[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_457":458,"_459":460},"routes/_app.x.$handle.$name",{"_99":98,"_31":42,"_108":87,"_26":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":122,"_123":24,"_124":125,"_126":56,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",43,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","R8_ISOLATED_LOCAL_READ_RELEASE.md","latestPath","fileId","d0ec0866-a35b-11f1-bd03-1607ee4eb77e","name","fileType","content","# RUMBO Continuity Relay — R8 ISOLATED LOCAL-READ ATTESTATION\n\nDate: 2026-08-29 UTC\nFork baseline: main version 67\nBranch: r8-isolated-local-read\nProduction: NO_GO\n\n## Recovered authority\n\nDurable File Library CURRENT at task start: SECOND_BRAIN_CONTINUITY_CURRENT_V9_20260829.json.\nV9 recognized R7-ACTUAL-CODEX-ATTESTATION / CODEX_REAL_RUNTIME_ACCEPTANCE_V2 as active and actual Windows Codex runtime NOT_OBSERVED.\n\nConcurrent live main progressed to R7 launcher 2.2 at version 67. R8 was forked only after reconciling that live state.\n\n## Defects found in R7\n\n1. R7 inherited the user's Codex configuration and required user_config_preserved=true.\n2. Current Codex behavior has a reported path where approvals_reviewer=auto_review can undermine an explicitly requested read-only exec.\n3. R7 did not force --ask-for-approval never.\n4. R7 supplied the expected local plugin manifest SHA directly to the model prompt, so an actual Codex turn could echo the expected value without proving a local file read.\n\nR8 does not promote R7 evidence.\n\n## Active successor challenge\n\nLane: CODEX_REAL_RUNTIME_ACCEPTANCE_V3\nChallenge id: 303a5235-c328-4e8e-b0f6-a699b656df79\nChallenge message SHA-256: c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157\nPayload SHA-256: 4989f3315fad248b96a7a5c54a06fe805c485849a89358276b6be8123678bf16\nCheckpoint SHA-256: 762b65bc2ca570b71d31b616e2f80eb0660158ae4f06235fa015bdc251376563\nRevision: 1\nDeadline: 2026-08-30T03:15:00Z\nPublish evaluation: 01a04b8f-44e7-708d-a596-d5dbb0b47e9c\n\nV1 and V2 become superseded only when R8 server code is promoted. Codex writes/ACKs to V1/V2 are then rejected.\n\n## R8 Python launcher\n\nPath: /v1/bootstrap/codex-device.py\nBlob: bootstrap/r8/codex_device_bootstrap_v3.py\nVersion: 3.0\nBytes: 16984\nSHA-256: 6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\nPlugin version: 1.2.0\nPlugin manifest SHA-256: c0f12562dbee00f897b7f0d164b35845f7388ec996c19b371c0ccf6e0fb12d27\nEmbedded credentials: false\nLocal py_compile on exact bytes: PASS\n\n### Isolation/proof contract\n\nBefore device pairing:\n- locate Codex CLI;\n- create a temporary isolated CODEX_HOME;\n- copy auth.json only when present;\n- remove inherited CODEX_* environment variables;\n- verify global --ask-for-approval and --sandbox support;\n- verify exec --ignore-user-config, --ignore-rules, --ephemeral, --output-schema and --output-last-message support;\n- verify isolated login status.\n\nActual command uses global flags before exec:\ncodex --ask-for-approval never --sandbox read-only exec --ignore-user-config --ignore-rules --skip-git-repo-check --ephemeral --json ...\n\nThe worktree contains:\n- exact local plugin.json;\n- canonical V1.6 Skill;\n- a fresh random RUNTIME_LOCAL_READ_CHALLENGE.txt.\n\nThe prompt does not contain the expected plugin manifest SHA or the hidden local-read hash. Codex must read/hash both local files. The launcher checks the returned hashes locally before pairing confirmation, ACK or response publication.\n\nFinal local fake-Codex harness against exact launcher bytes:\n- script SHA exact: PASS\n- CLI safety flag order: PASS\n- isolated CODEX_HOME: PASS\n- CLI capability preflight: PASS\n- hidden local-read proof: PASS\n- expected proof values absent from prompt: PASS\n\n## Device-session binding\n\nPublic device start now requires exact:\n- R8 bootstrap SHA;\n- V3 lane;\n- V3 challenge id;\n- V3 challenge SHA.\n\nThe relay persists that contract in device_pairing_contracts. The authorized poll validates the persisted contract and returns device_pairing_session_id.\n\nThe V3 runtime response must include that session id. Mechanical acceptance requires:\n- session exists;\n- approved_by is GPT/admin;\n- approved_at <= delivered_at <= expires_at;\n- codex-v4 confirmation happened after bearer delivery and before Codex ACK;\n- contract bootstrap/lane/challenge bindings exact;\n- device session SHA equals codex-v4 pairing SHA.\n\nThis prevents a static Codex bearer from substituting for an approved R8 device session.\n\nExpired unapproved session cleanup deletes device_pairing_contracts before the parent session, preserving R5 liveness under the new FK.\n\n## Windows wrapper\n\nPath: /v1/bootstrap/codex-device.ps1\nBlob: bootstrap/r8/RUN_RUMBO_CODEX_R8.ps1\nBytes: 2929\nSHA-256: b278b6db8c177453c45a85982017851357a6431f73cdd722dc478d7ed391fc3a\n\nThe wrapper verifies:\n- Codex is on PATH;\n- Python >=3.11;\n- live R8 revision/schema/lane/challenge;\n- deadline not expired;\n- downloaded Python launcher exact SHA and byte length;\n- temp cleanup.\n\n## Test evidence\n\nFinal blob integrity self-test:\nevaluation 01a04b98-eca8-70da-a061-f9f570553e6c\nPASS, exact 16984 bytes / exact SHA, isolation flags and prompt-proof checks.\n\nFinal branch regression:\nevaluation 01a04b9c-ba77-750d-ba26-d62c748bb4ac\nPASS:\n- R8 branch health;\n- Python launcher exact bytes/SHA;\n- Windows launcher exact bytes/SHA;\n- V1 superseded;\n- V2 superseded;\n- V3 PENDING_CODEX_ACK;\n- V3 revision/checkpoint exact;\n- stale R7 device start blocked;\n- V2 Codex ACK blocked;\n- V2 Codex response blocked;\n- device contract persisted;\n- pre-approval poll 202;\n- unauth approval 401;\n- GPT synthetic approval 200;\n- token_delivered=false;\n- codex-v4 untouched;\n- audit_chain_ok=true;\n- production_go=false.\n\nStatic/adversarial audit:\n27/27 checks PASS.\nR2_ALLOW_MERGE_AUTHORIZATION remains absent.\nNo literal API/GitHub/bearer secret in launcher.\n\nSelf-audit notes:\n- an early R8 branch test cleanup failed because FK child was not deleted before parent; functionality had passed. Teardown was corrected.\n- the first teardown patch inserted literal \\n into the TS test and failed parsing; corrected and rerun PASS.\n- acceptance_selftest.ts now targets future main R8; its branch-time run failed R8_HEALTH because main is intentionally still R7. It must be rerun after promotion and is not counted as a branch implementation failure.\n\n## Truth boundary before promotion\n\nR8_BRANCH = PASS\nR8_LAUNCHER = PASS_VERIFIED_BYTES\nR8_WINDOWS_WRAPPER = PASS_VERIFIED_BYTES\nV3_CHALLENGE = PUBLISHED_PENDING_CODEX\nREAL_CODEX_PAIRING_V4 = NOT_PROVEN\nREAL_CODEX_ACK_V3 = NOT_PROVEN\nREAL_CODEX_RESPONSE_V3 = NOT_PROVEN\nFINAL_CHATGPT_ACK_V3 = NOT_PROVEN\nACTUAL_WINDOWS_CODEX_RUNTIME = NOT_OBSERVED\nFULL_FEDERATED_RUNTIME = NO_GO\nPRODUCTION = NO_GO\n\nPromotion is permitted only if main is still exactly version 67 at the final stale check. After merge, all current tests must be rerun on main before R8_MAIN can be PASS_LIVE.\n","createdAt",["D",1787975016752],"branchVersion","branchId","9f4624b3-beea-4ec7-a452-ae9964039771","id","ea8b2cee-9441-4610-a164-e736539c861b","rumbo-continuity-relay",["D",1787964475423],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Durable GPT-Codex continuity relay","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","01a04afc-c88b-766f-9e89-3c0c81cf30bc","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","ea8b2cee94414610a164e736539c861b","tursoHostname","ea8b2cee94414610a164e736539c861b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789531243171],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":52,"_104":105,"_106":24},"branch",{"_13":86,"_31":87,"_40":39,"_88":41,"_89":90,"_91":92,"_93":47,"_94":41,"_95":62,"_96":42,"_97":98},"isOwned",46,"r8-isolated-local-read","projectId","forkedBranchId","cdbfe23c-d122-4f18-ad6e-34fdd0cb88da","forkedBranchVersion",67,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":452,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":453,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":454,"_81":455,"_83":456,"_85":24},"tree",[347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372],"files",[347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372],"counts",{"_336":60,"_337":338,"_339":60,"_340":341,"_342":343},"contents",[138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163],"upstreamProject","upstreamBranch",{"_40":90,"_35":131,"_132":133,"_31":134,"_88":41,"_13":135,"_89":-5,"_91":-5,"_136":137,"_44":-5,"_85":24,"_46":47,"_97":98,"_61":62,"_96":42},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787964475423],"updatedAt",["D",1788191453959],"main",234,"lockfileKey","1788191454040-esm.town_v_sebas1_rumbo-continuity-relay@234-main",{"_40":330,"_31":331,"_29":332,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":333,"_13":60,"_32":334,"_33":-5,"_23":24,"_173":-5,"_26":335},{"_40":324,"_31":325,"_29":326,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":327,"_13":60,"_32":20,"_33":328,"_23":24,"_173":-5,"_26":329},{"_40":318,"_31":319,"_29":320,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":321,"_13":60,"_32":20,"_33":322,"_23":24,"_173":-5,"_26":323},{"_40":312,"_31":313,"_29":314,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":315,"_13":60,"_32":20,"_33":316,"_23":24,"_173":-5,"_26":317},{"_40":306,"_31":307,"_29":308,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":309,"_13":60,"_32":20,"_33":310,"_23":24,"_173":-5,"_26":311},{"_40":300,"_31":301,"_29":302,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":303,"_13":60,"_32":20,"_33":304,"_23":24,"_173":-5,"_26":305},{"_40":294,"_31":295,"_29":296,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":297,"_13":60,"_32":20,"_33":298,"_23":24,"_173":-5,"_26":299},{"_40":288,"_31":289,"_29":290,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":291,"_13":60,"_32":20,"_33":292,"_23":24,"_173":-5,"_26":293},{"_40":285,"_31":27,"_29":30,"_167":-5,"_38":39,"_37":14,"_169":56,"_35":286,"_13":60,"_32":20,"_33":34,"_23":24,"_173":-5,"_26":287},{"_40":278,"_31":279,"_29":280,"_167":-5,"_38":39,"_37":281,"_169":56,"_35":282,"_13":207,"_32":20,"_33":283,"_23":24,"_173":-5,"_26":284},{"_40":271,"_31":272,"_29":273,"_167":-5,"_38":39,"_37":274,"_169":56,"_35":275,"_13":60,"_32":20,"_33":276,"_23":24,"_173":-5,"_26":277},{"_40":264,"_31":265,"_29":266,"_167":-5,"_38":39,"_37":267,"_169":56,"_35":268,"_13":207,"_32":171,"_33":269,"_23":24,"_173":-5,"_26":270},{"_40":256,"_31":257,"_29":258,"_167":-5,"_38":39,"_37":259,"_169":56,"_35":260,"_13":261,"_32":20,"_33":262,"_23":24,"_173":-5,"_26":263},{"_40":247,"_31":248,"_29":249,"_167":-5,"_38":39,"_37":250,"_169":56,"_35":251,"_13":252,"_32":253,"_33":254,"_23":24,"_173":-5,"_26":255},{"_40":241,"_31":242,"_29":243,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":244,"_13":60,"_32":171,"_33":245,"_23":24,"_173":-5,"_26":246},{"_40":235,"_31":236,"_29":237,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":238,"_13":60,"_32":171,"_33":239,"_23":24,"_173":-5,"_26":240},{"_40":229,"_31":230,"_29":231,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":232,"_13":60,"_32":171,"_33":233,"_23":24,"_173":-5,"_26":234},{"_40":223,"_31":224,"_29":225,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":226,"_13":60,"_32":171,"_33":227,"_23":24,"_173":-5,"_26":228},{"_40":217,"_31":218,"_29":219,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":220,"_13":60,"_32":171,"_33":221,"_23":24,"_173":-5,"_26":222},{"_40":211,"_31":212,"_29":213,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":214,"_13":60,"_32":171,"_33":215,"_23":24,"_173":-5,"_26":216},{"_40":204,"_31":205,"_29":206,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":208,"_13":60,"_32":171,"_33":209,"_23":24,"_173":-5,"_26":210},{"_40":197,"_31":198,"_29":199,"_167":-5,"_38":39,"_37":200,"_169":24,"_35":201,"_13":60,"_32":171,"_33":202,"_23":24,"_173":-5,"_26":203},{"_40":190,"_31":191,"_29":192,"_167":-5,"_38":39,"_37":193,"_169":56,"_35":194,"_13":178,"_32":171,"_33":195,"_23":24,"_173":-5,"_26":196},{"_40":182,"_31":183,"_29":184,"_167":-5,"_38":39,"_37":185,"_169":56,"_35":186,"_13":187,"_32":171,"_33":188,"_23":24,"_173":-5,"_26":189},{"_40":175,"_31":176,"_29":177,"_167":-5,"_38":39,"_37":178,"_169":24,"_35":179,"_13":60,"_32":171,"_33":180,"_23":24,"_173":-5,"_26":181},{"_40":164,"_31":165,"_29":166,"_167":-5,"_38":39,"_37":168,"_169":24,"_35":170,"_13":60,"_32":171,"_33":172,"_23":24,"_173":-5,"_26":174},"0fff60f0-0507-47ba-b0a1-d4111330a758","r8_windows_probe.ts","6ad9c57c-a35b-11f1-b42e-1607ee4eb77e","parentId",36,"latest",["D",1787974845505],"script","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nfor(const key of [\"bootstrap/r8/RUN_RUMBO_CODEX_R8.ps1\"]){\n const r=await blob.get(key); const raw=new Uint8Array(await r.arrayBuffer());\n const d=await crypto.subtle.digest(\"SHA-256\",raw);\n const sha=[...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n console.log(JSON.stringify({key,bytes:raw.length,sha256:sha}));\n}","label",[165],"59a4cd50-33e7-457a-8ef8-ff952cbb05fd","r8_prepare_challenge.ts","9e58f244-a359-11f1-a402-1607ee4eb77e",2,["D",1787974072914],"const base=\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\";\nconst token=Deno.env.get(\"GPT_TOKEN_V4\");\nif(!token) throw new Error(\"GPT_TOKEN_V4_MISSING\");\nconst lane=\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\";\nconst state=await fetch(base+\"/v1/state/\"+lane,{headers:{authorization:\"Bearer \"+token}});\nif(state.status===200){\n const s=await state.json();\n if(Number(s.state?.revision||0)!==0) throw new Error(\"V3_LANE_ALREADY_NONZERO\");\n}\nconst raw=new Uint8Array(32); crypto.getRandomValues(raw);\nconst nonce=btoa(String.fromCharCode(...raw)).