Status: LIVE_CANDIDATE / FAIL_CLOSED / PRODUCTION_NO_GO

This val separates R2 authorization custody from the general continuity relay.

• repository identity SHA-256: 59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23
• control package SHA-256: afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f

• dedicated encrypted controller bearer R2_AUTH_ROOT_TOKEN;
• no raw bearer in source;
• exact binding to action, PR number, base/head SHA, package SHA-256 and evidence SHA-256;
• one-time random token returned only at issuance;
• only token SHA-256 persisted;
• TTL 60–900 seconds;
• duplicate exact request rejection;
• atomic single consumption;
• replay rejection;
• token mismatch rejection;
• binding mismatch rejection;
• expiry/revoke states;
• independent audit hash chain;
• ledger and audit endpoints require the dedicated bearer;
• token hashes are not projected by ledger reads;
• production_go=false invariant.

MERGE_PR is checked at both issuance and consumption.

It remains disabled because:

R2_ALLOW_MERGE_AUTHORIZATION

is intentionally absent.

Val Town evaluation:

01a04b98-76d2-7582-919e-e052f8b1ca26

Result: PASS.

Observed matrix:

• health → 200
• unauthenticated ledger → 401
• invalid repository binding → 400
• MERGE_PR issue while disabled → 423
• MERGE_PR consume while disabled → 423
• TEST_ONLY issue → 201
• wrong one-time token → 403
• exact consume → 200
• replay → 409
• duplicate exact authorize → 409
• ledger → 200
• token-hash leakage → false
• audit → 200
• audit chain valid → true

Test receipt SHA-256:

9c01ae930da60c2c724bcfafe10fc0d77c3f8ac79e510d4e2d6aa4f9a5563e8d

Audit tail SHA-256:

8173af91ee447e9bf0d0aa7a0beb66a88dd5ebf44a5cd4674f45eb769cb59ec9

This service can issue and consume exact fail-closed authorization receipts.

It does not observe GitHub independently, does not hold a GitHub App credential, does not deploy, and cannot grant product production approval.