{
  "schemaVersion": 1,
  "observedUtc": "2026-10-24T06:49:22Z",
  "verdict": "BLOCKED",
  "scope": "Hosted MariaDB runner isolation and qualification only",
  "baselineSha": "549b2cba5a791862ba3f854312ea819a86dc42a0",
  "giteaVersion": "1.26.0",
  "apiPermissions": {
    "repository": {"admin": true, "push": true, "pull": true},
    "userHttpStatus": 403,
    "instanceRunnersHttpStatus": 403
  },
  "repositoryRunner": {"id": 3, "name": "pi-runner-1", "status": "offline", "labels": ["ubuntu-latest", "ubuntu-22.04"], "version": null},
  "baselineRun": {
    "id": 844,
    "jobId": 1734,
    "runnerId": 5,
    "runnerName": "Live-Runner",
    "runnerReportedVersion": "v0.4.1",
    "label": "ubuntu-latest",
    "conclusion": "failure",
    "jobImage": "node:20-bookworm",
    "mergedNetworkMode": "host",
    "mergedDockerSocketMount": true,
    "mergedPrivileged": false,
    "publishedPorts": [],
    "sdkInstalled": "9.0.317",
    "pythonGuardTests": {"passed": 5, "kind": "unit guards; mocked infrastructure"},
    "dockerFailure": "command not found",
    "dockerExitCode": 127,
    "mariaDbIntegrationExecuted": false,
    "integrationArtifactUploaded": false,
    "stepMetadataCaveat": "API marks all steps failure; raw log establishes SDK installation and five passing guard tests"
  },
  "officialSourceResearch": {
    "runnerTag": "v0.4.1",
    "runnerCommit": "9aafec169b7ebf3d71df2b06780868fb552b435e",
    "executionEngine": "gitea.com/gitea/act v0.261.10",
    "installedBinaryMatchedToSource": false,
    "sourceCapability": "Native services with generated network only when configured network is empty; socket suppression requires operator configuration; normal cleanup attempts removal",
    "effectivePrivateNetworkingProven": false,
    "runtimeLifecycleProven": false
  },
  "blockers": [
    "Effective job uses host networking and host Docker socket; daemon ownership and production separation unknown",
    "Actual runner is absent from repository-only runner listing; instance API forbidden",
    "Installed runner build identity and effective private service configuration unverified",
    "Success/failure/cancellation/interruption service cleanup unproven",
    "Current test transport deliberately accepts only loopback; private service transport not implemented or approved"
  ],
  "workflowChange": {
    "addedPushBranch": "fix/p9-ci-and-requalification",
    "originalPushBranchRetained": true,
    "unconditionalIsolationBlockBeforeDocker": true,
    "variableBypass": false,
    "nativeServicesAdded": false,
    "runnerConfigurationChanged": false,
    "deploymentWorkflowsChanged": false,
    "hostedRunStartedByInvestigation": false
  },
  "futureImage": "mariadb:12.2.2@sha256:42a27baaba3e8f3f0159d16381d5a7156661aa91dcc65f663cabb6a6f9503c00",
  "nextAction": "Infrastructure owner supplies dedicated-runner identity, effective private network/socket suppression and complete lifecycle proof; repository owner reviews transport/workflow before enabling execution",
  "rawEvidenceSha256": {
    ".artifacts/mariadb/requal-ci-api.json": "3369a245165a40e20553f633ff7751f14bc8396d0523c379f658adff16f863ac",
    ".artifacts/mariadb/hosted-ci-843.log": "47ba05d12f08eb7a16a5649f71dde18cd582176a2bed818f3e045932ec025891",
    ".artifacts/mariadb/hosted-ci-844.log": "e03d82a3d24329482b9acd66866bdc500244a85af89932691d09f00d881fdaf9",
    ".artifacts/mariadb/act-runner-v0.4.1/go.mod": "9863a6049f423c537b02caf6307c8bb6c7dcfe809fb314193b1856274a160824",
    ".artifacts/mariadb/act-runner-v0.4.1/internal_pkg_config_config.example.yaml": "e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa",
    ".artifacts/mariadb/act-runner-v0.4.1/runner.go": "857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590",
    ".artifacts/mariadb/act-runner-v0.4.1/pkg_runner_run_context.go": "45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c"
  }
}