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/,\"\");\nconst payload={\n kind:\"runtime_acceptance_challenge_v3\",\n challenge_nonce:nonce,\n acceptance_not_after_utc:\"2026-08-30T03:15:00Z\",\n canonical_release:\"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n canonical_release_sha256:\"cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b\",\n canonical_skill_sha256:\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n expected_plugin_name:\"rumbo-gpt-codex-continuity\",\n expected_plugin_version:\"1.2.0\",\n acceptance_requirements:[\n \"consume_this_exact_message\",\n \"ack_exact_message_id_and_message_sha256\",\n \"execute_actual_codex_cli_isolated_read_only_never_approve\",\n \"prove_fresh_local_read_challenge_not_present_in_prompt\",\n \"publish_reverse_response_with_same_challenge_nonce\",\n \"include_local_plugin_manifest_sha256\",\n \"include_local_runtime_receipt_sha256\",\n \"include_local_read_challenge_sha256\",\n \"include_codex_runtime_nonce\",\n \"include_codex_last_message_sha256\",\n \"include_codex_exec_events_sha256\",\n \"do_not_include_secrets\",\n \"preserve_fail_closed_project_gates\",\n \"production_go_false\"\n ],\n required_codex_execution:{\n mode:\"codex exec\",\n ephemeral:true,\n sandbox:\"read-only\",\n ask_for_approval:\"never\",\n skip_git_repo_check:true,\n dangerous_bypass_forbidden:true,\n model_override_forbidden:true,\n isolated_codex_home:true,\n user_config_inherited:false,\n project_config_inherited:false,\n local_read_challenge_required:true,\n hidden_local_nonce_not_in_prompt:true\n },\n claim_boundary:\"Continuity runtime/local-read binding only. Does not authorize project production, deployment, merge, payment, identity, or other irreversible action.\"\n};\nconst res=await fetch(base+\"/v1/messages\",{\n method:\"POST\",\n headers:{authorization:\"Bearer \"+token,\"content-type\":\"application/json\"},\n body:JSON.stringify({lane,base_revision:0,request_id:\"r8-v3-runtime-acceptance-challenge-20260829\",payload})\n});\nconst out=await res.json();\nif(res.status!==201&&res.status!==200) throw new Error(\"CHALLENGE_PUBLISH_\"+res.status+\"_\"+JSON.stringify(out));\nconsole.log(JSON.stringify({status:\"PASS\",...out,nonce_length:nonce.length},null,2));",[176],"0677bb46-392b-4743-9f49-660799cbc9f9","r8_branch_regression.ts","a8c69af0-a35a-11f1-947c-1607ee4eb77e",41,["D",1787974957496],4,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nconst base=\"https://sebas1--01a04b8ef2f5718d89db3c8ae3de3ec5.web.val.run\";\nconst gpt=Deno.env.get(\"GPT_TOKEN_V4\"), codex=Deno.env.get(\"CODEX_TOKEN_V4\"), admin=Deno.env.get(\"ADMIN_TOKEN_V4\");\nif(!gpt||!codex||!admin) throw new Error(\"R8_REQUIRED_ENV_MISSING\");\nconst V1=\"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\", V2=\"CODEX_REAL_RUNTIME_ACCEPTANCE_V2\", V3=\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\";\nconst challengeId=\"303a5235-c328-4e8e-b0f6-a699b656df79\";\nconst challengeSha=\"c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157\";\nconst launcherSha=\"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\";\nlet fixture=\"\";\n\nasync function req(method:string,path:string,body?:unknown,token?:string,ok=[200]){\n const r=await fetch(base+path,{method,headers:{\n ...(body!==undefined?{\"content-type\":\"application/json\"}:{}),\n ...(token?{authorization:\"Bearer \"+token}:{}),\n \"user-agent\":\"r8-branch-regression/1\"\n },body:body===undefined?undefined:JSON.stringify(body),cache:\"no-store\"});\n let x:any=null; const raw=await r.text(); try{x=JSON.parse(raw)}catch{x=raw}\n if(!ok.includes(r.status)) throw new Error(path+\"_HTTP_\"+r.status+\"_\"+JSON.stringify(x));\n return {status:r.status,body:x};\n}\ntry {\n const health=await req(\"GET\",\"/health\");\n if(health.body.implementation_revision!==\"R8-ISOLATED-LOCAL-READ-ATTESTATION\"||health.body.production_go!==false) throw new Error(\"HEALTH_DRIFT\");\n if(!health.body.capabilities?.includes(\"isolated-codex-home-attestation\")||!health.body.capabilities?.includes(\"hidden-local-read-challenge\")) throw new Error(\"CAPABILITY_DRIFT\");\n\n const meta=await req(\"GET\",\"/v1/bootstrap/codex-device/metadata\");\n if(meta.body.schema!==\"rumbo-codex-device-bootstrap/v3\"||meta.body.launcher_sha256!==launcherSha||meta.body.launcher_bytes!==16984||meta.body.launcher_version!==\"3.0\"||meta.body.windows_launcher_sha256!==\"b278b6db8c177453c45a85982017851357a6431f73cdd722dc478d7ed391fc3a\"||meta.body.windows_launcher_bytes!==2929) throw new Error(\"META_DRIFT\");\n if(meta.body.acceptance_lane!==V3||meta.body.challenge_message_id!==challengeId||meta.body.challenge_message_sha256!==challengeSha) throw new Error(\"META_CHALLENGE_DRIFT\");\n const sb=meta.body.security_boundary||{};\n if(sb.codex_exec_ask_for_approval!==\"never\"||sb.isolated_codex_home!==true||sb.user_config_inherited!==false||sb.project_config_inherited!==false||sb.hidden_local_read_challenge_required!==true) throw new Error(\"META_SECURITY_BOUNDARY\");\n\n const boot=await fetch(base+\"/v1/bootstrap/codex-device.py\",{cache:\"no-store\"});\n const bytes=new Uint8Array(await boot.arrayBuffer());\n const digest=await crypto.subtle.digest(\"SHA-256\",bytes);\n const bootSha=[...new Uint8Array(digest)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n if(boot.status!==200||bytes.length!==16984||bootSha!==launcherSha||boot.headers.get(\"x-sha256\")!==launcherSha) throw new Error(\"BOOTSTRAP_HTTP_DRIFT\");\n const win=await fetch(base+\"/v1/bootstrap/codex-device.ps1\",{cache:\"no-store\"});\n const winBytes=new Uint8Array(await win.arrayBuffer());\n const winDigest=await crypto.subtle.digest(\"SHA-256\",winBytes);\n const winSha=[...new Uint8Array(winDigest)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n if(win.status!==200||winBytes.length!==2929||winSha!==\"b278b6db8c177453c45a85982017851357a6431f73cdd722dc478d7ed391fc3a\"||win.headers.get(\"x-sha256\")!==winSha) throw new Error(\"WINDOWS_BOOTSTRAP_HTTP_DRIFT\");\n\n for(const lane of [V1,V2]){\n const a=await req(\"GET\",\"/v1/acceptance/\"+lane,undefined,gpt);\n if(a.body.state!==\"SUPERSEDED_BY_CODEX_REAL_RUNTIME_ACCEPTANCE_V3\"||a.body.active_lane!==V3) throw new Error(\"SUPERSESSION_\"+lane);\n }\n const a3=await req(\"GET\",\"/v1/acceptance/\"+V3,undefined,gpt);\n if(a3.body.state!==\"PENDING_CODEX_ACK\"||a3.body.mechanical_checks_passed!==false||a3.body.production_go!==false) throw new Error(\"V3_ACCEPTANCE_\"+JSON.stringify(a3.body));\n\n const st=await req(\"GET\",\"/v1/state/\"+V3,undefined,gpt);\n if(Number(st.body.state?.revision)!==1||st.body.state?.checkpoint_sha256!==\"762b65bc2ca570b71d31b616e2f80eb0660158ae4f06235fa015bdc251376563\") throw new Error(\"V3_STATE_DRIFT\");\n\n const oldStart=await req(\"POST\",\"/v1/pair/codex/device/start\",{client_label:\"codex-r7:stale\"},undefined,[409]);\n if(oldStart.body.error!==\"DEVICE_BOOTSTRAP_CONTRACT_MISMATCH\") throw new Error(\"OLD_BOOTSTRAP_NOT_BLOCKED\");\n\n const oldAck=await req(\"POST\",\"/v1/acks\",{message_id:\"0d0f03ed-ba76-4607-acb8-e5f64ce40b61\",message_sha256:\"53bb04b8b2d01b5bea40ad5d02b8c9806c4f5f1d65ee108144995913b469238a\"},codex,[409]);\n if(oldAck.body.error!==\"ACCEPTANCE_LANE_SUPERSEDED\") throw new Error(\"OLD_ACK_NOT_BLOCKED\");\n const oldMessage=await req(\"POST\",\"/v1/messages\",{lane:V2,base_revision:1,request_id:\"r8-old-v2-write-block-test\",payload:{kind:\"test\"}},codex,[409]);\n if(oldMessage.body.error!==\"ACCEPTANCE_LANE_SUPERSEDED\") throw new Error(\"OLD_MESSAGE_NOT_BLOCKED\");\n\n const start=await req(\"POST\",\"/v1/pair/codex/device/start\",{\n client_label:\"r8-branch-regression\",\n bootstrap_script_sha256:launcherSha,\n acceptance_lane:V3,challenge_message_id:challengeId,challenge_message_sha256:challengeSha\n },undefined,[201]);\n fixture=String(start.body.pairing_id||\"\");\n const contract=await sqlite.execute({sql:\"SELECT bootstrap_script_sha256,acceptance_lane,challenge_message_id,challenge_message_sha256 FROM device_pairing_contracts WHERE pairing_id=?\",args:[fixture]});\n const cr:any=contract.rows[0];\n if(!cr||cr.bootstrap_script_sha256!==launcherSha||cr.acceptance_lane!==V3||cr.challenge_message_id!==challengeId||cr.challenge_message_sha256!==challengeSha) throw new Error(\"DEVICE_CONTRACT_DRIFT\");\n if(!/^[A-Za-z0-9_-]{43}$/.test(String(start.body.device_code||\"\"))||!/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(String(start.body.user_code||\"\"))) throw new Error(\"DEVICE_CODES_INVALID\");\n\n const pending=await req(\"POST\",\"/v1/pair/codex/device/poll\",{device_code:start.body.device_code},undefined,[202]);\n if(pending.body.authorized!==false||pending.body.status!==\"PENDING_APPROVAL\") throw new Error(\"PENDING_OPEN\");\n const unauth=await req(\"POST\",\"/v1/pair/codex/device/approve\",{user_code:start.body.user_code},undefined,[401]);\n if(unauth.body.error!==\"UNAUTHORIZED\") throw new Error(\"UNAUTH_APPROVAL\");\n const approved=await req(\"POST\",\"/v1/pair/codex/device/approve\",{user_code:start.body.user_code},gpt,[200]);\n if(approved.body.approved!==true||approved.body.idempotent!==false||approved.body.production_go!==false) throw new Error(\"APPROVE_FAIL\");\n const replay=await req(\"POST\",\"/v1/pair/codex/device/approve\",{user_code:start.body.user_code},gpt,[200]);\n if(replay.body.idempotent!==true) throw new Error(\"APPROVE_REPLAY\");\n\n const drow=await sqlite.execute({sql:\"SELECT approved_at,approved_by,delivered_at FROM device_pairing_sessions WHERE pairing_id=?\",args:[fixture]});\n const dr:any=drow.rows[0];\n if(!dr?.approved_at||dr.approved_by!==\"gpt\"||dr.delivered_at) throw new Error(\"DEVICE_DB_DRIFT\");\n\n const real=await sqlite.execute({sql:\"SELECT COUNT(*) AS n FROM pairing_sessions WHERE pairing_id='codex-v4'\"});\n if(Number((real.rows[0] as any)?.n ?? -1)!==0) throw new Error(\"REAL_PAIRING_TOUCHED\");\n\n const audit=await req(\"GET\",\"/v1/audit\",undefined,admin);\n if(audit.body.audit_chain_ok!==true) throw new Error(\"AUDIT_CHAIN_FAIL\");\n\n console.log(JSON.stringify({\n selftest:\"PASS\",implementation_revision:health.body.implementation_revision,\n launcher_sha256:bootSha,launcher_bytes:bytes.length,windows_launcher_sha256:winSha,windows_launcher_bytes:winBytes.length,device_contract_persisted:true,\n v1_superseded:true,v2_superseded:true,v3_state:a3.body.state,\n v3_revision:st.body.state.revision,v3_checkpoint_sha256:st.body.state.checkpoint_sha256,\n old_r7_device_start_blocked:true,old_v2_ack_blocked:true,old_v2_response_blocked:true,\n device_start_http:201,pending_poll_http:202,unauth_approval_http:401,gpt_approval_http:200,\n token_delivered:false,real_codex_pairing_touched:false,\n audit_chain_ok:true,audit_event_count:audit.body.count,production_go:false,\n actual_windows_codex_runtime:\"NOT_PROVEN_BY_THIS_TEST\"\n },null,2));\n} finally {\n if(fixture) {\n await sqlite.execute({sql:\"DELETE FROM device_pairing_contracts WHERE pairing_id=?\",args:[fixture]});\n await sqlite.execute({sql:\"DELETE FROM device_pairing_sessions WHERE pairing_id=?\",args:[fixture]});\n }\n const remaining=await sqlite.execute({sql:\"SELECT COUNT(*) AS n FROM device_pairing_sessions WHERE client_label='r8-branch-regression'\"});\n if(Number((remaining.rows[0] as any)?.n ?? -1)!==0) throw new Error(\"FIXTURE_CLEANUP_FAIL\");\n}",[183],"af896cce-29db-4196-83bd-19528934d291","r8_blob_selftest.ts","305e5ef4-a35a-11f1-8cee-1607ee4eb77e",29,["D",1787974708224],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nconst expectedSha=\"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\";\nconst expectedBytes=16984;\nconst r=await blob.get(\"bootstrap/r8/codex_device_bootstrap_v3.py\");\nconst raw=new Uint8Array(await r.arrayBuffer());\nconst d=await crypto.subtle.digest(\"SHA-256\",raw);\nconst sha=[...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nif(raw.length!==expectedBytes||sha!==expectedSha) throw new Error(\"R8_BLOB_INTEGRITY\");\nconst text=new TextDecoder().decode(raw);\nconst start=text.indexOf('prompt=f\"\"\"'), end=text.indexOf('\"\"\"',start+11), promptSection=text.slice(start,end+3);\nfor(const needle of ['\"--ask-for-approval\",\"never\"','\"--sandbox\",\"read-only\"','\"--ignore-user-config\"','\"--ignore-rules\"','env[\"CODEX_HOME\"]=str(iso)','RUNTIME_LOCAL_READ_CHALLENGE.txt','\"bootstrap_script_sha256\":H(Path(__file__).read_bytes())','\"device_pairing_session_id\":pairing.get(\"device_pairing_session_id\")','codex_cli_contract_preflight']) if(!text.includes(needle)) throw new Error(\"MISSING_\"+needle);\nif(!text.includes('for flag in (\"--ignore-user-config\",\"--ignore-rules\",\"--ephemeral\",\"--output-schema\",\"--output-last-message\")')) throw new Error(\"CLI_PREFLIGHT_MISSING\");\nif(promptSection.includes(\"c0f12562dbee00f897b7f0d164b35845f7388ec996c19b371c0ccf6e0fb12d27\")||promptSection.includes(\"local_read_sha\")) throw new Error(\"PROMPT_PROOF_LEAK\");\nconsole.log(JSON.stringify({selftest:\"PASS\",bytes:raw.length,sha256:sha,ask_for_approval:\"never\",sandbox:\"read-only\",isolated_codex_home:true,cli_contract_preflight:true,device_pairing_session_bound_in_receipt:true,hidden_local_read_challenge:true,proof_values_not_in_prompt:true},null,2));",[191],"08e89fff-cdac-4b19-ab31-73b32f85faad","r8_blob_probe.ts","7470fb7e-a35a-11f1-a6da-1607ee4eb77e",7,["D",1787974432105],"import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nconst r=await blob.get(\"bootstrap/r8/codex_device_bootstrap_v3.py\");\nconst raw=new Uint8Array(await r.arrayBuffer());\nconst d=await crypto.subtle.digest(\"SHA-256\",raw);\nconst sha=[...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nconsole.log(JSON.stringify({bytes:raw.length,sha256:sha},null,2));",[198],"b5d17deb-23f5-4536-a43c-2529d5cf7631","r6_main_postmerge_selftest.ts","01a04b8e-f2f5-718d-89db-5b45038e362d",1,["D",1787974054647],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nconst base=\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\";\nconst lane=\"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\";\nconst gpt=Deno.env.get(\"GPT_TOKEN_V4\");\nconst admin=Deno.env.get(\"ADMIN_TOKEN_V4\");\nif(!gpt||!admin) throw new Error(\"R6_MAIN_REQUIRED_ENV_MISSING\");\nlet fixture=\"\";\n\nasync function j(method:string,path:string,body?:unknown,token?:string,ok=[200]){\n const r=await fetch(base+path,{method,headers:{\n ...