REITS / ARCHITECTURED05 · G04 · CUT 85

P49 · offline qualified · live binding held

Configuration first.
Capability never implied.

把生产适配器的身份、配置引用、健康证据、失败语义和回滚责任做成一个可验签的无密钥配置包。资格验证只产生证据，不产生 module、factory、adapter 或生产连接。

global cut85 / 10419 cuts left

port model5 / 14 / 16ports · groups · calls

QA204 / 2042,120 cumulative

qualified24signed bundles

rejected180before capability

health120signed receipts

P-256494real verifications

effects0 × 6secret · import · connect

CURRENT EXTERNAL RED GATE

Portal 可达不代表它可以解析 Runner ConfigRef；当前 EC2 仍确定性拒绝。

DENY CURRENT EC2

生产 Portal 与专用 Controller 的责任边界不允许合并

production-host marker = PRESENT
Portal listener 8100 = 1
UID 991 = redis6
GID 991 = nginx

source release5ec3420 · Cut 84

qualified dedicated host0

controller identity / manifestABSENT / ABSENT

controller modules / unitABSENT / ABSENT

controller processes0

port 8110 listeners0

SIGNED BUNDLE ANATOMY

十三类顶层字段同时绑定 release、target、generation、rollback、五个端口与签名。

IDENTITYbundleId · releaseIdrc-cut85-{source12}

PROVENANCEsourceRevision · generation40 hex · monotonic ≥ 85

TARGETdedicated non-productionnever shared Portal

FRESHNESSissuedAt · expiresAtmaximum 900 seconds

ROLLBACKprevious + rollback digeststwo independent 64-hex bindings

TRUSTsignerKeyRef · signerOwnerreference only · no key bytes

PORT SETfive ordered descriptorsexact IDs and method sets

SEALECDSA P-256 / SHA-256canonical payload signature

FIVE-PORT CONFIGURATION BOARD

每个端口都有独立 implementation、module digest、ConfigRef、KeyRef、health authority 和 containment policy。

01 · 1 GROUP / 1 CALL

PACKAGE_VERIFIER

packaging trust root

NO_SIDE_EFFECT_ON_UNKNOWN

02 · 4 GROUPS / 4 CALLS

ATOMIC_NONCE_REGISTRY

linearizable nonce store

CAS_READ_AFTER_TIMEOUT

03 · 2 GROUPS / 2 CALLS

RECOVERY_JOURNAL

immutable digest-chain store

READ_CHAIN_TAIL_AFTER_TIMEOUT

04 · 4 GROUPS / 4 CALLS

ARGV_EXECUTOR

root consumer socket

PROBE_INTENT_THEN_COMPENSATE

05 · 3 GROUPS / 5 CALLS

INDEPENDENT_WITNESS

independent read view

READ_ONLY_RETRY_SAFE

METHOD ACCOUNTING

Cut 84 的“14 个方法”实际是 14 个合同方法组；witness 的第三组展开为三个 callable，因此运行时总数是 16。

Port	Method groups	Callable methods	Accounting
PACKAGE_VERIFIER	1	1	verifyAndDecode
ATOMIC_NONCE_REGISTRY	4	4	claim · advance · settle · inspect
RECOVERY_JOURNAL	2	2	append · read
ARGV_EXECUTOR	4	4	invoke · rollback · close · counters
INDEPENDENT_WITNESS	3	5	readback · probe · stoppedState · restoredEmpty · counters

SIGNATURE TRUST CHAIN

bundle signer 与五个 health authority 分离；任何一环不匹配都不能产生端口资格回执。

01SOURCE REVISIONrelease identity → bundle

02BUNDLE P-256 SEALrelease security owner

03MODULE DIGESTimplementation owner

04CONFIGREF DIGESTconfiguration owner

055 × HEALTH SEALindependent reliability owners

06LIVE TRUST ROOTnot resolved · production held

SECRET-FREE SCANNER

配置包只能携带引用和摘要；字段名与值都会被递归扫描。

SCAN PASS

0 secret-like fields

private key bytes: 0
access tokens: 0
password values: 0
embedded credentials: 0
production secret reads: 0

allowed:
 configref://runner-controller/recovery-journal/v85#digest16
 keyref://runner-controller/recovery-journal/v85#digest16
 moduleDigest: sha256: descriptor bytes

forbidden:
- secret / password / accessToken fields
- private-key PEM · cloud access key · inline credential
- resolver output · adapter handle · imported module object

