Date: 2026-08-28/29 UTC
Branch: r2-guard-v1
Source file: main.tsx version 23 before this evidence-file commit
Prior main baseline: version 36

R3-GUARD adds a fail-closed external authorization runtime and durable one-time-token ledger for the RUMBO Continuity R2 control package.

It does not grant product production approval, does not deploy the product, does not provide native GitHub branch protection, and does not claim dedicated GitHub App custody.

afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f

Local package evidence retained by the R2 control lane:

• unit tests: 105/105 PASS
• blackbox: 43/43 PASS
• static groups: 9/9 PASS
• manifest entries: 99/99 verified

• dedicated encrypted guard bearer; no bearer value in source;
• exact opaque repository-identity SHA-256 pin;
• exact PR/base/head/package/evidence binding;
• one-time random token, persisted only as SHA-256;
• 60–900 second TTL;
• duplicate exact request rejection;
• atomic single consumption;
• replay rejection;
• exact binding mismatch rejection;
• expiry enforcement;
• guard lifecycle events hash-chained through the existing audit ledger;
• protected ledger/status endpoints;
• token hashes omitted from read APIs;
• production_go=false invariant;
• MERGE_PR blocked at both issuance and consumption unless an explicit runtime gate is enabled.

The merge-enabling environment variable is intentionally absent.

Trace ID:

01a04b54d32f71f6a6603bbca17a4e44

HTTP result: 200.

Checks:

• unauthorized ledger: 401
• merge issuance disabled: 423
• invalid repository binding: 400
• invalid TTL: 400
• TEST_ONLY authorize: 201
• invalid consumer: 400; state remained ISSUED
• TEST_ONLY consume: 200
• replay: 409
• duplicate authorize: 409
• effective expired read: 200 / EXPIRED
• revoke expired authorization: 410 / durable EXPIRED
• MERGE_PR fixture consume while disabled: 423
• merge fixture revoke: 200
• ledger: 200
• token-hash leakage: false

TEST_ONLY consumption receipt SHA-256:

90d2e2fd1691b523e0a0ab182ad2f41dd9a6d8dd6ec2f06d8af19c24a58e82ab

Temporary self-test and housekeeping HTTP routes were removed before release.

• guard routes present: 5
• guard routes with explicit bearer check: 5
• self-test routes present: 0
• raw guard bearer embedded in source: false
• merge-disabled branches present at issuance and consumption: true
• public/authenticated ledger projection includes token SHA-256: false
• production-go false markers retained: true

GET /health returned 200 with:

• implementation revision R3-GUARD
• guard configured: true
• merge authorization enabled: false
• production_go: false

Promotion of this branch means only:

EXTERNAL_AUTHORIZER_LIVE_FAIL_CLOSED
ONE_TIME_TOKEN_LEDGER_LIVE

It does not mean:

GITHUB_OBSERVER_VALIDATED
DEDICATED_GITHUB_APP_CUSTODY
EXTERNAL_DEPLOYER_LIVE
PRODUCT_GO
PRODUCTION_GO