(body!==undefined?{\"content-type\":\"application/json\"}:{}),\n ...(token?{authorization:\"Bearer \"+token}:{}),\n \"user-agent\":\"r6-main-postmerge-selftest/1\"\n },body:body===undefined?undefined:JSON.stringify(body),cache:\"no-store\"});\n const x=await r.json();\n if(!ok.includes(r.status)) throw new Error(path+\"_HTTP_\"+r.status+\"_\"+JSON.stringify(x));\n return {status:r.status,body:x};\n}\n\ntry {\n const health=await j(\"GET\",\"/health\");\n if(health.body.implementation_revision!==\"R6-DEVICE-BOOTSTRAP\"||health.body.production_go!==false) throw new Error(\"HEALTH_INVARIANT\");\n\n const meta=await j(\"GET\",\"/v1/bootstrap/codex-device/metadata\");\n if(meta.body.launcher_sha256!==\"5bd101b674bcc4cc6f6e842d285c486857cb73b20211c375706067eba71fbcd6\"||meta.body.launcher_bytes!==13466||meta.body.launcher_version!==\"1.3\") throw new Error(\"META_DRIFT\");\n\n const launcher=await fetch(base+\"/v1/bootstrap/codex-device.py\",{cache:\"no-store\"});\n const raw=new Uint8Array(await launcher.arrayBuffer());\n const d=await crypto.subtle.digest(\"SHA-256\",raw);\n const sha=[...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n if(launcher.status!==200||raw.length!==13466||sha!==meta.body.launcher_sha256||launcher.headers.get(\"x-sha256\")!==sha) throw new Error(\"LAUNCHER_DRIFT\");\n\n const acc=await j(\"GET\",\"/v1/acceptance/\"+lane,undefined,gpt);\n if(acc.body.state!==\"PENDING_CODEX_ACK\"||acc.body.production_go!==false) throw new Error(\"ACCEPTANCE_DRIFT\");\n\n const state=await j(\"GET\",\"/v1/state/\"+lane,undefined,gpt);\n if(Number(state.body.state?.revision)!==1||state.body.state?.checkpoint_sha256!==\"d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962\") throw new Error(\"STATE_DRIFT\");\n\n const start=await j(\"POST\",\"/v1/pair/codex/device/start\",{client_label:\"r6-main-postmerge-selftest\"},undefined,[201]);\n fixture=String(start.body.pairing_id||\"\");\n if(!/^[A-Za-z0-9_-]{43}$/.test(String(start.body.device_code||\"\"))||!/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(String(start.body.user_code||\"\"))) throw new Error(\"DEVICE_CODES_INVALID\");\n\n const pending=await j(\"POST\",\"/v1/pair/codex/device/poll\",{device_code:start.body.device_code},undefined,[202]);\n if(pending.body.authorized!==false||pending.body.status!==\"PENDING_APPROVAL\") throw new Error(\"PENDING_NOT_CLOSED\");\n\n const unauth=await fetch(base+\"/v1/pair/codex/device/approve\",{method:\"POST\",headers:{\"content-type\":\"application/json\"},body:JSON.stringify({user_code:start.body.user_code})});\n if(unauth.status!==401) throw new Error(\"UNAUTH_APPROVE_\"+unauth.status);\n\n const approved=await j(\"POST\",\"/v1/pair/codex/device/approve\",{user_code:start.body.user_code},gpt,[200]);\n if(approved.body.approved!==true||approved.body.idempotent!==false||approved.body.production_go!==false) throw new Error(\"APPROVE_FAIL\");\n\n const replay=await j(\"POST\",\"/v1/pair/codex/device/approve\",{user_code:start.body.user_code},gpt,[200]);\n if(replay.body.idempotent!==true) throw new Error(\"APPROVE_REPLAY_FAIL\");\n\n const deviceRow=await sqlite.execute({sql:\"SELECT approved_at,approved_by,delivered_at FROM device_pairing_sessions WHERE pairing_id=?\",args:[fixture]});\n const dr:any=deviceRow.rows[0];\n if(!dr?.approved_at||dr.approved_by!==\"gpt\"||dr.delivered_at) throw new Error(\"DEVICE_DB_DRIFT\");\n\n const real=await sqlite.execute({sql:\"SELECT COUNT(*) AS n FROM pairing_sessions WHERE pairing_id='codex-v4'\"});\n if(Number((real.rows[0] as any)?.n ?? -1)!==0) throw new Error(\"REAL_CODEX_PAIRING_TOUCHED\");\n\n const audit=await j(\"GET\",\"/v1/audit\",undefined,admin);\n if(audit.body.audit_chain_ok!==true) throw new Error(\"AUDIT_CHAIN_FAIL\");\n\n console.log(JSON.stringify({\n selftest:\"PASS\",implementation_revision:health.body.implementation_revision,\n launcher_sha256:sha,launcher_bytes:raw.length,launcher_version:meta.body.launcher_version,\n device_start_http:201,pending_poll_http:202,unauth_approve_http:401,\n gpt_approve_http:200,approval_replay:\"IDEMPOTENT_PASS\",token_delivered:false,\n acceptance_state:acc.body.state,lane_revision:state.body.state.revision,\n checkpoint_sha256:state.body.state.checkpoint_sha256,audit_chain_ok:true,\n audit_event_count:audit.body.count,real_codex_pairing_touched:false,\n real_codex_runtime:\"NOT_PROVEN_BY_THIS_TEST\",production_go:false\n },null,2));\n} finally {\n if(fixture) await sqlite.execute({sql:\"DELETE FROM device_pairing_sessions WHERE pairing_id=?\",args:[fixture]});\n if(fixture){\n const left=await sqlite.execute({sql:\"SELECT COUNT(*) AS n FROM device_pairing_sessions WHERE pairing_id=?\",args:[fixture]});\n if(Number((left.rows[0] as any)?.n ?? -1)!==0) throw new Error(\"POSTMERGE_FIXTURE_CLEANUP_FAIL\");\n }\n}",[205],"68be333b-9e26-4660-9f11-6a94cb010e2e","r6_device_pairing_selftest.ts","01a04b8e-f2f5-718d-89db-574628e2c804",["D",1787974054647],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nconst base=\"https://sebas1--01a04b6c896271ba8fca9e6b08c7e987.web.val.run\";\nconst gpt=Deno.env.get(\"GPT_TOKEN_V4\");\nif(!gpt) throw new Error(\"GPT_TOKEN_V4_MISSING\");\nlet pairingId=\"\";\ntry {\n const start=await fetch(base+\"/v1/pair/codex/device/start\",{\n method:\"POST\",headers:{\"content-type\":\"application/json\",\"user-agent\":\"r6-device-selftest/1\"},\n body:JSON.stringify({client_label:\"r6-device-selftest\"})\n });\n const s=await start.json();\n if(start.status!==201) throw new Error(\"START_\"+start.status+\"_\"+JSON.stringify(s));\n pairingId=String(s.pairing_id||\"\");\n if(!/^[0-9a-f-]{36}$/.test(pairingId)) throw new Error(\"PAIRING_ID_INVALID\");\n if(!/^[A-Za-z0-9_-]{43}$/.test(String(s.device_code||\"\"))) throw new Error(\"DEVICE_CODE_INVALID\");\n if(!/^[A-Z2-9]{4}-[A-Z2-9]{4}$/.test(String(s.user_code||\"\"))) throw new Error(\"USER_CODE_INVALID\");\n if(s.production_go!==false) throw new Error(\"START_PRODUCTION_GO\");\n\n const pending=await fetch(base+\"/v1/pair/codex/device/poll\",{\n method:\"POST\",headers:{\"content-type\":\"application/json\"},\n body:JSON.stringify({device_code:s.device_code})\n });\n const p=await pending.json();\n if(pending.status!==202||p.status!==\"PENDING_APPROVAL\"||p.authorized!==false) {\n throw new Error(\"PENDING_FAIL_\"+pending.status+\"_\"+JSON.stringify(p));\n }\n\n const denied=await fetch(base+\"/v1/pair/codex/device/approve\",{\n method:\"POST\",headers:{\"content-type\":\"application/json\"},\n body:JSON.stringify({user_code:s.user_code})\n });\n if(denied.status!==401) throw new Error(\"UNAUTH_APPROVAL_EXPECTED_401_\"+denied.status);\n\n const before=await sqlite.execute({\n sql:\"SELECT approved_at,delivered_at FROM device_pairing_sessions WHERE pairing_id=?\",args:[pairingId]\n });\n if(!before.rows.length||(before.rows[0] as any).approved_at||(before.rows[0] as any).delivered_at) throw new Error(\"PREAPPROVAL_DB_DRIFT\");\n\n const approved=await fetch(base+\"/v1/pair/codex/device/approve\",{\n method:\"POST\",headers:{\"content-type\":\"application/json\",\"authorization\":\"Bearer \"+gpt},\n body:JSON.stringify({user_code:s.user_code})\n });\n const a=await approved.json();\n if(approved.status!==200||a.approved!==true||a.idempotent!==false||a.production_go!==false) {\n throw new Error(\"APPROVAL_FAIL_\"+approved.status+\"_\"+JSON.stringify(a));\n }\n\n const replay=await fetch(base+\"/v1/pair/codex/device/approve\",{\n method:\"POST\",headers:{\"content-type\":\"application/json\",\"authorization\":\"Bearer \"+gpt},\n body:JSON.stringify({user_code:s.user_code})\n });\n const ar=await replay.json();\n if(replay.status!==200||ar.approved!==true||ar.idempotent!==true) throw new Error(\"APPROVAL_REPLAY_FAIL\");\n\n const after=await sqlite.execute({\n sql:\"SELECT approved_at,approved_by,delivered_at FROM device_pairing_sessions WHERE pairing_id=?\",args:[pairingId]\n });\n const row:any=after.rows[0];\n if(!row?.approved_at||row.approved_by!==\"gpt\"||row.delivered_at) throw new Error(\"POSTAPPROVAL_DB_DRIFT\");\n\n const real=await sqlite.execute({sql:\"SELECT COUNT(*) AS n FROM pairing_sessions WHERE pairing_id='codex-v4'\"});\n if(Number((real.rows[0] as any)?.n||0)!==0) throw new Error(\"REAL_PAIRING_TOUCHED\");\n\n console.log(JSON.stringify({\n selftest:\"PASS\",\n start_http:201,\n pending_poll_http:202,\n unauth_approve_http:401,\n authenticated_approve_http:200,\n approval_replay:\"IDEMPOTENT_PASS\",\n approved_by:\"gpt\",\n token_delivered:false,\n real_codex_pairing_touched:false,\n production_go:false\n },null,2));\n} finally {\n if(pairingId) await sqlite.execute({sql:\"DELETE FROM device_pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n const left=pairingId?await sqlite.execute({sql:\"SELECT COUNT(*) AS n FROM device_pairing_sessions WHERE pairing_id=?\",args:[pairingId]}):null;\n if(left&&Number((left.rows[0] as any)?.n ?? -1)!==0) throw new Error(\"DEVICE_FIXTURE_CLEANUP_FAILED\");\n}",[212],"eded0ca6-e22e-4dd1-bc7d-a6d01f04c83a","r6_branch_regression.ts","01a04b8e-f2f5-718d-89db-52abf4fb3261",["D",1787974054647],"const base=\"https://sebas1--01a04b6c896271ba8fca9e6b08c7e987.web.val.run\";\nconst lane=\"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\";\nconst gpt=Deno.env.get(\"GPT_TOKEN_V4\");\nconst admin=Deno.env.get(\"ADMIN_TOKEN_V4\");\nif(!gpt||!admin) throw new Error(\"R6_REQUIRED_ENV_MISSING\");\n\nconst healthRes=await fetch(base+\"/health\",{cache:\"no-store\"});\nconst health=await healthRes.json();\nif(healthRes.status!==200||health.implementation_revision!==\"R6-DEVICE-BOOTSTRAP\") throw new Error(\"R6_HEALTH\");\nif(health.production_go!==false) throw new Error(\"R6_HEALTH_PRODUCTION_GO\");\n\nconst metaRes=await fetch(base+\"/v1/bootstrap/codex-device/metadata\",{cache:\"no-store\"});\nconst meta=await metaRes.json();\nif(metaRes.status!==200||meta.launcher_sha256!==\"5bd101b674bcc4cc6f6e842d285c486857cb73b20211c375706067eba71fbcd6\"||meta.launcher_bytes!==13466||meta.launcher_version!==\"1.3\") throw new Error(\"R6_METADATA\");\nif(meta.security_boundary?.embedded_credentials!==false||meta.security_boundary?.final_chatgpt_ack_required!==true) throw new Error(\"R6_METADATA_BOUNDARY\");\n\nconst accRes=await fetch(base+\"/v1/acceptance/\"+lane,{headers:{authorization:\"Bearer \"+gpt},cache:\"no-store\"});\nconst acc=await accRes.json();\nif(accRes.status!==200||acc.state!==\"PENDING_CODEX_ACK\") throw new Error(\"R6_ACCEPTANCE_\"+acc.state);\nif(acc.production_go!==false) throw new Error(\"R6_ACCEPTANCE_GO\");\n\nconst stateRes=await fetch(base+\"/v1/state/\"+lane,{headers:{authorization:\"Bearer \"+gpt},cache:\"no-store\"});\nconst state=await stateRes.json();\nif(stateRes.status!==200||Number(state.state?.revision)!==1) throw new Error(\"R6_STATE_REVISION\");\nif(state.state?.checkpoint_sha256!==\"d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962\") throw new Error(\"R6_STATE_CHECKPOINT\");\n\nconst auditRes=await fetch(base+\"/v1/audit\",{headers:{authorization:\"Bearer \"+admin},cache:\"no-store\"});\nconst audit=await auditRes.json();\nif(auditRes.status!==200||audit.audit_chain_ok!==true) throw new Error(\"R6_AUDIT\");\n\nconsole.log(JSON.stringify({\n selftest:\"PASS\",implementation_revision:health.implementation_revision,\n acceptance_state:acc.state,lane_revision:state.state.revision,\n checkpoint_sha256:state.state.checkpoint_sha256,audit_chain_ok:audit.audit_chain_ok,\n audit_event_count:audit.count,launcher_sha256:meta.launcher_sha256,\n launcher_bytes:meta.launcher_bytes,launcher_version:meta.launcher_version,embedded_credentials:false,\n final_chatgpt_ack_required:true,production_go:false,\n real_codex_runtime:\"NOT_PROVEN_BY_THIS_TEST\"\n},null,2));",[218],"705268f3-c02c-42c4-bb68-61326af343a5","r6_bootstrap_http_selftest.ts","01a04b8e-f2f5-718d-89db-4cd22f7766a2",["D",1787974054647],"const url=\"https://sebas1--01a04b6c896271ba8fca9e6b08c7e987.web.val.run/v1/bootstrap/codex-device.py\";\nconst expectedSha=\"5bd101b674bcc4cc6f6e842d285c486857cb73b20211c375706067eba71fbcd6\";\nconst expectedBytes=13466;\nconst res=await fetch(url,{cache:\"no-store\"});\nconst raw=new Uint8Array(await res.arrayBuffer());\nconst d=await crypto.subtle.digest(\"SHA-256\",raw);\nconst sha=[...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nif(res.status!==200) throw new Error(\"BOOTSTRAP_HTTP_\"+res.status);\nif(raw.length!==expectedBytes) throw new Error(\"BOOTSTRAP_SIZE_\"+raw.length);\nif(sha!==expectedSha) throw new Error(\"BOOTSTRAP_SHA_\"+sha);\nif(res.headers.get(\"x-sha256\")!==expectedSha) throw new Error(\"BOOTSTRAP_HEADER_SHA\");\nconst text=new TextDecoder().decode(raw);\nif(!text.startsWith(\"#!