REITS / ARCHITECTURED05 · G04 · CUT 88
P52 · repository transaction qualified · live execution held

Connect five.
Or connect none.
Leave zero behind.

第三套独立一次性执行票据只允许在隔离 fixture 中按固定顺序暂存五个连接；每一步必须通过健康验证，任何失败都逆序断开、销毁、隔离并归零。生产环境不签票、不连接、不启动 8110。

global cut88 / 10416 cuts left
QA240 / 2402,804 cumulative
qualified24atomic fixture sets
rejected216fail closed
staged496fixture links
rollback496reverse disconnects
partial0committed sets
production0adapter links
01

CURRENT EXTERNAL RED GATE

真实环境事实不因 fixture 内出现五连接而改变。

DENIED HOSTSHARED PRODUCTION PORTAL8100 服务与 Controller 不可共址。dedicated hosts = 0
IDENTITY COLLISIONUID / GID 991 occupiedredis6 与 nginx 已占用预期身份。controller identity = absent
NO RUNTIMEController installation absentmanifest、modules、unit 与 process 均不存在。port 8110 listeners = 0
HARD HOLDNo live execution authority无 durable escrow、执行票据签发器或补偿账本。production tickets = 0
02

CUT 87 CAPABILITY-FREE INTENT INPUT

上游只交付纯数据意图回执；五个 escrow 输出已经销毁，不能继承对象能力。

228 / 228escrow-intent QACut 87 qualified
INTENT ONLYtarget + generation + port setexecution = false
5 DISPOSEDescrow outputsretained = 0
CAPABILITY FREEdigest-only handoffexports = 0
LIVE EXECUTIONnot configuredproduction = 0
03

THREE-AUTHORITY SEPARATION

托管、意图和执行使用三位不同 owner；执行权不能从前两张许可推导。

01

Capability Escrow

构造、托管、释放五个不可调用输出。

team:runtime-capability-escrow
≠
02

Connection Intent

确认目标、generation、port set 与健康一致。

team:security-connection-authority
≠
03

Connection Execution

只签发零或五、一次使用、60 秒执行票据。

team:security-connection-execution-authority
04

23-FIELD EXECUTION TICKET

票据同时绑定 Cut 87 回执、事务、目标、generation、五端口计划与预检快照。

#FieldBindingRuleProduction
05

ONE-TIME EXECUTION NONCE

票据只能从 AVAILABLE 原子进入 CLAIMED，成功消费；所有中途失败都烧毁，禁止重放。

AVAILABLEticket signed, unused
CLAIMINGatomic compare-and-set
CLAIMEDuseOrdinal = 1
STAGINGno visible partial set
CONSUMEDfive committed in fixture
BURNEDany abort path
TERMINALreplay denied forever
06

30-SECOND PRECONNECT HEALTH SNAPSHOT

连接前快照必须来自独立 SRE witness，五端口均无现存连接、无监听、未隔离。

FRESHNESScapturedAt → expiresAt ≤ 30sobserved window = 24s
CONSISTENCYtarget + generation + portSet + planDigestall four bindings exact
WITNESSindependent from three authorization ownersteam:sre-atomic-connection-witness
07

FIVE-PORT FIXED CONNECTION PLAN

可信验证在前、恢复能力早于执行、独立 witness 最后接入；回滚严格反向。

ConnectPortPhaseHealthRollbackProduction
01PACKAGE_VERIFIERTRUST_FIRSTrequired05not configured
02ATOMIC_NONCE_REGISTRYCLAIM_LEDGER_SECONDrequired04not configured
03RECOVERY_JOURNALRECOVERY_BEFORE_EXECUTIONrequired03not configured
04ARGV_EXECUTOREXECUTION_AFTER_RECOVERYrequired02not configured
05INDEPENDENT_WITNESSWITNESS_LASTrequired01not configured
08

ATOMIC TRANSACTION STATE MACHINE

部分连接只存在于不可见 transaction 内；对外唯一允许的提交状态是五连接集合。

OPEN · 0zero visible
STAGED · 1pending health
STAGED · 2pending commit
STAGED · 3pending commit
STAGED · 4pending commit
COMMIT · 5short-lived fixture set
CLOSE · 0terminal cleanup
09

