[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_251":252,"_253":254},"routes/_app.x.$handle.$name",{"_100":99,"_32":44,"_109":88,"_27":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":123,"_124":48,"_125":126,"_127":25,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":48,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":25,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":48},"version",4,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",true,"deletedHere","path","pr412_successor_binding_selftest.ts","latestPath","fileId","44a705d0-a352-11f1-a966-1607ee4eb77e","name","fileType","script","content","const endpoint=\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\";\nconst guard=Deno.env.get(\"R2_GUARD_TOKEN_V1\");\nif(!guard) throw new Error(\"R2_GUARD_TOKEN_V1_MISSING\");\n\nconst healthRes=await fetch(endpoint+\"/health\");\nconst health=await healthRes.json();\nif(healthRes.status!==200) throw new Error(\"HEALTH_NOT_200\");\nif(health.implementation_revision!==\"R4-ACCEPTANCE-GUARD\") throw new Error(\"RUNTIME_REVISION_MISMATCH\");\nif(health.guard?.configured!==true) throw new Error(\"GUARD_NOT_CONFIGURED\");\nif(health.guard?.merge_authorization_enabled!==false) throw new Error(\"MERGE_GATE_NOT_FAIL_CLOSED\");\nif(health.production_go!==false) throw new Error(\"PRODUCTION_GO_INVARIANT_BROKEN\");\n\nconst binding={\n action:\"TEST_ONLY\",\n repository_identity_sha256:\"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\",\n pr_number:412,\n base_sha:\"1ad77acefc7326595c50d7b0edffa81a2188e737\",\n head_sha:\"d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7\",\n package_sha256:\"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\",\n evidence_sha256:\"67613e277793d67e574db7af2399084e454209af492b78dbff2c8c99e0ff5b8b\"\n};\nconst headers={\"Authorization\":`Bearer ${guard}`,\"Content-Type\":\"application/json\"};\n\nconst issueRes=await fetch(endpoint+\"/v1/guard/authorize\",{\n method:\"POST\",headers,body:JSON.stringify({...binding,ttl_seconds:300})\n});\nconst issue=await issueRes.json();\nif(issueRes.status!==201) throw new Error(`AUTHORIZE_FAILED_${issueRes.status}_${issue.error||\"UNKNOWN\"}`);\nif(!issue.authorization_id||!issue.token) throw new Error(\"AUTHORIZE_RESPONSE_INCOMPLETE\");\nif(issue.production_go!==false||issue.merge_authorized!==false) throw new Error(\"AUTHORIZE_SCOPE_VIOLATION\");\n\nconst consumeRes=await fetch(endpoint+\"/v1/guard/consume\",{\n method:\"POST\",headers,body:JSON.stringify({\n ...binding,authorization_id:issue.authorization_id,token:issue.token,\n consumer:\"pr412-successor-head-bind-v1\"\n })\n});\nconst consume=await consumeRes.json();\nif(consumeRes.status!==200) throw new Error(`CONSUME_FAILED_${consumeRes.status}_${consume.error||\"UNKNOWN\"}`);\nif(consume.consumed!==true) throw new Error(\"NOT_CONSUMED\");\nif(consume.production_go!==false||consume.merge_authorized!==false) throw new Error(\"CONSUME_SCOPE_VIOLATION\");\nif(!/^[a-f0-9]{64}$/.test(String(consume.receipt_sha256||\"\"))) throw new Error(\"INVALID_RECEIPT_SHA256\");\n\nconsole.log(JSON.stringify({\n selftest:\"PASS\",\n schema:\"rumbo-pr412-successor-binding-selftest/v1\",\n runtime_revision:health.implementation_revision,\n merge_authorization_enabled:health.guard.merge_authorization_enabled,\n authorization_id:issue.authorization_id,\n request_sha256:issue.request_sha256,\n receipt_sha256:consume.receipt_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n production_go:false,\n merge_authorized:false\n},null,2));","createdAt",["D",1787970936793],"branchVersion","branchId","dfb67b8a-eddc-44b9-9eaf-444a8024ceb7","id","ea8b2cee-9441-4610-a164-e736539c861b","rumbo-continuity-relay",["D",1787964475423],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","Durable GPT-Codex continuity relay","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","01a04afc-c88b-766f-9e89-3c0c81cf30bc","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","ea8b2cee94414610a164e736539c861b","tursoHostname","ea8b2cee94414610a164e736539c861b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789531243171],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_108":104},"org",{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":48},"branch",{"_13":14,"_32":88,"_42":41,"_89":43,"_90":91,"_92":93,"_94":50,"_95":43,"_96":64,"_97":44,"_98":99},"isOwned","r4-pr412-successor-bind","projectId","forkedBranchId","cdbfe23c-d122-4f18-ad6e-34fdd0cb88da","forkedBranchVersion",48,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_32":44,"_37":246,"_46":-5,"_47":48,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":25,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":247,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":248,"_83":249,"_85":250,"_87":48},"tree",[213,214,215,216,217,218,219,220],"files",[213,214,215,216,217,218,219,220],"counts",{"_201":62,"_202":203,"_204":62,"_205":206,"_207":208},"contents",[139,140,141,142,143,144,145,146],"upstreamProject","upstreamBranch",{"_42":91,"_37":132,"_133":134,"_32":135,"_89":43,"_13":136,"_90":-5,"_92":-5,"_137":138,"_46":-5,"_87":48,"_49":50,"_98":99,"_63":64,"_97":44},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787964475423],"updatedAt",["D",1788191453959],"main",234,"lockfileKey","1788191454040-esm.town_v_sebas1_rumbo-continuity-relay@234-main",{"_42":195,"_32":196,"_30":197,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":198,"_13":62,"_33":199,"_35":-5,"_24":48,"_156":-5,"_27":200},{"_42":189,"_32":190,"_30":191,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":192,"_13":62,"_33":20,"_35":193,"_24":48,"_156":-5,"_27":194},{"_42":183,"_32":184,"_30":185,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":186,"_13":62,"_33":20,"_35":187,"_24":48,"_156":-5,"_27":188},{"_42":177,"_32":178,"_30":179,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":180,"_13":62,"_33":20,"_35":181,"_24":48,"_156":-5,"_27":182},{"_42":170,"_32":171,"_30":172,"_150":-5,"_40":41,"_39":173,"_152":25,"_37":174,"_13":62,"_33":20,"_35":175,"_24":48,"_156":-5,"_27":176},{"_42":164,"_32":165,"_30":166,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":167,"_13":62,"_33":20,"_35":168,"_24":48,"_156":-5,"_27":169},{"_42":158,"_32":159,"_30":160,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":161,"_13":62,"_33":34,"_35":162,"_24":48,"_156":-5,"_27":163},{"_42":147,"_32":148,"_30":149,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":153,"_13":62,"_33":154,"_35":155,"_24":48,"_156":-5,"_27":157},"b3b25080-946b-4eb7-bd04-3c71e653ef4d","main.tsx","01a04b5e-d628-7300-9f10-20c6507670c8","parentId",1,"latest",["D",1787970901574],"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst app = new Hono();\nconst LANE_RE = /^[A-Z0-9][A-Z0-9_.:-]{0,95}$/;\nconst MAX_BODY = 256 * 1024;\nconst secretKeyRe = /(password|api[_-]?key|secret|access[_-]?token|refresh[_-]?token|private[_-]?key|authorization|session[_-]?cookie)/i;\nconst tokenPrefixRe = /(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{12,}|xox[baprs]-[A-Za-z0-9-]{10,})/;\nconst SHA256_RE = /^[a-f0-9]{64}$/;\nconst R2_TARGET_REPOSITORY_IDENTITY_SHA256 = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst R2_CONTROL_PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst R2_GUARD_MAX_TTL_SECONDS = 900;\n\nasync function init() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS lane_state (\n lane TEXT PRIMARY KEY,\n revision INTEGER NOT NULL DEFAULT 0,\n checkpoint_sha256 TEXT NOT NULL DEFAULT '',\n updated_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS messages (\n id TEXT PRIMARY KEY,\n actor TEXT NOT NULL CHECK(actor IN ('gpt','codex')),\n recipient TEXT NOT NULL CHECK(recipient IN ('gpt','codex')),\n lane TEXT NOT NULL,\n base_revision INTEGER NOT NULL,\n revision INTEGER NOT NULL,\n payload_json TEXT NOT NULL,\n payload_sha256 TEXT NOT NULL,\n message_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL,\n acked_at TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_messages_inbox ON messages(recipient,lane,acked_at,revision)`,\n `CREATE TABLE IF NOT EXISTS acknowledgements (\n