Status: PASS / DEPLOY_DISABLED / CREDENTIAL_PENDING / PRODUCTION_NO_GO

Implementation:

R2_DEPLOYER_CONTROLLER_V3_1_AUTHORIZER_PINNED_REVIEW_PROOF

V3.1 closes two rollback/enforcement gaps found during self-audit.

The deployer now requires:

• receipt schema: rumbo-r2-dedicated-authorizer-consumption/v3.1
• signed field: authorizer_implementation=DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED

A receipt from the prior V3 authorizer is rejected even if it uses the same ES256 signing key. This prevents a stale implementation from bypassing observer revision pinning.

Classic protection counts only if:

• at least one approving review is required;
• force pushes are explicitly disabled;
• deletions are explicitly disabled.

Ruleset protection counts only if:

• active and targeting main/default;
• pull-request rule exists;
• at least one approval is required;
• non-fast-forward rule exists;
• deletion rule exists.

Provider preflight now fetches the PR review set, reduces to the latest review per reviewer, excludes the PR author, and requires the number of current APPROVED reviewers to meet or exceed the live native required-approval count.

Thus configuration alone is no longer enough; the exact PR must have fulfilled review requirements before provider merge.

All earlier exact base/head, current-main equality, native revalidation, exact head SHA merge and post-merge main readback checks remain.

Evaluation:

01a04bcf-4a9f-7714-9aff-290f8b7bbb50

Result: PASS.

Validated:

• authorizer V3.1 signed fixture → valid;
• implementation downgrade/tamper → invalid;
• V2/V1 provider paths → retired 410;
• forged merge receipt → rejected;
• provider preflight without dedicated credential → 424;
• TEST_ONLY execute → 403;
• durable ledger/audit chain → PASS;
• production_go → false.

Fixture receipt SHA-256:

1ac50f804258d37a21d5be84c73317efade62b803edd8913b3f800703b2624a3

Static source audit: PASS.

Actual provider execution remains impossible because deploy enablement and the dedicated GitHub App credential remain absent.