REITS / ARCHITECTURED05 · G04 · CUT 86

P50 · isolated qualified · live escrow held

Resolve opaquely.
Construct without connecting.

一次性签名许可把五个 ConfigRef 解析为不可导出的短期句柄，在隔离工厂事务中创建五个真实但未连接的输出；成功和失败都必须逆序销毁，终端回执不携带任何对象能力。

global cut86 / 10418 cuts left

QA216 / 2162,336 cumulative

qualified24transactions

rejected192before capability

resolved300fixture only

outputs212 = 212built = disposed

reverse92abort cleanups

effects0 × 8plain · export · connect

CURRENT EXTERNAL RED GATE

Portal 在线不等于具备 Controller 解析、工厂托管或连接授权。

DENY CURRENT EC2

共享 Portal 不得持有适配器输出能力

production-host marker = PRESENT
8100 listener = 1
UID 991 = redis6 · GID 991 = nginx
Controller unit / 8110 = ABSENT / 0

source release41285c1 · Cut 85

qualified host0

live permit0

production handles0

escrowed outputs0

connections0

ONE-TIME PERMIT ANATOMY

18 个精确字段把签名、目标、bundle、generation、nonce、五端口和四项动作锁成一个不可扩权的许可。

IDENTITY

permitId · transactionId

一次事务一套不可复用身份。

p50-resolution-permit-024

TARGET

targetHostId · targetClass

不能从隔离目标漂移到共享 Portal。

fixture-host://cut86/isolated-host-024

ANCESTRY

bundleDigest · sourceRevision

只消费第 85 刀已资格化的配置束。

generation ≥ 86

ONE USE

nonce · maxUses = 1

claim 后只能 settle 或 burn。

AVAILABLE → CLAIMED → TERMINAL

5 PORTS

portBindings

ConfigRef、implementation 和 module digest 逐端口绑定。

5 exact ordered bindings

4 ACTIONS

least authority

resolve、inspect、construct、dispose；没有 connect。

CONNECT_ADAPTER = absent

P-256 TRUST & FRESHNESS

真实 ECDSA P-256 验签；许可最长 300 秒，并绑定安全授权 owner。

CUT 85 RECEIPTbundle qualifiedeffect-free

PERMIT SEALsecurity authority152 real verifies

TARGET BINDINGisolated host only≤ 300 seconds

ONE-TIME CLAIMatomic useOrdinal=1152 claims

LIVE AUTHORITYnot configuredproduction uses 0

ATOMIC NONCE STATE MACHINE

许可不能回到 AVAILABLE；所有失败都 burn，防止“失败后重放”。

AVAILABLEsignature verifiedno capability

CLAIMEDuseOrdinal = 1single transaction

CONSTRUCTINGfive ports orderedconnections 0

DISPOSINGreverse orderall objects

CONSUMED / BURNEDnever reusableterminal receipt

FIVE CONFIGREF RESOLUTION LANES

每条 lane 只返回绑定 digest 的 opaque handle，不返回字符串、凭证或客户端对象。

Port	Resolver scope	Handle	Exportable
PACKAGE_VERIFIER	PACKAGING_TRUST_ROOT	opaque · expiring	NO
ATOMIC_NONCE_REGISTRY	LINEARIZABLE_NONCE_STORE	opaque · expiring	NO
RECOVERY_JOURNAL	IMMUTABLE_DIGEST_CHAIN	opaque · expiring	NO
ARGV_EXECUTOR	ROOT_CONSUMER_SOCKET	opaque · expiring	NO
INDEPENDENT_WITNESS	INDEPENDENT_READ_VIEW	opaque · expiring	NO

OPAQUE HANDLE CONTRACT

11 个字段只描述身份、作用域、目标和过期时间；明文投影与导出必须显式为 false / 0。

handle {
  handleId: "opaque-handle://cut86/…",
  transactionId, targetHostId, portId, configRefDigest,
  scope: "ISOLATED_FACTORY_CONSTRUCTION_ONLY",
  opaque: true, exportable: false,
  plaintextProjected: false, secretProjectionCount: 0,
  expiresAt: permit.expiresAt
}

