Status: CANDIDATE_ONLY / PRODUCTION_NO_GO

This is the reconciled successor of PR #392. It preserves the sealed RUMBO_GITHUB_CONTINUITY_GUARD_V4_5_R2_FINAL package while rebasing the work by construction onto a current main snapshot, without force-pushing or rewriting the predecessor branch.

PR #392 was originally based on fd66dc70415c2aefcd654b9f01ce5b3c4d115a7f. During parallel RUMBO work, main advanced by 47 commits to 3f0dd8b81613620fcee05a6d9530bedb107978be.

Rather than rewrite the predecessor history, this successor branch was created directly from that current main commit and the five R2 bootstrap files were materialized again. Successor draft PR #412 now carries this reconciled branch. PR #392 is historical/superseded and must not be merged.

The predecessor TEST_ONLY external receipt 7a73164985f7f19e26fdd755f83387adc1bc2729aa193dbb15330df0c8cf8c15 remains valid only for its exact old PR #392 head and is not transferable.

The repository's own DEPLOYMENT_STATUS.json remains authoritative for broader RUMBO product state:

PRODUCT_PRODUCTION_NO_GO_PUBLIC_WEB_LIVE

A live website, a green external guard, or a future observer result cannot independently promote product production.

Observed limitations remain fail-closed:

• repository is private under the current personal-account plan;
• rulesets API returned 403 requiring a plan upgrade or public repository;
• native main protection is not proven;
• current process rule forbids direct main mutation;
• merge must use a reviewed PR and re-read main immediately before merge.

GitHub's own usage notification confirmed 2,000 / 2,000 included Actions minutes consumed on 2026-08-01, with reset on 2026-09-01. Artifact storage was also reported at the included limit.

Compared failures occur before runner assignment and execute zero steps. Therefore the observer code is not proven faulty; changing it cannot repair runner allocation.

The workflow is hardened to minimize future spend:

• no duplicate push trigger;
• PR paths restricted to the R2 observer surface;
• concurrency cancellation enabled;
• five-minute timeout;
• read-only contents permission;
• pinned Actions;
• no secrets, environments, deployment or status mutation;
• no artifact upload;
• diagnostic receipt goes to the job summary only.

External fail-closed custody is live in:

sebas1/rumbo-continuity-relay

Current HTTP implementation:

R4-ACCEPTANCE-GUARD (main.tsx version 40).

Preserved R3 guard properties:

• dedicated encrypted controller bearer;
• exact repository/PR/base/head/package/evidence binding;
• random one-time token, persisted only as SHA-256;
• 60–900 second TTL;
• duplicate request, replay, mismatch and expiry rejection;
• atomic one-time consumption;
• protected ledger/status reads without token-hash projection;
• audit-chain lifecycle events;
• production_go=false;
• MERGE_PR disabled at both issue and consume because R2_ALLOW_MERGE_AUTHORIZATION is absent.

R4 additionally adds a read-only Codex real-runtime acceptance verifier. Its authenticated self-test passes, audit chain is valid, and the live state is:

PENDING_CODEX_ACK

That means the exact real Codex runtime challenge has not yet been ACKed. It is not permitted to infer a runtime roundtrip.

• ZIP SHA-256: afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f
• same-byte digest: 28b32b07de6847f59d6be20dbc767723551ab8b8f0aa0cab511e3dac366fc52b
• unit tests: 105/105 PASS
• blackbox: 43/43 PASS
• static groups: 9/9 PASS
• manifest: 99/99 verified

The following are still unresolved:

• a working execution substrate for the private GitHub observer;
• external deployer runtime;
• Dedicated GitHub App custody;
• native branch/ruleset enforcement for the private repository;
• real Codex runtime ACK/response/ChatGPT semantic ACK roundtrip.

External authorizer runtime and durable one-time-token custody are live and no longer unresolved, but merge authorization remains deliberately disabled.

If PR #412 is eventually reviewed and merged after all gates are satisfied, installing this bootstrap can mean only:

R2_OBSERVER_INSTALLED

It must never be interpreted as:

PRODUCT_GO, PRODUCTION_GO, DEPLOYED, or MERGE_AUTHORIZED.