Status: IMPLEMENTED / SELFTEST_PASS / GITHUB_APP_CREDENTIAL_PENDING / PRODUCTION_NO_GO

Runtime:

sebas1/rumbo-r2-github-observer

Implementation:

R2_GITHUB_OBSERVER_V1

This observer removes the architectural requirement that a diagnostic R2 snapshot must execute on a GitHub-hosted runner. Once a dedicated GitHub App installation token is bound, the observer can read the private repository directly through the GitHub REST API and independently verify the exact PR snapshot.

It does not weaken the historical GitHub Actions observer. The workflow remains pinned in the candidate, but the external observer provides a second execution substrate that is not coupled to the account's exhausted hosted-runner minutes.

Repository:

• full name: fscfede-beep/rumbo-control-queue
• repository id: 1314199389
• owner id: 293577326
• default branch: main

Sealed package SHA-256:

afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f

Static bootstrap Git blob pins:

• observer workflow: 3d5dd465aad367cde5eabfff2ba7033865ceef8b
• expected package: 1260b3516219341c63107dca1cc1b21a1ecb9ba0
• snapshot guard: 752f12df05d0b6b1bc122cbe61a3145458fdd074

A live observation is bound to:

• exact repository identity;
• exact PR number;
• exact base SHA;
• exact head SHA;
• open DRAFT PR state;
• base branch main;
• Git compare proof that head descends from base;
• exact three static blob pins;
• parseable LIVE_STATE.json;
• rumbo-continuity-live-state/v3 dynamic state invariants;
• package SHA-256;
• process prohibitions against direct main mutation and unreviewed merge;
• product NO_GO;
• README package and PRODUCTION_NO_GO markers;
• observed native branch/ruleset enforcement.

Native protection is measured independently from snapshot validity. A receipt may be OBSERVATION_PASS while merge_ready=false if native enforcement is not proven.

Observer receipts use ES256.

Signing key id:

aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8

The private signing JWK is stored only as encrypted Val Town environment state. The public verification JWK is exposed in /health.

Receipts are persisted in a dedicated SQLite ledger and lifecycle creation is anchored in a separate audit hash chain.

Current:

• observer control bearer: configured;
• observer receipt signing key: configured;
• dedicated GitHub App token: not configured;
• observer_can_run=false;
• live observe request without GitHub App token: HTTP 424;
• production_go=false.

No private GitHub credential is present in source.

Evaluation:

01a04bc2-7e75-7109-b401-e5af497fbc30

Result: PASS.

Checks:

• health → 200;
• unauthenticated ledger → 401;
• observe without GitHub App token → 424;
• ES256 fixture signature → valid;
• tampered fixture under same signature → invalid;
• audit → 200;
• audit chain → valid;
• production_go → false.

Fixture receipt SHA-256:

3adf54a665f4bfa4e7975a3bc3a0754135ee3799506bc93619487cd6c5094fa5

Code-level private GitHub observation is implemented.

Live independent observation remains unavailable until a dedicated GitHub App installation credential is placed in R2_GITHUB_APP_TOKEN. This service cannot itself create that GitHub App, change the user's GitHub plan, or bypass GitHub private-repository plan limits.

No merge or product-production authorization is implied.