[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_214":215,"_216":217},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_17":18,"_38":-7,"_126":-5,"_19":127,"_128":129,"_130":131,"_132":133,"_134":135,"_21":136,"_137":-5,"_138":139,"_140":24,"_141":142,"_143":84,"_144":-5,"_145":-5,"_146":147},"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":24,"_30":-5},"handle","sebas1","name","rumbo-continuity-relay","branchName","r2-guard-v1","path","R3_GUARD_RELEASE.md","project",{"_32":71,"_13":14,"_36":72,"_73":-5,"_74":24,"_75":76,"_77":76,"_78":79,"_80":-5,"_30":67,"_81":82,"_83":84,"_85":-5,"_86":-5,"_87":26,"_40":41,"_88":89,"_90":91,"_92":93,"_94":-5,"_95":96,"_97":96,"_98":99,"_100":99,"_101":99,"_102":96,"_103":96,"_53":104,"_105":106,"_107":108,"_109":24},"file",{"_63":64,"_13":18,"_65":21,"_66":24,"_70":-5},"isDirectory",false,"page",0,"history",[31],"hasNext","userId",{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":-5,"_58":-5,"_59":-5,"_60":61},"id","3639ac93-2f24-486c-82b8-f0be1aa5ba45","branchId","44b6e0bd-ad35-4d1e-a7f3-465da988c49f","createdAt",["D",1787970379299],"version",24,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","parentId","f0f0ee0a-cd58-4d31-9b1b-656807c4e0e6","incomingCommitId","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","mcp","clientLabel","ChatGPT","user",{"_32":67,"_40":41,"_11":12,"_68":69},{"_63":64,"_13":18,"_65":21,"_66":24},"pull","merge","revert","multiple","commits",[62],{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":43,"_44":-5,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":-5,"_58":-5},"fileId","04ce58ec-a351-11f1-9d6e-1607ee4eb77e","fileType","deleted","d3788f19-13c5-4356-87e8-dce639626bb9","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","deletedAtVersion","ea8b2cee-9441-4610-a164-e736539c861b",["D",1787964475423],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Durable GPT-Codex continuity relay","imageUrl","pinnedFileId","01a04afc-c88b-766f-9e89-3c0c81cf30bc","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","ea8b2cee94414610a164e736539c861b","tursoHostname","ea8b2cee94414610a164e736539c861b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789531243171],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_125":69},"org",{"_11":12,"_120":121,"_68":69,"_30":67,"_122":123,"_124":24},"branch",{"_38":39,"_13":16,"_32":35,"_110":71,"_111":112,"_113":114,"_115":76,"_116":71,"_117":41,"_118":14,"_119":12},"isOwned","projectId","forkedBranchId","cdbfe23c-d122-4f18-ad6e-34fdd0cb88da","forkedBranchVersion",37,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_32":71,"_13":14,"_36":209,"_73":-5,"_74":24,"_75":76,"_77":76,"_78":79,"_80":-5,"_30":67,"_81":82,"_83":84,"_85":-5,"_86":-5,"_87":26,"_40":41,"_88":89,"_90":91,"_92":210,"_94":-5,"_95":96,"_97":96,"_98":99,"_100":99,"_101":99,"_102":96,"_103":96,"_53":211,"_105":212,"_107":213,"_109":24},"tree",[174,175,176,177],"files",[174,175,176,177],"counts",{"_162":26,"_163":164,"_165":26,"_166":167,"_168":169},"contents",[],{"_32":155,"_34":35,"_63":64,"_13":18,"_156":157,"_65":21,"_38":26,"_42":-5,"_36":158,"_159":39,"_160":-5,"_17":161},"upstreamProject","upstreamBranch",{"_32":112,"_36":148,"_149":150,"_13":151,"_110":71,"_38":152,"_111":-5,"_113":-5,"_153":154,"_73":-5,"_109":24,"_75":76,"_119":12,"_40":41,"_118":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787964475423],"updatedAt",["D",1788191453959],"main",234,"lockfileKey","1788191454040-esm.town_v_sebas1_rumbo-continuity-relay@234-main","343a71e0-cdf8-4a51-8e36-c7d42785801c","content","# RUMBO Continuity Relay — R3-GUARD Release Evidence\n\nDate: 2026-08-28/29 UTC \nBranch: `r2-guard-v1` \nSource file: `main.tsx` version 23 before this evidence-file commit \nPrior main baseline: version 36\n\n## Scope\n\nR3-GUARD adds a fail-closed external authorization runtime and durable one-time-token ledger for the RUMBO Continuity R2 control package.\n\nIt does **not** grant product production approval, does not deploy the product, does not provide native GitHub branch protection, and does not claim dedicated GitHub App custody.\n\n## Exact package pin\n\n`afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\nLocal package evidence retained by the R2 control lane:\n\n- unit tests: 105/105 PASS\n- blackbox: 43/43 PASS\n- static groups: 9/9 PASS\n- manifest entries: 99/99 verified\n\n## Runtime safety properties\n\n- dedicated encrypted guard bearer; no bearer value in source;\n- exact opaque repository-identity SHA-256 pin;\n- exact PR/base/head/package/evidence binding;\n- one-time random token, persisted only as SHA-256;\n- 60–900 second TTL;\n- duplicate exact request rejection;\n- atomic single consumption;\n- replay rejection;\n- exact binding mismatch rejection;\n- expiry enforcement;\n- guard lifecycle events hash-chained through the existing audit ledger;\n- protected ledger/status endpoints;\n- token hashes omitted from read APIs;\n- `production_go=false` invariant;\n- `MERGE_PR` blocked at both issuance and consumption unless an explicit runtime gate is enabled.\n\nThe merge-enabling environment variable is intentionally absent.\n\n## Live adversarial self-test V2\n\nTrace ID:\n\n`01a04b54d32f71f6a6603bbca17a4e44`\n\nHTTP result: 200.