Status: PASS / CUSTODY_CODE_READY / APP_INSTALLATION_PENDING / PRODUCTION_NO_GO

Implementation: R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE.

The broker implements the GitHub App Manifest flow, AES-256-GCM private-key custody, app-JWT authentication, role-specific JIT installation tokens, exact one-repository scope verification, and a durable audit hash chain.

Hardening added in V1.1:

• exact GitHub App owner/id/slug verification through GET /app;
• exact app permission set: contents:read, pull_requests:write, administration:read (plus implicit metadata:read only);
• zero webhook events;
• installation must belong to the exact owner, be unsuspended, and use repository_selection=selected;
• installation permissions/events must remain exact;
• every minted token is independently checked via GET /installation/repositories and must expose exactly one private repository: fscfede-beep/rumbo-control-queue, repository id 1314199389, owner id 293577326;
• verification tokens are revoked immediately after setup validation;
• role tokens are revoked before returning an error if exact repository scope validation fails;
• role responses carry the broker implementation id for downstream anti-downgrade pinning;
• installation/access tokens are never persisted;
• plaintext PEM is never returned by an HTTP response; only AES-GCM ciphertext is stored.

Selftest evaluation: 01a04be4-8d9f-75ed-925d-5c285c05a08f — PASS.

Selftest covers AES-GCM roundtrip, GitHub App RS256 JWT construction, exact manifest permission set, rejection of extra/upgraded permissions, private app manifest, inactive webhook, endpoint authentication and audit-chain integrity.

Independent static source audit after hardening: PASS across exact app/install/repository scope, revocation behavior, encrypted custody, absence of raw secret literals, no token persistence, implementation-bound token responses and production_go=false.

The broker is intentionally not ready until GitHub completes the authenticated App creation and exact repository installation. No billing or product-production action is performed by this release.