/usr/bin/env python3\")) throw new Error(\"BOOTSTRAP_SHEBANG\");\nif(!text.includes('User-Agent\":\"rumbo-codex-device-bootstrap/1.3')) throw new Error(\"BOOTSTRAP_VERSION_MARKER\");\nif(!text.includes(\"receipt_sha=h(RECEIPT.read_bytes())\")) throw new Error(\"EXACT_RECEIPT_HASH_MISSING\");\nif(!text.includes(\"def verify_existing_receipt():\")) throw new Error(\"RESUME_VERIFIER_MISSING\");\nif(!text.includes('\"challenge_nonce\":nonce')) throw new Error(\"NONCE_RECEIPT_BINDING_MISSING\");\nif(!text.includes(\"local receipt belongs to a different bootstrap script\")) throw new Error(\"SCRIPT_RECEIPT_BINDING_MISSING\");\nif(!text.includes('market_backup=BACKUPS/f\"marketplace-{stamp}.json\"')) throw new Error(\"PERSISTENT_MARKET_BACKUP_MISSING\");\nif(!text.includes('cache_backup=BACKUPS/f\"{PLUGIN}-cache-{stamp}\"')) throw new Error(\"CACHE_BACKUP_MISSING\");\nif(!text.includes(\"write(MARKET,market_before)\")) throw new Error(\"MARKETPLACE_ROLLBACK_MISSING\");\nif(!text.includes(\"shutil.move(str(cache_backup),str(cache))\")) throw new Error(\"CACHE_ROLLBACK_MISSING\");\nconsole.log(JSON.stringify({\n selftest:\"PASS\",status:res.status,bytes:raw.length,sha256:sha,\n header_sha256:res.headers.get(\"x-sha256\"),launcher_version:\"1.3\",\n exact_receipt_bytes_hash:true,resume_verification:true,nonce_receipt_binding:true,\n plugin_backup_rollback:true,marketplace_backup_rollback:true,cache_backup_rollback:true\n},null,2));",[224],"f36b0bae-5490-46f5-a2b9-acf75cbd98ff","r5_pairing_selftest.ts","01a04b8e-f2f5-718d-89db-48a1cc280d19",["D",1787974054647],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { classifyPairing } from \"./pairing_state.ts\";\n\nfunction assert(cond: unknown, message: string): asserts cond {\n if (!cond) throw new Error(message);\n}\n\nconst now = Date.now();\nassert(classifyPairing(null, now) === \"ISSUE_NEW\", \"null must issue\");\nassert(\n classifyPairing({expires_at:new Date(now+60000).toISOString(),confirmed_at:null}, now) === \"REDELIVER_ACTIVE\",\n \"active unconfirmed must redeliver\"\n);\nassert(\n classifyPairing({expires_at:new Date(now).toISOString(),confirmed_at:null}, now) === \"REISSUE_EXPIRED\",\n \"expiry boundary must reissue\"\n);\nassert(\n classifyPairing({expires_at:new Date(now-1).toISOString(),confirmed_at:null}, now) === \"REISSUE_EXPIRED\",\n \"expired must reissue\"\n);\nassert(\n classifyPairing({expires_at:new Date(now+60000).toISOString(),confirmed_at:new Date(now-1).toISOString()}, now) === \"ALREADY_CONFIRMED\",\n \"confirmed must stop\"\n);\nassert(\n classifyPairing({expires_at:\"not-a-date\",confirmed_at:null}, now) === \"INVALID_EXISTING_SESSION\",\n \"invalid expiry must fail closed\"\n);\n\nconst pairingId = \"r5-selftest-expired\";\nconst dummySha = \"a\".repeat(64);\nlet cleanupOk = false;\ntry {\n await sqlite.execute({sql:\"DELETE FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n const expiredIssued = new Date(now-120000).toISOString();\n const expiredAt = new Date(now-60000).toISOString();\n await sqlite.execute({\n sql:\"INSERT INTO pairing_sessions(pairing_id,pairing_code_sha256,issued_at,expires_at,confirmed_at,client_label) VALUES(?,?,?,?,NULL,?)\",\n args:[pairingId,dummySha,expiredIssued,expiredAt,\"r5-selftest\"]\n });\n\n const before = await sqlite.execute({sql:\"SELECT expires_at,confirmed_at FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n const beforeRow:any = before.rows[0];\n assert(classifyPairing({expires_at:String(beforeRow.expires_at),confirmed_at:null}, Date.now()) === \"REISSUE_EXPIRED\", \"fixture must be expired\");\n\n const issuedAt = new Date().toISOString();\n const expiresAt = new Date(Date.parse(issuedAt)+10*60*1000).toISOString();\n const reissued:any = await sqlite.execute({\n sql:\"UPDATE pairing_sessions SET pairing_code_sha256=?,issued_at=?,expires_at=?,confirmed_at=NULL,client_label=? WHERE pairing_id=? AND confirmed_at IS NULL AND expires_at<=?\",\n args:[dummySha,issuedAt,expiresAt,\"r5-selftest-reissued\",pairingId,issuedAt]\n });\n assert(Number(reissued?.rowsAffected ?? 0) === 1, \"expired row must reissue atomically\");\n\n const active = await sqlite.execute({sql:\"SELECT expires_at,confirmed_at FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n const activeRow:any = active.rows[0];\n assert(classifyPairing({expires_at:String(activeRow.expires_at),confirmed_at:null}, Date.now()) === \"REDELIVER_ACTIVE\", \"reissued row must be active\");\n\n const confirmedAt = new Date().toISOString();\n const confirmed:any = await sqlite.execute({\n sql:\"UPDATE pairing_sessions SET confirmed_at=? WHERE pairing_id=? AND confirmed_at IS NULL AND expires_at>?\",\n args:[confirmedAt,pairingId,confirmedAt]\n });\n assert(Number(confirmed?.rowsAffected ?? 0) === 1, \"active row must confirm atomically\");\n\n const after = await sqlite.execute({sql:\"SELECT expires_at,confirmed_at FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n const afterRow:any = after.rows[0];\n assert(!!afterRow.confirmed_at, \"confirmed_at must be durable\");\n assert(\n classifyPairing({expires_at:String(afterRow.expires_at),confirmed_at:String(afterRow.confirmed_at)}, Date.now()) === \"ALREADY_CONFIRMED\",\n \"confirmed row must classify confirmed\"\n );\n\n console.log(JSON.stringify({\n selftest:\"PASS\",\n pure_state_cases:6,\n sqlite_expiry_reissue:\"PASS\",\n sqlite_atomic_confirm:\"PASS\",\n production_pairing_touched:false\n }, null, 2));\n} finally {\n await sqlite.execute({sql:\"DELETE FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n const left = await sqlite.execute({sql:\"SELECT COUNT(*) AS n FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n cleanupOk = Number((left.rows[0] as any)?.n ?? -1) === 0;\n if (!cleanupOk) throw new Error(\"SELFTEST_FIXTURE_CLEANUP_FAILED\");\n}\n",[230],"c5c2d5ea-c000-4ba3-b4da-06c28677fab7","r5_branch_regression.ts","01a04b8e-f2f5-718d-89db-47a2ac85b3eb",["D",1787974054647],"const base = \"https://sebas1--01a04b6631be7019bc45cebfd3460391.web.val.run\";\nconst lane = \"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\";\nconst gpt = Deno.env.get(\"GPT_TOKEN_V4\");\nconst admin = Deno.env.get(\"ADMIN_TOKEN_V4\");\nif (!gpt || !admin) throw new Error(\"R5_REQUIRED_ENV_MISSING\");\n\nconst healthRes = await fetch(base + \"/health\");\nconst health = await healthRes.json();\nif (healthRes.status !== 200 || health.implementation_revision !== \"R5-PAIRING-RECOVERY\") {\n throw new Error(\"R5_HEALTH_MISMATCH\");\n}\nif (health.production_go !== false) throw new Error(\"R5_PRODUCTION_GO_INVARIANT_BROKEN\");\n\nconst acceptanceRes = await fetch(`${base}/v1/acceptance/${lane}`, {\n headers:{Authorization:`Bearer ${gpt}`}\n});\nconst acceptance = await acceptanceRes.json();\nif (acceptanceRes.status !== 200) throw new Error(\"R5_ACCEPTANCE_UNREADABLE\");\nif (acceptance.state !== \"PENDING_CODEX_ACK\") throw new Error(`R5_ACCEPTANCE_DRIFT_${acceptance.state}`);\nif (acceptance.production_go !== false) throw new Error(\"R5_ACCEPTANCE_PRODUCTION_GO\");\n\nconst stateRes = await fetch(`${base}/v1/state/${lane}`, {\n headers:{Authorization:`Bearer ${gpt}`}\n});\nconst state = await stateRes.json();\nif (stateRes.status !== 200 || Number(state.state?.revision) !== 1) throw new Error(\"R5_LANE_REVISION_DRIFT\");\nif (state.state?.checkpoint_sha256 !== \"d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962\") {\n throw new Error(\"R5_LANE_CHECKPOINT_DRIFT\");\n}\n\nconst auditRes = await fetch(base + \"/v1/audit\", {\n headers:{Authorization:`Bearer ${admin}`}\n});\nconst audit = await auditRes.json();\nif (auditRes.status !== 200 || audit.audit_chain_ok !== true) throw new Error(\"R5_AUDIT_CHAIN_FAIL\");\n\nconsole.log(JSON.stringify({\n selftest:\"PASS\",\n implementation_revision:health.implementation_revision,\n acceptance_state:acceptance.state,\n lane_revision:state.state.revision,\n checkpoint_sha256:state.state.checkpoint_sha256,\n audit_chain_ok:audit.audit_chain_ok,\n audit_event_count:audit.count,\n production_go:false,\n real_codex_runtime:\"NOT_PROVEN_BY_THIS_TEST\"\n},null,2));",[236],"96c5af70-70ee-4eda-a669-68704e6103fb","pairing_state.ts","01a04b8e-f2f5-718d-89db-4263f2a8234f",["D",1787974054647],"export type PairingSnapshot = {\n expires_at: string | null;\n confirmed_at: string | null;\n} | null;\n\nexport type PairingDecision =\n | \"ISSUE_NEW\"\n | \"REDELIVER_ACTIVE\"\n | \"REISSUE_EXPIRED\"\n | \"ALREADY_CONFIRMED\"\n | \"INVALID_EXISTING_SESSION\";\n\nexport function classifyPairing(\n existing: PairingSnapshot,\n nowMs: number,\n): PairingDecision {\n if (!Number.isFinite(nowMs)) return \"INVALID_EXISTING_SESSION\";\n if (!existing) return \"ISSUE_NEW\";\n if (existing.confirmed_at) return \"ALREADY_CONFIRMED\";\n if (!existing.expires_at) return \"INVALID_EXISTING_SESSION\";\n const expiresMs = Date.parse(existing.expires_at);\n if (!Number.isFinite(expiresMs)) return \"INVALID_EXISTING_SESSION\";\n return expiresMs <= nowMs ? \"REISSUE_EXPIRED\" : \"REDELIVER_ACTIVE\";\n}\n",[242],"584815e6-121b-471e-becb-d3100bf481b8","main.tsx","01a04b8e-f2f5-718d-89db-3c8ae3de3ec5",39,["D",1787974876824],21,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport { classifyPairing } from \"./pairing_state.ts\";\n\nconst app = new Hono();\nconst LANE_RE = /^[A-Z0-9][A-Z0-9_.:-]{0,95}$/;\nconst MAX_BODY = 256 * 1024;\nconst secretKeyRe = /(password|api[_-]?key|secret|access[_-]?token|refresh[_-]?token|private[_-]?key|authorization|session[_-]?cookie)/i;\nconst tokenPrefixRe = /(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{12,}|xox[baprs]-[A-Za-z0-9-]{10,})/;\nconst SHA256_RE = /^[a-f0-9]{64}$/;\nconst R2_TARGET_REPOSITORY_IDENTITY_SHA256 = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst R2_CONTROL_PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst R2_GUARD_MAX_TTL_SECONDS = 900;\nconst DEVICE_PAIRING_TTL_MS = 15 * 60 * 1000;\nconst DEVICE_PAIRING_MAX_PENDING_PER_FINGERPRINT = 3;\nconst DEVICE_PAIRING_MAX_PENDING_GLOBAL = 100;\nconst DEVICE_USER_CODE_ALPHABET = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\nasync function init() {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS lane_state (\n lane TEXT PRIMARY KEY,\n revision INTEGER NOT NULL DEFAULT 0,\n checkpoint_sha256 TEXT NOT NULL DEFAULT '',\n updated_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS messages (\n id TEXT PRIMARY KEY,\n actor TEXT NOT NULL CHECK(actor IN ('gpt','codex')),\n recipient TEXT NOT NULL CHECK(recipient IN ('gpt','codex')),\n lane TEXT NOT NULL,\n base_revision INTEGER NOT NULL,\n revision INTEGER NOT NULL,\n payload_json TEXT NOT NULL,\n payload_sha256 TEXT NOT NULL,\n message_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL,\n acked_at TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_messages_inbox ON messages(recipient,lane,acked_at,revision)`,\n `CREATE TABLE IF NOT EXISTS acknowledgements (\n id TEXT PRIMARY KEY,\n actor TEXT NOT NULL CHECK(actor IN ('gpt','codex')),\n target_message_id TEXT NOT NULL UNIQUE,\n target_message_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL,\n FOREIGN KEY(target_message_id) REFERENCES messages(id)\n )`,\n `CREATE TABLE IF NOT EXISTS audit_events (\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n actor TEXT NOT NULL,\n lane TEXT,\n object_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS pairing_events (\n pairing_id TEXT PRIMARY KEY,\n pairing_code_sha256 TEXT NOT NULL,\n consumed_at TEXT NOT NULL,\n client_label TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS pairing_sessions (\n pairing_id TEXT PRIMARY KEY,\n pairing_code_sha256 TEXT NOT NULL,\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n confirmed_at TEXT,\n client_label TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS device_pairing_sessions (\n pairing_id TEXT PRIMARY KEY,\n device_code_sha256 TEXT NOT NULL UNIQUE,\n user_code_sha256 TEXT NOT NULL UNIQUE,\n client_fingerprint_sha256 TEXT NOT NULL,\n client_label TEXT,\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n approved_at TEXT,\n approved_by TEXT,\n delivered_at TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_device_pairing_pending ON device_pairing_sessions(client_fingerprint_sha256,expires_at,approved_at)`,\n `CREATE TABLE IF NOT EXISTS device_pairing_contracts (\n pairing_id TEXT PRIMARY KEY,\n bootstrap_script_sha256 TEXT NOT NULL,\n acceptance_lane TEXT NOT NULL,\n challenge_message_id TEXT NOT NULL,\n challenge_message_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL,\n FOREIGN KEY(pairing_id) REFERENCES device_pairing_sessions(pairing_id)\n )`,\n `CREATE TABLE IF NOT EXISTS request_dedup (\n actor TEXT NOT NULL,\n request_id TEXT NOT NULL,\n body_sha256 TEXT NOT NULL,\n message_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n PRIMARY KEY(actor,request_id),\n FOREIGN KEY(message_id) REFERENCES messages(id)\n )`,\n `CREATE TABLE IF NOT EXISTS guard_authorizations (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_guard_status ON guard_authorizations(status,expires_at)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_unique ON audit_events(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_message_accepted_unique ON audit_events(object_id) WHERE event_type='MESSAGE_ACCEPTED'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_message_acked_unique ON audit_events(object_id) WHERE event_type='MESSAGE_ACKED'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_guard_event_unique ON audit_events(event_type,object_id) WHERE event_type LIKE 'GUARD_%'`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_device_event_unique ON audit_events(event_type,object_id) WHERE event_type LIKE 'CODEX_DEVICE_%'`,\n `CREATE TRIGGER IF NOT EXISTS messages_revision_guard\n BEFORE INSERT ON messages\n BEGIN\n SELECT CASE\n WHEN COALESCE((SELECT revision FROM lane_state WHERE lane=NEW.lane), -1) != NEW.base_revision\n THEN RAISE(ABORT, 'STALE_REVISION')\n END;\n END`,\n `CREATE TRIGGER IF NOT EXISTS messages_revision_advance\n AFTER INSERT ON messages\n BEGIN\n UPDATE lane_state\n SET revision=NEW.revision, updated_at=NEW.created_at\n WHERE lane=NEW.lane AND revision=NEW.base_revision;\n END`\n ]);\n}\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\n\nfunction roleFrom(req: Request): \"gpt\" | \"codex\" | \"admin\" | null {\n const token = bearer(req);\n if (!token) return null;\n if (token === Deno.env.get(\"GPT_TOKEN_V4\")) return \"gpt\";\n if (token === Deno.env.get(\"CODEX_TOKEN_V4\")) return \"codex\";\n if (token === Deno.env.get(\"ADMIN_TOKEN_V4\")) return \"admin\";\n return null;\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n const aa = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < aa.length; i++) diff |= aa[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction guardAuthorized(req: Request): boolean {\n const expected = Deno.env.get(\"R2_GUARD_TOKEN_V1\") || \"\";\n const observed = bearer(req);\n return !!expected && !!observed && constantTimeEqual(expected, observed);\n}\n\nfunction validGitSha(v: unknown): boolean {\n return typeof v === \"string\" && /^[a-f0-9]{40}$/.test(v);\n}\n\nfunction validSha256(v: unknown): v is string {\n return typeof v === \"string\" && SHA256_RE.test(v);\n}\n\nfunction randomOneTimeToken(bytes = 32): string {\n const raw = new Uint8Array(bytes);\n crypto.getRandomValues(raw);\n const binary = Array.from(raw, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\nfunction randomUserCode(chars = 8): string {\n let out = \"\";\n while (out.length < chars) {\n const raw = new Uint8Array(16);\n crypto.getRandomValues(raw);\n for (const n of raw) {\n const limit = 256 - (256 % DEVICE_USER_CODE_ALPHABET.length);\n if (n >= limit) continue;\n out += DEVICE_USER_CODE_ALPHABET[n % DEVICE_USER_CODE_ALPHABET.length];\n if (out.length === chars) break;\n }\n }\n return out;\n}\n\nfunction normalizeUserCode(v: unknown): string {\n return String(v || \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\");\n}\n\ntype GuardAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype GuardBinding = {\n action: GuardAction;\n repository_identity_sha256: string;\n pr_number: number;\n base_sha: string;\n head_sha: string;\n package_sha256: string;\n evidence_sha256: string;\n};\n\nfunction parseGuardBinding(b: any): GuardBinding | null {\n const action = String(b?.action || \"\") as GuardAction;\n const repository_identity_sha256 = String(b?.repository_identity_sha256 || \"\");\n const pr_number = Number(b?.pr_number);\n const base_sha = String(b?.base_sha || \"\");\n const head_sha = String(b?.head_sha || \"\");\n const package_sha256 = String(b?.package_sha256 || \"\");\n const evidence_sha256 = String(b?.evidence_sha256 || \"\");\n if (action !