\n\nChecks:\n\n- unauthorized ledger: 401\n- merge issuance disabled: 423\n- invalid repository binding: 400\n- invalid TTL: 400\n- TEST_ONLY authorize: 201\n- invalid consumer: 400; state remained ISSUED\n- TEST_ONLY consume: 200\n- replay: 409\n- duplicate authorize: 409\n- effective expired read: 200 / EXPIRED\n- revoke expired authorization: 410 / durable EXPIRED\n- MERGE_PR fixture consume while disabled: 423\n- merge fixture revoke: 200\n- ledger: 200\n- token-hash leakage: false\n\nTEST_ONLY consumption receipt SHA-256:\n\n`90d2e2fd1691b523e0a0ab182ad2f41dd9a6d8dd6ec2f06d8af19c24a58e82ab`\n\nTemporary self-test and housekeeping HTTP routes were removed before release.\n\n## Final static audit\n\n- guard routes present: 5\n- guard routes with explicit bearer check: 5\n- self-test routes present: 0\n- raw guard bearer embedded in source: false\n- merge-disabled branches present at issuance and consumption: true\n- public/authenticated ledger projection includes token SHA-256: false\n- production-go false markers retained: true\n\n## Post-cleanup live check\n\n`GET /health` returned 200 with:\n\n- implementation revision `R3-GUARD`\n- guard configured: true\n- merge authorization enabled: false\n- production_go: false\n\n## Promotion boundary\n\nPromotion of this branch means only:\n\n`EXTERNAL_AUTHORIZER_LIVE_FAIL_CLOSED` \n`ONE_TIME_TOKEN_LEDGER_LIVE`\n\nIt does not mean:\n\n`GITHUB_OBSERVER_VALIDATED` \n`DEDICATED_GITHUB_APP_CUSTODY` \n`EXTERNAL_DEPLOYER_LIVE` \n`PRODUCT_GO` \n`PRODUCTION_GO`\n",["D",1787970379299],"branchVersion","label",[18],"pulls","branches",26,"forks","envVars",{"_170":172,"_173":26},"connections",{"_170":26,"_171":26},"count","unfilledCount",21,"emptyCount",{"_32":201,"_13":202,"_63":203,"_42":-5,"_34":35,"_159":204,"_182":84,"_36":205,"_38":26,"_65":206,"_156":-5,"_66":24,"_160":-5,"_187":207,"_17":208},{"_32":155,"_13":18,"_63":64,"_42":-5,"_34":35,"_159":39,"_182":84,"_36":198,"_38":26,"_65":21,"_156":157,"_66":24,"_160":-5,"_187":199,"_17":200},{"_32":190,"_13":191,"_63":192,"_42":-5,"_34":35,"_159":172,"_182":84,"_36":193,"_38":194,"_65":21,"_156":195,"_66":24,"_160":-5,"_187":196,"_17":197},{"_32":178,"_13":179,"_63":180,"_42":-5,"_34":35,"_159":181,"_182":84,"_36":183,"_38":184,"_65":185,"_156":186,"_66":24,"_160":-5,"_187":188,"_17":189},"52c4bef8-e547-4e33-94e9-f7b09976d388","main.tsx","01a04b4f-e7ae-75f9-a43d-c0917030143e",23,"latest",["D",1787970357068],20,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst app = new Hono();\nconst LANE_RE = /^[A-Z0-9][A-Z0-9_.:-]{0,95}$/;\nconst MAX_BODY = 256 * 1024;\nconst secretKeyRe = /(password|api[_-]?key|secret|access[_-]?token|refresh[_-]?token|private[_-]?key|authorization|session[_-]?cookie)/i;\nconst tokenPrefixRe = /(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{12,}|xox[baprs]-[A-Za-z0-9-]{10,})/;\nconst SHA256_RE = /^[a-f0-9]{64}$/;\nconst R2_TARGET_REPOSITORY_IDENTITY_SHA256 = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst R2_CONTROL_PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst R2_GUARD_MAX_TTL_SECONDS = 900;\n\nasync function init() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS lane_state (\n lane TEXT PRIMARY KEY,\n revision INTEGER NOT NULL DEFAULT 0,\n checkpoint_sha256 TEXT NOT NULL DEFAULT '',\n updated_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS messages (\n id TEXT PRIMARY KEY,\n actor TEXT NOT NULL CHECK(actor IN ('gpt','codex')),\n recipient TEXT NOT NULL CHECK(recipient IN ('gpt','codex')),\n lane TEXT NOT NULL,\n base_revision INTEGER NOT NULL,\n revision INTEGER NOT NULL,\n payload_json TEXT NOT NULL,\n payload_sha256 TEXT NOT NULL,\n message_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL,\n acked_at TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_messages_inbox ON messages(recipient,lane,acked_at,revision)`,\n `CREATE TABLE IF NOT EXISTS acknowledgements (\n id TEXT PRIMARY KEY,\n actor TEXT NOT NULL CHECK(actor IN ('gpt','codex')),\n target_message_id TEXT NOT NULL UNIQUE,\n target_message_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL,\n FOREIGN KEY(target_message_id) REFERENCES messages(id)\n )`,\n `CREATE TABLE IF NOT EXISTS audit_events (\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n actor TEXT NOT NULL,\n lane TEXT,\n object_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS pairing_events (\n pairing_id TEXT PRIMARY KEY,\n pairing_code_sha256 TEXT NOT NULL,\n consumed_at TEXT NOT NULL,\n client_label TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS pairing_sessions (\n pairing_id TEXT PRIMARY KEY,\n pairing_code_sha256 TEXT NOT NULL,\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n confirmed_at TEXT,\n client_label TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS request_dedup (\n actor TEXT NOT NULL,\n request_id TEXT NOT NULL,\n body_sha256 TEXT NOT NULL,\n message_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n PRIMARY KEY(actor,request_id),\n FOREIGN KEY(message_id) REFERENCES messages(id)\n )`,\n `CREATE TABLE IF NOT EXISTS guard_authorizations (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_guard_status ON