IMPLEMENTATION IDENTITY

实现身份同时绑定模块名和 12 位内容版本；latest、branch 或浮动 tag 均不能进入包。

EXACT

Implementation ID

固定命名空间、固定端口 slug、固定内容版本。

reits-runner-controller/atomic-nonce-registry@9f31ac28b4d0

DENY

Floating identity

latest、main、semver range 或未审计 package 均拒绝。

@latest · @main · ^1.0.0

OWNER

Implementation owner

只对源码与 module digest 负责，不能签健康结果。

team:runner-platform

MODULE DESCRIPTOR — INSPECT, NEVER IMPORT

资格阶段读取的是仓库 descriptor，不执行 import、不构造 factory，也不加载顶层代码。

descriptor {
 implementationId,
 moduleDigest,
 interfaceVersion,
 callableMethods: [ exact ordered set ],
 imported: false,
 factoryConstructed: false
}

120 descriptors qualified
0 dynamic imports · 0 factory constructions · 0 adapter capabilities

CONFIGREF / KEYREF BOUNDARY

引用形状、摘要和 owner 可以在离线阶段验证；真实解析必须等到专用主机的一次性授权。

CONFIGREF

Configuration identity

端口、版本、digest 都进入引用；不携带连接字符串。

configref://runner-controller/{port}/v85#{digest16}

KEYREF

Runtime / health key split

运行时 KeyRef 与 health authority KeyRef 必须不同。

keyref://runner-controller/{port}-health/v85#{digest16}

LIVE HELD

Resolver execution

当前只验证引用，不调用生产 KMS、Secrets Manager、D1、R2 或外部存储。

productionConfigRefsResolved = 0

FIVE INDEPENDENT HEALTH RECEIPTS

每个有效包携带五份独立 P-256 健康回执，绑定相同 bundle generation、implementation、module、ConfigRef 和 method set。

24 / 24PACKAGE_VERIFIER10 offline checksQUALIFIED_OFFLINE

24 / 24NONCE_REGISTRY10 offline checksQUALIFIED_OFFLINE

24 / 24RECOVERY_JOURNAL10 offline checksQUALIFIED_OFFLINE

24 / 24ARGV_EXECUTOR10 offline checksQUALIFIED_OFFLINE

24 / 24WITNESS10 offline checksQUALIFIED_OFFLINE

TIMEOUT BUDGETS

connect、operation 与 qualification 三层预算单调递增且有全局上限。

Connect budget

100–2,000 ms

Operation budget

≤ 10,000 ms

Qualification budget

≤ 30,000 ms

Bundle freshness

≤ 900 seconds

Health freshness

≤ 300 seconds

RETRY / BACKOFF POLICY

重试是端口语义的一部分，不是调用方自行决定；ARGV executor 永远最多一次。

Port	Max attempts	Base backoff	Max backoff	Jitter	Blind retry
PACKAGE_VERIFIER	2	30 ms	275 ms	FULL	NO
ATOMIC_NONCE_REGISTRY	2	35 ms	300 ms	FULL	NO
RECOVERY_JOURNAL	2	40 ms	325 ms	FULL	NO
ARGV_EXECUTOR	1	45 ms	350 ms	FULL	NEVER
INDEPENDENT_WITNESS	2	50 ms	375 ms	FULL	NO

AMBIGUITY SEMANTICS

超时后的下一步由端口类型决定：CAS 读回、chain tail 读回、intent probe 或只读重试。

PACKAGENO_SIDE_EFFECT_ON_UNKNOWN不返回 decode capability。

NONCECAS_READ_AFTER_TIMEOUT读取权威 revision，绝不重新 claim。

JOURNALREAD_CHAIN_TAIL_AFTER_TIMEOUT检查 sequence 与 digest tail。

EXECUTORPROBE_INTENT_THEN_COMPENSATE禁止盲重试写入。

WITNESSREAD_ONLY_RETRY_SAFE只读观察允许有界重试。

FAILURE CONTAINMENT

任何单端口失败都会停止整组晋级；不存在“四个成功、一个缺失”的部分运行时。

PACKAGENO DECODE CAPABILITY验签失败不释放字节。

NONCEBURN OR DENYnonce 永不回到 available。

JOURNALQUARANTINE CHAINbroken digest chain 隔离。

EXECUTORCLOSE + REVERSE关闭 session 并补偿。

WITNESSDENY TERMINAL观察缺口不签终态。

FIVE-OWNER SEPARATION

每个端口的实现、配置、健康、隔离和回滚职责必须由五个不同 owner 承担。

IIMPLEMENTATION

module source + digest

cannot sign health

CCONFIGURATION

ConfigRef + timeout

cannot own module

HHEALTH AUTHORITY

independent P-256 receipt

cannot configure

FCONTAINMENT

isolation + quarantine

cannot promote

RROLLBACK

Cut 84 restore identity

cannot self-approve

CUT 84 ROLLBACK COMPATIBILITY

新配置包必须保留 Cut 84 的三种终态和 prior-state restoration；升级不能改变补偿语义。

Binding	Required value	Qualified ports
compatibleCut84Schema	privileged consumer recovery candidate / v1	5 / 5
previousBundleDigest	exact bundle-level digest	5 / 5
restoresPriorState	true	5 / 5
terminalStates	ROLLED_BACK · RECOVERED · ABORTED_BURNED	5 / 5