== \"TEST_ONLY\" && action !== \"MERGE_PR\") return null;\n if (repository_identity_sha256 !== R2_TARGET_REPOSITORY_IDENTITY_SHA256) return null;\n if (!Number.isSafeInteger(pr_number) || pr_number <= 0) return null;\n if (!validGitSha(base_sha) || !validGitSha(head_sha)) return null;\n if (package_sha256 !== R2_CONTROL_PACKAGE_SHA256) return null;\n if (!validSha256(evidence_sha256)) return null;\n return {action,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256};\n}\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\") + \"}\";\n}\nasync function sha(s: string): Promise {\n const b = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(b)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction hasSecret(v: unknown): boolean {\n if (typeof v === \"string\") return tokenPrefixRe.test(v);\n if (Array.isArray(v)) return v.some(hasSecret);\n if (v && typeof v === \"object\") {\n return Object.entries(v as Record).some(([k,x]) => secretKeyRe.test(k) || hasSecret(x));\n }\n return false;\n}\nasync function bodyJson(c: any) {\n const len = Number(c.req.header(\"content-length\") || \"0\");\n if (len > MAX_BODY) throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt = await c.req.text();\n if (new TextEncoder().encode(txt).length > MAX_BODY) throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt || \"{}\");\n}\nasync function audit(event_type:string, actor:string, lane:string|null, object_id:string|null, object_sha256:string|null) {\n const idempotentEvent = event_type === \"MESSAGE_ACCEPTED\" || event_type === \"MESSAGE_ACKED\" || event_type.startsWith(\"GUARD_\") || event_type.startsWith(\"CODEX_DEVICE_\");\n if (idempotentEvent && object_id) {\n const existing = await sqlite.execute({sql:\"SELECT event_sha256 FROM audit_events WHERE event_type=? AND object_id=? LIMIT 1\",args:[event_type,object_id]});\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n for (let attempt=0; attempt<8; attempt++) {\n const last = await sqlite.execute(\"SELECT event_sha256 FROM audit_events ORDER BY seq DESC LIMIT 1\");\n const prev = String(last.rows[0]?.event_sha256 || \"0\".repeat(64));\n const created_at = new Date().toISOString();\n const ev = {event_type,actor,lane,object_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256 = await sha(canonical(ev));\n try {\n await sqlite.execute({sql:`INSERT INTO audit_events(event_type,actor,lane,object_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?,?,?)`,args:[event_type,actor,lane,object_id,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n } catch (e) {\n if (idempotentEvent && object_id) {\n const existing = await sqlite.execute({sql:\"SELECT event_sha256 FROM audit_events WHERE event_type=? AND object_id=? LIMIT 1\",args:[event_type,object_id]});\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\nawait init();\n\napp.get(\"/\", (c) => c.json({service:\"rumbo-continuity-relay\",protocol:\"rumbo-continuity-relay/v1\",implementation_revision:\"R8-ISOLATED-LOCAL-READ-ATTESTATION\",status:\"ok\",production_go:false}));\napp.get(\"/health\", (c) => c.json({\n ok:true,\n protocol:\"rumbo-continuity-relay/v1\",\n implementation_revision:\"R8-ISOLATED-LOCAL-READ-ATTESTATION\",\n capabilities:[\n \"atomic-stale-guard\",\"request-idempotency\",\"idempotent-ack\",\"audit-chain\",\n \"two-phase-pairing\",\"pairing-expiry-recovery\",\"pairing-constant-time-code-check\",\"device-code-pairing\",\n \"secretless-public-bootstrap\",\"canonical-plugin-reconstruction\",\"canonical-v1.6-skill-bootstrap\",\n \"codex-runtime-acceptance-verifier\",\"server-enforced-acceptance-deadline\",\"actual-codex-exec-evidence\",\n \"exact-bootstrap-hash-binding\",\"isolated-codex-home-attestation\",\"never-approval-enforcement\",\"hidden-local-read-challenge\",\"cli-capability-preflight\",\"device-session-response-binding\",\"v1-v2-superseded-v3-active\",\n \"external-r2-authorizer\",\"one-time-token-ledger\",\"exact-pr-binding\",\"fail-closed-merge-gate\"\n ],\n guard:{\n configured:!!Deno.env.get(\"R2_GUARD_TOKEN_V1\"),\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n max_ttl_seconds:R2_GUARD_MAX_TTL_SECONDS\n },\n production_go:false\n}));\n\napp.get(\"/v1/state/:lane\", async (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n const lane = c.req.param(\"lane\"); if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n const st = await sqlite.execute({sql:\"SELECT lane,revision,checkpoint_sha256,updated_at FROM lane_state WHERE lane=?\",args:[lane]});\n const row = st.rows[0] || {lane,revision:0,checkpoint_sha256:\"0\".repeat(64),updated_at:null};\n const pending = await sqlite.execute({sql:\"SELECT recipient,COUNT(*) AS n FROM messages WHERE lane=? AND acked_at IS NULL GROUP BY recipient\",args:[lane]});\n return c.json({state:row,pending:pending.rows});\n});\n\napp.get(\"/v1/inbox\", async (c) => {\n const role = roleFrom(c.req.raw); if (role !== \"gpt\" && role !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n const lane = c.req.query(\"lane\") || \"\"; if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n const rs = await sqlite.execute({sql:`SELECT id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at\n FROM messages WHERE recipient=? AND lane=? AND acked_at IS NULL ORDER BY revision,id LIMIT 100`,args:[role,lane]});\n return c.json({messages:rs.rows.map((r:any)=>({...r,payload:JSON.parse(String(r.payload_json)),payload_json:undefined}))});\n});\n\napp.post(\"/v1/messages\", async (c) => {\n const actor = roleFrom(c.req.raw); if (actor !== \"gpt\" && actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n try {\n const b = await bodyJson(c);\n const lane = String(b.lane||\"\"); if (!LANE_RE.test(lane)) return c.json({error:\"INVALID_LANE\"},400);\n if (actor === \"codex\" && (lane === \"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\" || lane === \"CODEX_REAL_RUNTIME_ACCEPTANCE_V2\")) {\n return c.json({error:\"ACCEPTANCE_LANE_SUPERSEDED\",active_lane:\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n const base = Number(b.base_revision); if (!Number.isSafeInteger(base) || base < 0) return c.json({error:\"INVALID_BASE_REVISION\"},400);\n const payload = b.payload ?? {}; if (hasSecret(payload)) return c.json({error:\"SECRET_REJECTED\"},400);\n const requestId = String(b.request_id || \"\").trim();\n if (requestId && !/^[A-Za-z0-9_.:-]{16,128}$/.test(requestId)) return c.json({error:\"INVALID_REQUEST_ID\"},400);\n const requestBodySha256 = await sha(canonical({lane,base_revision:base,payload}));\n if (requestId) {\n const prior = await sqlite.execute({sql:\"SELECT body_sha256,message_id FROM request_dedup WHERE actor=? AND request_id=?\",args:[actor,requestId]});\n if (prior.rows.length) {\n const d:any = prior.rows[0];\n if (String(d.body_sha256)!==requestBodySha256) return c.json({error:\"IDEMPOTENCY_KEY_REUSE_MISMATCH\"},409);\n const m = await sqlite.execute({sql:\"SELECT id,lane,revision,payload_sha256,message_sha256 FROM messages WHERE id=?\",args:[String(d.message_id)]});\n if (!m.rows.length) return c.json({error:\"DEDUP_MESSAGE_MISSING\"},500);\n const row:any = m.rows[0];\n const checkpoint_sha256 = await sha(canonical({lane:String(row.lane),revision:Number(row.revision),message_sha256:String(row.message_sha256)}));\n return c.json({accepted:true,idempotent:true,id:row.id,lane:row.lane,revision:row.revision,payload_sha256:row.payload_sha256,message_sha256:row.message_sha256,checkpoint_sha256},200);\n }\n }\n await sqlite.execute({sql:\"INSERT OR IGNORE INTO lane_state(lane,revision,checkpoint_sha256,updated_at) VALUES(?,0,?,?)\",args:[lane,\"0\".repeat(64),new Date().toISOString()]});\n const st = await sqlite.execute({sql:\"SELECT revision FROM lane_state WHERE lane=?\",args:[lane]});\n const cur = Number(st.rows[0]?.revision ?? 0); if (cur !== base) return c.json({error:\"STALE_REVISION\",expected:cur,observed:base},409);\n const recipient = actor === \"gpt\" ? \"codex\" : \"gpt\";\n const id = crypto.randomUUID(); const revision = base + 1; const created_at = new Date().toISOString();\n const payload_json = canonical(payload); const payload_sha256 = await sha(payload_json);\n const envelope = {protocol:\"rumbo-continuity-relay/v1\",id,actor,recipient,lane,base_revision:base,revision,payload_sha256,created_at};\n const message_sha256 = await sha(canonical(envelope));\n const checkpoint_sha256 = await sha(canonical({lane,revision,message_sha256}));\n const statements:any[] = [\n {sql:`INSERT INTO messages(id,actor,recipient,lane,base_revision,revision,payload_json,payload_sha256,message_sha256,created_at)\n VALUES(?,?,?,?,?,?,?,?,?,?)`,args:[id,actor,recipient,lane,base,revision,payload_json,payload_sha256,message_sha256,created_at]},\n {sql:\"UPDATE lane_state SET checkpoint_sha256=? WHERE lane=? AND revision=?\",args:[checkpoint_sha256,lane,revision]}\n ];\n if (requestId) statements.push({sql:\"INSERT INTO request_dedup(actor,request_id,body_sha256,message_id,created_at) VALUES(?,?,?,?,?)\",args:[actor,requestId,requestBodySha256,id,created_at]});\n try {\n await sqlite.batch(statements);\n } catch (e) {\n if (requestId) {\n const prior = await sqlite.execute({sql:\"SELECT body_sha256,message_id FROM request_dedup WHERE actor=? AND request_id=?\",args:[actor,requestId]});\n if (prior.rows.length) {\n const d:any = prior.rows[0];\n if (String(d.body_sha256)!==requestBodySha256) return c.json({error:\"IDEMPOTENCY_KEY_REUSE_MISMATCH\"},409);\n const m = await sqlite.execute({sql:\"SELECT id,lane,revision,payload_sha256,message_sha256 FROM messages WHERE id=?\",args:[String(d.message_id)]});\n if (m.rows.length) {\n const row:any=m.rows[0];\n const cp=await sha(canonical({lane:String(row.lane),revision:Number(row.revision),message_sha256:String(row.message_sha256)}));\n return c.json({accepted:true,idempotent:true,id:row.id,lane:row.lane,revision:row.revision,payload_sha256:row.payload_sha256,message_sha256:row.message_sha256,checkpoint_sha256:cp},200);\n }\n }\n }\n if (String(e).includes(\"STALE_REVISION\")) {\n const curState=await sqlite.execute({sql:\"SELECT revision FROM lane_state WHERE lane=?\",args:[lane]});\n return c.json({error:\"STALE_REVISION\",expected:Number(curState.rows[0]?.revision ?? 0),observed:base},409);\n }\n throw e;\n }\n const verify = await sqlite.execute({sql:\"SELECT revision,checkpoint_sha256 FROM lane_state WHERE lane=?\",args:[lane]});\n if (Number(verify.rows[0]?.revision) !== revision || String(verify.rows[0]?.checkpoint_sha256)!==checkpoint_sha256) return c.json({error:\"ATOMIC_ADVANCE_FAILED\"},409);\n await audit(\"MESSAGE_ACCEPTED\",actor,lane,id,message_sha256);\n return c.json({accepted:true,idempotent:false,id,lane,revision,payload_sha256,message_sha256,checkpoint_sha256},201);\n } catch (e) { return c.json({error:String(e?.message||e)},400); }\n});\n\napp.post(\"/v1/acks\", async (c) => {\n const actor = roleFrom(c.req.raw); if (actor !== \"gpt\" && actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401);\n try {\n const b = await bodyJson(c); const id = String(b.message_id||\"\"); const msgSha = String(b.message_sha256||\"\");\n const rs = await sqlite.execute({sql:\"SELECT * FROM messages WHERE id=?\",args:[id]}); const m:any = rs.rows[0];\n if (!m) return c.json({error:\"NOT_FOUND\"},404);\n if (actor === \"codex\" && (String(m.lane) === \"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\" || String(m.lane) === \"CODEX_REAL_RUNTIME_ACCEPTANCE_V2\")) {\n return c.json({error:\"ACCEPTANCE_LANE_SUPERSEDED\",active_lane:\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n if (String(m.recipient)!==actor) return c.json({error:\"WRONG_RECIPIENT\"},403);\n if (String(m.message_sha256)!==msgSha) return c.json({error:\"HASH_MISMATCH\"},409);\n const prior = await sqlite.execute({sql:\"SELECT id FROM acknowledgements WHERE target_message_id=?\",args:[id]});\n if (prior.rows.length) return c.json({acked:true,idempotent:true,message_id:id});\n const ackId = crypto.randomUUID(), created_at = new Date().toISOString();\n const results:any = await sqlite.batch([\n {sql:\"INSERT OR IGNORE INTO acknowledgements(id,actor,target_message_id,target_message_sha256,created_at) VALUES(?,?,?,?,?)\",args:[ackId,actor,id,msgSha,created_at]},\n {sql:\"UPDATE messages SET acked_at=COALESCE(acked_at,?) WHERE id=?\",args:[created_at,id]}\n ]);\n const inserted = Number(results?.[0]?.rowsAffected ?? 