Status: PASS / LIVE_CANDIDATE / DEPLOY_DISABLED / CREDENTIAL_PENDING / PRODUCTION_NO_GO

V3 implements the provider adapter that V2 intentionally left unbound.

Implementation:

R2_DEPLOYER_CONTROLLER_V3_GITHUB_REST_ADAPTER

Provider adapter:

GITHUB_REST_2026_03_10_IMPLEMENTED

Required authorizer:

DEDICATED_R2_AUTHORIZER_V3_OBSERVER_GATED

Required receipt:

rumbo-r2-dedicated-authorizer-consumption/v3

The deployer pins the authorizer ES256 public key and independently verifies the full receipt before plan admission.

For MERGE_PR, the signed receipt must contain a non-null observer receipt SHA-256 and that SHA must equal evidence_sha256.

Before any provider mutation, the adapter re-reads GitHub and requires:

• exact repository id 1314199389;
• exact owner id 293577326;
• private repository;
• default branch main;
• exact PR number from signed authorization;
• PR still open;
• PR no longer draft;
• PR base still main;
• PR base SHA exactly equals the signed base;
• PR head SHA exactly equals the signed head;
• compare API proves head descends from base;
• current live main equals the signed base SHA;
• native branch/ruleset enforcement is proven live.

Any mismatch fails closed before merge.

If all gates are satisfied, the adapter uses GitHub's merge endpoint with the exact authorized head SHA and then requires main readback to equal the returned merge SHA.

The execution ledger is marked EXECUTED only after that exact post-merge readback.

This merge is scoped only to installation of the R2 observer bootstrap. The response retains product_production_go=false and production_go=false.

• R2_ALLOW_DEPLOY: false/absent;
• dedicated GitHub App credential: absent;
• provider adapter code: implemented;
• provider mutation: impossible under current gates;
• production_go: false.

Branch evaluation:

01a04bc8-ae80-7681-bb0b-711eb437cef1

Result: PASS.

Matrix:

• health → 200;
• signed authorizer V3 fixture verifies → true;
• modified signed fixture verifies → false;
• unauthenticated V3 ledger → 401;
• V2 endpoint retired → 410;
• V1 endpoint retired → 410;
• tampered receipt admission → 400;
• forged TEST_ONLY→MERGE_PR receipt → 400;
• valid signed TEST_ONLY plan → 201;
• provider preflight without dedicated credential → 424;
• TEST_ONLY execute → 403;
• duplicate plan → 409;
• signature bytes projected by ledger → false;
• audit chain → PASS;
• production_go → false.

Fixture authorizer receipt SHA-256:

25d86f0213156af385df003cf8cb63a30de2ae7191b9442593d881e136ad2b53

PASS:

• authorizer private signing material absent;
• exact repository identity pinned;
• observer-link invariant present for MERGE_PR;
• current-main/base equality revalidated;
• native enforcement revalidated;
• exact authorized head SHA supplied to merge endpoint;
• post-merge main readback required;
• V2 provider path retired;
• signature bytes omitted from ledger projection;
• production-go remains false.

The provider adapter is now implemented. Provider execution is not live because the dedicated GitHub App credential and deploy enable flag remain absent.

No product production authorization is created by this controller.