{
  "schemaVersion": 1,
  "reportLocalDate": "2026-10-25",
  "timezone": "Europe/Paris",
  "observedUtc": "2026-10-25T06:23:27.915835+00:00",
  "baselineCommit": "f17dba2ec06ea8f53c2785eaaebd25abc515ebf8",
  "branch": "fix/p9-model-cache-and-ci-qualification",
  "hostedVerdict": "BLOCKED",
  "isolationVerdict": "UNVERIFIED",
  "currentLiveHostConfig": "UNKNOWN; metadata cannot certify effective HostConfig",
  "scope": "Bounded read-only CI API GET metadata and official pinned source retrieval; no runtime logs or host inspection",
  "giteaVersion": {
    "version": "1.26.0"
  },
  "repositoryPermissions": {
    "admin": true,
    "push": true,
    "pull": true
  },
  "httpStatuses": {
    "version": 200,
    "repository": 200,
    "repository-runners": 200,
    "instance-runners": 403,
    "user": 403,
    "runs-latest100": 200,
    "runs-branch-query": 200,
    "jobs-855": 200,
    "jobs-854": 200
  },
  "repositoryRunners": {
    "runners": [
      {
        "id": 3,
        "name": "pi-runner-1",
        "status": "offline",
        "busy": false,
        "disabled": false,
        "ephemeral": false,
        "labels": [
          {
            "id": 0,
            "name": "ubuntu-latest",
            "type": "custom"
          },
          {
            "id": 1,
            "name": "ubuntu-22.04",
            "type": "custom"
          }
        ]
      }
    ],
    "total_count": 1
  },
  "observedLatestRunCount": 50,
  "latestObservedRuns": [
    {
      "id": 855,
      "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
      "head_branch": "main",
      "status": "completed",
      "conclusion": "success",
      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/855",
      "created_at": null,
      "updated_at": null
    },
    {
      "id": 854,
      "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
      "head_branch": "main",
      "status": "completed",
      "conclusion": "success",
      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/854",
      "created_at": null,
      "updated_at": null
    },
    {
      "id": 853,
      "head_sha": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
      "head_branch": "fix/p9-ci-and-requalification",
      "status": "completed",
      "conclusion": "failure",
      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/853",
      "created_at": null,
      "updated_at": null
    },
    {
      "id": 852,
      "head_sha": "7092697cb3e20a5f22e173648fd544de3de6c553",
      "head_branch": "fix/p9-ci-and-requalification",
      "status": "completed",
      "conclusion": "failure",
      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/852",
      "created_at": null,
      "updated_at": null
    },
    {
      "id": 851,
      "head_sha": "5ac11549b2caa27469aa9fb2b5b9ed402471a453",
      "head_branch": "fix/p9-ci-and-requalification",
      "status": "completed",
      "conclusion": "failure",
      "html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/851",
      "created_at": null,
      "updated_at": null
    }
  ],
  "latestAccessibleJobs": [
    {
      "runId": 855,
      "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
      "jobs": [
        {
          "id": 1745,
          "name": "backup",
          "status": "completed",
          "conclusion": "success",
          "runner_id": 5,
          "runner_name": "Live-Runner",
          "started_at": "2026-10-25T01:00:47Z",
          "completed_at": "2026-10-25T01:01:04Z"
        }
      ]
    },
    {
      "runId": 854,
      "head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
      "jobs": [
        {
          "id": 1744,
          "name": "backup",
          "status": "completed",
          "conclusion": "success",
          "runner_id": 5,
          "runner_name": "Live-Runner",
          "started_at": "2026-10-25T00:01:21Z",
          "completed_at": "2026-10-25T00:01:38Z"
        }
      ]
    }
  ],
  "taskBranchQuery": {
    "observedCount": 0,
    "allReturnedRowsMatchRequestedBranch": true,
    "matchingRunIds": [],
    "note": "An empty or ignored query is not proof of all historical branch executions."
