Status: PASS / BROKER_WIRED / APP_CUSTODY_PENDING / PRODUCTION_NO_GO

Implementation:

R2_GITHUB_OBSERVER_V1_2_BROKER_JIT

The observer no longer accepts or reads a directly provisioned R2_GITHUB_APP_TOKEN.

The only private-repository access path is now the dedicated GitHub App custody broker:

R2_GITHUB_APP_CUSTODY_BROKER_V1

The observer holds only a role-specific broker bearer in encrypted environment state. For each execution it requests a short-lived installation token scoped to:

• exact repository id 1314199389;
• contents: read;
• pull_requests: read;
• administration: read.

The returned broker contract, repository id, role and permissions are validated before the token is accepted.

The installation token is cached only in process memory until shortly before expiry. It is never inserted into the observer SQLite ledger and is never emitted in receipts, health or audit views.

The broker role bearer is configured, but the broker has not yet completed GitHub App creation and installation.

Therefore:

• broker health is reachable;
• broker_ready=false;
• observer live execution returns HTTP 424;
• no shared/direct GitHub credential fallback exists;
• observer_can_run=false;
• production_go=false.

Evaluation:

01a04bdc-94db-7113-934f-9945f4e697cb

Result: PASS.

Validated:

• health → 200;
• direct GitHub token path retired;
• broker role bearer configured;
• broker reports not ready;
• unauthenticated ledger → 401;
• observe without completed broker custody → 424;
• signed receipt fixture verifies;
• tampered receipt fails verification;
• audit chain passes;
• production_go remains false.

Fixture receipt SHA-256:

b7808664e5a4874c3c81ac76474cfbaa84765863ac95b4b735b2b95c2e4a0628

PASS:

• broker endpoint pinned;
• direct GitHub token environment path absent;
• broker role secret not embedded in source;
• exact observer token permissions checked;
• repository id checked;
• no SQL token persistence path;
• installation token cache is ephemeral;
• observer implementation remains signed into every receipt;
• strict native enforcement proof remains unchanged;
• production_go remains false.

This removes the direct/shared credential architecture from the observer. Live GitHub observation still requires the human-authenticated GitHub App Manifest installation step to complete in the broker.