ISOLATED FACTORY DESCRIPTORS

descriptor 可以被检查和构造，但必须明确不可连接、无顶层副作用且方法集合精确。

ISOLATED

isolated = true

对象只存在于本次事务范围。

retention after QA = 0

CONSTRUCTABLE

constructable = true

允许创建未连接输出。

212 constructions

UNCONNECTABLE

connectable = false

本许可不包含连接能力。

adapterConnections = 0

ISOLATION REALM BOUNDARY

解析句柄和工厂输出不能穿越事务边界；终端仅投影纯数据 receipt。

PERMIT SCOPEtarget + actions5 minutes

OPAQUE HANDLEnon-exportableplaintext 0

FACTORY INPUTfrozen descriptorno import

OUTPUT OBJECTunconnectednot returned

DATA RECEIPTcapability-freeobject retention 0

UNCONNECTED OUTPUT CONTRACT

14 个精确字段绑定实现、模块、配置摘要、接口和方法集；连接计数、明文计数和能力导出全部为零。

output {
  outputId, transactionId, targetHostId, portId,
  implementationId, moduleDigest, configRefDigest,
  interfaceVersion, methodSetDigest,
  state: "CONSTRUCTED_UNCONNECTED",
  connected: false, connectionCount: 0,
  secretProjectionCount: 0, capabilityExported: false
}

FIVE-PORT ALL-OR-NOTHING TRANSACTION

五条 lane 按固定顺序 resolve → inspect → construct → validate；任一失败都禁止部分晋级。

PACKAGE1 outputunconnected

NONCE1 outputunconnected

JOURNAL1 outputunconnected

ARGV1 outputunconnected

WITNESS1 outputthen dispose all

CONNECTION AUTHORITY FIREWALL

permit actions 不含 connect；descriptor 不可连接；output 不导出；terminal receipt 不返回对象，四层同时阻断连接。

NO ACTION

Permit

CONNECT_ADAPTER 不在签名动作集合。

4 exact actions

NO METHOD

Descriptor

connectable 必须为 false。

topLevelEffects = 0

NO EXPORT

Output & receipt

capabilityExported = false。

retained outputs = 0

SUCCESS PATH DISPOSAL

资格通过也不会保留对象；五个输出从 witness 到 package 逆序销毁，再消费许可。

WITNESSdispose 050 writes

ARGVdispose 040 connections

JOURNALdispose 030 secrets

NONCEdispose 020 capability

PACKAGEdispose 01permit consumed

EIGHT FAILURE CUTPOINTS

从首次解析前到 settlement 前均有显式终态；不存在悬挂对象或重放许可。

REVERSE DISPOSAL PROOF

92 个失败路径输出被逆序销毁；总构造 212 与总销毁 212 精确相等。

BALANCED

212 constructed = 212 disposed

无对象逃逸或遗留。

difference = 0

ABORT

92 reverse disposals

只清理已成功创建的前缀。

LIFO cleanup

TERMINAL

124 burned permits

失败 nonce 永不重用。

ABORTED_NONCE_BURNED

PERMIT SETTLEMENT ACCOUNTING

claim、settlement 和 burn 作为独立计数展示，防止把“函数返回”误认成 durable production receipt。

Counter	Fixture evidence	Required invariant
oneTimePermitClaims	152	useOrdinal = 1
permitSettlements	148	success or abort terminal
permitsBurnedOnAbort	124	never AVAILABLE again
retained outputs	0	all disposed

CAPABILITY-FREE TERMINAL RECEIPT

只返回 digest、计数与五个 disposed descriptor；不返回 handle、module、factory 或 adapter object。

receipt {
  status: "P50_ISOLATED_FACTORY_TRANSACTION_QUALIFIED_OUTPUTS_DISPOSED_NO_CONNECTION",
  permitUses: 1, configRefsResolvedInFixture: 5,
  opaqueHandlesQualified: 5, factoryDescriptorsQualified: 5,
  unconnectedOutputsConstructed: 5, unconnectedOutputsDisposed: 5,
  outputDescriptors: [ DISPOSED_AFTER_QUALIFICATION × 5 ],
  plaintextConfigurationsProjected: 0,
  capabilityExports: 0, adapterConnections: 0
}