guard_authorizations(status,expires_at)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_unique ON audit_events(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_message_accepted_unique ON audit_events(object_id) WHERE event_type='MESSAGE_ACCEPTED'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_message_acked_unique ON audit_events(object_id) WHERE event_type='MESSAGE_ACKED'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_guard_event_unique ON audit_events(event_type,object_id) WHERE event_type LIKE 'GUARD_%'`,\n `CREATE TRIGGER IF NOT EXISTS messages_revision_guard\n BEFORE INSERT ON messages\n BEGIN\n SELECT CASE\n WHEN COALESCE((SELECT revision FROM lane_state WHERE lane=NEW.lane), -1) != NEW.base_revision\n THEN RAISE(ABORT, 'STALE_REVISION')\n END;\n END`,\n `CREATE TRIGGER IF NOT EXISTS messages_revision_advance\n AFTER INSERT ON messages\n BEGIN\n UPDATE lane_state\n SET revision=NEW.revision, updated_at=NEW.created_at\n WHERE lane=NEW.lane AND revision=NEW.base_revision;\n END`\n ]);\n}\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\n\nfunction roleFrom(req: Request): \"gpt\" | \"codex\" | \"admin\" | null {\n const token = bearer(req);\n if (!token) return null;\n if (token === Deno.env.get(\"GPT_TOKEN_V4\")) return \"gpt\";\n if (token === Deno.env.get(\"CODEX_TOKEN_V4\")) return \"codex\";\n if (token === Deno.env.get(\"ADMIN_TOKEN_V4\")) return \"admin\";\n return null;\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n const aa = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < aa.length; i++) diff |= aa[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction guardAuthorized(req: Request): boolean {\n const expected = Deno.env.get(\"R2_GUARD_TOKEN_V1\") || \"\";\n const observed = bearer(req);\n return !!expected && !!observed && constantTimeEqual(expected, observed);\n}\n\nfunction validGitSha(v: unknown): boolean {\n return typeof v === \"string\" && /^[a-f0-9]{40}$/.test(v);\n}\n\nfunction validSha256(v: unknown): v is string {\n return typeof v === \"string\" && SHA256_RE.test(v);\n}\n\nfunction randomOneTimeToken(bytes = 32): string {\n const raw = new Uint8Array(bytes);\n crypto.getRandomValues(raw);\n const binary = Array.from(raw, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\ntype GuardAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype GuardBinding = {\n action: GuardAction;\n repository_identity_sha256: string;\n pr_number: number;\n base_sha: string;\n head_sha: string;\n package_sha256: string;\n evidence_sha256: string;\n};\n\nfunction parseGuardBinding(b: any): GuardBinding | null {\n const action = String(b?.action || \"\") as GuardAction;\n const repository_identity_sha256 = String(b?.repository_identity_sha256 || \"\");\n const pr_number = Number(b?.pr_number);\n const base_sha = String(b?.base_sha || \"\");\n const head_sha = String(b?.head_sha || \"\");\n const package_sha256 = String(b?.package_sha256 || \"\");\n const evidence_sha256 = String(b?.evidence_sha256 || \"\");\n if (action !== \"TEST_ONLY\" && action !== \"MERGE_PR\") return null;\n if (repository_identity_sha256 !== R2_TARGET_REPOSITORY_IDENTITY_SHA256) return null;\n if (!Number.isSafeInteger(pr_number) || pr_number <= 0) return null;\n if (!validGitSha(base_sha) || !validGitSha(head_sha)) return null;\n if (package_sha256 !== R2_CONTROL_PACKAGE_SHA256) return null;\n if (!validSha256(evidence_sha256)) return null;\n return {action,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256};\n}\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\") + \"}\";\n}\nasync function sha(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction hasSecret(v: unknown): boolean {\n if (typeof v === \"string\") return tokenPrefixRe.test(v);\n if (Array.isArray(v)) return v.some(hasSecret);\n if (v && typeof v === \"object\") {\n return Object.entries(v as Record).some(([k,x]) => secretKeyRe.test(k) || hasSecret(x));\n }\n return false;\n}\nasync function bodyJson(c: any) {\n const len = Number(c.req.header(\"content-length\") || \"0\");\n if (len > MAX_BODY) throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt = await c.req.text();\n if (new TextEncoder().encode(txt).length > MAX_BODY) throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt || \"{}\");\n}\nasync function audit(event_type:string, actor:string, lane:string|null, object_id:string|null, object_sha256:string|null) {\n const idempotentEvent = event_type === \"MESSAGE_ACCEPTED\" || event_type === \"MESSAGE_ACKED\" || event_type.startsWith(\"GUARD_\");\n if (idempotentEvent && object_id) {\n const existing = await sqlite.execute({sql:\"SELECT event_sha256 FROM audit_events WHERE event_type=? AND object_id=? LIMIT 1\",args:[event_type,object_id]});\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n for (let attempt=0; attempt<8; attempt++) {\n const last = await sqlite.execute(\"SELECT event_sha256 FROM audit_events ORDER BY seq DESC LIMIT 1\");\n const prev = String(last.rows[0]?.event_sha256 || \"0\".repeat(64));\n const created_at = new Date().toISOString();\n const ev = {event_type,actor,lane,object_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256 = await sha(canonical(ev));\n try {\n await sqlite.execute({sql:`INSERT INTO audit_events(event_type,actor,lane,object_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?,?,?)