DENIEDCURRENT EXTERNAL RED GATE
仓库和 fixture 证明不能替代专用主机上的真实租约 authority 与生产调用防火墙。
0 leases0 calls0 listenersCUT 88 PURE-DATA INPUT
只接受五端口曾在隔离事务中原子提交、随后全部逆序断开并归零的终态收据。
5 COMMITTEDfixture peak only
→5 DISCONNECTEDreverse order
→5 DISPOSEDno retained output
→0 TERMINALno callable handle
FOUR-AUTHORITY SEPARATION
能力托管、连接意图、连接执行和调用会话四套签名根不能复用 owner、keyRef 或 nonce。
team:runtime-capability-escrowteam:security-connection-authorityteam:security-connection-execution-authorityteam:security-invocation-session-authority28-FIELD SIGNED SESSION LEASE
租约同时绑定 Cut 88 收据、connected set、generation、端口集、连接计划、方法白名单和调用计划。
| # | field | # | field | # | field | # | field |
|---|
20-SECOND LEASE WINDOW
签发、not-before、调用 deadline、主动撤销与过期清理在同一短窗口内；无续租、无隐式宽限。
T+00 · ISSUEP-256 signed
T+00 · CLAIMone-time CAS
T+01–18 · CALLSfive allowlisted
T+19 · REVOKEnew calls denied
T+20 · EXPIREDzero terminal
EXACT FIVE PORT-METHOD ALLOWLIST
没有通配方法、反射调用、动态 method name 或跨端口代理。
HARD CALL-BUDGET ENVELOPE
任一预算超限都在调用前拒绝，已开始的调用不获得追加预算。
20seconds TTL
1lease use
5session calls
1active call
500ms / call
4KiBrequest max
8KiBresponse max
SEVEN-STATE SESSION MACHINE
租约从可用到关闭只有单向路径，失败只能进入撤销与隔离分支。
AVAILABLEunclaimed
→CLAIMEDnonce burned
→ACTIVEfirewall only
→DRAININGno new calls
→REVOKEDlease closed
→DISCONNECTEDfive reversed
→CLOSEDzero terminal
14-FIELD NON-EXPORTABLE SESSION ENVELOPE
会话只暴露状态描述，不暴露连接对象、函数、socket、配置值或 secret。
8-FIELD CALL PLAN
每次调用都预绑定 ordinal、callId、port、method、请求摘要、字节数、响应 Schema 和 deadline。
ONE-TIME CALL PERMITS
租约 claim 不直接调用端口；每一调用还需要 session-local、method-bound、一次性 permit。
LEASE CLAIMEDone session only
→CALL PERMIT CAScallId useOrdinal=1
→ACTIVE CALL = 1concurrency fence
→SETTLEDresponse reference released
INVOCATION FIREWALL DECISION PIPELINE
每个调用在进入 connector 前经过八层不可跳过的检查。
exact sessionIdexact generationallowlist hitCAS available≤ expiresAt4KiB / 8KiBactiveCalls=1retained=016-FIELD SEALED RESPONSE RECEIPT
调用结果仅投影为摘要、Schema、大小、耗时和裁决分类；引用在 permit settlement 前释放。
CONCURRENCY = ONE
第二个 active call、并行 fan-out、递归调用和 connector 内转调全部 fail closed。
PASSDENYDENYDENYREPLAY & CROSS-SESSION DENIAL MATRIX
旧 lease、旧 call permit、相邻 generation 和不同 session 的任何组合都不能复用。
LEASE REPLAYnonce already consumed
CALL REPLAYcallId already settled
CROSS SESSIONsessionId mismatch
CROSS GENERATIONgeneration mismatch
METHOD SWAPport pair mismatch
PLAN SWAPdigest mismatch
LATE RESPONSEdeadline exceeded
POST REVOKEnewCallsAllowed=false
SUCCESS PATH STILL REVOKES
五次合法调用完成后不保留 warm session；立即撤销、逆序断开、销毁并关闭。
5 CALLSsealed + settled
→REVOKEnew calls denied
→5→1 DISCONNECTreverse order
→CLOSE ZEROcalls=0, links=0
REVERSE DISCONNECT LEDGER
成功和失败都使用同一固定逆序，避免补偿路径与正常路径发生语义分叉。
| rollback | port | prior | terminal | external writes | retained |