24 QUALIFIED TRANSACTIONS

每个事务完成五次解析、五次 descriptor 检查、五次构造、五次销毁和一次许可终态。

192 DETERMINISTIC REJECTIONS

六组负向套件各 32 条，覆盖签名、上游、handle、descriptor、output 和事务 cutpoint。

32PERMITshape · signature · freshness · target

32CUT 85 BINDINGreceipt · port · digest · owner

32OPAQUE HANDLEscope · export · plaintext · expiry

32DESCRIPTORmodule · interface · isolation · effects

32OUTPUTidentity · state · connect · capability

32TRANSACTIONclaim · resolver · factory cutpoints

216-CASE EXECUTABLE QA LAB

筛选、搜索并点击用例，检查其确定性终态和零生产副作用。

Select a QA case216 / 216 passed · plaintext=0 · capabilityExports=0 · adapterConnections=0 · productionWrites=0

P50A–G SUBGATES

七个仓库子门全部闭环；live escrow 和 connection authorization 保持独立红门。

P50A · UPSTREAM

Cut 85 effect-free receipt

BOUND

P50B · PERMIT

signed target-bound one-use

BOUND

P50C · HANDLE

opaque non-exportable expiring

BOUND

P50D · FACTORY

isolated and unconnectable

BOUND

P50E · OUTPUT

real object, zero connection

BOUND

P50F · CLEANUP

reverse dispose and burn

BOUND

P50G · RECEIPT

capability-free projection

BOUND

99 / 102 QUALITY GATES

P48 live root installation、P49 live adapter construction、P50 live escrow/connection 三个门仍未观测。

VISIBLE INTEGRATION DEBT

专用主机、许可、解析器、模块、托管、连接、SRE 和 release 八类责任明确列出。

Dedicated host

PLATFORM · OPEN

Live permit

SECURITY · OPEN

Production resolver

SECURITY · OPEN

Reviewed modules

RUNTIME · OPEN

Capability escrow

RUNTIME · OPEN

Connection authority

SECURITY · OPEN

Live containment

SRE · OPEN

Rollback receipt

RELEASE · OPEN

NO PRODUCTION CONFIGREFresolved = 0

NO ESCROWED OUTPUTretained = 0

NO CONNECTIONadapterConnections = 0

CUT 87 / 104 · 18 CUTS REMAIN

CUT 87 HANDOFF — capability escrow and separate connection authorization

下一刀定义短期能力托管：五个未连接输出进入不可调用 escrow，独立 connection authority 必须验证 target、generation、health、nonce 和全组一致性后才能签发一次性连接意图。仍不执行真实网络连接。

01 · OUTPUT ESCROWopaque · expiring · non-callable

02 · CONNECTION PERMITseparate signer and nonce

03 · FIVE-PORT CONSISTENCYall-or-nothing intent

04 · ZERO-CONNECTION RECEIPTauthorize intent, execute nothing

API & COLLABORATION CONTRACT

人、AI 与 CI 读取同一接口、Schema、策略、候选实现和验证器，不依赖截图推断。

Surface	Canonical path	Use
Machine API	`/api/runner-controller/d05-g04-configref-resolution-isolated-factory-transaction-admission`	runtime evidence
JSON Schema	`/schemas/runner-controller-d05-g04-configref-resolution-isolated-factory-transaction-admission.v1.schema.json`	consumer validation
Candidate	`ops/runner-factory/controller-production-adapter-configref-resolution-isolated-factory-transaction-candidate.mjs`	qualification logic
Verifier	`scripts/verify-runner-controller-production-adapter-configref-resolution-isolated-factory-transaction-candidate.mjs`	216 cases

Resolve opaquely.Construct without connecting.

共享 Portal 不得持有适配器输出能力

permitId · transactionId

targetHostId · targetClass

bundleDigest · sourceRevision

nonce · maxUses = 1

portBindings

least authority

isolated = true

constructable = true

connectable = false

Permit

Descriptor

Output & receipt

212 constructed = 212 disposed

92 reverse disposals

124 burned permits

Dedicated host

Live permit

Production resolver

Reviewed modules

Capability escrow

Connection authority

Live containment

Rollback receipt

CUT 87 HANDOFF — capability escrow and separate connection authorization

Resolve opaquely.
Construct without connecting.