`,args:[event_type,actor,lane,object_id,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n } catch (e) {\n if (idempotentEvent && object_id) {\n const existing = await sqlite.execute({sql:\"SELECT event_sha256 FROM audit_events WHERE event_type=? AND object_id=? LIMIT 1\",args:[event_type,object_id]});\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\nawait init();\n\napp.get(\"/\", (c) => c.json({service:\"rumbo-continuity-relay\",protocol:\"rumbo-continuity-relay/v1\",implementation_revision:\"R3-GUARD\",status:\"ok\",production_go:false}));\napp.get(\"/health\", (c) => c.json({\n ok:true,\n protocol:\"rumbo-continuity-relay/v1\",\n implementation_revision:\"R3-GUARD\",\n capabilities:[\n \"atomic-stale-guard\",\"request-idempotency\",\"idempotent-ack\",\"audit-chain\",\n \"two-phase-pairing\",\"canonical-v1.6-skill-bootstrap\",\n \"external-r2-authorizer\",\"one-time-token-ledger\",\"exact-pr-binding\",\"fail-closed-merge-gate\"\n ],\n guard:{\n configured:!!Deno.env.get(\"R2_GUARD_TOKEN_V1\"),\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n max_ttl_seconds:R2_GUARD_MAX_TTL_SECONDS\n },\n production_go:false\n}));\n\napp.get(\"/v1/state/:lane\", async (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n const lane = c.req.param(\"lane\"); if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n const st = await sqlite.execute({sql:\"SELECT lane,revision,checkpoint_sha256,updated_at FROM lane_state WHERE lane=?\",args:[lane]});\n const row = st.rows[0] || {lane,revision:0,checkpoint_sha256:\"0\".repeat(64),updated_at:null};\n const pending = await sqlite.execute({sql:\"SELECT recipient,COUNT(*) AS n FROM messages WHERE lane=? AND acked_at IS NULL GROUP BY recipient\",args:[lane]});\n return c.json({state:row,pending:pending.rows});\n});\n\napp.get(\"/v1/inbox\", async (c) => {\n const role = roleFrom(c.req.raw); if (role !== \"gpt\" && role !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n const lane = c.req.query(\"lane\") || \"\"; if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n const rs = await sqlite.execute({sql:`SELECT id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at\n FROM messages WHERE recipient=? AND lane=? AND acked_at IS NULL ORDER BY revision,id LIMIT 100`,args:[role,lane]});\n return c.json({messages:rs.rows.map((r:any)=>({...r,payload:JSON.parse(String(r.payload_json)),payload_json:undefined}))});\n});\n\napp.post(\"/v1/messages\", async (c) => {\n const actor = roleFrom(c.req.raw); if (actor !== \"gpt\" && actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n try {\n const b = await bodyJson(c);\n const lane = String(b.lane||\"\"); if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n const base = Number(b.base_revision); if (!Number.isSafeInteger(base) || base < 0) return c.json({error:\"INVALID_BASE_REVISION\"},400);\n const payload = b.payload ?? {}; if (hasSecret(payload)) return c.json({error:\"SECRET_REJECTED\"},400);\n const requestId = String(b.request_id || \"\").trim();\n if (requestId && !/^[A-Za-z0-9_.:-]{16,128}$/.test(requestId)) return c.json({error:\"INVALID_REQUEST_ID\"},400);\n const requestBodySha256 = await sha(canonical({lane,base_revision:base,payload}));\n if (requestId) {\n const prior = await sqlite.execute({sql:\"SELECT body_sha256,message_id FROM request_dedup WHERE actor=? AND request_id=?\",args:[actor,requestId]});\n if (prior.rows.length) {\n const d:any = prior.rows[0];\n if (String(d.body_sha256)!==requestBodySha256) return c.json({error:\"IDEMPOTENCY_KEY_REUSE_MISMATCH\"},409);\n const m = await sqlite.execute({sql:\"SELECT id,lane,revision,payload_sha256,message_sha256 FROM messages WHERE id=?\",args:[String(d.message_id)]});\n if (!m.rows.length) return c.json({error:\"DEDUP_MESSAGE_MISSING\"},500);\n const row:any = m.rows[0];\n const checkpoint_sha256 = await sha(canonical({lane:String(row.lane),revision:Number(row.revision),message_sha256:String(row.message_sha256)}));\n return c.json({accepted:true,idempotent:true,id:row.id,lane:row.lane,revision:row.revision,payload_sha256:row.payload_sha256,message_sha256:row.message_sha256,checkpoint_sha256},200);\n }\n }\n await sqlite.execute({sql:\"INSERT OR IGNORE INTO lane_state(lane,revision,checkpoint_sha256,updated_at) VALUES(?,0,?,?)\",args:[lane,\"0\".repeat(64),new Date().toISOString()]});\n const st = await sqlite.execute({sql:\"SELECT revision FROM lane_state WHERE lane=?\",args:[lane]});\n const cur = Number(st.rows[0]?.revision ?? 0); if (cur !== base) return c.json({error:\"STALE_REVISION\",expected:cur,observed:base},409);\n const recipient = actor === \"gpt\" ? \"codex\" : \"gpt\";\n const id = crypto.randomUUID(); const revision = base + 1; const created_at = new Date().toISOString();\n const payload_json = canonical(payload); const payload_sha256 = await sha(payload_json);\n const envelope = {protocol:\"rumbo-continuity-relay/v1\",id,actor,recipient,lane,base_revision:base,revision,payload_sha256,created_at};\n const message_sha256 = await sha(canonical(envelope));\n const checkpoint_sha256 = await sha(canonical({lane,revision,message_sha256}));\n const statements:any[] = [\n {sql:`INSERT INTO messages(id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at)\n VALUES(?,?,?,?,?,?,?,?,?,?)