Status: LIVE_CANDIDATE / FAIL_CLOSED / PROVIDER_UNBOUND / PRODUCTION_NO_GO

This service creates an independent deployment-control boundary separate from both the continuity relay and the dedicated R2 authorizer.

• controller bearer: encrypted environment variable R2_DEPLOY_ROOT_TOKEN;
• deploy enable gate R2_ALLOW_DEPLOY: absent / false;
• GitHub App provider credential R2_GITHUB_APP_TOKEN: absent;
• provider adapter: NOT_BOUND;
• product production: false.

Every prepared deployment plan binds exactly to:

• repository identity SHA-256;
• PR number;
• base SHA;
• head SHA;
• sealed package SHA-256;
• evidence SHA-256;
• dedicated-authorizer consumption receipt SHA-256.

Exact duplicate plans are rejected.

POST /v1/execute fails closed in this order:

1. plan must exist and remain PREPARED;
2. R2_ALLOW_DEPLOY=true must be explicitly present;
3. a dedicated GitHub App credential must be configured;
4. a provider adapter must be implemented.

At present step 2 fails with HTTP 423. No provider-side mutation can occur.

Val Town evaluation:

01a04b9c-9389-760a-be16-a819d85ebf7f

Result: PASS.

Matrix:

• health → 200;
• unauthenticated ledger → 401;
• invalid binding → 400;
• prepare → 201;
• execute while disabled → 423;
• duplicate prepare → 409;
• cancel → 200;
• execute cancelled plan → 409;
• ledger → 200;
• audit → 200;
• audit chain valid → true.

Test plan request SHA-256:

4fdc1f93766e2b457c58ae02189b6666c075dc8fadef9c6a9afd2e1ee3d4f5c4

The external deployer controller runtime exists and is live fail-closed.

Actual provider deployment remains unresolved because no dedicated GitHub App provider credential or provider adapter is bound. This is intentional and must not be reported as EXTERNAL_DEPLOYER_EXECUTION_LIVE.