  },
  "taskBranchRunsInLatestWindow": [],
  "historicalRuntimeEvidence": {
    "runId": 853,
    "jobId": 1743,
    "sourceCommit": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
    "logSha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134",
    "effectiveHostNetworking": true,
    "effectiveDockerSocketBind": true,
    "privileged": false,
    "guardExitCode": 1,
    "mariaDbExecuted": false,
    "historicalIsolationVerdict": "UNSAFE for the proposed database lane"
  },
  "sourceCapability": {
    "runnerVersionReportedHistorically": "v0.4.1",
    "runnerSourceCommit": "9aafec169b7ebf3d71df2b06780868fb552b435e",
    "actVersion": "v0.261.10",
    "nativePrivateServicesSupportedInPinnedSource": true,
    "installedBinaryMatched": false,
    "sources": [
      {
        "name": "docs",
        "url": "https://docs.gitea.com/1.26/usage/actions/act-runner/",
        "httpStatus": 403,
        "path": ".artifacts/p9-sec-02/ci/sources-20261025/docs.txt",
        "bytes": 17,
        "sha256": "2938e9f1284180959e33ab1718d0793a72ff6e4cdb8108c34dcd14e69446de5c"
      },
      {
        "name": "config",
        "url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml",
        "httpStatus": 200,
        "path": ".artifacts/p9-sec-02/ci/sources-20261025/config.txt",
        "bytes": 7511,
        "sha256": "e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa"
      },
      {
        "name": "runner",
        "url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go",
        "httpStatus": 200,
        "path": ".artifacts/p9-sec-02/ci/sources-20261025/runner.txt",
        "bytes": 9299,
        "sha256": "857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590"
      },
      {
        "name": "engine",
        "url": "https://gitea.com/gitea/act/raw/tag/v0.261.10/pkg/runner/run_context.go",
        "httpStatus": 200,
        "path": ".artifacts/p9-sec-02/ci/sources-20261025/engine.txt",
        "bytes": 36451,
        "sha256": "45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c"
      }
    ]
  },
  "repositoryGuardAssessment": {
    "unconditionalFirstStepFailure": true,
    "taskBranchPushTrigger": false,
    "pullRequestAndManualTriggers": true,
    "runnerPreparationOccursBeforeGuard": true,
    "sharedUbuntuLatestRouting": true,
    "defaultLoopbackAndGeneratedSchemasPreserved": true,
    "sourceManifest": [
      {
        "path": ".gitea/workflows/mariadb-integration.yml",
        "bytes": 1306,
        "sha256": "f7579be39a4b4318567edf98ba8dff0d6991ceae96ae27b917e6847253b1f850"
      },
      {
        "path": "scripts/mariadb-integration.py",
        "bytes": 4570,
        "sha256": "410cede3ca8794de99735a579ac626a34b6a56ee89c6ef63880d692153c7cd97"
      },
      {
        "path": "scripts/test-mariadb-integration.py",
        "bytes": 2938,
        "sha256": "39aa5618724e74b859aceaf814bf08b9ea63a54205452805caa810a302441a80"
      },
      {
        "path": "JobTrackerApi.MariaDb.Tests/MariaDbDatabase.cs",
        "bytes": 6716,
        "sha256": "1375d97093f686f77d511ef6d81ad2d62ecf329aa6e7bf53036cd6e199035e40"
      },
      {
        "path": "docker-compose.database.yml",
        "bytes": 1441,
        "sha256": "bc4f0d19ef913f9e0f92540ed9a817e7bbf00d2f00ae80ed5b1acd43d55ba363"
      },
      {
        "path": ".gitea/workflows/backup.yml",
        "bytes": 1008,
        "sha256": "9a6a7a9d49f88b6d9383a2d688ef64b14c53c451d1669ae6bda642780d291f75"
      },
      {
        "path": ".gitea/workflows/ci-deploy.yml",
        "bytes": 21659,
        "sha256": "713a62a635b1f695c3e70d2484997fb3ce2a616bbaae3885f80c1be821cf98cf"
      },
      {
        "path": ".gitea/workflows/maintenance.yml",
        "bytes": 2343,
        "sha256": "49fac8dde43531338fc713ac2a367ec9ca55379c94fcee44c1957dd861df54f9"