id TEXT PRIMARY KEY,\n actor TEXT NOT NULL CHECK(actor IN ('gpt','codex')),\n target_message_id TEXT NOT NULL UNIQUE,\n target_message_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL,\n FOREIGN KEY(target_message_id) REFERENCES messages(id)\n )`,\n `CREATE TABLE IF NOT EXISTS audit_events (\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n actor TEXT NOT NULL,\n lane TEXT,\n object_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS pairing_events (\n pairing_id TEXT PRIMARY KEY,\n pairing_code_sha256 TEXT NOT NULL,\n consumed_at TEXT NOT NULL,\n client_label TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS pairing_sessions (\n pairing_id TEXT PRIMARY KEY,\n pairing_code_sha256 TEXT NOT NULL,\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n confirmed_at TEXT,\n client_label TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS request_dedup (\n actor TEXT NOT NULL,\n request_id TEXT NOT NULL,\n body_sha256 TEXT NOT NULL,\n message_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n PRIMARY KEY(actor,request_id),\n FOREIGN KEY(message_id) REFERENCES messages(id)\n )`,\n `CREATE TABLE IF NOT EXISTS guard_authorizations (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_guard_status ON guard_authorizations(status,expires_at)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_unique ON audit_events(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_message_accepted_unique ON audit_events(object_id) WHERE event_type='MESSAGE_ACCEPTED'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_message_acked_unique ON audit_events(object_id) WHERE event_type='MESSAGE_ACKED'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_guard_event_unique ON audit_events(event_type,object_id) WHERE event_type LIKE 'GUARD_%'`,\n `CREATE TRIGGER IF NOT EXISTS messages_revision_guard\n BEFORE INSERT ON messages\n BEGIN\n SELECT CASE\n WHEN COALESCE((SELECT revision FROM lane_state WHERE lane=NEW.lane), -1) != NEW.base_revision\n THEN RAISE(ABORT, 'STALE_REVISION')\n END;\n END`,\n `CREATE TRIGGER IF NOT EXISTS messages_revision_advance\n AFTER INSERT ON messages\n BEGIN\n UPDATE lane_state\n SET revision=NEW.revision, updated_at=NEW.created_at\n WHERE lane=NEW.lane AND revision=NEW.base_revision;\n END`\n ]);\n}\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\n\nfunction roleFrom(req: Request): \"gpt\" | \"codex\" | \"admin\" | null {\n const token = bearer(req);\n if (!token) return null;\n if (token === Deno.env.get(\"GPT_TOKEN_V4\")) return \"gpt\";\n if (token === Deno.env.get(\"CODEX_TOKEN_V4\")) return \"codex\";\n if (token === Deno.env.get(\"ADMIN_TOKEN_V4\")) return \"admin\";\n return null;\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n const aa = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < aa.length; i++) diff |= aa[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction guardAuthorized(req: Request): boolean {\n const expected = Deno.env.get(\"R2_GUARD_TOKEN_V1\") || \"\";\n const observed = bearer(req);\n return !!expected && !!observed && constantTimeEqual(expected, observed);\n}\n\nfunction validGitSha(v: unknown): boolean {\n return typeof v === \"string\" && /^[a-f0-9]{40}$/.test(v);\n}\n\nfunction validSha256(v: unknown): v is string {\n return typeof v === \"string\" && SHA256_RE.test(v);\n}\n\nfunction randomOneTimeToken(bytes = 32): string {\n const raw = new Uint8Array(bytes);\n crypto.getRandomValues(raw);\n const binary = Array.from(raw, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\ntype GuardAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype GuardBinding = {\n action: GuardAction;\n repository_identity_sha256: string;\n pr_number: number;\n base_sha: string;\n head_sha: string;\n package_sha256: string;\n evidence_sha256: string;\n};\n\nfunction parseGuardBinding(b: any): GuardBinding | null {\n const action = String(b?.action || \"\") as GuardAction;\n const repository_identity_sha256 = String(b?.repository_identity_sha256 || \"\");\n const pr_number = Number(b?.pr_number);\n const base_sha = String(b?.base_sha || \"\");\n const head_sha = String(b?.head_sha || \"\");\n const package_sha256 = String(b?.package_sha256 || \"\");\n const evidence_sha256 = String(b?.evidence_sha256 || \"\");\n if (action !== \"TEST_ONLY\" && action !== \"MERGE_PR\") return null;\n if (repository_identity_sha256 !== R2_TARGET_REPOSITORY_IDENTITY_SHA256) return null;\n if (!Number.isSafeInteger(pr_number) || pr_number <= 0) return null;\n if (!validGitSha(base_sha) || !validGitSha(head_sha)) return null;\n if (package_sha256 !== R2_CONTROL_PACKAGE_SHA256) return null;\n if (!validSha256(evidence_sha256)) return null;\n return {action,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256};\n}\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\") + \"}\";\n}\nasync function sha(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction hasSecret(v: unknown): boolean {\n if (typeof v === \"string\") return tokenPrefixRe.test(v);\n if (Array.isArray(v)) return v.some(hasSecret);\n if (v && typeof v === \"object\") {\n return Object.entries(v as Record).some(([k,x]) => secretKeyRe.test(k) || hasSecret(x));\n }\n return false;\n}\nasync function bodyJson(c: any) {\n const len = Number(c.req.header(\"content-length\") || \"0\");\n if (len > MAX_BODY) throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt = await c.req.text();\n if (new TextEncoder().encode(txt).length > MAX_BODY) throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt || \"{}\");\n}\nasync function audit(event_type:string, actor:string, lane:string|null, object_id:string|null, object_sha256:string|null) {\n const idempotentEvent = event_type === \"MESSAGE_ACCEPTED\" || event_type === \"MESSAGE_ACKED\" || event_type.startsWith(\"GUARD_\");\n if (idempotentEvent && object_id) {\n const existing = await sqlite.execute({sql:\"SELECT event_sha256 FROM audit_events WHERE event_type=? AND object_id=? LIMIT 1\",args:[event_type,object_id]});\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n for (let attempt=0; attempt<8; attempt++) {\n const last = await sqlite.execute(\"SELECT event_sha256 FROM audit_events ORDER BY seq DESC LIMIT 1\");\n const prev = String(last.rows[0]?.event_sha256 || \"0\".repeat(64));\n const created_at = new Date().toISOString();\n const ev = {event_type,actor,lane,object_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256 = await sha(canonical(ev));\n try {\n await sqlite.execute({sql:`INSERT INTO audit_events(event_type,actor,lane,object_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?,?,?)`,args:[event_type,actor,lane,object_id,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n } catch (e) {\n if (idempotentEvent && object_id) {\n const existing = await sqlite.execute({sql:\"SELECT event_sha256 FROM audit_events WHERE event_type=? AND object_id=? LIMIT 1\",args:[event_type,object_id]});\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\nawait init();\n\napp.get(\"/\", (c) => c.json({service:\"rumbo-continuity-relay\",protocol:\"rumbo-continuity-relay/v1\",implementation_revision:\"R4-ACCEPTANCE-GUARD\",status:\"ok\",production_go:false}));\napp.get(\"/health\", (c) => c.json({\n ok:true,\n protocol:\"rumbo-continuity-relay/v1\",\n implementation_revision:\"R4-ACCEPTANCE-GUARD\",\n capabilities:[\n \"atomic-stale-guard\",\"request-idempotency\",\"idempotent-ack\",\"audit-chain\",\n \"two-phase-pairing\",\"canonical-v1.6-skill-bootstrap\",\"codex-runtime-acceptance-verifier\",\n \"external-r2-authorizer\",\"one-time-token-ledger\",\"exact-pr-binding\",\"fail-closed-merge-gate\"\n ],\n guard:{\n configured:!!Deno.env.get(\"R2_GUARD_TOKEN_V1\"),\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n max_ttl_seconds:R2_GUARD_MAX_TTL_SECONDS\n },\n production_go:false\n}));\n\napp.get(\"/v1/state/:lane\", async (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n const lane = c.req.param(\"lane\"); if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n const st = await sqlite.execute({sql:\"SELECT lane,revision,checkpoint_sha256,updated_at FROM lane_state WHERE lane=?