`,args:[id,actor,recipient,lane,base,revision,payload_json,payload_sha256,message_sha256,created_at]},\n {sql:\"UPDATE lane_state SET checkpoint_sha256=? WHERE lane=? AND revision=?\",args:[checkpoint_sha256,lane,revision]}\n ];\n if (requestId) statements.push({sql:\"INSERT INTO request_dedup(actor,request_id,body_sha256,message_id,created_at) VALUES(?,?,?,?,?)\",args:[actor,requestId,requestBodySha256,id,created_at]});\n try {\n await sqlite.batch(statements);\n } catch (e) {\n if (requestId) {\n const prior = await sqlite.execute({sql:\"SELECT body_sha256,message_id FROM request_dedup WHERE actor=? AND request_id=?\",args:[actor,requestId]});\n if (prior.rows.length) {\n const d:any = prior.rows[0];\n if (String(d.body_sha256)!==requestBodySha256) return c.json({error:\"IDEMPOTENCY_KEY_REUSE_MISMATCH\"},409);\n const m = await sqlite.execute({sql:\"SELECT id,lane,revision,payload_sha256,message_sha256 FROM messages WHERE id=?\",args:[String(d.message_id)]});\n if (m.rows.length) {\n const row:any=m.rows[0];\n const cp=await sha(canonical({lane:String(row.lane),revision:Number(row.revision),message_sha256:String(row.message_sha256)}));\n return c.json({accepted:true,idempotent:true,id:row.id,lane:row.lane,revision:row.revision,payload_sha256:row.payload_sha256,message_sha256:row.message_sha256,checkpoint_sha256:cp},200);\n }\n }\n }\n if (String(e).includes(\"STALE_REVISION\")) {\n const curState=await sqlite.execute({sql:\"SELECT revision FROM lane_state WHERE lane=?\",args:[lane]});\n return c.json({error:\"STALE_REVISION\",expected:Number(curState.rows[0]?.revision ?? 0),observed:base},409);\n }\n throw e;\n }\n const verify = await sqlite.execute({sql:\"SELECT revision,checkpoint_sha256 FROM lane_state WHERE lane=?\",args:[lane]});\n if (Number(verify.rows[0]?.revision) !== revision || String(verify.rows[0]?.checkpoint_sha256)!==checkpoint_sha256) return c.json({error:\"ATOMIC_ADVANCE_FAILED\"},409);\n await audit(\"MESSAGE_ACCEPTED\",actor,lane,id,message_sha256);\n return c.json({accepted:true,idempotent:false,id,lane,revision,payload_sha256,message_sha256,checkpoint_sha256},201);\n } catch (e) { return c.json({error:String(e?.message||e)},400); }\n});\n\napp.post(\"/v1/acks\", async (c) => {\n const actor = roleFrom(c.req.raw); if (actor !== \"gpt\" && actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n try {\n const b = await bodyJson(c); const id = String(b.message_id||\"\"); const msgSha = String(b.message_sha256||\"\");\n const rs = await sqlite.execute({sql:\"SELECT * FROM messages WHERE id=?\",args:[id]}); const m:any = rs.rows[0];\n if (!m) return c.json({error:\"NOT_FOUND\"},404);\n if (String(m.recipient)!==actor) return c.json({error:\"WRONG_RECIPIENT\"},403);\n if (String(m.message_sha256)!==msgSha) return c.json({error:\"HASH_MISMATCH\"},409);\n const prior = await sqlite.execute({sql:\"SELECT id FROM acknowledgements WHERE target_message_id=?\",args:[id]});\n if (prior.rows.length) return c.json({acked:true,idempotent:true,message_id:id});\n const ackId = crypto.randomUUID(), created_at = new Date().toISOString();\n const results:any = await sqlite.batch([\n {sql:\"INSERT OR IGNORE INTO acknowledgements(id,actor,target_message_id,target_message_sha256,created_at) VALUES(?,?,?,?,?)\",args:[ackId,actor,id,msgSha,created_at]},\n {sql:\"UPDATE messages SET acked_at=COALESCE(acked_at,?) WHERE id=?\",args:[created_at,id]}\n ]);\n const inserted = Number(results?.[0]?.rowsAffected ?? 0) > 0;\n if (inserted) await audit(\"MESSAGE_ACKED\",actor,String(m.lane),id,msgSha);\n return c.json({acked:true,idempotent:!inserted,message_id:id});\n } catch (e) { return c.json({error:String(e?.message||e)},400); }\n});\n\napp.post(\"/v1/guard/authorize\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseGuardBinding(b);\n if (!binding) return c.json({error:\"INVALID_GUARD_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < 60 || ttl > R2_GUARD_MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min_seconds:60,max_seconds:R2_GUARD_MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n const requestSha256 = await sha(canonical(binding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM guard_authorizations WHERE request_sha256=? LIMIT 1\",\n args:[requestSha256]\n });\n if (prior.rows.length) {\n const row:any = prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256:requestSha256\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const rawToken = randomOneTimeToken();\n const tokenSha256 = await sha(rawToken);\n const authorizationId = crypto.randomUUID();\n const issuedAt = new Date();\n const issuedAtIso = issuedAt.toISOString();\n const expiresAt = new Date(issuedAt.getTime() + ttl * 1000).toISOString();\n try {\n await sqlite.execute({\n sql:`INSERT INTO guard_authorizations(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorizationId,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n requestSha256,tokenSha256,issuedAtIso,expiresAt\n ]\n });\n } catch (e) {\n if (String(e).includes(\"UNIQUE\")) return c.json({error:\"AUTHORIZATION_COLLISION\"},409,{\"Cache-Control\":\"no-store\"});\n throw e;\n }\n\n try {\n await audit(\"GUARD_AUTHORIZATION_ISSUED\",\"guard\",null,authorizationId,requestSha256);\n } catch (e) {\n await sqlite.execute({sql:\"UPDATE guard_authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",args:[authorizationId]});\n throw e;\n }\n\n return c.json({\n authorized:true,\n authorization_id:authorizationId,\n action:binding.action,\n request_sha256:requestSha256,\n token:rawToken,\n token_type:\"One-Time\",\n issued_at:issuedAtIso,\n expires_at:expiresAt,\n production_go:false,\n merge_authorized:binding.action === \"MERGE_PR\",\n note:\"The raw one-time token is returned only on issuance; only its SHA-256 is persisted.