Status: IMPLEMENTED / AUDITED / FAIL_CLOSED / PRODUCTION_NO_GO

The R2 authorization chain now has two independent runtime boundaries:

1. sebas1/rumbo-r2-authorizer — DEDICATED_R2_AUTHORIZER_V2_SIGNED_RECEIPTS
2. sebas1/rumbo-r2-deployer — R2_DEPLOYER_CONTROLLER_V2_SIGNED_AUTHORIZATION

V1 deployer planning accepted a caller-provided authorizer receipt SHA-256 without cryptographically proving that the dedicated authorizer had created that receipt.

V2 removes that trust shortcut.

The authorizer signs the exact canonical consumed receipt with ES256. The deployer pins the public key and independently verifies both the receipt digest and signature before a plan can exist.

A caller cannot elevate TEST_ONLY to MERGE_PR, change repository/PR/base/head/package or evidence bindings, or substitute an unsigned V1 receipt without failing admission.

Even a valid signed TEST_ONLY receipt is non-executable.

An executable path would require all of:

• signed MERGE_PR authorization;
• merge_authorized=true;
• receipt no older than 900 seconds;
• deploy enable gate explicitly true;
• dedicated GitHub App provider credential;
• bound provider adapter.

None of those activation conditions are currently satisfied. Product production remains NO_GO.

Authorizer post-merge self-test:

01a04bab-c4c2-7639-9ea5-eb05636802b8 — PASS.

Deployer post-merge self-test:

01a04bab-e006-737b-9571-99e6300fdfac — PASS.

Cross-service public-key/package/gate reconciliation: PASS.

This release closes receipt authenticity between the two external control-plane boundaries. It does not close GitHub execution, GitHub App custody, provider execution, native branch enforcement, or the real Codex acceptance gate.