Status: PASS / CREDENTIAL_PENDING / PRODUCTION_NO_GO

Implementation:

R2_GITHUB_OBSERVER_V1_1_NATIVE_REVIEW_HARDENING

V1.1 tightens the native-enforcement proof required for a future merge-capable observer receipt and binds the implementation revision into the signed receipt itself.

Every new observer receipt now signs:

observer_implementation=R2_GITHUB_OBSERVER_V1_1_NATIVE_REVIEW_HARDENING

A downstream authorizer can therefore reject receipts from older implementations even if they share the same receipt schema and signing key.

Classic protection counts as proven only when all are explicit:

• required pull-request reviews are configured;
• required approving-review count is at least 1;
• force pushes are explicitly disabled;
• branch deletion is explicitly disabled.

Missing/null fields no longer count as safe.

A ruleset counts as proven only when it:

• is active;
• targets branches;
• targets main or the default branch;
• contains a pull_request rule;
• requires at least 1 approving review;
• contains non_fast_forward;
• contains deletion.

This closes the earlier weakness where a pull-request + non-fast-forward ruleset could be treated as sufficient while branch deletion or zero required approvals remained possible.

Evaluation:

01a04bca-f946-77ca-a820-0e18424ce7ac

Result: PASS.

• health → 200;
• dedicated GitHub App credential absent → fail-closed;
• unauthenticated ledger → 401;
• live observe without credential → 424;
• signed V1.1 fixture → valid;
• tampered fixture → invalid;
• audit chain → PASS;
• production_go → false.

Fixture SHA-256:

69a2adace45f11c6520507b238d68b0ba748607b0a661f2d1a99cbf0cc0542f6

The stricter native-enforcement verifier is implemented. Live private-repository observation still requires a dedicated read credential. No merge or production authority is created by this service.