\",args:[lane]});\n const row = st.rows[0] || {lane,revision:0,checkpoint_sha256:\"0\".repeat(64),updated_at:null};\n const pending = await sqlite.execute({sql:\"SELECT recipient,COUNT(*) AS n FROM messages WHERE lane=? AND acked_at IS NULL GROUP BY recipient\",args:[lane]});\n return c.json({state:row,pending:pending.rows});\n});\n\napp.get(\"/v1/inbox\", async (c) => {\n const role = roleFrom(c.req.raw); if (role !== \"gpt\" && role !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n const lane = c.req.query(\"lane\") || \"\"; if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n const rs = await sqlite.execute({sql:`SELECT id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at\n FROM messages WHERE recipient=? AND lane=? AND acked_at IS NULL ORDER BY revision,id LIMIT 100`,args:[role,lane]});\n return c.json({messages:rs.rows.map((r:any)=>({...r,payload:JSON.parse(String(r.payload_json)),payload_json:undefined}))});\n});\n\napp.post(\"/v1/messages\", async (c) => {\n const actor = roleFrom(c.req.raw); if (actor !== \"gpt\" && actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n try {\n const b = await bodyJson(c);\n const lane = String(b.lane||\"\"); if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n const base = Number(b.base_revision); if (!Number.isSafeInteger(base) || base < 0) return c.json({error:\"INVALID_BASE_REVISION\"},400);\n const payload = b.payload ?? {}; if (hasSecret(payload)) return c.json({error:\"SECRET_REJECTED\"},400);\n const requestId = String(b.request_id || \"\").trim();\n if (requestId && !/^[A-Za-z0-9_.:-]{16,128}$/.test(requestId)) return c.json({error:\"INVALID_REQUEST_ID\"},400);\n const requestBodySha256 = await sha(canonical({lane,base_revision:base,payload}));\n if (requestId) {\n const prior = await sqlite.execute({sql:\"SELECT body_sha256,message_id FROM request_dedup WHERE actor=? AND request_id=?\",args:[actor,requestId]});\n if (prior.rows.length) {\n const d:any = prior.rows[0];\n if (String(d.body_sha256)!==requestBodySha256) return c.json({error:\"IDEMPOTENCY_KEY_REUSE_MISMATCH\"},409);\n const m = await sqlite.execute({sql:\"SELECT id,lane,revision,payload_sha256,message_sha256 FROM messages WHERE id=?\",args:[String(d.message_id)]});\n if (!m.rows.length) return c.json({error:\"DEDUP_MESSAGE_MISSING\"},500);\n const row:any = m.rows[0];\n const checkpoint_sha256 = await sha(canonical({lane:String(row.lane),revision:Number(row.revision),message_sha256:String(row.message_sha256)}));\n return c.json({accepted:true,idempotent:true,id:row.id,lane:row.lane,revision:row.revision,payload_sha256:row.payload_sha256,message_sha256:row.message_sha256,checkpoint_sha256},200);\n }\n }\n await sqlite.execute({sql:\"INSERT OR IGNORE INTO lane_state(lane,revision,checkpoint_sha256,updated_at) VALUES(?,0,?,?)\",args:[lane,\"0\".repeat(64),new Date().toISOString()]});\n const st = await sqlite.execute({sql:\"SELECT revision FROM lane_state WHERE lane=?\",args:[lane]});\n const cur = Number(st.rows[0]?.revision ?? 0); if (cur !== base) return c.json({error:\"STALE_REVISION\",expected:cur,observed:base},409);\n const recipient = actor === \"gpt\" ? \"codex\" : \"gpt\";\n const id = crypto.randomUUID(); const revision = base + 1; const created_at = new Date().toISOString();\n const payload_json = canonical(payload); const payload_sha256 = await sha(payload_json);\n const envelope = {protocol:\"rumbo-continuity-relay/v1\",id,actor,recipient,lane,base_revision:base,revision,payload_sha256,created_at};\n const message_sha256 = await sha(canonical(envelope));\n const checkpoint_sha256 = await sha(canonical({lane,revision,message_sha256}));\n const statements:any[] = [\n {sql:`INSERT INTO messages(id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at)\n VALUES(?,?,?,?,?,?,?,?,?,?)`,args:[id,actor,recipient,lane,base,revision,payload_json,payload_sha256,message_sha256,created_at]},\n {sql:\"UPDATE lane_state SET checkpoint_sha256=? WHERE lane=? AND revision=?\",args:[checkpoint_sha256,lane,revision]}\n ];\n if (requestId) statements.push({sql:\"INSERT INTO request_dedup(actor,request_id,body_sha256,message_id,created_at) VALUES(?,?,?,?,?)\",args:[actor,requestId,requestBodySha256,id,created_at]});\n try {\n await sqlite.batch(statements);\n } catch (e) {\n if (requestId) {\n const prior = await sqlite.execute({sql:\"SELECT body_sha256,message_id FROM request_dedup WHERE actor=? AND request_id=?\",args:[actor,requestId]});\n if (prior.rows.length) {\n const d:any = prior.rows[0];\n if (String(d.body_sha256)!==requestBodySha256) return c.json({error:\"IDEMPOTENCY_KEY_REUSE_MISMATCH\"},409);\n const m = await sqlite.execute({sql:\"SELECT id,lane,revision,payload_sha256,message_sha256 FROM messages WHERE id=?\",args:[String(d.message_id)]});\n if (m.rows.length) {\n const row:any=m.rows[0];\n const cp=await sha(canonical({lane:String(row.lane),revision:Number(row.revision),message_sha256:String(row.message_sha256)}));\n return c.json({accepted:true,idempotent:true,id:row.id,lane:row.lane,revision:row.revision,payload_sha256:row.payload_sha256,message_sha256:row.message_sha256,checkpoint_sha256:cp},200);\n }\n }\n }\n if (String(e).includes(\"STALE_REVISION\")) {\n const curState=await sqlite.execute({sql:\"SELECT revision FROM lane_state WHERE lane=?\",args:[lane]});\n return c.json({error:\"STALE_REVISION\",expected:Number(curState.rows[0]?.revision ?? 0),observed:base},409);\n }\n throw e;\n }\n const verify = await sqlite.execute({sql:\"SELECT revision,checkpoint_sha256 FROM lane_state WHERE lane=?\",args:[lane]});\n if (Number(verify.rows[0]?.revision) !== revision || String(verify.rows[0]?.checkpoint_sha256)!==checkpoint_sha256) return c.json({error:\"ATOMIC_ADVANCE_FAILED\"},409);\n await audit(\"MESSAGE_ACCEPTED\",actor,lane,id,message_sha256);\n return c.json({accepted:true,idempotent:false,id,lane,revision,payload_sha256,message_sha256,checkpoint_sha256},201);\n } catch (e) { return c.json({error:String(e?.message||e)},400); }\n});\n\napp.post(\"/v1/acks\", async (c) => {\n const actor = roleFrom(c.req.raw); if (actor !== \"gpt\" && actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n try {\n const b = await bodyJson(c); const id = String(b.message_id||\"\"); const msgSha = String(b.message_sha256||\"\");\n const rs = await sqlite.execute({sql:\"SELECT * FROM messages WHERE id=?\",args:[id]}); const m:any = rs.rows[0];\n if (!m) return c.json({error:\"NOT_FOUND\"},404);\n if (String(m.recipient)!==actor) return c.json({error:\"WRONG_RECIPIENT\"},403);\n if (String(m.message_sha256)!==msgSha) return c.json({error:\"HASH_MISMATCH\"},409);\n const prior = await sqlite.execute({sql:\"SELECT id FROM acknowledgements WHERE target_message_id=?\",args:[id]});\n if (prior.rows.length) return c.json({acked:true,idempotent:true,message_id:id});\n const ackId = crypto.randomUUID(), created_at = new Date().toISOString();\n const results:any = await sqlite.batch([\n {sql:\"INSERT OR IGNORE INTO acknowledgements(id,actor,target_message_id,target_message_sha256,created_at) VALUES(?,?,?,?,?)\",args:[ackId,actor,id,msgSha,created_at]},\n {sql:\"UPDATE messages SET acked_at=COALESCE(acked_at,?) WHERE id=?\",args:[created_at,id]}\n ]);\n const inserted = Number(results?.[0]?.rowsAffected ?? 0) > 0;\n if (inserted) await audit(\"MESSAGE_ACKED\",actor,String(m.lane),id,msgSha);\n return c.json({acked:true,idempotent:!inserted,message_id:id});\n } catch (e) { return c.json({error:String(e?.message||e)},400); }\n});\n\napp.get(\"/v1/acceptance/:lane\", async (c) => {\n const role = roleFrom(c.req.raw);\n if (role !== \"gpt\" && role !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const lane = c.req.param(\"lane\");\n if (lane !== \"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\") return c.json({error:\"UNSUPPORTED_ACCEPTANCE_LANE\"},404,{\"Cache-Control\":\"no-store\"});\n const challenges = await sqlite.execute({sql:`SELECT id,revision,payload_json,message_sha256,created_at,acked_at\n FROM messages WHERE lane=? AND actor='gpt' AND recipient='codex' ORDER BY revision ASC`,args:[lane]});\n if (challenges.rows.length !