

下一刀不连接生产、不安装 root consumer；先把五端口的 implementation id、module digest、ConfigRef/KeyRef、health receipt、timeout、retry 与 failure semantics 封成签名配置包，证明候选可以从 fixture adapter 平滑替换为生产 adapter。

01 · IMPLEMENTATION IDSfive adapters, exact versions
02 · CONFIGREF / KEYREFreferences only, no secret values
03 · HEALTH RECEIPTSfresh, signed, owner-separated
04 · FAILURE POLICYtimeouts, retries, ambiguity

developer.reits.tech · D05 G04 · Cut 84 evidence workbench · production installation observed = false