Status: PASS / MERGE_DISABLED / PRODUCTION_NO_GO

Implementation:

DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED

V3.1 closes a rollback path found during self-audit.

V3 already required a signed observer receipt, native enforcement and exact evidence_sha256 = observer_receipt_sha256. However, an older observer implementation using the same receipt schema and signing key could still produce a cryptographically valid receipt.

V3.1 requires the signed observer field:

observer_implementation=R2_GITHUB_OBSERVER_V1_1_NATIVE_REVIEW_HARDENING

Any older implementation now fails with OBSERVER_IMPLEMENTATION_MISMATCH.

The authorizer's own consumption receipt is also revision-bound:

• schema: rumbo-r2-dedicated-authorizer-consumption/v3.1;
• signed field: authorizer_implementation=DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED.

This gives downstream deployers an explicit anti-downgrade field instead of relying only on a stable signing key.

Evaluation:

01a04bcc-bdd9-77ec-af9e-641e8d22a43a

Result: PASS.

Receipt SHA-256:

7173d3c8134e1588933e11aa70f066be89ba161c5520a44f31352cd2e1e7d74c

The legacy V1 merge path remains HTTP 410, the global merge flag remains disabled, one-time/replay protections remain active, signatures verify, tampering fails, audit chain passes and production_go=false.

Static audit: PASS.