0) > 0;\n if (inserted) await audit(\"MESSAGE_ACKED\",actor,String(m.lane),id,msgSha);\n return c.json({acked:true,idempotent:!inserted,message_id:id});\n } catch (e) { return c.json({error:String(e?.message||e)},400); }\n});\n\napp.get(\"/v1/acceptance/:lane\", async (c) => {\n const role = roleFrom(c.req.raw);\n if (role !== \"gpt\" && role !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const lane = c.req.param(\"lane\");\n if (lane === \"CODEX_REAL_RUNTIME_ACCEPTANCE_V1\" || lane === \"CODEX_REAL_RUNTIME_ACCEPTANCE_V2\") return c.json({\n lane,state:\"SUPERSEDED_BY_CODEX_REAL_RUNTIME_ACCEPTANCE_V3\",\n active_lane:\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\",\n mechanical_checks_passed:false,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n if (lane !== \"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\") return c.json({error:\"UNSUPPORTED_ACCEPTANCE_LANE\"},404,{\"Cache-Control\":\"no-store\"});\n\n const challenges = await sqlite.execute({\n sql:\"SELECT id,revision,payload_json,message_sha256,created_at,acked_at FROM messages WHERE lane=? AND actor='gpt' AND recipient='codex' ORDER BY revision ASC\",\n args:[lane]\n });\n if (challenges.rows.length !== 1) return c.json({\n lane,state:challenges.rows.length ? \"AMBIGUOUS_CHALLENGE_SET\" : \"CHALLENGE_NOT_PROVEN\",\n challenge_count:challenges.rows.length,mechanical_checks_passed:false,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n const challenge:any = challenges.rows[0];\n let cp:any;\n try { cp = JSON.parse(String(challenge.payload_json)); } catch { cp = null; }\n const required = [\n \"consume_this_exact_message\",\"ack_exact_message_id_and_message_sha256\",\n \"execute_actual_codex_cli_isolated_read_only_never_approve\",\n \"prove_fresh_local_read_challenge_not_present_in_prompt\",\n \"publish_reverse_response_with_same_challenge_nonce\",\n \"include_local_plugin_manifest_sha256\",\"include_local_runtime_receipt_sha256\",\n \"include_local_read_challenge_sha256\",\"include_codex_runtime_nonce\",\n \"include_codex_last_message_sha256\",\"include_codex_exec_events_sha256\",\n \"do_not_include_secrets\",\"preserve_fail_closed_project_gates\",\"production_go_false\"\n ];\n const declared = Array.isArray(cp?.acceptance_requirements) ? cp.acceptance_requirements.map(String) : [];\n const deadline = String(cp?.acceptance_not_after_utc || \"\");\n const deadlineMs = Date.parse(deadline);\n const execContract:any = cp?.required_codex_execution || {};\n const contractOk = cp?.kind === \"runtime_acceptance_challenge_v3\"\n && typeof cp?.challenge_nonce === \"string\" && cp.challenge_nonce.length >= 32\n && Number.isFinite(deadlineMs)\n && cp?.canonical_release === \"GPT_CODEX_CONTEXT_BRIDGE_V1_6\"\n && cp?.canonical_release_sha256 === \"cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b\"\n && cp?.canonical_skill_sha256 === \"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\"\n && cp?.expected_plugin_name === \"rumbo-gpt-codex-continuity\"\n && cp?.expected_plugin_version === \"1.2.0\"\n && execContract?.mode === \"codex exec\"\n && execContract?.ephemeral === true\n && execContract?.sandbox === \"read-only\"\n && execContract?.ask_for_approval === \"never\"\n && execContract?.skip_git_repo_check === true\n && execContract?.dangerous_bypass_forbidden === true\n && execContract?.model_override_forbidden === true\n && execContract?.isolated_codex_home === true\n && execContract?.user_config_inherited === false\n && execContract?.project_config_inherited === false\n && execContract?.local_read_challenge_required === true\n && execContract?.hidden_local_nonce_not_in_prompt === true\n && required.every(x => declared.includes(x));\n\n const evidence:any = {\n challenge_message_id:String(challenge.id),\n challenge_message_sha256:String(challenge.message_sha256),\n challenge_revision:Number(challenge.revision),\n acceptance_not_after_utc:deadline\n };\n if (!contractOk) return c.json({lane,state:\"CHALLENGE_CONTRACT_MISMATCH\",mechanical_checks_passed:false,evidence,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n\n const codexAck = await sqlite.execute({\n sql:\"SELECT id,created_at FROM acknowledgements WHERE actor='codex' AND target_message_id=? AND target_message_sha256=? LIMIT 1\",\n args:[String(challenge.id),String(challenge.message_sha256)]\n });\n if (!codexAck.rows.length) {\n return c.json({\n lane,state:Date.now() > deadlineMs ? \"CHALLENGE_EXPIRED_NO_CODEX_ACK\" : \"PENDING_CODEX_ACK\",\n mechanical_checks_passed:false,evidence,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n }\n const codexAckAt = Date.parse(String((codexAck.rows[0] as any).created_at || \"\"));\n if (!Number.isFinite(codexAckAt) || codexAckAt > deadlineMs) return c.json({\n lane,state:\"CODEX_ACK_AFTER_DEADLINE\",mechanical_checks_passed:false,\n evidence:{...evidence,codex_ack_id:String((codexAck.rows[0] as any).id)},production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n const reverse = await sqlite.execute({\n sql:\"SELECT id,revision,payload_json,message_sha256,created_at,acked_at FROM messages WHERE lane=? AND actor='codex' AND recipient='gpt' AND revision>? ORDER BY revision ASC\",\n args:[lane,Number(challenge.revision)]\n });\n if (!reverse.rows.length) return c.json({\n lane,state:\"PENDING_CODEX_RESPONSE\",mechanical_checks_passed:false,\n evidence:{...evidence,codex_ack_id:String((codexAck.rows[0] as any).id)},production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n if (reverse.rows.length !== 1) return c.json({\n lane,state:\"AMBIGUOUS_MULTIPLE_CODEX_RESPONSES\",response_count:reverse.rows.length,\n mechanical_checks_passed:false,evidence,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n const response:any = reverse.rows[0];\n let rp:any;\n try { rp = JSON.parse(String(response.payload_json)); } catch { rp = null; }\n const responseCreatedAt = Date.parse(String(response.created_at || \"\"));\n const codexExecution:any = rp?.codex_execution || {};\n const devicePairingSessionId = String(rp?.device_pairing_session_id || \"\");\n const deviceProofRs = await sqlite.execute({\n sql:\"SELECT ds.device_code_sha256,ds.expires_at,ds.approved_at,ds.approved_by,ds.delivered_at,dc.bootstrap_script_sha256,dc.acceptance_lane,dc.challenge_message_id,dc.challenge_message_sha256,ps.pairing_code_sha256 AS codex_pairing_code_sha256,ps.confirmed_at AS codex_pairing_confirmed_at FROM device_pairing_sessions ds JOIN device_pairing_contracts dc ON dc.pairing_id=ds.pairing_id LEFT JOIN pairing_sessions ps ON ps.pairing_id='codex-v4' WHERE ds.pairing_id=? LIMIT 1\",\n args:[devicePairingSessionId]\n });\n const dp:any = deviceProofRs.rows[0] || null;\n const deviceApprovedAt = Date.parse(String(dp?.approved_at || \"\"));\n const deviceDeliveredAt = Date.parse(String(dp?.delivered_at || \"\"));\n const deviceExpiresAt = Date.parse(String(dp?.expires_at || \"\"));\n const codexPairingConfirmedAt = Date.parse(String(dp?.codex_pairing_confirmed_at || \"\"));\n const deviceBindingOk = !!dp\n && /^[0-9a-f-]{36}$/.test(devicePairingSessionId)\n && (String(dp.approved_by) === \"gpt\" || String(dp.approved_by) === \"admin\")\n && Number.isFinite(deviceApprovedAt)\n && Number.isFinite(deviceDeliveredAt)\n && Number.isFinite(deviceExpiresAt)\n && Number.isFinite(codexPairingConfirmedAt)\n && deviceApprovedAt <= deviceDeliveredAt\n && deviceDeliveredAt <= deviceExpiresAt\n && codexPairingConfirmedAt >= deviceDeliveredAt\n && codexPairingConfirmedAt <= codexAckAt\n && String(dp.bootstrap_script_sha256) === \"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\"\n && String(dp.acceptance_lane) === lane\n && String(dp.challenge_message_id) === String(challenge.id)\n && String(dp.challenge_message_sha256) === String(challenge.message_sha256)\n && String(dp.device_code_sha256) === String(dp.codex_pairing_code_sha256);\n const checks = {\n response_before_deadline:Number.isFinite(responseCreatedAt) && responseCreatedAt <= deadlineMs,\n response_after_codex_ack:Number.isFinite(responseCreatedAt) && responseCreatedAt >= codexAckAt,\n response_kind:rp?.kind === \"runtime_acceptance_response_v3\",\n device_pairing_session_id:devicePairingSessionId.length > 0,\n device_pairing_session_bound:deviceBindingOk,\n challenge_nonce_exact:typeof rp?.challenge_nonce === \"string\" && rp.challenge_nonce === cp.challenge_nonce,\n challenge_message_id_exact:rp?.challenge_message_id === String(challenge.id),\n challenge_message_sha256_exact:rp?.challenge_message_sha256 === String(challenge.message_sha256),\n canonical_release_exact:rp?.canonical_release === \"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n canonical_release_sha256_exact:rp?.canonical_release_sha256 === \"cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b\",\n canonical_skill_sha256_exact:rp?.canonical_skill_sha256 === \"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n plugin_name_exact:rp?.plugin_name === \"rumbo-gpt-codex-continuity\",\n plugin_version_exact:rp?.plugin_version === \"1.2.0\",\n local_plugin_manifest_sha256_exact:rp?.local_plugin_manifest_sha256 === \"c0f12562dbee00f897b7f0d164b35845f7388ec996c19b371c0ccf6e0fb12d27\",\n local_runtime_receipt_sha256:validSha256(rp?.local_runtime_receipt_sha256),\n bootstrap_script_sha256_exact:rp?.bootstrap_script_sha256 === \"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\",\n codex_cli_version:typeof rp?.codex_cli_version === \"string\" && rp.codex_cli_version.length > 0 && rp.codex_cli_version.length <= 300,\n codex_runtime_nonce:typeof rp?.codex_runtime_nonce === \"string\" && /^[a-f0-9]{64}$/.test(rp.codex_runtime_nonce),\n codex_local_read_challenge_sha256:validSha256(rp?.codex_local_read_challenge_sha256),\n codex_local_read_proof_exact:rp?.codex_local_read_proof_exact === true,\n codex_last_message_sha256:validSha256(rp?.codex_last_message_sha256),\n codex_exec_events_sha256:validSha256(rp?.codex_exec_events_sha256),\n codex_exec_exit_code:rp?.codex_exec_exit_code === 0,\n codex_cli_contract_preflight:rp?.codex_cli_contract_preflight === true,\n codex_output_bindings_exact:rp?.codex_output_bindings_exact === true,\n codex_exec_mode:codexExecution?.mode === \"codex exec\",\n codex_exec_ephemeral:codexExecution?.ephemeral === true,\n codex_exec_sandbox:codexExecution?.sandbox === \"read-only\",\n codex_exec_approval_never:codexExecution?.ask_for_approval === \"never\",\n codex_exec_dangerous_bypass:codexExecution?.dangerous_bypass_used === false,\n codex_exec_model_override:codexExecution?.model_override_used === false,\n codex_exec_skip_git_repo_check:codexExecution?.skip_git_repo_check === true,\n codex_exec_isolated_home:codexExecution?.isolated_codex_home === true,\n codex_exec_user_config_not_inherited:codexExecution?.user_config_inherited === false,\n codex_exec_project_config_not_inherited:codexExecution?.project_config_inherited === false,\n codex_exec_ignore_user_config:codexExecution?.ignore_user_config === true,\n codex_exec_ignore_rules:codexExecution?.ignore_rules === true,\n runtime_claim:rp?.runtime_claim === \"ACTUAL_CODEX_CLI_EXEC_ISOLATED_READ_ONLY_LOCAL_READ_PROVEN\",\n fail_closed_project_gates_preserved:rp?.fail_closed_project_gates_preserved === true,\n secrets_exposed:rp?.secrets_exposed === false,\n production_go:rp?.production_go === false\n };\n const responseEvidence = {\n ...evidence,codex_ack_id:String((codexAck.rows[0] as any).id),\n codex_ack_created_at:String((codexAck.rows[0] as any).created_at || \"\"),\n codex_response_message_id:String(response.id),\n codex_response_message_sha256:String(response.message_sha256),\n codex_response_revision:Number(response.revision),\n codex_response_created_at:String(response.created_at || \"\"),\n device_pairing_session_id:devicePairingSessionId,\n device_pairing_approved_at:dp?.approved_at || null,\n device_pairing_delivered_at:dp?.delivered_at || null,\n codex_pairing_confirmed_at:dp?.codex_pairing_confirmed_at || null,\n checks\n };\n if (!Object.values(checks).every(Boolean)) return c.json({\n lane,state:\"INVALID_CODEX_RESPONSE\",mechanical_checks_passed:false,evidence:responseEvidence,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n const gptAck = await sqlite.execute({\n sql:\"SELECT id,created_at FROM acknowledgements WHERE actor='gpt' AND target_message_id=? AND target_message_sha256=? LIMIT 1\",\n args:[String(response.id),String(response.message_sha256)]\n });\n if (!gptAck.rows.length) return c.json({\n lane,state:\"PENDING_CHATGPT_ACK\",mechanical_checks_passed:true,\n evidence:responseEvidence,manual_semantic_review_required:true,production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n\n return c.json({\n lane,state:\"PASS_RUNTIME_ROUNDTRIP\",mechanical_checks_passed:true,\n evidence:{...responseEvidence,gpt_ack_id:String((gptAck.rows[0] as any).id),gpt_ack_created_at:String((gptAck.rows[0] as any).created_at || \"\")},\n claim_boundary:\"Continuity runtime/local-read binding only; no project production authorization.\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/guard/authorize\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseGuardBinding(b);\n if (!binding) return c.json({error:\"INVALID_GUARD_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < 60 || ttl > R2_GUARD_MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min_seconds:60,max_seconds:R2_GUARD_MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n const requestSha256 = await sha(canonical(binding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM guard_authorizations WHERE request_sha256=? LIMIT 1\",\n args:[requestSha256]\n });\n if (prior.rows.length) {\n const row:any = prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256:requestSha256\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const rawToken = randomOneTimeToken();\n const tokenSha256 = await sha(rawToken);\n const authorizationId = crypto.randomUUID();\n const issuedAt = new Date();\n const issuedAtIso = issuedAt.toISOString();\n const expiresAt = new Date(issuedAt.getTime() + ttl * 1000).toISOString();\n try {\n await sqlite.execute({\n sql:`INSERT INTO guard_authorizations(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorizationId,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n requestSha256,tokenSha256,issuedAtIso,expiresAt\n ]\n });\n } catch (e) {\n if (String(e).includes(\"UNIQUE\")) return c.json({error:\"AUTHORIZATION_COLLISION\"},409,{\"Cache-Control\":\"no-store\"});\n throw e;\n }\n\n try {\n await audit(\"GUARD_AUTHORIZATION_ISSUED\",\"guard\",null,authorizationId,requestSha256);\n } catch (e) {\n await sqlite.execute({sql:\"UPDATE guard_authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",args:[authorizationId]});\n throw e;\n }\n\n return c.json({\n authorized:true,\n authorization_id:authorizationId,\n action:binding.action,\n request_sha256:requestSha256,\n token:rawToken,\n token_type:\"One-Time\",\n issued_at:issuedAtIso,\n expires_at:expiresAt,\n production_go:false,\n merge_authorized:binding.action === \"MERGE_PR\",\n note:\"The raw one-time token is returned only on issuance; only its SHA-256 is persisted.