\"\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/guard/consume\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseGuardBinding(b);\n if (!binding) return c.json({error:\"INVALID_GUARD_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const authorizationId = String(b.authorization_id || \"\");\n const rawToken = String(b.token || \"\");\n if (!authorizationId || !/^[A-Za-z0-9_-]{43,128}$/.test(rawToken)) {\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const requestSha256 = await sha(canonical(binding));\n const rs = await sqlite.execute({sql:\"SELECT * FROM guard_authorizations WHERE authorization_id=? LIMIT 1\",args:[authorizationId]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n await sqlite.execute({sql:\"UPDATE guard_authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",args:[authorizationId]});\n await audit(\"GUARD_AUTHORIZATION_EXPIRED\",\"guard\",null,authorizationId,String(row.request_sha256));\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id:authorizationId},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",authorization_id:authorizationId,status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n if (!constantTimeEqual(String(row.request_sha256), requestSha256)) {\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n const observedTokenSha256 = await sha(rawToken);\n if (!constantTimeEqual(String(row.token_sha256), observedTokenSha256)) {\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumedAt = new Date().toISOString();\n const consumer = String(b.consumer || \"unspecified\").slice(0,128);\n if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)) {\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumedAt,consumer,authorizationId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"AUTHORIZATION_RACE_LOST\",authorization_id:authorizationId},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt = {\n schema:\"rumbo-r2-guard-consumption/v1\",\n authorization_id:authorizationId,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n request_sha256:requestSha256,\n consumed_at:consumedAt,\n consumer,\n production_go:false,\n merge_authorized:binding.action === \"MERGE_PR\"\n };\n const receiptSha256 = await sha(canonical(receipt));\n await audit(\"GUARD_AUTHORIZATION_CONSUMED\",\"guard\",null,authorizationId,receiptSha256);\n return c.json({...receipt,consumed:true,receipt_sha256:receiptSha256},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/guard/revoke\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const authorizationId = String(b.authorization_id || \"\");\n if (!authorizationId) return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute({sql:\"SELECT status,request_sha256,expires_at FROM guard_authorizations WHERE authorization_id=? LIMIT 1\",args:[authorizationId]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorizationId]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"GUARD_AUTHORIZATION_EXPIRED\",\"guard\",null,authorizationId,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id:authorizationId},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorizationId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"GUARD_AUTHORIZATION_REVOKED\",\"guard\",null,authorizationId,String(row.request_sha256));\n return c.json({revoked:true,authorization_id:authorizationId,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/guard/authorizations/:id\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const authorizationId = c.req.param(\"id\");\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM guard_authorizations WHERE authorization_id=? LIMIT 1`,\n args:[now,authorizationId]\n });\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n return c.json({authorization:rs.rows[0],production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/guard/ledger\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rawLimit = Number(c.req.query(\"limit\") || \"50\");\n const limit = Number.isSafeInteger(rawLimit) ? Math.max(1,Math.min(100,rawLimit)) : 50;\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM guard_authorizations ORDER BY issued_at DESC LIMIT ?`,\n args:[now,limit]\n });\n return c.json({\n schema:\"rumbo-r2-guard-ledger/v1\",\n external_authorizer_live:true,\n durable_one_time_token_ledger:true,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\", async (c) => {\n const role = roleFrom(c.req.raw); if (role !