== 1) return c.json({\n lane,state:challenges.rows.length ? \"AMBIGUOUS_CHALLENGE_SET\" : \"CHALLENGE_NOT_PROVEN\",\n challenge_count:challenges.rows.length,mechanical_checks_passed:false,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n const challenge:any = challenges.rows[0];\n let cp:any;\n try { cp = JSON.parse(String(challenge.payload_json)); } catch { cp = null; }\n const required = [\n \"consume_this_exact_message\",\"ack_exact_message_id_and_message_sha256\",\n \"publish_reverse_response_with_same_challenge_nonce\",\"include_local_plugin_manifest_sha256\",\n \"include_local_runtime_receipt_sha256\",\"do_not_include_secrets\",\"preserve_fail_closed_project_gates\"\n ];\n const declared = Array.isArray(cp?.acceptance_requirements) ? cp.acceptance_requirements.map(String) : [];\n const contractOk = cp?.kind === \"runtime_acceptance_challenge\"\n && typeof cp?.challenge_nonce === \"string\" && cp.challenge_nonce.length >= 32\n && required.every(x => declared.includes(x));\n const evidence:any = {\n challenge_message_id:String(challenge.id),\n challenge_message_sha256:String(challenge.message_sha256),\n challenge_revision:Number(challenge.revision)\n };\n if (!contractOk) return c.json({lane,state:\"CHALLENGE_CONTRACT_MISMATCH\",mechanical_checks_passed:false,evidence,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n\n const codexAck = await sqlite.execute({sql:`SELECT id,created_at FROM acknowledgements\n WHERE actor='codex' AND target_message_id=? AND target_message_sha256=? LIMIT 1`,\n args:[String(challenge.id),String(challenge.message_sha256)]});\n if (!codexAck.rows.length) return c.json({lane,state:\"PENDING_CODEX_ACK\",mechanical_checks_passed:false,evidence,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n\n const reverse = await sqlite.execute({sql:`SELECT id,revision,payload_json,message_sha256,created_at,acked_at\n FROM messages WHERE lane=? AND actor='codex' AND recipient='gpt' AND revision>? ORDER BY revision ASC`,\n args:[lane,Number(challenge.revision)]});\n if (!reverse.rows.length) return c.json({lane,state:\"PENDING_CODEX_RESPONSE\",mechanical_checks_passed:false,evidence:{...evidence,codex_ack_id:String((codexAck.rows[0] as any).id)},production_go:false},200,{\"Cache-Control\":\"no-store\"});\n if (reverse.rows.length !== 1) return c.json({lane,state:\"AMBIGUOUS_MULTIPLE_CODEX_RESPONSES\",response_count:reverse.rows.length,mechanical_checks_passed:false,evidence,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n\n const response:any = reverse.rows[0];\n let rp:any;\n try { rp = JSON.parse(String(response.payload_json)); } catch { rp = null; }\n const checks = {\n challenge_nonce_exact:typeof rp?.challenge_nonce === \"string\" && rp.challenge_nonce === cp.challenge_nonce,\n local_plugin_manifest_sha256:validSha256(rp?.local_plugin_manifest_sha256),\n local_runtime_receipt_sha256:validSha256(rp?.local_runtime_receipt_sha256)\n };\n const responseEvidence = {\n ...evidence,codex_ack_id:String((codexAck.rows[0] as any).id),\n codex_response_message_id:String(response.id),\n codex_response_message_sha256:String(response.message_sha256),\n codex_response_revision:Number(response.revision),\n checks\n };\n if (!Object.values(checks).every(Boolean)) return c.json({lane,state:\"INVALID_CODEX_RESPONSE\",mechanical_checks_passed:false,evidence:responseEvidence,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n\n const gptAck = await sqlite.execute({sql:`SELECT id,created_at FROM acknowledgements\n WHERE actor='gpt' AND target_message_id=? AND target_message_sha256=? LIMIT 1`,\n args:[String(response.id),String(response.message_sha256)]});\n if (!gptAck.rows.length) return c.json({\n lane,state:\"PENDING_CHATGPT_ACK\",mechanical_checks_passed:true,\n evidence:responseEvidence,manual_semantic_review_required:true,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n return c.json({\n lane,state:\"PASS_RUNTIME_ROUNDTRIP\",mechanical_checks_passed:true,\n evidence:{...responseEvidence,gpt_ack_id:String((gptAck.rows[0] as any).id)},\n claim_boundary:\"Continuity transport/runtime binding only; no project production authorization.\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/guard/authorize\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseGuardBinding(b);\n if (!binding) return c.json({error:\"INVALID_GUARD_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < 60 || ttl > R2_GUARD_MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min_seconds:60,max_seconds:R2_GUARD_MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n const requestSha256 = await sha(canonical(binding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM guard_authorizations WHERE request_sha256=? LIMIT 1\",\n args:[requestSha256]\n });\n if (prior.rows.length) {\n const row:any = prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256:requestSha256\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const rawToken = randomOneTimeToken();\n const tokenSha256 = await sha(rawToken);\n const authorizationId = crypto.randomUUID();\n const issuedAt = new Date();\n const issuedAtIso = issuedAt.toISOString();\n const expiresAt = new Date(issuedAt.getTime() + ttl * 1000).toISOString();\n try {\n await sqlite.execute({\n sql:`INSERT INTO guard_authorizations(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorizationId,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n requestSha256,tokenSha256,issuedAtIso,expiresAt\n ]\n });\n } catch (e) {\n if (String(e).includes(\"UNIQUE\")) return c.json({error:\"AUTHORIZATION_COLLISION\"},409,{\"Cache-Control\":\"no-store\"});\n throw e;\n }\n\n try {\n await audit(\"GUARD_AUTHORIZATION_ISSUED\",\"guard\",null,authorizationId,requestSha256);\n } catch (e) {\n await sqlite.execute({sql:\"UPDATE guard_authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",args:[authorizationId]});\n throw e;\n }\n\n return c.json({\n authorized:true,\n authorization_id:authorizationId,\n action:binding.action,\n request_sha256:requestSha256,\n token:rawToken,\n token_type:\"One-Time\",\n issued_at:issuedAtIso,\n expires_at:expiresAt,\n production_go:false,\n merge_authorized:binding.action === \"MERGE_PR\",\n note:\"The raw one-time token is returned only on issuance; only its SHA-256 is persisted.\"\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/guard/consume\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseGuardBinding(b);\n if (!binding) return c.json({error:\"INVALID_GUARD_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const authorizationId = String(b.authorization_id || \"\");\n const rawToken = String(b.token || \"\");\n if (!authorizationId || !/^[A-Za-z0-9_-]{43,128}$/.test(rawToken)) {\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const requestSha256 = await sha(canonical(binding));\n const rs = await sqlite.execute({sql:\"SELECT * FROM guard_authorizations WHERE authorization_id=? LIMIT 1\",args:[authorizationId]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n await sqlite.execute({sql:\"UPDATE guard_authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",args:[authorizationId]});\n await audit(\"GUARD_AUTHORIZATION_EXPIRED\",\"guard\",null,authorizationId,String(row.request_sha256));\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id:authorizationId},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",authorization_id:authorizationId,status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n if (!constantTimeEqual(String(row.request_sha256), requestSha256)) {\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n const observedTokenSha256 = await sha(rawToken);\n if (!constantTimeEqual(String(row.token_sha256), observedTokenSha256)) {\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumedAt = new Date().toISOString();\n const consumer = String(b.consumer || \"unspecified\").slice(0,128);\n if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)) {\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumedAt,consumer,authorizationId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"AUTHORIZATION_RACE_LOST\",authorization_id:authorizationId},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt = {\n schema:\"rumbo-r2-guard-consumption/v1\",\n authorization_id:authorizationId,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n request_sha256:requestSha256,\n consumed_at:consumedAt,\n consumer,\n production_go:false,\n merge_authorized:binding.action === \"MERGE_PR\"\n };\n const receiptSha256 = await sha(canonical(receipt));\n await audit(\"GUARD_AUTHORIZATION_CONSUMED\",\"guard\",null,authorizationId,receiptSha256);\n return c.json({...receipt,consumed:true,receipt_sha256:receiptSha256},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/guard/revoke\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const authorizationId = String(b.authorization_id || \"\");\n if (!authorizationId) return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute({sql:\"SELECT status,request_sha256,expires_at FROM guard_authorizations WHERE authorization_id=? LIMIT 1\",args:[authorizationId]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorizationId]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"GUARD_AUTHORIZATION_EXPIRED\",\"guard\",null,authorizationId,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id:authorizationId},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorizationId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"GUARD_AUTHORIZATION_REVOKED\",\"guard\",null,authorizationId,String(row.request_sha256));\n return c.json({revoked:true,authorization_id:authorizationId,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/guard/authorizations/:id\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const authorizationId = c.req.param(\"id\");\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM guard_authorizations WHERE authorization_id=? LIMIT 1`,\n args:[now,authorizationId]\n });\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n return c.json({authorization:rs.rows[0],production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/guard/ledger\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rawLimit = Number(c.req.query(\"limit\") || \"50\");\n const limit = Number.isSafeInteger(rawLimit) ? Math.max(1,Math.min(100,rawLimit)) : 50;\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM guard_authorizations ORDER BY issued_at DESC LIMIT ?`,\n args:[now,limit]\n });\n return c.json({\n schema:\"rumbo-r2-guard-ledger/v1\",\n external_authorizer_live:true,\n durable_one_time_token_ledger:true,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\", async (c) => {\n const role = roleFrom(c.req.raw); if (role !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401);\n const rs = await sqlite.execute(\"SELECT * FROM audit_events ORDER BY seq ASC\");\n let prev=\"0\".repeat(64), ok=true;\n for (const r of rs.rows as any[]) {\n const ev={event_type:r.event_type,actor:r.actor,lane:r.lane,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha(canonical(ev)); if (r.prev_event_sha256!==prev || r.event_sha256!==h) ok=false; prev=String(r.event_sha256);\n }\n return c.json({audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,events:rs.rows});\n});\n\napp.post(\"/v1/pair/codex\", async (c) => {\n try {\n const b = await bodyJson(c);\n const code = String(b.code || \"\");\n const clientLabel = String(b.client_label || \"\").slice(0,128);\n const expected = Deno.env.get(\"CODEX_PAIRING_CODE_V4\") || \"\";\n if (!expected || code !== expected) return c.json({error:\"PAIRING_DENIED\"},403,{\"Cache-Control\":\"no-store\"});\n const pairingId = \"codex-v4\";\n const now = new Date();\n const existing = await sqlite.execute({sql:\"SELECT pairing_id,issued_at,expires_at,confirmed_at FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n if (existing.rows.length) {\n const row:any = existing.rows[0];\n if (row.confirmed_at) return c.json({error:\"PAIRING_ALREADY_CONFIRMED\"},409,{\"Cache-Control\":\"no-store\"});\n if (Date.parse(String(row.expires_at)) < now.getTime()) return c.json({error:\"PAIRING_EXPIRED\"},410,{\"Cache-Control\":\"no-store\"});\n await audit(\"CODEX_PAIRING_REDELIVERED\",\"codex\",null,pairingId,String(row.pairing_code_sha256 || await sha(code)));\n return c.json({\n paired:\"ISSUED_UNCONFIRMED\",\n role:\"codex\",\n token_type:\"Bearer\",\n token:Deno.env.get(\"CODEX_TOKEN_V4\"),\n pairing_id:pairingId,\n expires_at:row.expires_at,\n confirm_path:\"/v1/pair/codex/confirm\",\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\"\n },200,{\"Cache-Control\":\"no-store\"});\n }\n const issuedAt = now.toISOString();\n const expiresAt = new Date(now.getTime()+10*60*1000).toISOString();\n const codeSha = await sha(code);\n await sqlite.execute({sql:\"INSERT INTO pairing_sessions(pairing_id,pairing_code_sha256,issued_at,expires_at,client_label) VALUES(?,?,?,?,?)\",args:[pairingId,codeSha,issuedAt,expiresAt,clientLabel]});\n await audit(\"CODEX_PAIRING_ISSUED\",\"codex\",null,pairingId,codeSha);\n return c.json({\n paired:\"ISSUED_UNCONFIRMED\",\n role:\"codex\",\n token_type:\"Bearer\",\n token:Deno.env.get(\"CODEX_TOKEN_V4\"),\n pairing_id:pairingId,\n expires_at:expiresAt,\n confirm_path:\"/v1/pair/codex/confirm\",\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\"\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) { return c.json({error:String(e?.message||e)},400,{\"Cache-Control\":\"no-store\"}); }\n});\n\napp.post(\"/v1/pair/codex/confirm\", async (c) => {\n const actor = roleFrom(c.req.raw);\n if (actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const pairingId = String(b.pairing_id || \"\");\n if (pairingId !== \"codex-v4\") return c.json({error:\"INVALID_PAIRING_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute({sql:\"SELECT pairing_id,expires_at,confirmed_at,pairing_code_sha256 FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n if (!rs.rows.length) return c.json({error:\"PAIRING_NOT_ISSUED\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (row.confirmed_at) return c.json({confirmed:true,idempotent:true,pairing_id:pairingId},200,{\"Cache-Control\":\"no-store\"});\n if (Date.parse(String(row.expires_at)) < Date.now()) return c.json({error:\"PAIRING_EXPIRED\"},410,{\"Cache-Control\":\"no-store\"});\n const confirmedAt = new Date().toISOString();\n await sqlite.execute({sql:\"UPDATE pairing_sessions SET confirmed_at=? WHERE pairing_id=? AND confirmed_at IS NULL\",args:[confirmedAt,pairingId]});\n await audit(\"CODEX_PAIRING_CONFIRMED\",\"codex\",null,pairingId,String(row.pairing_code_sha256));\n return c.json({confirmed:true,idempotent:false,pairing_id:pairingId,confirmed_at:confirmedAt},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) { return c.json({error:String(e?.message||e)},400,{\"Cache-Control\":\"no-store\"}); }\n});\n\napp.get(\"/v1/bootstrap/skill/metadata\", (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n return c.json({\n release:\"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n protocol:\"gpt-codex-context-bridge/v2\",\n skill_name:\"gpt-codex-context-bridge\",\n skill_zip_sha256:\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n encoding:\"binary/zip\",\n source_blob:\"bridge/v1.6/gpt-codex-context-bridge-skill.zip.b64\",\n claim_boundary:\"Skill bytes are canonical V1.6 bytes; installing/running them in the user's real Codex runtime remains a separate acceptance gate.\"\n });\n});\n\napp.get(\"/v1/bootstrap/skill\", async (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n const res = await blob.get(\"bridge/v1.6/gpt-codex-context-bridge-skill.zip.b64\");\n const b64 = await res.text();\n const raw = Uint8Array.from(atob(b64), ch => ch.charCodeAt(0));\n return new Response(raw, {\n status:200,\n headers:{\n \"Content-Type\":\"application/zip\",\n \"Content-Disposition\":\"attachment; filename=gpt-codex-context-bridge.zip\",\n \"X-SHA256\":\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n \"Cache-Control\":\"no-store\"\n }\n });\n});\n\napp.onError((err,c) => { console.error(err); return c.json({error:\"INTERNAL_ERROR\"},500); });\nexport default app.fetch;\n","label",[148],"dafdc067-f9f4-4f6c-9a72-733890bb756d","acceptance_selftest.ts","01a04b5e-d628-7300-9f10-1cacd6a870db",["D",1787970901574],"const base = \"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\";\nconst lane = \"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\";\nconst gpt = Deno.env.get(\"GPT_TOKEN_V4\");\nconst admin = Deno.env.get(\"ADMIN_TOKEN_V4\");\nif (!gpt || !admin) throw new Error(\"R4_REQUIRED_ENV_MISSING\");\n\nconst healthRes = await fetch(base + \"/health\");\nconst health = await healthRes.json();\nif (healthRes.status !