\"\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/guard/consume\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseGuardBinding(b);\n if (!binding) return c.json({error:\"INVALID_GUARD_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n if (binding.action === \"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const authorizationId = String(b.authorization_id || \"\");\n const rawToken = String(b.token || \"\");\n if (!authorizationId || !/^[A-Za-z0-9_-]{43,128}$/.test(rawToken)) {\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const requestSha256 = await sha(canonical(binding));\n const rs = await sqlite.execute({sql:\"SELECT * FROM guard_authorizations WHERE authorization_id=? LIMIT 1\",args:[authorizationId]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n await sqlite.execute({sql:\"UPDATE guard_authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",args:[authorizationId]});\n await audit(\"GUARD_AUTHORIZATION_EXPIRED\",\"guard\",null,authorizationId,String(row.request_sha256));\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id:authorizationId},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",authorization_id:authorizationId,status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n if (!constantTimeEqual(String(row.request_sha256), requestSha256)) {\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n const observedTokenSha256 = await sha(rawToken);\n if (!constantTimeEqual(String(row.token_sha256), observedTokenSha256)) {\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumedAt = new Date().toISOString();\n const consumer = String(b.consumer || \"unspecified\").slice(0,128);\n if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)) {\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumedAt,consumer,authorizationId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"AUTHORIZATION_RACE_LOST\",authorization_id:authorizationId},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt = {\n schema:\"rumbo-r2-guard-consumption/v1\",\n authorization_id:authorizationId,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n request_sha256:requestSha256,\n consumed_at:consumedAt,\n consumer,\n production_go:false,\n merge_authorized:binding.action === \"MERGE_PR\"\n };\n const receiptSha256 = await sha(canonical(receipt));\n await audit(\"GUARD_AUTHORIZATION_CONSUMED\",\"guard\",null,authorizationId,receiptSha256);\n return c.json({...receipt,consumed:true,receipt_sha256:receiptSha256},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/guard/revoke\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const authorizationId = String(b.authorization_id || \"\");\n if (!authorizationId) return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute({sql:\"SELECT status,request_sha256,expires_at FROM guard_authorizations WHERE authorization_id=? LIMIT 1\",args:[authorizationId]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorizationId]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"GUARD_AUTHORIZATION_EXPIRED\",\"guard\",null,authorizationId,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id:authorizationId},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE guard_authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorizationId]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"GUARD_AUTHORIZATION_REVOKED\",\"guard\",null,authorizationId,String(row.request_sha256));\n return c.json({revoked:true,authorization_id:authorizationId,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/guard/authorizations/:id\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const authorizationId = c.req.param(\"id\");\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM guard_authorizations WHERE authorization_id=? LIMIT 1`,\n args:[now,authorizationId]\n });\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n return c.json({authorization:rs.rows[0],production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/guard/ledger\", async (c) => {\n if (!guardAuthorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rawLimit = Number(c.req.query(\"limit\") || \"50\");\n const limit = Number.isSafeInteger(rawLimit) ? Math.max(1,Math.min(100,rawLimit)) : 50;\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM guard_authorizations ORDER BY issued_at DESC LIMIT ?`,\n args:[now,limit]\n });\n return c.json({\n schema:\"rumbo-r2-guard-ledger/v1\",\n external_authorizer_live:true,\n durable_one_time_token_ledger:true,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\", async (c) => {\n const role = roleFrom(c.req.raw); if (role !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401);\n const rs = await sqlite.execute(\"SELECT * FROM audit_events ORDER BY seq ASC\");\n let prev=\"0\".repeat(64), ok=true;\n for (const r of rs.rows as any[]) {\n const ev={event_type:r.event_type,actor:r.actor,lane:r.lane,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha(canonical(ev)); if (r.prev_event_sha256!==prev || r.event_sha256!==h) ok=false; prev=String(r.event_sha256);\n }\n return c.json({audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,events:rs.rows});\n});\n\napp.post(\"/v1/pair/codex/device/start\", async (c) => {\n try {\n const b = await bodyJson(c);\n const bootstrapSha = String(b.bootstrap_script_sha256 || \"\");\n const acceptanceLane = String(b.acceptance_lane || \"\");\n const challengeId = String(b.challenge_message_id || \"\");\n const challengeSha = String(b.challenge_message_sha256 || \"\");\n if (bootstrapSha !== \"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\"\n || acceptanceLane !== \"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\"\n || challengeId !== \"303a5235-c328-4e8e-b0f6-a699b656df79\"\n || challengeSha !== \"c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157\") {\n return c.json({error:\"DEVICE_BOOTSTRAP_CONTRACT_MISMATCH\",active_lane:\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n const rawLabel = String(b.client_label || \"\").slice(0,128);\n const clientLabel = rawLabel.replace(/[^\\x20-\\x7E]/g, \"?\");\n const ip = c.req.header(\"cf-connecting-ip\") || (c.req.header(\"x-forwarded-for\") || \"\").split(\",\")[0].trim() || \"unknown\";\n const ua = c.req.header(\"user-agent\") || \"unknown\";\n const fingerprint = await sha(ip + \"|\" + ua);\n const now = new Date();\n const nowIso = now.toISOString();\n await sqlite.batch([\n {\n sql:\"DELETE FROM device_pairing_contracts WHERE pairing_id IN (SELECT pairing_id FROM device_pairing_sessions WHERE approved_at IS NULL AND expires_at<=?)\",\n args:[nowIso]\n },\n {\n sql:\"DELETE FROM device_pairing_sessions WHERE approved_at IS NULL AND expires_at<=?\",\n args:[nowIso]\n }\n ]);\n const perClient = await sqlite.execute({\n sql:\"SELECT COUNT(*) AS n FROM device_pairing_sessions WHERE client_fingerprint_sha256=? AND approved_at IS NULL AND expires_at>?\",\n args:[fingerprint,nowIso]\n });\n const globalPending = await sqlite.execute({\n sql:\"SELECT COUNT(*) AS n FROM device_pairing_sessions WHERE approved_at IS NULL AND expires_at>?\",\n args:[nowIso]\n });\n if (Number((perClient.rows[0] as any)?.n || 0) >= DEVICE_PAIRING_MAX_PENDING_PER_FINGERPRINT) {\n return c.json({error:\"DEVICE_PAIRING_RATE_LIMITED\",scope:\"client\",production_go:false},429,{\"Cache-Control\":\"no-store\"});\n }\n if (Number((globalPending.rows[0] as any)?.n || 0) >= DEVICE_PAIRING_MAX_PENDING_GLOBAL) {\n return c.json({error:\"DEVICE_PAIRING_CAPACITY_REACHED\",production_go:false},503,{\"Cache-Control\":\"no-store\"});\n }\n\n for (let attempt=0; attempt<8; attempt++) {\n const pairingId = crypto.randomUUID();\n const deviceCode = randomOneTimeToken(32);\n const userCodeRaw = randomUserCode(8);\n const userCode = userCodeRaw.slice(0,4) + \"-\" + userCodeRaw.slice(4);\n const deviceSha = await sha(deviceCode);\n const userSha = await sha(userCodeRaw);\n const expiresAt = new Date(now.getTime()+DEVICE_PAIRING_TTL_MS).toISOString();\n try {\n await sqlite.batch([\n {\n sql:`INSERT INTO device_pairing_sessions(\n pairing_id,device_code_sha256,user_code_sha256,client_fingerprint_sha256,client_label,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?)`,\n args:[pairingId,deviceSha,userSha,fingerprint,clientLabel,nowIso,expiresAt]\n },\n {\n sql:\"INSERT INTO device_pairing_contracts(pairing_id,bootstrap_script_sha256,acceptance_lane,challenge_message_id,challenge_message_sha256,created_at) VALUES(?,?,?,?,?,?)\",\n args:[pairingId,bootstrapSha,acceptanceLane,challengeId,challengeSha,nowIso]\n }\n ]);\n return c.json({\n schema:\"rumbo-codex-device-pairing/v1\",\n pairing_id:pairingId,\n device_code:deviceCode,\n user_code:userCode,\n expires_at:expiresAt,\n expires_in_seconds:Math.floor(DEVICE_PAIRING_TTL_MS/1000),\n poll_after_seconds:2,\n poll_path:\"/v1/pair/codex/device/poll\",\n approval_instruction:\"Paste user_code into the authorized RUMBO/ChatGPT continuity conversation. Never share device_code.\",\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n return c.json({error:\"DEVICE_PAIRING_COLLISION_RETRY_EXHAUSTED\",production_go:false},503,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/pair/codex/device/approve\", async (c) => {\n const actor = roleFrom(c.req.raw);\n if (actor !== \"gpt\" && actor !== \"admin\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const normalized = normalizeUserCode(b.user_code);\n if (normalized.length !== 8 || [...normalized].some(ch => !DEVICE_USER_CODE_ALPHABET.includes(ch))) {\n return c.json({error:\"INVALID_USER_CODE\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const userSha = await sha(normalized);\n const rs = await sqlite.execute({\n sql:\"SELECT pairing_id,device_code_sha256,expires_at,approved_at,approved_by FROM device_pairing_sessions WHERE user_code_sha256=? LIMIT 1\",\n args:[userSha]\n });\n if (!rs.rows.length) return c.json({error:\"DEVICE_PAIRING_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n const nowIso = new Date().toISOString();\n if (String(row.expires_at) <= nowIso) return c.json({error:\"DEVICE_PAIRING_EXPIRED\"},410,{\"Cache-Control\":\"no-store\"});\n if (row.approved_at) {\n return c.json({approved:true,idempotent:true,pairing_id:row.pairing_id,expires_at:row.expires_at,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE device_pairing_sessions SET approved_at=?,approved_by=? WHERE pairing_id=? AND approved_at IS NULL AND expires_at>?\",\n args:[nowIso,actor,String(row.pairing_id),nowIso]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"DEVICE_PAIRING_APPROVAL_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n try {\n await audit(\"CODEX_DEVICE_PAIRING_APPROVED\",actor,null,String(row.pairing_id),String(row.device_code_sha256));\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE device_pairing_sessions SET approved_at=NULL,approved_by=NULL WHERE pairing_id=? AND approved_at=? AND delivered_at IS NULL\",\n args:[String(row.pairing_id),nowIso]\n });\n throw e;\n }\n return c.json({\n approved:true,idempotent:false,pairing_id:row.pairing_id,expires_at:row.expires_at,\n next:\"The local device may continue polling. Approval does not itself issue an acceptance ACK.\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/pair/codex/device/poll\", async (c) => {\n try {\n const b = await bodyJson(c);\n const deviceCode = String(b.device_code || \"\");\n if (!/^[A-Za-z0-9_-]{43}$/.test(deviceCode)) {\n return c.json({error:\"INVALID_DEVICE_CODE\"},400,{\"Cache-Control\":\"no-store\"});\n }\n const deviceSha = await sha(deviceCode);\n const rs = await sqlite.execute({\n sql:\"SELECT pairing_id,device_code_sha256,expires_at,approved_at,approved_by,delivered_at,client_label FROM device_pairing_sessions WHERE device_code_sha256=? LIMIT 1\",\n args:[deviceSha]\n });\n if (!rs.rows.length) return c.json({error:\"DEVICE_PAIRING_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const d:any = rs.rows[0];\n const contractRs = await sqlite.execute({\n sql:\"SELECT bootstrap_script_sha256,acceptance_lane,challenge_message_id,challenge_message_sha256 FROM device_pairing_contracts WHERE pairing_id=? LIMIT 1\",\n args:[String(d.pairing_id)]\n });\n const dc:any = contractRs.rows[0] || null;\n if (!dc\n || String(dc.bootstrap_script_sha256) !== \"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\"\n || String(dc.acceptance_lane) !== \"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\"\n || String(dc.challenge_message_id) !== \"303a5235-c328-4e8e-b0f6-a699b656df79\"\n || String(dc.challenge_message_sha256) !