Status: PASS / BROKER_WIRED / DEPLOY_DISABLED / PRODUCTION_NO_GO

Implementation: R2_DEPLOYER_CONTROLLER_V3_2_BROKER_JIT_AUTHORIZER_PINNED.

Required authorizer: DEDICATED_R2_AUTHORIZER_V3_2_OBSERVER_BROKER_PINNED with signed schema rumbo-r2-dedicated-authorizer-consumption/v3.2.

The direct R2_GITHUB_APP_TOKEN path is retired. Provider access now comes only from R2_GITHUB_APP_CUSTODY_BROKER_V1 through a deployer-scoped role bearer. The returned JIT installation token is accepted only when it is for repository id 1314199389 with exactly contents:read, pull_requests:write, and administration:read; it is held only in process memory until shortly before expiry.

All previous merge gates remain: signed observer-linked authority, live main equals bound base, exact PR head, strict native enforcement, actual independent APPROVED review fulfillment, exact authorized head SHA merge, and post-merge main readback.

Validation evaluation: 01a04be2-0ac5-7071-b4e2-ec49fea504db — PASS.

Fixture authorizer receipt SHA-256: 460004f5b7f44cdaf5e5e3b6e8f7ae4e7fc3f7760fdda6a43e1c55f02488890e.

Static audit: PASS. R2_ALLOW_DEPLOY remains false/absent; broker custody is not yet installed; production_go=false.