== 200 || health.implementation_revision !== \"R4-ACCEPTANCE-GUARD\") {\n throw new Error(\"R4_HEALTH_MISMATCH\");\n}\nif (health.production_go !== false) throw new Error(\"HEALTH_PRODUCTION_GO_INVARIANT_BROKEN\");\n\nconst unauthRes = await fetch(`${base}/v1/acceptance/${lane}`);\nif (unauthRes.status !== 401) throw new Error(`UNAUTH_ACCEPTANCE_EXPECTED_401_GOT_${unauthRes.status}`);\n\nconst acceptanceRes = await fetch(`${base}/v1/acceptance/${lane}`, {\n headers: { Authorization: `Bearer ${gpt}` }\n});\nconst acceptance = await acceptanceRes.json();\nconst allowed = new Set([\n \"CHALLENGE_NOT_PROVEN\",\"AMBIGUOUS_CHALLENGE_SET\",\"CHALLENGE_CONTRACT_MISMATCH\",\n \"PENDING_CODEX_ACK\",\"PENDING_CODEX_RESPONSE\",\"AMBIGUOUS_MULTIPLE_CODEX_RESPONSES\",\n \"INVALID_CODEX_RESPONSE\",\"PENDING_CHATGPT_ACK\",\"PASS_RUNTIME_ROUNDTRIP\"\n]);\nif (acceptanceRes.status !== 200 || !allowed.has(acceptance.state)) {\n throw new Error(\"ACCEPTANCE_STATE_INVALID\");\n}\nif (acceptance.production_go !== false) throw new Error(\"ACCEPTANCE_PRODUCTION_GO_INVARIANT_BROKEN\");\nif (acceptance.state === \"PASS_RUNTIME_ROUNDTRIP\") {\n if (acceptance.mechanical_checks_passed !== true || !acceptance.evidence?.gpt_ack_id) {\n throw new Error(\"FALSE_PASS_GUARD_FAILED\");\n }\n}\nif (acceptance.state === \"PENDING_CODEX_ACK\") {\n if (acceptance.evidence?.challenge_message_id !== \"f7ca12d8-226a-43b9-9fc0-bd9ede8548af\") {\n throw new Error(\"CHALLENGE_ID_DRIFT\");\n }\n if (acceptance.evidence?.challenge_message_sha256 !== \"70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979\") {\n throw new Error(\"CHALLENGE_SHA_DRIFT\");\n }\n}\n\nconst stateRes = await fetch(`${base}/v1/state/${lane}`, {\n headers: { Authorization: `Bearer ${gpt}` }\n});\nconst state = await stateRes.json();\nif (stateRes.status !== 200) throw new Error(\"LANE_STATE_UNREADABLE\");\n\nconst auditRes = await fetch(base + \"/v1/audit\", {\n headers: { Authorization: `Bearer ${admin}` }\n});\nconst audit = await auditRes.json();\nif (auditRes.status !== 200 || audit.audit_chain_ok !== true) throw new Error(\"AUDIT_CHAIN_NOT_OK\");\n\nconsole.log(JSON.stringify({\n selftest:\"PASS\",\n implementation_revision:health.implementation_revision,\n unauth_acceptance_status:unauthRes.status,\n acceptance_state:acceptance.state,\n mechanical_checks_passed:acceptance.mechanical_checks_passed,\n lane_revision:state.state?.revision,\n lane_checkpoint_sha256:state.state?.checkpoint_sha256,\n audit_chain_ok:audit.audit_chain_ok,\n audit_event_count:audit.count,\n production_go:false,\n evidence:acceptance.evidence ?? null\n}, null, 2));",[159],"fe3939d1-8efc-42b1-8795-8afa6cb2ac77","README.md","01a04b5e-d628-7300-9f10-1a65a7ae3e21",["D",1787970901574],"# RUMBO Continuity Relay\n\nLive durable relay for material continuity between ChatGPT-side workflows and a Codex/local runtime.\n\n## Protocol\n\n`rumbo-continuity-relay/v1`\n\nCurrent implementation: `R4-ACCEPTANCE-GUARD` (R3-GUARD preserved; runtime-acceptance verifier added).\n\n## Security model\n\n- bearer-role separation: GPT, Codex, admin;\n- no credentials in repository/code;\n- secret-bearing continuity payload rejection;\n- strict lane grammar;\n- optimistic revision control with SQLite trigger-enforced stale-write rejection;\n- exact message SHA-256 binding;\n- exact recipient ACK binding;\n- idempotent ACK replay handling;\n- append-only hash-chained audit events;\n- persistent val-scoped SQLite storage.\n\n## Codex real-runtime acceptance verifier\n\nR4 adds a read-only, fail-closed verifier for the exact lane `CODEX_REAL_RUNTIME_ACCEPTANCE_V1`.\n\nProtected endpoint:\n\n- `GET /v1/acceptance/CODEX_REAL_RUNTIME_ACCEPTANCE_V1` — GPT/admin bearer only.\n\nThe verifier derives its contract from the stored acceptance challenge and never creates an ACK, message, pairing, authorization or production promotion. It reports only evidence-backed states:\n\n`CHALLENGE_NOT_PROVEN -> PENDING_CODEX_ACK -> PENDING_CODEX_RESPONSE -> PENDING_CHATGPT_ACK -> PASS_RUNTIME_ROUNDTRIP`\n\nAmbiguous, malformed or mechanically invalid evidence fails closed. `PENDING_CHATGPT_ACK` explicitly requires semantic review before the final GPT ACK. Even `PASS_RUNTIME_ROUNDTRIP` proves only continuity transport/runtime binding and always returns `production_go=false`.\n\nCurrent authenticated self-test observes `PENDING_CODEX_ACK`, which is consistent with the live ledger: the real Codex runtime has not yet ACKed the exact challenge.\n\n## R2 external authorization guard\n\nR3-GUARD adds an external, fail-closed authorization surface for the RUMBO Continuity R2 control package.\n\nProperties:\n\n- controller bearer is held only as an encrypted Val Town environment variable;\n- target repository is bound by an opaque immutable repository-identity SHA-256;\n- control package is pinned to one exact SHA-256;\n- authorization binds exactly to action, PR number, base SHA, head SHA, package SHA-256 and evidence SHA-256;\n- raw one-time authorization tokens are returned only at issuance;\n- only token SHA-256 values are persisted;\n- authorizations have a 60–900 second TTL;\n- exact request bindings cannot be re-issued because request SHA-256 is unique;\n- consumption is atomic and one-time;\n- replay, token mismatch, binding mismatch and stale/expired authorization fail closed;\n- ledger reads never expose token hashes;\n- guard lifecycle events are added to the existing audit hash chain;\n- `production_go` is always false on this surface.\n\n### Merge gate\n\n`MERGE_PR` issuance **and consumption** are disabled unless the runtime environment explicitly contains:\n\n`R2_ALLOW_MERGE_AUTHORIZATION=true`\n\nThat variable is intentionally absent. Therefore this runtime cannot presently authorize a PR merge.\n\nA green guard receipt is not product GO and cannot substitute for live GitHub-side observation of the exact PR state.\n\n## Guard endpoints\n\nAll guard endpoints require the dedicated R2 guard bearer except public health.\n\n- `POST /v1/guard/authorize`\n- `POST /v1/guard/consume`\n- `POST /v1/guard/revoke`\n- `GET /v1/guard/authorizations/:id`\n- `GET /v1/guard/ledger`\n\nThe temporary self-test route used during branch validation was removed before promotion.\n\n## Guard validation evidence\n\nThe branch implementation was exercised against the live Val Town runtime with an internal bearer self-test that did not expose the bearer or one-time token.\n\nFinal adversarial matrix:\n\n- unauthenticated ledger → 401;\n- merge issuance while disabled → 423;\n- invalid repository binding → 400;\n- TTL below policy → 400;\n- TEST_ONLY issuance → 201;\n- invalid consumer label → 400 with authorization still ISSUED;\n- exact TEST_ONLY consumption → 200;\n- consumed-token replay → 409;\n- duplicate exact authorization request → 409;\n- read of an expired fixture → effective status EXPIRED without mutating on read;\n- revoke of expired authorization → 410 and durable EXPIRED state;\n- pre-existing MERGE_PR fixture consumption while merge gate disabled → 423;\n- revoked merge fixture → 200;\n- ledger read → 200;\n- token-hash leakage check → false.\n\nValidated receipt SHA-256:\n\n`90d2e2fd1691b523e0a0ab182ad2f41dd9a6d8dd6ec2f06d8af19c24a58e82ab`\n\nThe live health endpoint remained 200 after removal of the temporary self-test route.\n\n## Continuity endpoints\n\n- `GET /health`\n- `GET /v1/state/:lane`\n- `GET /v1/inbox?lane=...`\n- `POST /v1/messages`\n- `POST /v1/acks`\n- `GET /v1/acceptance/CODEX_REAL_RUNTIME_ACCEPTANCE_V1` (GPT/admin; read-only)\n- `GET /v1/audit` (admin only)\n\n## Boundary\n\nThe relay is a transport, evidence surface and external fail-closed authorization ledger. It does not replace lane-scoped CURRENT authority, the RUMBO continuity capsule, GitHub branch/ruleset enforcement, a dedicated GitHub App, an independent deployer, or project production authorization.