STARTUP QUALIFICATION SEQUENCE

十九步全部在 capability 产生前完成；最后输出仍不含 module、factory 或 adapter handle。

24 QUALIFIED BUNDLES

每个有效包完成 1 次 bundle seal、5 次 health seal、5 个 descriptor 检查和 5 组 rollback compatibility。

180 DETERMINISTIC REJECTIONS

五组负向套件分别覆盖 envelope、port、health、policy/rollback 与 capability/effect fence。

36ENVELOPEschema · freshness · signer · signature · cardinality · id

36PORT DESCRIPTORorder · module · ConfigRef · method · implementation · ordinal

36HEALTH RECEIPTseal · status · expiry · checks · owner · digest

36POLICY / ROLLBACKowner · timeout · retry · ambiguity · containment · previous

36EFFECT FENCEmissing key · missing descriptor · digest · import · factory

CAPABILITY-FREE TERMINAL RECEIPT

合格回执证明配置可以进入下一道授权评审，不提供连接或执行能力。

OFFLINE QUALIFIED

CONFIGURATION_BUNDLE

ports / groups / calls: 5 / 14 / 16
health receipts: 5
module descriptors: 5
secret fields: 0
adapter connections: 0
port 8110 calls: 0

receipt {
 bundleDigest, generation, releaseId, sourceRevision,
 portReceipts[5]: {
   implementationId, moduleDigest, configRefDigest,
   healthReceiptDigest, ownerSeparationVerified,
   ambiguitySemantics, failureContainment,
   rollbackCompatible: true
 },
 secretFieldsObserved: 0,
 adapterConnections: 0,
 modulesImported: 0,
 factoriesConstructed: 0
}

P49A–F SUBGATES

六个仓库子门全部闭环；live ConfigRef 解析与 adapter construction 独立保持红色。

P49A · BUNDLE

signed, fresh, secret-free, rollback-bound

BOUND

P49B · PORTS

five ordered implementations and exact methods

BOUND

P49C · HEALTH

five independent signed receipts

BOUND

P49D · POLICY

bounded timeout, retry and ambiguity

BOUND

P49E · OWNERS

five responsibilities and rollback separation

BOUND

P49F · EFFECT FENCE

zero capability and zero production effect

BOUND

204-CASE EXECUTABLE QA LAB

按 suite 筛选或搜索 case；点击后查看确定性结果与零副作用计数。

Select a QA case204 / 204 passed · secrets=0 · imports=0 · factories=0 · adapterConnections=0 · productionHostMutations=0

93 / 95 GATES + VISIBLE DEBT

P48 live root installation 与 P49 live adapter construction 都尚未观测；这两个缺口不能被仓库 fixture 覆盖。

DEDICATED HOST + PERMITPLATFORM / SECURITY

LIVE TRUST ROOT + CONFIGREF RESOLVERSECURITY / PLATFORM

FIVE REVIEWED MODULE ARTIFACTSRUNTIME

ROOT ARGV CONSUMERSECURITY

LIVE HEALTH + CONTAINMENTSRE

TARGET-HOST ROLLBACK RECEIPTRELEASE

CUT 86 / 104 · 19 CUTS REMAIN

CUT 86 HANDOFF — signed ConfigRef resolution and isolated adapter factory transaction

下一刀建立一次性、目标绑定、可撤销的 ConfigRef 解析授权；在隔离 realm 中只构造五个尚未连接的 adapter factory output，并为部分失败提供整组销毁与回滚证据。没有专用主机、live permit 与真实 trust-root 时仍保持 repository-only。

01 · RESOLUTION PERMITone-time · target-bound · expiring

02 · ISOLATED RESOLVERsecret handle, never plaintext projection

03 · FACTORY TRANSACTIONfive outputs · zero connections

04 · GROUP CONTAINMENTall-or-nothing disposal + receipt

Configuration first.Capability never implied.

生产 Portal 与专用 Controller 的责任边界不允许合并

PACKAGE_VERIFIER

ATOMIC_NONCE_REGISTRY

RECOVERY_JOURNAL

ARGV_EXECUTOR

INDEPENDENT_WITNESS

0 secret-like fields

Implementation ID

Floating identity

Implementation owner

Configuration identity

Runtime / health key split

Resolver execution

CONFIGURATION_BUNDLE

CUT 86 HANDOFF — signed ConfigRef resolution and isolated adapter factory transaction

Configuration first.
Capability never implied.