Status: PASS / FAIL_CLOSED / APP_CEREMONY_PENDING / PRODUCTION_NO_GO

Implementation: R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT.

V1.2 adds a narrow post-install automation chain. After the owner-authenticated GitHub App creation and exact repository installation callback succeeds, the broker automatically attempts only:

1. the deployer JIT draft-PR preparation endpoint;
2. the external observer exact PR/base/head snapshot;
3. durable storage of the preparation and signed observer receipt summary.

It never calls the authorizer, a merge endpoint, a deploy endpoint, billing, repository visibility or product-production actions.

Two independent service bearers are held only in encrypted environment state. The deployer and observer store only SHA-256 verifiers and accept those credentials only on the JIT preparation and observation endpoints respectively.

Autopilot validates exact downstream implementation revisions, requires deploy disabled, validates the JIT fail-closed response contract, requires a signed ES256 observer receipt, requires invocation_mode=BROKER_AUTOPILOT, and preserves merge_authorized=false, deploy_enabled=false, product_production=NO_GO, production_go=false.

New admin endpoints:

• GET /v1/autopilot/status
• POST /v1/autopilot/retry

Selftest evaluation: 01a04c4c-abe8-77af-b152-b24237c6e7b6 — PASS.

The current pre-install state correctly returns CUSTODY_NOT_READY before any GitHub mutation. Downstream revision readiness is intentionally false until observer V1.5 and deployer V3.6 are promoted.

Static audit confirms no service-token literals in source, no authorizer/merge call, exact one-repository custody, exact permission ceilings, durable receipt-summary audit, and global NO_GO.