\n\nA real Codex-runtime roundtrip remains a separate acceptance gate until the user's actual Codex/local runtime executes the client and produces a receipt.\n",[165],"f17d4a4f-7328-4176-baa1-a72038d07cd3","R4_PR412_SUCCESSOR_BIND.md","5015ffd4-a352-11f1-921f-1607ee4eb77e",3,["D",1787970935134],"# RUMBO R4 — Successor PR #412 Exact TEST_ONLY Binding\n\nStatus: **PASS / MERGE_NOT_AUTHORIZED / PRODUCTION_NO_GO**\n\nThis record supersedes the historical PR #392 binding for active continuity work.\n\n## Exact GitHub binding\n\n- PR: `412`\n- base SHA observed at binding precheck: `1ad77acefc7326595c50d7b0edffa81a2188e737`\n- head SHA: `d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7`\n- changed files: 5\n- PR state: OPEN / DRAFT\n- mergeable at precheck: true\n- branch relation at precheck: 7 ahead / 4 behind current main\n\nRepository identity SHA-256:\n\n`59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23`\n\nControl package SHA-256:\n\n`afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\n## External evidence object\n\nCanonical evidence SHA-256:\n\n`67613e277793d67e574db7af2399084e454209af492b78dbff2c8c99e0ff5b8b`\n\nScope:\n\n`TEST_ONLY_SUCCESSOR_PR_HEAD_BINDING_NO_MERGE_NO_PRODUCTION`\n\nThe evidence object also recorded:\n\n- runtime `R4-ACCEPTANCE-GUARD`;\n- HTTP runtime file version 40;\n- guard configured true;\n- merge authorization enabled false;\n- `production_go=false`;\n- Codex runtime acceptance `PENDING_CODEX_ACK`;\n- observer run `33229303565` queued at binding precheck.\n\n## One-time transaction\n\nVal Town evaluation ID:\n\n`01a04b5f-19d9-73cd-a69c-a81df8bad877`\n\nResult:\n\n- selftest: PASS\n- authorization ID: `5ea45798-b901-42c3-bd6a-bc3998f6c2a8`\n- request SHA-256: `28ca0c6ec5eeb5b1f54554b863cfe03c02e94876a95dee38b44713cca6b37c2d`\n- consumption receipt SHA-256: `f2fbfe727122a89f3833d97a54b9497d29d860f5bf1efdabeef76ceca708195f`\n- merge_authorized: false\n- production_go: false\n\nThe dedicated guard bearer and raw one-time token were used only inside the Val Town runtime and were not logged. The temporary self-test script was deleted after the single successful execution.\n\n## Claim boundary\n\nThis proves a live, exact, one-time TEST_ONLY authorization for the stated PR #412 snapshot.\n\nIt does not authorize merging, deployment, product production, or bypass of any unresolved trust-root gate. If the PR head or relevant base evidence changes, this receipt becomes historical and a new exact binding is required.\n",[171],"dfe0eb54-4390-40fc-8480-e361bdeb4e11","R4_PR392_FINAL_BIND.md","01a04b5e-d628-7300-9f10-155d74d6fe9d",["D",1787970901574],"# RUMBO R4 — PR #392 Final Head Binding\n\nStatus: **TEST_ONLY_BINDING_PASS / MERGE_NOT_AUTHORIZED / PRODUCTION_NO_GO**\n\nThis record binds the live external R2 guard to the exact current GitHub PR #392 head without granting merge or production authority.\n\n## GitHub binding\n\n- repository identity SHA-256: `59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23`\n- PR: `392`\n- base SHA: `fd66dc70415c2aefcd654b9f01ce5b3c4d115a7f`\n- head SHA: `bcfb38f46438535cd200d10a2cde3bcb4f7aafc2`\n- control package SHA-256: `afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\nThe PR was observed OPEN, DRAFT, mergeable, with five changed files when the evidence object was constructed.\n\n## External runtime binding\n\nRuntime: `sebas1/rumbo-continuity-relay`\n\nImplementation observed before issuance:\n\n`R4-ACCEPTANCE-GUARD`\n\nRuntime guard state:\n\n- configured: true\n- merge authorization enabled: false\n- production_go: false\n\nThe Codex real-runtime acceptance verifier remained fail-closed at:\n\n`PENDING_CODEX_ACK`\n\nChallenge message SHA-256:\n\n`70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979`\n\n## Evidence object\n\nCanonical evidence SHA-256:\n\n`2abe5bb70059597092668a7c1d50534a069aacb6f84d92037e7db21a2bf14914`\n\nScope:\n\n`TEST_ONLY_FINAL_PR_HEAD_BINDING_NO_MERGE_NO_PRODUCTION`\n\n## One-time authorization transaction\n\nA branch-scoped script used the encrypted `R2_GUARD_TOKEN_V1` environment variable to call the live main runtime. The bearer and the raw one-time token were never logged.\n\nResult:\n\n- authorize: PASS\n- consume: PASS\n- one-time authorization ID: `6c54a26a-4cf3-4893-87ff-233c5351cc3d`\n- request SHA-256: `76629d5646aca94992c6248b24d1713d8ebf795214f5b2f8716265955c1bf196`\n- consumption receipt SHA-256: `7a73164985f7f19e26fdd755f83387adc1bc2729aa193dbb15330df0c8cf8c15`\n- merge_authorized: false\n- production_go: false\n\nVal Town evaluation ID:\n\n`01a04b5b-0efc-7728-8cc1-a86bd8d43430`\n\n## Safety audit\n\nThe runtime was independently re-audited before this transaction:\n\n- five guard routes present;\n- five guard routes require the dedicated guard bearer;\n- no raw guard bearer embedded in source;\n- merge authorization blocked at both issuance and consumption;\n- no public guard self-test route;\n- unauthenticated ledger access returns 401;\n- guard token hashes are not projected by ledger/status reads;\n- `production_go=false` remains invariant;\n- R4 acceptance verifier is read-only and currently reports `PENDING_CODEX_ACK`;\n- acceptance self-test returned PASS while preserving `production_go=false`.\n\nThe temporary PR-binding script was deleted from the release branch after its single successful execution.\n\n## Claim boundary\n\nThis record proves only that the external fail-closed authorizer could issue and atomically consume one TEST_ONLY authorization bound to the exact PR #392 head above.\n\nIt does **not** prove or authorize:\n\n- `MERGE_PR`\n- `GITHUB_OBSERVER_VALIDATED`\n- `DEDICATED_GITHUB_APP_CUSTODY`\n- `EXTERNAL_DEPLOYER_LIVE`\n- `PRODUCT_GO`\n- `PRODUCTION_GO`\n\nPR #392 must remain draft while the private GitHub-hosted observer is unable to obtain a runner and until the remaining trust-root gates are satisfied.\n",[178],"074a1103-7183-49a1-a29c-ecac2c0d1c95","R4_ACCEPTANCE_RELEASE.md","01a04b5e-d628-7300-9f10-128c2ff68709",["D",1787970901574],"# RUMBO Continuity Relay — R4-ACCEPTANCE-GUARD Release Evidence\n\nDate: 2026-08-28/29 UTC\nScope: GPT↔Codex continuity relay / real-runtime acceptance verification only\nBaseline reconciled: main branch version 37 (R3-GUARD merge)\nProduction: NO_GO\n\n## Why R4 exists\n\nThe durable CURRENT V6 correctly required one real Codex runtime execution but had no live read-only endpoint that converted the exact acceptance-lane evidence into an explicit fail-closed state machine.\n\nR4 adds that verifier without changing the acceptance challenge, issuing an ACK, creating a message, consuming pairing, authorizing a project action or promoting production.\n\n## Preserved concurrent work\n\nR3-GUARD was detected as a concurrent same-scope mutation after the earlier relay baseline was read. It was reconciled before R4 edits.\n\nR4 preserves:\n- external R2 authorizer;\n- one-time-token ledger;\n- exact PR/base/head/package/evidence binding;\n- merge authorization disabled unless separately enabled;\n- production_go=false.\n\n## New protected endpoint\n\nGET /v1/acceptance/CODEX_REAL_RUNTIME_ACCEPTANCE_V1\n\nAuthorization: GPT or admin bearer only.\nMutation behavior: none.\n\nFail-closed states:\n- CHALLENGE_NOT_PROVEN\n- AMBIGUOUS_CHALLENGE_SET\n- CHALLENGE_CONTRACT_MISMATCH\n- PENDING_CODEX_ACK\n- PENDING_CODEX_RESPONSE\n- AMBIGUOUS_MULTIPLE_CODEX_RESPONSES\n- INVALID_CODEX_RESPONSE\n- PENDING_CHATGPT_ACK\n- PASS_RUNTIME_ROUNDTRIP\n\nPASS requires:\n1. exactly one stored GPT→Codex acceptance challenge;\n2. challenge contract contains all seven declared acceptance requirements;\n3. exact Codex ACK bound to challenge message id + message SHA-256;\n4. exactly one Codex→GPT reverse response;\n5. exact challenge nonce;\n6. valid SHA-256 syntax for local plugin manifest and local runtime receipt;\n7. exact final GPT ACK bound to reverse message id + message SHA-256.