Status: PASS / FAIL_CLOSED / BROKER_CUSTODY_PENDING / PRODUCTION_NO_GO

Implementation: R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT.

V1.5 adds one narrow service-auth path for the GitHub App broker's post-install autopilot. The observer stores only SHA-256 of that service bearer and accepts it only on POST /v1/observe; ledger, audit and all other administrative endpoints remain root-authenticated.

Every signed observer receipt now records invocation_mode as either ROOT or BROKER_AUTOPILOT. The broker implementation is pinned to R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT.

All V1.4 controls remain: exact repository/PR/base/head binding, Git ancestry, sealed static blob pins, stable-state invariants, GitHub runtime coordinate authority, strict native enforcement, ES256 signed receipts, and production_go=false.

Selftest evaluation: 01a04c4d-ce1b-70f9-981b-f9d5222a2501 — PASS.

Independent static audit: 18/18 PASS, including hashed service-token auth, observe-only service scope, no plaintext service token, direct GitHub-token path retired, strict native enforcement and no merge authority.

The observer remains unable to run a live private-repository observation until dedicated GitHub App custody is installed.