jobtrackingapp/docs/redesign/phase-9/p9-remed-02/ci-isolation.json

{
  "schemaVersion": 1,
  "observedUtc": "2026-10-24T16:58:58.951740+00:00",
  "baselineCommit": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
  "verdict": "BLOCKED",
  "giteaVersion": "1.26.0",
  "apiHttpStatuses": {
    "version": 200,
    "repository": 200,
    "repositoryRunners": 200,
    "instanceRunners": 403,
    "user": 403,
    "runs": 200
  },
  "repositoryPermissions": {
    "admin": true,
    "push": true,
    "pull": true
  },
  "repositoryRunner": {
    "id": 3,
    "name": "pi-runner-1",
    "status": "offline",
    "ephemeral": false
  },
  "actualRun": {
    "id": 853,
    "jobId": 1743,
    "runnerId": 5,
    "runnerName": "Live-Runner",
    "reportedRunnerVersion": "v0.4.1",
    "jobImage": "node:20-bookworm",
    "jobImageObservedDigest": "sha256:8f693eaa7e0a8e71560c9a82b55fd54c2ae920a2ba5d2cde28bac7d1c01c9ba5",
    "mergedHostNetwork": true,
    "mergedDockerSocketBind": true,
    "mergedPrivileged": false,
    "persistentToolcacheMounted": true,
    "guardExitCode": 1,
    "guardUtc": "2026-10-24T16:33:21Z",
    "checkoutAndSdkMainSkipped": true,
    "mariaDbStarted": false,
    "mariaDbTestsExecuted": false,
    "jobContainerRemovalLogged": true,
    "generatedWorkspaceVolumeRemovalAttemptLogged": true,
    "privateServiceLifecycleProven": false
  },
  "unverified": [
    "Host/daemon ownership and production separation",
    "Installed binary source identity and actual effective private service configuration",
    "Repository/instance secret and PR/fork token policies",
    "Persistent cache and cross-job isolation",
    "Success/failure/cancel/crash database-service cleanup"
  ],
  "sourceCapability": {
    "runnerTag": "v0.4.1",
    "runnerCommit": "9aafec169b7ebf3d71df2b06780868fb552b435e",
    "actVersion": "v0.261.10",
    "nativePrivateServicesSupportedInSource": true,
    "installedBinaryMatched": false,
    "freshSourceManifest": [
      {
        "name": "tag",
        "url": "https://gitea.com/api/v1/repos/gitea/runner/git/refs/tags/v0.4.1",
        "sha256": "0f6c54a16c6761e8e5393b68bfd227162f919142a75ba050f0fbbc8de308166b"
      },
      {
        "name": "config",
        "url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml",
        "sha256": "e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa"
      },
      {
        "name": "runner",
        "url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go",
        "sha256": "857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590"
      },
      {
        "name": "engine",
        "url": "https://gitea.com/gitea/act/raw/tag/v0.261.10/pkg/runner/run_context.go",
        "sha256": "45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c"
      }
    ]
  },
  "workflowChanged": false,
  "hostedJobsDispatched": false,
  "runnerChanged": false,
  "productionAccess": false,
  "ciGuardBypass": false,
  "documentation": "CI_ISOLATION.md",
  "rawEvidence": [
    {
      "path": ".artifacts/p9-remed-02/ci/instanceRunners.json",
      "bytes": 164,
      "sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/jobs-853.json",
      "bytes": 1867,
      "sha256": "d3aa3ca89944f436bbae0042b685072cd9f2b7b615eaadf545e9135ded2a6486"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/log-1743.raw",
      "bytes": 10209,
      "sha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/repository.json",
      "bytes": 2315,
      "sha256": "1cc33f21848fb0223e415a5cf5a936467ade9ac9a3f166895ba2332e16282d1d"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/repositoryRunners.json",
      "bytes": 232,
      "sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/runs.json",
      "bytes": 81697,
      "sha256": "baeaf9ec220ef238cc37a9c67ed6902569a764c577104cb3682e5ef2832c99fe"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/sources/manifest.json",
      "bytes": 894,
      "sha256": "ef5b108a2871cb35efed3592801cb2b66eaf73fb5f8075adf4afca768fddf59e"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/inspection.json",
      "bytes": 5324,
      "sha256": "f9850385ba22487bbe942fa34dd334655c32398db1b3ac110ffa5d2d7310e71c"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/instanceRunners.json",
      "bytes": 164,
      "sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/job-1743.log",
      "bytes": 10209,
      "sha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/jobs-853.json",
      "bytes": 1867,
      "sha256": "d3aa3ca89944f436bbae0042b685072cd9f2b7b615eaadf545e9135ded2a6486"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/log-1743.raw",
      "bytes": 10209,
      "sha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/repository.json",
      "bytes": 2315,
      "sha256": "1cc33f21848fb0223e415a5cf5a936467ade9ac9a3f166895ba2332e16282d1d"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/repositoryRunners.json",
      "bytes": 232,
      "sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/runs.json",
      "bytes": 81697,
      "sha256": "baeaf9ec220ef238cc37a9c67ed6902569a764c577104cb3682e5ef2832c99fe"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/user.json",
      "bytes": 163,
      "sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/successor/version.json",
      "bytes": 20,
      "sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/user.json",
      "bytes": 163,
      "sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b"
    },
    {
      "path": ".artifacts/p9-remed-02/ci/version.json",
      "bytes": 20,
      "sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e"
    }
  ],
  "collectorCaveat": "Initial text-log-as-JSON failure retained. Successor convenience mergedHostNetwork:false used a JSON substring against a Go-formatted log; published actualRun reads the merged Go field NetworkMode:host directly."
}