Date: 2026-08-28/29 UTC Branch: r5-pairing-recovery Fork baseline: main version 48 Scope: Codex V4 bootstrap liveness/security hardening only Production: NO_GO

The durable CURRENT requires one real user Codex execution on lane CODEX_REAL_RUNTIME_ACCEPTANCE_V1. R4 already verifies that roundtrip fail-closed. R5 does not change that gate.

Exact challenge remains:

• message id: f7ca12d8-226a-43b9-9fc0-bd9ede8548af
• message SHA-256: 70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979
• checkpoint SHA-256: d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962
• state during validation: PENDING_CODEX_ACK

The R4 pairing route used the fixed real pairing id codex-v4. Once an unconfirmed issuance exceeded its ten-minute expiry, every subsequent valid pairing request returned PAIRING_EXPIRED. No re-issuance path existed, so a lost/abandoned first attempt could permanently block the only real-runtime gate.

Additional hardening findings:

• pairing-code comparison used ordinary string equality even though constantTimeEqual already existed;
• confirmation expiry was checked before a later unconditional UPDATE, leaving a narrow time-of-check/time-of-use race.

Added pairing_state.ts with explicit fail-closed states:

• ISSUE_NEW
• REDELIVER_ACTIVE
• REISSUE_EXPIRED
• ALREADY_CONFIRMED
• INVALID_EXISTING_SESSION

Pair issue now:

• compares the V4 pairing code with constantTimeEqual;
• redelivers an active unconfirmed issuance;
• atomically reissues an expired unconfirmed session using the same fixed pairing id;
• rejects confirmed or malformed state;
• detects issue/reissue races;
• emits CODEX_PAIRING_REISSUED_AFTER_EXPIRY only after a successful atomic reissue.

Pair confirmation now:

• rejects invalid timestamps;
• returns retryable PAIRING_EXPIRED at the expiry boundary;
• atomically confirms only while expires_at is still in the future;
• re-reads after a lost race and returns confirmed-idempotent, expired-retryable, or fail-closed race state.

No real pairing was issued by validation.

Synthetic pairing state + SQLite regression:

• file: r5_pairing_selftest.ts
• branch file version: 8
• evaluation id: 01a04b67-a25c-731b-8fe8-5d21ab141684
• pure state cases: 6 PASS
• expired-session atomic reissue: PASS
• atomic confirmation: PASS
• synthetic fixture cleanup: PASS
• production_pairing_touched: false

Branch HTTP regression:

• file: r5_branch_regression.ts
• branch file version: 12
• evaluation id: 01a04b69-aaae-7148-b28c-0dc5ddd28407
• branch health: R5-PAIRING-RECOVERY / HTTP 200
• acceptance: PENDING_CODEX_ACK
• lane revision: 1
• checkpoint SHA-256 exact: PASS
• audit_chain_ok: true
• production_go: false
• real_codex_runtime: NOT_PROVEN_BY_THIS_TEST

Negative HTTP checks:

• wrong pairing code: HTTP 403 PAIRING_DENIED
• unauthenticated confirmation: HTTP 401

Post-test database check:

• codex-v4 rows: 0
• r5-selftest-expired rows: 0

Thirteen source/runtime invariants passed:

• R5 revision marker present;
• R4 acceptance route preserved;
• exactly one pair-issue route;
• exactly one pair-confirm route;
• no self-test HTTP route;
• constant-time pairing-code comparison present;
• expired reissue is atomic;
• confirmation expiry is atomic;
• reissue event is audited;
• production_go=false invariant retained;
• no literal OpenAI key pattern;
• no literal GitHub token pattern;
• R2_ALLOW_MERGE_AUTHORIZATION environment variable absent.

R5 preserves:

• R4-ACCEPTANCE-GUARD state machine and exact acceptance challenge;
• R3-GUARD external TEST_ONLY authorizer;
• PR #412 as the active TEST_ONLY successor binding;
• merge authorization disabled;
• production NO_GO.

R5_PAIRING_RECOVERY_IMPLEMENTATION = PASS_BRANCH R5_SYNTHETIC_REGRESSION = PASS R5_BRANCH_HTTP_REGRESSION = PASS REAL_CODEX_PAIRING_V4 = NOT_PROVEN REAL_CODEX_ACK = NOT_PROVEN REAL_CODEX_RESPONSE = NOT_PROVEN FINAL_CHATGPT_ACK = NOT_PROVEN FULL_FEDERATED_RUNTIME = NO_GO PRODUCTION = NO_GO

This branch may be merged into the relay because it repairs the bootstrap path without consuming the bootstrap. Merge does not authorize or simulate the real runtime. After merge, health, synthetic pairing regression, acceptance regression, database absence of codex-v4, and audit-chain validity must be rechecked on main.