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401);\n const rs = await sqlite.execute(\"SELECT * FROM audit_events ORDER BY seq ASC\");\n let prev=\"0\".repeat(64), ok=true;\n for (const r of rs.rows as any[]) {\n const ev={event_type:r.event_type,actor:r.actor,lane:r.lane,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha(canonical(ev)); if (r.prev_event_sha256!==prev || r.event_sha256!==h) ok=false; prev=String(r.event_sha256);\n }\n return c.json({audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,events:rs.rows});\n});\n\napp.post(\"/v1/pair/codex\", async (c) => {\n try {\n const b = await bodyJson(c);\n const code = String(b.code || \"\");\n const clientLabel = String(b.client_label || \"\").slice(0,128);\n const expected = Deno.env.get(\"CODEX_PAIRING_CODE_V4\") || \"\";\n if (!expected || code !== expected) return c.json({error:\"PAIRING_DENIED\"},403,{\"Cache-Control\":\"no-store\"});\n const pairingId = \"codex-v4\";\n const now = new Date();\n const existing = await sqlite.execute({sql:\"SELECT pairing_id,issued_at,expires_at,confirmed_at FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n if (existing.rows.length) {\n const row:any = existing.rows[0];\n if (row.confirmed_at) return c.json({error:\"PAIRING_ALREADY_CONFIRMED\"},409,{\"Cache-Control\":\"no-store\"});\n if (Date.parse(String(row.expires_at)) < now.getTime()) return c.json({error:\"PAIRING_EXPIRED\"},410,{\"Cache-Control\":\"no-store\"});\n await audit(\"CODEX_PAIRING_REDELIVERED\",\"codex\",null,pairingId,String(row.pairing_code_sha256 || await sha(code)));\n return c.json({\n paired:\"ISSUED_UNCONFIRMED\",\n role:\"codex\",\n token_type:\"Bearer\",\n token:Deno.env.get(\"CODEX_TOKEN_V4\"),\n pairing_id:pairingId,\n expires_at:row.expires_at,\n confirm_path:\"/v1/pair/codex/confirm\",\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\"\n },200,{\"Cache-Control\":\"no-store\"});\n }\n const issuedAt = now.toISOString();\n const expiresAt = new Date(now.getTime()+10*60*1000).toISOString();\n const codeSha = await sha(code);\n await sqlite.execute({sql:\"INSERT INTO pairing_sessions(pairing_id,pairing_code_sha256,issued_at,expires_at,client_label) VALUES(?,?,?,?,?)\",args:[pairingId,codeSha,issuedAt,expiresAt,clientLabel]});\n await audit(\"CODEX_PAIRING_ISSUED\",\"codex\",null,pairingId,codeSha);\n return c.json({\n paired:\"ISSUED_UNCONFIRMED\",\n role:\"codex\",\n token_type:\"Bearer\",\n token:Deno.env.get(\"CODEX_TOKEN_V4\"),\n pairing_id:pairingId,\n expires_at:expiresAt,\n confirm_path:\"/v1/pair/codex/confirm\",\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\"\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) { return c.json({error:String(e?.message||e)},400,{\"Cache-Control\":\"no-store\"}); }\n});\n\napp.post(\"/v1/pair/codex/confirm\", async (c) => {\n const actor = roleFrom(c.req.raw);\n if (actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const pairingId = String(b.pairing_id || \"\");\n if (pairingId !== \"codex-v4\") return c.json({error:\"INVALID_PAIRING_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute({sql:\"SELECT pairing_id,expires_at,confirmed_at,pairing_code_sha256 FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n if (!rs.rows.length) return c.json({error:\"PAIRING_NOT_ISSUED\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (row.confirmed_at) return c.json({confirmed:true,idempotent:true,pairing_id:pairingId},200,{\"Cache-Control\":\"no-store\"});\n if (Date.parse(String(row.expires_at)) < Date.now()) return c.json({error:\"PAIRING_EXPIRED\"},410,{\"Cache-Control\":\"no-store\"});\n const confirmedAt = new Date().toISOString();\n await sqlite.execute({sql:\"UPDATE pairing_sessions SET confirmed_at=? WHERE pairing_id=? AND confirmed_at IS NULL\",args:[confirmedAt,pairingId]});\n await audit(\"CODEX_PAIRING_CONFIRMED\",\"codex\",null,pairingId,String(row.pairing_code_sha256));\n return c.json({confirmed:true,idempotent:false,pairing_id:pairingId,confirmed_at:confirmedAt},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) { return c.json({error:String(e?.message||e)},400,{\"Cache-Control\":\"no-store\"}); }\n});\n\napp.get(\"/v1/bootstrap/skill/metadata\", (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n return c.json({\n release:\"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n protocol:\"gpt-codex-context-bridge/v2\",\n skill_name:\"gpt-codex-context-bridge\",\n skill_zip_sha256:\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n encoding:\"binary/zip\",\n source_blob:\"bridge/v1.6/gpt-codex-context-bridge-skill.zip.b64\",\n claim_boundary:\"Skill bytes are canonical V1.6 bytes; installing/running them in the user's real Codex runtime remains a separate acceptance gate.\"\n });\n});\n\napp.get(\"/v1/bootstrap/skill\", async (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n const res = await blob.get(\"bridge/v1.6/gpt-codex-context-bridge-skill.zip.b64\");\n const b64 = await res.text();\n const raw = Uint8Array.from(atob(b64), ch => ch.charCodeAt(0));\n return new Response(raw, {\n status:200,\n headers:{\n \"Content-Type\":\"application/zip\",\n \"Content-Disposition\":\"attachment; filename=gpt-codex-context-bridge.zip\",\n \"X-SHA256\":\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n \"Cache-Control\":\"no-store\"\n }\n });\n});\n\napp.onError((err,c) => { console.error(err); return c.json({error:\"INTERNAL_ERROR\"},500); });\nexport default app.fetch;\n","children",[],[179],"d356fe3b-6301-4bbe-890f-ba859c8904cc","README.md","01a04b4f-e7ae-75f9-a43d-bf554bc583a9",["D",1787970305742],2,"# RUMBO Continuity Relay\n\nLive durable relay for material continuity between ChatGPT-side workflows and a Codex/local runtime.