Status: PASS / LIVE_CANDIDATE / MERGE_DISABLED / PRODUCTION_NO_GO

V3 closes the remaining authorization-policy gap between an independently observed GitHub PR snapshot and a future MERGE_PR authorization.

Required observer:

R2_GITHUB_OBSERVER_V1

Observer receipt schema:

rumbo-r2-github-observer-receipt/v1

Pinned observer signing key id:

aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8

Only the observer public P-256 verification key is embedded here. The observer private signing key is not present in the authorizer source.

Legacy V1 MERGE_PR issue and consume paths are retired with HTTP 410.

The new V3 path requires all of the following before a merge authorization can even be issued:

1. global R2_ALLOW_MERGE_AUTHORIZATION=true;
2. exact repository/PR/base/head/package binding;
3. a signed R2_GITHUB_OBSERVER_V1 receipt;
4. observer scope exactly R2_GITHUB_PR_SNAPSHOT_ONLY;
5. observer production_go=false;
6. exact observer repository identity;
7. observer OBSERVATION_PASS with zero blocking checks;
8. native_enforcement.proven=true;
9. merge_ready=true;
10. receipt freshness <= 300 seconds;
11. exact ES256 signature under the pinned observer public key;
12. evidence_sha256 equal to the observer receipt SHA-256.

At consumption, the observer binding must remain identical and its observation age must remain <= 600 seconds.

Thus neither a stale observer result nor a valid result without native branch/ruleset enforcement can authorize merge.

TEST_ONLY remains available through V3 without observer authority.

A TEST_ONLY request carrying an observer merge receipt is rejected, preventing accidental authority mixing.

Successful V3 TEST_ONLY consumption emits a signed authorizer receipt using the existing authorizer ES256 custody key.

The global merge flag remains absent/false.

Therefore MERGE_PR currently fails with HTTP 423 before any merge authority can be issued.

Product production remains false.

Branch evaluation:

01a04bc6-1812-72cf-bbbf-8bf50289ec48

Result: PASS.

Validated matrix:

• health → 200;
• unauthenticated V3 ledger → 401;
• invalid binding → 400;
• legacy V1 merge issue → 410;
• legacy V1 merge consume → 410;
• V3 merge while global gate disabled → 423;
• TEST_ONLY carrying observer receipt → 400;
• V3 TEST_ONLY issue → 201;
• wrong token → 403;
• V3 TEST_ONLY consume → 200;
• signed V3 authorizer receipt verifies → true;
• modified signed receipt verifies → false;
• replay → 409;
• duplicate request → 409;
• V3 ledger → 200;
• token hash exposed by ledger → false;
• audit chain → PASS;
• production_go → false.

Test receipt SHA-256:

ef6e154110336e9322cf089af4de37a0c124986e0df2d041ac7c7d2350cd624b

PASS:

• observer private signing material is absent;
• authorizer private signing material is absent;
• observer public key is pinned;
• observer receipt hash is bound to evidence_sha256;
• native enforcement is mandatory for merge;
• both legacy merge entry points are retired;
• observer freshness limits exist at issue and consume;
• V3 ledger does not project token hashes;
• production_go=false remains pervasive.

This version makes a future merge authorization cryptographically dependent on fresh, independent GitHub observation plus proven native enforcement.

Because native private-repository enforcement is not currently available on the user's plan and the dedicated GitHub App credential is not yet bound, this new merge path cannot become live by accident.