|---|---|---|---|---|---|
| 01 | INDEPENDENT_WITNESS | CONNECTED_SESSION_LOCAL | DISCONNECTED_ISOLATED | 0 | no |
| 02 | ARGV_EXECUTOR | CONNECTED_SESSION_LOCAL | DISCONNECTED_ISOLATED | 0 | no |
| 03 | RECOVERY_JOURNAL | CONNECTED_SESSION_LOCAL | DISCONNECTED_ISOLATED | 0 | no |
| 04 | ATOMIC_NONCE_REGISTRY | CONNECTED_SESSION_LOCAL | DISCONNECTED_ISOLATED | 0 | no |
| 05 | PACKAGE_VERIFIER | CONNECTED_SESSION_LOCAL | DISCONNECTED_ISOLATED | 0 | no |
FAILURE REVOCATION & COMPENSATION
调用失败先结束 active permit，再撤销 lease；不会让未决调用与断开动作竞态。
ABORT CALLactiveCalls → 0
→REVOKE LEASEnew calls → denied
→DISCONNECT + DISPOSEfive outputs
→QUARANTINE + CLOSEzero terminal
14 FAILURE CUTPOINTS
从 lease claim 前到最终 settlement，每个断点都有明确的终态责任。
24 QUALIFIED FIXTURE SESSIONS
每个合法 session 完成五个 allowlisted calls，所有 response reference 在退出前释放。
5 × 24every session5 × 24capability free228 REJECTED OR CONTAINED SESSIONS
授权、方法、预算、重放、调用失败和上游终态六个拒绝面独立覆盖。
252-CASE EXECUTABLE QA LAB
按 suite 筛选、搜索并点击用例，核对调用、并发、撤销、终态与生产零副作用。
Select a QA case
252 / 252 passed · maximumConcurrentCalls=1 · terminalActiveCalls=0 · terminalConnections=0 · retainedResponses=0 · productionAdapterInvocations=0P53A–H SUBGATES
八个仓库子门全部闭环；专用主机、真实租约 authority 与生产调用仍保持独立红门。
BOUNDBOUNDBOUNDBOUNDBOUNDBOUNDBOUNDREPOSITORY BOUND111 / 117 QUALITY GATES & VISIBLE DEBT
P48、P49、P50、P51、P52、P53 六个 live 门未观测；仓库证明不冒充生产事实。
PLATFORMdedicated host
SECURITYlive lease authority
RUNTIMEproduction firewall
SREexpiry + compensation ledger
RELEASElive terminal proof
CUT 90 / 104 · 15 CUTS REMAIN
CUT 90 HANDOFF — invocation batch outcome adjudication and recovery checkpoint
下一刀将把五个 sealed response digests 聚合成一次不可变 batch outcome，执行 witness quorum、成功/重试/终止裁决、恢复检查点和幂等重放边界；仍不持久化 response payload，不提交生产副作用。
01 · BATCH SEALfive response digests
02 · OUTCOME QUORUMruntime + SRE + witness
03 · RECOVERY CHECKPOINTidempotent terminal cursor
04 · ZERO-EFFECT HANDOFFno payload or production commit
| surface | canonical path | use |
|---|---|---|
| Machine API | /api/runner-controller/d05-g04-connected-set-session-lease-invocation-firewall-admission | runtime evidence |
| JSON Schema | /schemas/runner-controller-d05-g04-connected-set-session-lease-invocation-firewall-admission.v1.schema.json | consumer validation |
| Candidate | ops/runner-factory/controller-production-adapter-connected-set-session-lease-invocation-firewall-candidate.mjs | qualification logic |
| Verifier | scripts/verify-runner-controller-production-adapter-connected-set-session-lease-invocation-firewall-candidate.mjs | 252 cases |
| Architecture doc | docs/ui-blueprint/182-d05-g04-connected-set-session-lease-invocation-firewall-admission.md | team handoff |