ISOLATED TRANSACTION ENVELOPE

连接行为仅通过显式端口发生，事务对象本身不可导出、不可跨 session 调用。

ATOMICITYZERO_OR_FIVEpartial commit forbidden
EXPECTED5 connectionsexact canonical set
VISIBILITY0 until commitstaged links isolated
PRODUCTIONauthorization = 0fixture envelope only
10

13-FIELD CONNECTION OUTPUT CONTRACT

每个 materialized output 绑定 transaction、目标、ordinal、connector 和 descriptor digest。

11

FIXED-ORDER CONNECT PIPELINE

五个 connector 不允许并发抢跑；前一步健康回执是下一步的必要前置。

01 · VERIFYtrust anchorhealth → pass
02 · NONCEreplay ledgerhealth → pass
03 · JOURNALrecovery pathhealth → pass
04 · EXECUTORargv boundaryhealth → pass
05 · WITNESSindependent proofhealth → pass
12

PER-STEP POST-CONNECT HEALTH

每次暂存连接都核对当前 connectedCount、期望 ordinal、零外部可见连接与 witness owner。

StepExpected stagedObserved fixtureVisible before commitWitnessResult
01110SRE atomic witnessqualified
02220SRE atomic witnessqualified
03330SRE atomic witnessqualified
04440SRE atomic witnessqualified
05550SRE atomic witnessqualified
13

ZERO-OR-FIVE COMMIT FENCE

提交器只接受完整的五端口集合；1–4 个连接永远不能成为可见 connected set。

0

ABORT / TERMINAL

任一校验失败、连接失败或健康失败后，逆序补偿并关闭为零。

  • partial set never visible
  • ticket burned
  • outputs disposed
5

FIXTURE COMMIT

只有五项全部健康时生成 30 秒、不可导出的 connected-set receipt。

  • five exact ports
  • one atomic commit
  • immediate qualified cleanup
14

15-FIELD CONNECTED-SET RECEIPT

回执证明 fixture 内曾完成原子五连接，但不携带调用能力，也不是生产执行证据。

15

SUCCESS PATH · QUALIFY THEN CLEAN

成功不是永久保留连接；完成五连接集合证明后立即逆序断开并销毁五个输出。

VERIFYticket P-256
CLAIMone nonce
OPENvisible 0
CONNECT 1health
CONNECT 2health
CONNECT 3health
CONNECT 4health
CONNECT 5health
COMMITset = 5
DISCONNECT5 → 1
DISPOSEall outputs
CLOSEterminal 0
16

TWELVE FAILURE CUTPOINTS

任何切点都必须抵达零连接、零能力、零生产副作用的确定性终态。

17

REVERSE DISCONNECT LEDGER

连接顺序 1→5，补偿顺序 5→1；恢复日志早于 executor 连接，保证补偿信息已存在。

RollbackPortPriorTerminalExternal writesRetained
01INDEPENDENT_WITNESSCONNECTED_PENDINGDISCONNECTED_ISOLATED0no
02ARGV_EXECUTORCONNECTED_PENDINGDISCONNECTED_ISOLATED0no
03RECOVERY_JOURNALCONNECTED_PENDINGDISCONNECTED_ISOLATED0no
04ATOMIC_NONCE_REGISTRYCONNECTED_PENDINGDISCONNECTED_ISOLATED0no
05PACKAGE_VERIFIERCONNECTED_PENDINGDISCONNECTED_ISOLATED0no
18

QUARANTINE, CLOSE & TICKET SETTLEMENT

失败事务不是简单抛错：先补偿，再隔离事务身份，随后关闭并烧毁票据。

REVERSE496 disconnectsterminal links = 0
DISPOSE550 outputsretained = 0
QUARANTINE108 transactionspartial never committed
CLOSE132 transactionsclosed zero links
SETTLE108 burnedreplay denied
19