\n\nPENDING_CHATGPT_ACK keeps manual semantic review explicit. PASS proves only continuity transport/runtime binding; it never grants project production authorization.\n\n## Live release regression\n\nSelf-test file: acceptance_selftest.ts\nSelf-test file version: 45\nEvaluation ID: 01a04b59-7aa6-74ed-a388-865ee2e1437c\nResult: PASS\n\nObserved:\n- implementation_revision = R4-ACCEPTANCE-GUARD\n- unauthenticated acceptance request = HTTP 401\n- authenticated acceptance state = PENDING_CODEX_ACK\n- mechanical_checks_passed = false\n- lane revision = 1\n- lane checkpoint SHA-256 = d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962\n- audit_chain_ok = true\n- audit event count at release test = 29\n- production_go = false\n\nExact challenge:\n- message id = f7ca12d8-226a-43b9-9fc0-bd9ede8548af\n- message SHA-256 = 70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979\n- acked_at = null\n\nReal pairing:\n- pairing id codex-v4 rows observed = 0\n- therefore production pairing is NOT_ISSUED / NOT_CONFIRMED.\n\n## Source versions at seal preparation\n\n- main.tsx = version 40\n- README.md = version 44\n- acceptance_selftest.ts = version 45\n- R3_GUARD_RELEASE.md = version 37\n\n## Reconciliation with durable CURRENT\n\nSECOND_BRAIN_CONTINUITY_CURRENT_V6 remains semantically correct for the gate:\n- actual Codex runtime requires one real execution;\n- full federated runtime remains NO_GO until real Codex response and final ChatGPT ACK.\n\nIts relay implementation label is now stale relative to the live relay because R3-GUARD and R4-ACCEPTANCE-GUARD were promoted afterward. This release evidence is an append-only live implementation delta; it does not silently rewrite the durable CURRENT pointer.\n\n## Truth boundary\n\nR4_IMPLEMENTATION = PASS_LIVE\nR4_SELFTEST = PASS\nAUDIT_CHAIN = PASS\nREAL_CODEX_PAIRING_V4 = NOT_PROVEN\nREAL_CODEX_ACK = NOT_PROVEN\nREAL_CODEX_RESPONSE = NOT_PROVEN\nFINAL_CHATGPT_ACK = NOT_PROVEN\nFULL_FEDERATED_RUNTIME = NO_GO\nPRODUCTION = NO_GO\n\n## Next gate\n\nThe only valid next promotion event is a real user Codex/local runtime:\n1. performs V4 pairing/bootstrap;\n2. consumes this exact challenge;\n3. ACKs this exact challenge id + SHA-256;\n4. publishes one reverse response with the same nonce plus local manifest/runtime receipt SHA-256 values;\n5. then ChatGPT performs semantic review and exact final ACK.\n\nNo simulation, static package, activation ZIP, self-test or prepared launcher may substitute for that receipt.\n",[184],"fa39c2f3-ec87-4995-bb4c-30e4a45430b5","R3_GUARD_RELEASE.md","01a04b5e-d628-7300-9f10-0e664c3bb8aa",["D",1787970901574],"# RUMBO Continuity Relay — R3-GUARD Release Evidence\n\nDate: 2026-08-28/29 UTC \nBranch: `r2-guard-v1` \nSource file: `main.tsx` version 23 before this evidence-file commit \nPrior main baseline: version 36\n\n## Scope\n\nR3-GUARD adds a fail-closed external authorization runtime and durable one-time-token ledger for the RUMBO Continuity R2 control package.\n\nIt does **not** grant product production approval, does not deploy the product, does not provide native GitHub branch protection, and does not claim dedicated GitHub App custody.\n\n## Exact package pin\n\n`afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\nLocal package evidence retained by the R2 control lane:\n\n- unit tests: 105/105 PASS\n- blackbox: 43/43 PASS\n- static groups: 9/9 PASS\n- manifest entries: 99/99 verified\n\n## Runtime safety properties\n\n- dedicated encrypted guard bearer; no bearer value in source;\n- exact opaque repository-identity SHA-256 pin;\n- exact PR/base/head/package/evidence binding;\n- one-time random token, persisted only as SHA-256;\n- 60–900 second TTL;\n- duplicate exact request rejection;\n- atomic single consumption;\n- replay rejection;\n- exact binding mismatch rejection;\n- expiry enforcement;\n- guard lifecycle events hash-chained through the existing audit ledger;\n- protected ledger/status endpoints;\n- token hashes omitted from read APIs;\n- `production_go=false` invariant;\n- `MERGE_PR` blocked at both issuance and consumption unless an explicit runtime gate is enabled.\n\nThe merge-enabling environment variable is intentionally absent.\n\n## Live adversarial self-test V2\n\nTrace ID:\n\n`01a04b54d32f71f6a6603bbca17a4e44`\n\nHTTP result: 200.\n\nChecks:\n\n- unauthorized ledger: 401\n- merge issuance disabled: 423\n- invalid repository binding: 400\n- invalid TTL: 400\n- TEST_ONLY authorize: 201\n- invalid consumer: 400; state remained ISSUED\n- TEST_ONLY consume: 200\n- replay: 409\n- duplicate authorize: 409\n- effective expired read: 200 / EXPIRED\n- revoke expired authorization: 410 / durable EXPIRED\n- MERGE_PR fixture consume while disabled: 423\n- merge fixture revoke: 200\n- ledger: 200\n- token-hash leakage: false\n\nTEST_ONLY consumption receipt SHA-256:\n\n`90d2e2fd1691b523e0a0ab182ad2f41dd9a6d8dd6ec2f06d8af19c24a58e82ab`\n\nTemporary self-test and housekeeping HTTP routes were removed before release.\n\n## Final static audit\n\n- guard routes present: 5\n- guard routes with explicit bearer check: 5\n- self-test routes present: 0\n- raw guard bearer embedded in source: false\n- merge-disabled branches present at issuance and consumption: true\n- public/authenticated ledger projection includes token SHA-256: false\n- production-go false markers retained: true\n\n## Post-cleanup live check\n\n`GET /health` returned 200 with:\n\n- implementation revision `R3-GUARD`\n- guard configured: true\n- merge authorization enabled: false\n- production_go: false\n\n## Promotion boundary\n\nPromotion of this branch means only:\n\n`EXTERNAL_AUTHORIZER_LIVE_FAIL_CLOSED` \n`ONE_TIME_TOKEN_LEDGER_LIVE`\n\nIt does not mean:\n\n`GITHUB_OBSERVER_VALIDATED` \n`DEDICATED_GITHUB_APP_CUSTODY` \n`EXTERNAL_DEPLOYER_LIVE` \n`PRODUCT_GO` \n`PRODUCTION_GO`\n",[190],"8df8c646-1efd-4bcd-9a45-3ddc6b06a415","components","01a04b5e-d628-7300-9f10-0848bb668a6e",["D",1787970901574],"directory",[196],"pulls","branches",26,"forks","envVars",{"_209":211,"_212":62},"connections",{"_209":62,"_210":62},"count","unfilledCount",21,"emptyCount",{"_42":195,"_32":196,"_30":197,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":243,"_13":62,"_33":199,"_35":-5,"_24":48,"_156":-5,"_222":244,"_27":245},{"_42":189,"_32":190,"_30":191,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":240,"_13":62,"_33":20,"_35":193,"_24":48,"_156":-5,"_222":241,"_27":242},{"_42":183,"_32":184,"_30":185,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":237,"_13":62,"_33":20,"_35":187,"_24":48,"_156":-5,"_222":238,"_27":239},{"_42":177,"_32":178,"_30":179,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":234,"_13":62,"_33":20,"_35":181,"_24":48,"_156":-5,"_222":235,"_27":236},{"_42":170,"_32":171,"_30":172,"_150":-5,"_40":41,"_39":173,"_152":25,"_37":231,"_13":62,"_33":20,"_35":175,"_24":48,"_156":-5,"_222":232,"_27":233},{"_42":164,"_32":165,"_30":166,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":228,"_13":62,"_33":20,"_35":168,"_24":48,"_156":-5,"_222":229,"_27":230},{"_42":158,"_32":159,"_30":160,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":225,"_13":62,"_33":34,"_35":162,"_24":48,"_156":-5,"_222":226,"_27":227},{"_42":147,"_32":148,"_30":149,"_150":-5,"_40":41,"_39":151,"_152":25,"_37":221,"_13":62,"_33":154,"_35":155,"_24":48,"_156":-5,"_222":223,"_27":224},["D",1787970901574],"children",[],[148],["D",1787970901574],[],[159],["D",1787970901574],[],[165],["D",1787970935134],[],[171],["D",1787970901574],[],[178],["D",1787970901574],[],[184],["D",1787970901574],[],[190],["D",1787970901574],[],[196],["D",1787964475423],["D",1789531243171],{"_100":99,"_108":104},{"_100":99,"_101":102,"_103":104,"_18":55,"_105":106,"_107":48},{"_13":14,"_32":88,"_42":41,"_89":43,"_90":91,"_92":93,"_94":50,"_95":43,"_96":64,"_97":44,"_98":99},"ctx",{"_81":-5,"_129":284,"_285":286,"_287":288,"_289":48,"_290":48,"_291":48,"_292":25,"_293":-5,"_294":-7,"_295":-7,"_296":62,"_297":48,"_298":48,"_299":-5,"_300":48,"_301":48,"_302":48,"_303":-5},"ENV",{"_255":256,"_257":258,"_259":135,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v4