\n\n## Protocol\n\n`rumbo-continuity-relay/v1`\n\nCurrent implementation: `R3-GUARD`.\n\n## Security model\n\n- bearer-role separation: GPT, Codex, admin;\n- no credentials in repository/code;\n- secret-bearing continuity payload rejection;\n- strict lane grammar;\n- optimistic revision control with SQLite trigger-enforced stale-write rejection;\n- exact message SHA-256 binding;\n- exact recipient ACK binding;\n- idempotent ACK replay handling;\n- append-only hash-chained audit events;\n- persistent val-scoped SQLite storage.\n\n## R2 external authorization guard\n\nR3-GUARD adds an external, fail-closed authorization surface for the RUMBO Continuity R2 control package.\n\nProperties:\n\n- controller bearer is held only as an encrypted Val Town environment variable;\n- target repository is bound by an opaque immutable repository-identity SHA-256;\n- control package is pinned to one exact SHA-256;\n- authorization binds exactly to action, PR number, base SHA, head SHA, package SHA-256 and evidence SHA-256;\n- raw one-time authorization tokens are returned only at issuance;\n- only token SHA-256 values are persisted;\n- authorizations have a 60–900 second TTL;\n- exact request bindings cannot be re-issued because request SHA-256 is unique;\n- consumption is atomic and one-time;\n- replay, token mismatch, binding mismatch and stale/expired authorization fail closed;\n- ledger reads never expose token hashes;\n- guard lifecycle events are added to the existing audit hash chain;\n- `production_go` is always false on this surface.\n\n### Merge gate\n\n`MERGE_PR` issuance **and consumption** are disabled unless the runtime environment explicitly contains:\n\n`R2_ALLOW_MERGE_AUTHORIZATION=true`\n\nThat variable is intentionally absent. Therefore this runtime cannot presently authorize a PR merge.\n\nA green guard receipt is not product GO and cannot substitute for live GitHub-side observation of the exact PR state.\n\n## Guard endpoints\n\nAll guard endpoints require the dedicated R2 guard bearer except public health.\n\n- `POST /v1/guard/authorize`\n- `POST /v1/guard/consume`\n- `POST /v1/guard/revoke`\n- `GET /v1/guard/authorizations/:id`\n- `GET /v1/guard/ledger`\n\nThe temporary self-test route used during branch validation was removed before promotion.\n\n## Guard validation evidence\n\nThe branch implementation was exercised against the live Val Town runtime with an internal bearer self-test that did not expose the bearer or one-time token.\n\nFinal adversarial matrix:\n\n- unauthenticated ledger → 401;\n- merge issuance while disabled → 423;\n- invalid repository binding → 400;\n- TTL below policy → 400;\n- TEST_ONLY issuance → 201;\n- invalid consumer label → 400 with authorization still ISSUED;\n- exact TEST_ONLY consumption → 200;\n- consumed-token replay → 409;\n- duplicate exact authorization request → 409;\n- read of an expired fixture → effective status EXPIRED without mutating on read;\n- revoke of expired authorization → 410 and durable EXPIRED state;\n- pre-existing MERGE_PR fixture consumption while merge gate disabled → 423;\n- revoked merge fixture → 200;\n- ledger read → 200;\n- token-hash leakage check → false.\n\nValidated receipt SHA-256:\n\n`90d2e2fd1691b523e0a0ab182ad2f41dd9a6d8dd6ec2f06d8af19c24a58e82ab`\n\nThe live health endpoint remained 200 after removal of the temporary self-test route.\n\n## Continuity endpoints\n\n- `GET /health`\n- `GET /v1/state/:lane`\n- `GET /v1/inbox?lane=...`\n- `POST /v1/messages`\n- `POST /v1/acks`\n- `GET /v1/audit` (admin only)\n\n## Boundary\n\nThe relay is a transport, evidence surface and external fail-closed authorization ledger. It does not replace lane-scoped CURRENT authority, the RUMBO continuity capsule, GitHub branch/ruleset enforcement, a dedicated GitHub App, an independent deployer, or project production authorization.\n\nA real Codex-runtime roundtrip remains a separate acceptance gate until the user's actual Codex/local runtime executes the client and produces a receipt.\n",[],[191],["D",1787970379299],[],[18],"2d332578-1cd2-44db-91b4-21da9ccb0b91","components","01a04b4f-e7ae-75f9-a43d-b9d481a7a8d4",1,["D",1787969922996],"directory",[],[202],["D",1787964475423],["D",1789531243171],{"_11":12,"_125":69},{"_11":12,"_120":121,"_68":69,"_30":67,"_122":123,"_124":24},{"_38":39,"_13":16,"_32":35,"_110":71,"_111":112,"_113":114,"_115":76,"_116":71,"_117":41,"_118":14,"_119":12},"ctx",{"_53":-5,"_145":247,"_248":249,"_250":251,"_252":24,"_253":24,"_254":24,"_255":84,"_256":-5,"_257":-7,"_258":-7,"_259":26,"_260":24,"_261":24,"_262":-5,"_263":24,"_264":24,"_265":24,"_266":-5},"ENV",{"_218":219,"_220":221,"_222":151,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · R3_GUARD_RELEASE.md