Status: PASS / FAIL_CLOSED / DEPLOY_DISABLED / APP_CUSTODY_PENDING / PRODUCTION_NO_GO

Implementation: R2_DEPLOYER_CONTROLLER_V3_6_BROKER_AUTOPILOT.

V3.6 advances the trust chain to broker R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT and authorizer DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED with receipt schema v3.5.

It adds a narrow hashed service-token path for POST /v3/jit/prepare-activation only. The service bearer cannot call preflight, execute, ledger or other root-only deployment controls. Every successful JIT preparation records invocation_mode and remains DRAFT-only, no direct ref write, no merge, no deploy, exact static pins, main drift abort and signed-observer next gate.

Branch selftest evaluation: 01a04c52-8e4d-756a-af7d-3c52a9a9e7f1 — PASS.

Cross-service service-auth evaluation: 01a04c53-16e5-7272-96e9-83c58fc66fb4 — PASS. The broker service token reached the JIT endpoint and failed only at CUSTODY_NOT_READY; the same token was rejected with 401 by /v3/execute. The observer service token likewise reached /v1/observe and was rejected by /v1/ledger.

Independent static audit: 23/23 PASS covering broker/authorizer pins, v3.5 receipt verification, v3.6 ledger schema, hashed service auth, JIT-only service scope, root-only execution/preflight, DRAFT-only JIT, no ref write, no JIT merge, update-branch, exact pins, main revalidation, strict native/review gates, exact head merge, post-merge readback, deploy gate and global NO_GO.

R2_ALLOW_DEPLOY remains false/absent. production_go=false.