      }
    ]
  },
  "validation": {
    "staticGuardAssertions": "PASS",
    "offlinePythonGuardTests": {
      "passed": 5,
      "failed": 0,
      "scope": "Mocked runner guard tests only; no Docker/service/database access",
      "outputCaveat": "Expected injected cleanup failure17 and setup failure1 are test fixtures, not real service failures"
    }
  },
  "unknowns": [
    "Runner5 host/daemon ownership, installed binary identity, registration scope and current effective configuration",
    "Production workload/credential/mount/egress separation",
    "Job-token/fork/PR trust and secret scopes",
    "Private service runtime, DNS and no published port/socket/host network/privilege",
    "Cross-job/cache isolation and success/failure/cancel/crash recovery"
  ],
  "repositoryImprovementProposal": "Keep execution blocker. Optionally remove the broad pull_request event while isolation is unverified to prevent automatic runner preparation; review provider behavior and dedicated routing before re-enabling. No enabling transport change is justified before operator proof.",
  "rawMetadataEvidence": [
    {
      "httpStatus": 200,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/version.json",
      "bytes": 20,
      "sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e"
    },
    {
      "httpStatus": 200,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/repository.json",
      "bytes": 2315,
      "sha256": "cb29faeadc15e5761db1043edff1c9d810c43ffea38abc5e6cee8d410a20e94d"
    },
    {
      "httpStatus": 200,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/repository-runners.json",
      "bytes": 232,
      "sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45"
    },
    {
      "httpStatus": 403,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/instance-runners.json",
      "bytes": 164,
      "sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1"
    },
    {
      "httpStatus": 403,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/user.json",
      "bytes": 163,
      "sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b"
    },
    {
      "httpStatus": 200,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/runs-latest100.json",
      "bytes": 203780,
      "sha256": "7c2ac0004b093f34f83804a9168f23af17c4036f79ed7ff48bcb30daa7822cf2"
    },
    {
      "httpStatus": 200,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/runs-branch-query.json",
      "bytes": 36,
      "sha256": "c88e581390a4c04eaddaf6dc1bafd07c56d33e594c62ad3498c7313043b39bbf"
    },
    {
      "httpStatus": 200,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/jobs-855.json",
      "bytes": 836,
      "sha256": "8fddbb1014c708d1c088f45c874cffb2f1446d21d3412cda64e18917e94ed5c9"
    },
    {
      "httpStatus": 200,
      "path": ".artifacts/p9-sec-02/ci/metadata-20261025/jobs-854.json",
      "bytes": 836,
      "sha256": "6b7e0849d1eeca72cc264984e00bd4ae2bbb576aa541f7c2e8f26b38e4348b05"
    }
  ],
  "actions": {
    "hostedJobsDispatched": false,
    "newRuntimeLogsDownloaded": false,
    "runnerOrHostChanged": false,
    "workflowChanged": false,
    "dockerSocketAccess": false,
    "secretValuesReadOrRetained": false,
    "productionAccess": false,
    "deployment": false
  },
  "limits": [
    "Latest request limit100 returned50; bounded window, not full history",
    "Branch query0 and no latest-window match do not prove provider filter support or exhaustive absence",
    "Instance runners and user403 despite repository admin/push/pull",
    "Official docs HTTPS request403; capability rests on freshly fetched immutable primary source matching prior hashes",
    "Backup success metadata is not MariaDB execution or isolation evidence"
  ],
  "documentation": "CI_ASSESSMENT.md"
}