24 QUALIFIED ATOMIC TRANSACTIONS

每个合格事务达到相同证据链：1 ticket、5 staged links、5 health checks、1 set commit、5 reverse disconnects、0 terminal links。

24 CONNECTED SETSexactly five ports eachpartial commits = 0
120 SUCCESS LINKSfixture-only staged connectionsproduction links = 0
120 HEALTH RECEIPTSone after each stagevisible precommit = 0
120 CLEAN DISCONNECTSreverse order after qualificationterminal links = 0
20

216 DETERMINISTIC REJECTIONS

六类负向套件覆盖票据、计划、预检、连接、补偿和提交边界。

EXECUTION TICKET · 36owner, scope, atomicity, lifetime
CONNECTION PLAN · 36order, ordinal, connector, digest
PREFLIGHT · 36target, generation, health, expiry
CONNECT & HEALTH · 36fail at every staged step
COMPENSATION · 36reverse, dispose, quarantine, burn
COMMIT FENCE · 36count, visibility, ttl, export, state
21

240-CASE EXECUTABLE QA LAB

按 suite 筛选、搜索并点击用例，核对 peak、commit、terminal 与生产零副作用。

Select a QA case240 / 240 passed · committedPartialSets=0 · terminalConnections=0 · retainedOutputs=0 · productionAdapterConnections=0
22

P52A–H SUBGATES

八个仓库子门全部闭环；live dedicated host 与生产执行仍保持独立红门。

P52A · UPSTREAMCut 87 capability-free receiptBOUND
P52B · EXECUTION AUTHthird independent P-256 ticketBOUND
P52C · PLANfive-port fixed orderBOUND
P52D · HEALTHpreflight + per-step witnessBOUND
P52E · ATOMICITYzero-or-five commit fenceBOUND
P52F · COMPENSATIONreverse + quarantine + closeBOUND
P52G · TERMINALpure-data zero-link receiptBOUND
P52H · LIVE HOLDproduction execution remains zeroREPOSITORY BOUND
23

108 / 113 QUALITY GATES & VISIBLE DEBT

P48、P49、P50、P51、P52 五个 live 门未观测；仓库证明不能替代生产证据。

PLATFORM · DEDICATED HOSTisolated Controller host and identity
RUNTIME · DURABLE ESCROWencrypted non-callable capability custody
SECURITY · LIVE TICKET AUTHORITYthird signing root, revocation and replay registry
RUNTIME · PRODUCTION CONNECTORSfive real adapter connector implementations
SRE · COMPENSATIONdurable reverse disconnect and quarantine ledger
RELEASE · TERMINAL PROOFlive set expiry, rollback and zero-link receipt
CUT 89 / 104 · 16 CUTS REMAIN

CUT 89 HANDOFF — connected-set session lease and invocation firewall

下一刀将定义 fixture connected set 的短期 session lease、调用白名单、per-call budget、超时回收与并发隔离；即使五端口已原子连接，也不能自动获得任意调用权。生产调用与连接继续保持为 0。

01 · SESSION LEASEbounded ttl and generation
02 · INVOCATION ACLexplicit port-method allowlist
03 · CALL BUDGETcount, time and concurrency caps
04 · EXPIRY CLEANUPrevoke, disconnect and terminal proof
25

API & COLLABORATION CONTRACT

开发者、AI 与 CI 使用同一 API、Schema、策略、候选实现和验证器，不从 UI 截图反推系统事实。

SurfaceCanonical pathUse
Machine API/api/runner-controller/d05-g04-atomic-five-port-connection-transaction-admissionruntime evidence
JSON Schema/schemas/runner-controller-d05-g04-atomic-five-port-connection-transaction-admission.v1.schema.jsonconsumer validation
Candidateops/runner-factory/controller-production-adapter-atomic-five-port-connection-transaction-candidate.mjsqualification logic
Verifierscripts/verify-runner-controller-production-adapter-atomic-five-port-connection-transaction-candidate.mjs240 cases
Architecture docdocs/ui-blueprint/181-d05-g04-atomic-five-port-connection-transaction-admission.mdteam handoff