== \"c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157\") {\n return c.json({error:\"DEVICE_PAIRING_CONTRACT_INVALID\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n const now = new Date();\n const nowIso = now.toISOString();\n if (String(d.expires_at) <= nowIso) return c.json({error:\"DEVICE_PAIRING_EXPIRED\"},410,{\"Cache-Control\":\"no-store\"});\n if (!d.approved_at) {\n return c.json({authorized:false,status:\"PENDING_APPROVAL\",retry_after_seconds:2,production_go:false},202,{\"Cache-Control\":\"no-store\"});\n }\n const codexToken = Deno.env.get(\"CODEX_TOKEN_V4\") || \"\";\n if (!codexToken) return c.json({error:\"CODEX_BEARER_NOT_CONFIGURED\"},503,{\"Cache-Control\":\"no-store\"});\n\n const pairingId = \"codex-v4\";\n const existing = await sqlite.execute({\n sql:\"SELECT pairing_id,pairing_code_sha256,issued_at,expires_at,confirmed_at,client_label FROM pairing_sessions WHERE pairing_id=?\",\n args:[pairingId]\n });\n const p:any = existing.rows[0] || null;\n let delivery = \"UNKNOWN\";\n let pairingExpiresAt = p?.expires_at ? String(p.expires_at) : null;\n let confirmed = !!p?.confirmed_at;\n\n if (p?.confirmed_at) {\n delivery = \"ALREADY_CONFIRMED_REDELIVERY\";\n } else {\n const decision = classifyPairing(\n p ? {expires_at:String(p.expires_at || \"\"),confirmed_at:null} : null,\n now.getTime()\n );\n if (decision === \"INVALID_EXISTING_SESSION\") {\n return c.json({error:\"PAIRING_STATE_INVALID\"},409,{\"Cache-Control\":\"no-store\"});\n }\n if (decision === \"REDELIVER_ACTIVE\") {\n if (!constantTimeEqual(String(p.pairing_code_sha256),deviceSha)) {\n return c.json({error:\"PAIRING_CHANNEL_CONFLICT_ACTIVE\",retry_after_expiry:p.expires_at,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n delivery = \"REDELIVERED_ACTIVE\";\n } else if (decision === \"REISSUE_EXPIRED\") {\n pairingExpiresAt = new Date(now.getTime()+10*60*1000).toISOString();\n const updated:any = await sqlite.execute({\n sql:\"UPDATE pairing_sessions SET pairing_code_sha256=?,issued_at=?,expires_at=?,confirmed_at=NULL,client_label=? WHERE pairing_id=? AND confirmed_at IS NULL AND expires_at<=?\",\n args:[deviceSha,nowIso,pairingExpiresAt,String(d.client_label || \"device-bootstrap\"),pairingId,nowIso]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"PAIRING_REISSUE_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n try {\n await audit(\"CODEX_PAIRING_REISSUED_AFTER_EXPIRY\",\"codex\",null,pairingId,deviceSha);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE pairing_sessions SET pairing_code_sha256=?,issued_at=?,expires_at=?,confirmed_at=NULL,client_label=? WHERE pairing_id=? AND pairing_code_sha256=? AND issued_at=? AND confirmed_at IS NULL\",\n args:[String(p.pairing_code_sha256),String(p.issued_at),String(p.expires_at),p.client_label ?? null,pairingId,deviceSha,nowIso]\n });\n throw e;\n }\n delivery = \"REISSUED_AFTER_EXPIRY\";\n } else if (decision === \"ISSUE_NEW\") {\n pairingExpiresAt = new Date(now.getTime()+10*60*1000).toISOString();\n const inserted:any = await sqlite.execute({\n sql:\"INSERT OR IGNORE INTO pairing_sessions(pairing_id,pairing_code_sha256,issued_at,expires_at,client_label) VALUES(?,?,?,?,?)\",\n args:[pairingId,deviceSha,nowIso,pairingExpiresAt,String(d.client_label || \"device-bootstrap\")]\n });\n if (Number(inserted?.rowsAffected ?? 0) !== 1) return c.json({error:\"PAIRING_ISSUE_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n try {\n await audit(\"CODEX_PAIRING_ISSUED\",\"codex\",null,pairingId,deviceSha);\n } catch (e) {\n await sqlite.execute({\n sql:\"DELETE FROM pairing_sessions WHERE pairing_id=? AND pairing_code_sha256=? AND issued_at=? AND confirmed_at IS NULL\",\n args:[pairingId,deviceSha,nowIso]\n });\n throw e;\n }\n delivery = \"ISSUED_NEW\";\n } else {\n return c.json({error:\"PAIRING_DECISION_UNEXPECTED\",decision},409,{\"Cache-Control\":\"no-store\"});\n }\n }\n\n if (!d.delivered_at) {\n const deliveredAt = new Date().toISOString();\n const updated:any = await sqlite.execute({\n sql:\"UPDATE device_pairing_sessions SET delivered_at=? WHERE pairing_id=? AND delivered_at IS NULL\",\n args:[deliveredAt,String(d.pairing_id)]\n });\n if (Number(updated?.rowsAffected ?? 0) === 1) {\n try {\n await audit(\"CODEX_DEVICE_PAIRING_TOKEN_DELIVERED\",\"codex\",null,String(d.pairing_id),deviceSha);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE device_pairing_sessions SET delivered_at=NULL WHERE pairing_id=? AND delivered_at=?\",\n args:[String(d.pairing_id),deliveredAt]\n });\n throw e;\n }\n }\n }\n return c.json({\n schema:\"rumbo-codex-device-pairing/v1\",\n authorized:true,\n role:\"codex\",\n token_type:\"Bearer\",\n token:codexToken,\n pairing_id:pairingId,\n device_pairing_session_id:String(d.pairing_id),\n pairing_delivery:delivery,\n pairing_expires_at:pairingExpiresAt,\n confirmed,\n confirm_path:\"/v1/pair/codex/confirm\",\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/pair/codex\", async (c) => {\n try {\n const b = await bodyJson(c);\n const code = String(b.code || \"\");\n const clientLabel = String(b.client_label || \"\").slice(0,128);\n const expected = Deno.env.get(\"CODEX_PAIRING_CODE_V4\") || \"\";\n if (!expected || !constantTimeEqual(code,expected)) return c.json({error:\"PAIRING_DENIED\"},403,{\"Cache-Control\":\"no-store\"});\n const pairingId = \"codex-v4\";\n const now = new Date();\n const codeSha = await sha(code);\n const existing = await sqlite.execute({\n sql:\"SELECT pairing_id,issued_at,expires_at,confirmed_at,pairing_code_sha256 FROM pairing_sessions WHERE pairing_id=?\",\n args:[pairingId]\n });\n const row:any = existing.rows[0] || null;\n const decision = classifyPairing(\n row ? {expires_at:String(row.expires_at || \"\"),confirmed_at:row.confirmed_at ? String(row.confirmed_at) : null} : null,\n now.getTime()\n );\n if (decision === \"ALREADY_CONFIRMED\") {\n return c.json({error:\"PAIRING_ALREADY_CONFIRMED\"},409,{\"Cache-Control\":\"no-store\"});\n }\n if (decision === \"INVALID_EXISTING_SESSION\") {\n return c.json({error:\"PAIRING_STATE_INVALID\"},409,{\"Cache-Control\":\"no-store\"});\n }\n if (decision === \"REDELIVER_ACTIVE\") {\n await audit(\"CODEX_PAIRING_REDELIVERED\",\"codex\",null,pairingId,String(row.pairing_code_sha256 || codeSha));\n return c.json({\n paired:\"ISSUED_UNCONFIRMED\",\n delivery:\"REDELIVERED_ACTIVE\",\n role:\"codex\",\n token_type:\"Bearer\",\n token:Deno.env.get(\"CODEX_TOKEN_V4\"),\n pairing_id:pairingId,\n expires_at:row.expires_at,\n confirm_path:\"/v1/pair/codex/confirm\",\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\"\n },200,{\"Cache-Control\":\"no-store\"});\n }\n const issuedAt = now.toISOString();\n const expiresAt = new Date(now.getTime()+10*60*1000).toISOString();\n if (decision === \"REISSUE_EXPIRED\") {\n const updated:any = await sqlite.execute({\n sql:\"UPDATE pairing_sessions SET pairing_code_sha256=?,issued_at=?,expires_at=?,confirmed_at=NULL,client_label=? WHERE pairing_id=? AND confirmed_at IS NULL AND expires_at<=?\",\n args:[codeSha,issuedAt,expiresAt,clientLabel,pairingId,issuedAt]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"PAIRING_REISSUE_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"CODEX_PAIRING_REISSUED_AFTER_EXPIRY\",\"codex\",null,pairingId,codeSha);\n return c.json({\n paired:\"ISSUED_UNCONFIRMED\",\n delivery:\"REISSUED_AFTER_EXPIRY\",\n role:\"codex\",\n token_type:\"Bearer\",\n token:Deno.env.get(\"CODEX_TOKEN_V4\"),\n pairing_id:pairingId,\n expires_at:expiresAt,\n confirm_path:\"/v1/pair/codex/confirm\",\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\"\n },200,{\"Cache-Control\":\"no-store\"});\n }\n const inserted:any = await sqlite.execute({\n sql:\"INSERT OR IGNORE INTO pairing_sessions(pairing_id,pairing_code_sha256,issued_at,expires_at,client_label) VALUES(?,?,?,?,?)\",\n args:[pairingId,codeSha,issuedAt,expiresAt,clientLabel]\n });\n if (Number(inserted?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"PAIRING_ISSUE_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"CODEX_PAIRING_ISSUED\",\"codex\",null,pairingId,codeSha);\n return c.json({\n paired:\"ISSUED_UNCONFIRMED\",\n delivery:\"ISSUED_NEW\",\n role:\"codex\",\n token_type:\"Bearer\",\n token:Deno.env.get(\"CODEX_TOKEN_V4\"),\n pairing_id:pairingId,\n expires_at:expiresAt,\n confirm_path:\"/v1/pair/codex/confirm\",\n relay_url:\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\",\n skill_metadata_path:\"/v1/bootstrap/skill/metadata\",\n skill_download_path:\"/v1/bootstrap/skill\"\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) { return c.json({error:String(e?.message||e)},400,{\"Cache-Control\":\"no-store\"}); }\n});\n\napp.post(\"/v1/pair/codex/confirm\", async (c) => {\n const actor = roleFrom(c.req.raw);\n if (actor !== \"codex\") return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const pairingId = String(b.pairing_id || \"\");\n if (pairingId !== \"codex-v4\") return c.json({error:\"INVALID_PAIRING_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute({sql:\"SELECT pairing_id,expires_at,confirmed_at,pairing_code_sha256 FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n if (!rs.rows.length) return c.json({error:\"PAIRING_NOT_ISSUED\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n if (row.confirmed_at) return c.json({confirmed:true,idempotent:true,pairing_id:pairingId},200,{\"Cache-Control\":\"no-store\"});\n const confirmedAt = new Date().toISOString();\n const expiresAt = String(row.expires_at || \"\");\n if (!expiresAt || !Number.isFinite(Date.parse(expiresAt))) {\n return c.json({error:\"PAIRING_STATE_INVALID\"},409,{\"Cache-Control\":\"no-store\"});\n }\n if (Date.parse(expiresAt) <= Date.parse(confirmedAt)) {\n return c.json({error:\"PAIRING_EXPIRED\",retryable:true},410,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any = await sqlite.execute({\n sql:\"UPDATE pairing_sessions SET confirmed_at=? WHERE pairing_id=? AND confirmed_at IS NULL AND expires_at>?\",\n args:[confirmedAt,pairingId,confirmedAt]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n const check = await sqlite.execute({sql:\"SELECT confirmed_at,expires_at FROM pairing_sessions WHERE pairing_id=?\",args:[pairingId]});\n const current:any = check.rows[0] || null;\n if (current?.confirmed_at) return c.json({confirmed:true,idempotent:true,pairing_id:pairingId},200,{\"Cache-Control\":\"no-store\"});\n if (current && Date.parse(String(current.expires_at)) <= Date.now()) {\n return c.json({error:\"PAIRING_EXPIRED\",retryable:true},410,{\"Cache-Control\":\"no-store\"});\n }\n return c.json({error:\"PAIRING_CONFIRM_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"CODEX_PAIRING_CONFIRMED\",\"codex\",null,pairingId,String(row.pairing_code_sha256));\n return c.json({confirmed:true,idempotent:false,pairing_id:pairingId,confirmed_at:confirmedAt},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) { return c.json({error:String(e?.message||e)},400,{\"Cache-Control\":\"no-store\"}); }\n});\n\napp.get(\"/v1/bootstrap/codex-device/metadata\", (c) => {\n return c.json({\n schema:\"rumbo-codex-device-bootstrap/v3\",\n implementation_revision:\"R8-ISOLATED-LOCAL-READ-ATTESTATION\",\n launcher_path:\"/v1/bootstrap/codex-device.py\",\n launcher_sha256:\"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\",\n launcher_bytes:16984,\n launcher_version:\"3.0\",\n windows_launcher_path:\"/v1/bootstrap/codex-device.ps1\",\n windows_launcher_sha256:\"b278b6db8c177453c45a85982017851357a6431f73cdd722dc478d7ed391fc3a\",\n windows_launcher_bytes:2929,\n python_minimum:\"3.11\",\n canonical_release:\"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n canonical_release_sha256:\"cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b\",\n canonical_skill_sha256:\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n plugin_name:\"rumbo-gpt-codex-continuity\",\n plugin_version:\"1.2.0\",\n plugin_manifest_sha256:\"c0f12562dbee00f897b7f0d164b35845f7388ec996c19b371c0ccf6e0fb12d27\",\n acceptance_lane:\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\",\n challenge_message_id:\"303a5235-c328-4e8e-b0f6-a699b656df79\",\n challenge_message_sha256:\"c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157\",\n acceptance_not_after_utc:\"2026-08-30T03:15:00Z\",\n security_boundary:{\n embedded_credentials:false,\n device_code_secret_delivered_only_after_gpt_or_admin_approval:true,\n actual_codex_exec_required:true,\n codex_exec_ephemeral:true,\n codex_exec_sandbox:\"read-only\",\n codex_exec_ask_for_approval:\"never\",\n isolated_codex_home:true,\n user_config_inherited:false,\n project_config_inherited:false,\n ignore_user_config:true,\n ignore_rules:true,\n hidden_local_read_challenge_required:true,\n expected_local_read_hash_not_in_prompt:true,\n cli_capability_preflight_required:true,\n device_pairing_session_binding_required:true,\n superseded_launchers_blocked_before_pairing:true,\n dangerous_bypass_forbidden:true,\n model_override_forbidden:true,\n exact_runtime_output_hashes_required:true,\n final_chatgpt_ack_required:true,\n production_go:false\n },\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/bootstrap/codex-device.ps1\", async (c) => {\n const res = await blob.get(\"bootstrap/r8/RUN_RUMBO_CODEX_R8.ps1\");\n const raw = await res.arrayBuffer();\n const bytes = new Uint8Array(raw);\n const observed = await sha(new TextDecoder().decode(bytes));\n if (observed !== \"b278b6db8c177453c45a85982017851357a6431f73cdd722dc478d7ed391fc3a\") {\n return c.json({error:\"WINDOWS_BOOTSTRAP_BLOB_HASH_MISMATCH\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n }\n return new Response(bytes,{\n status:200,\n headers:{\n \"Content-Type\":\"text/plain; charset=utf-8\",\n \"Content-Disposition\":\"attachment; filename=RUN_RUMBO_CODEX_R8.ps1\",\n \"X-SHA256\":\"b278b6db8c177453c45a85982017851357a6431f73cdd722dc478d7ed391fc3a\",\n \"Cache-Control\":\"no-store\"\n }\n });\n});\n\napp.get(\"/v1/bootstrap/codex-device.py\", async (c) => {\n const res = await blob.get(\"bootstrap/r8/codex_device_bootstrap_v3.py\");\n const raw = await res.arrayBuffer();\n const bytes = new Uint8Array(raw);\n const observed = await sha(new TextDecoder().decode(bytes));\n if (observed !== \"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\") {\n return c.json({error:\"BOOTSTRAP_BLOB_HASH_MISMATCH\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n }\n return new Response(bytes,{\n status:200,\n headers:{\n \"Content-Type\":\"text/x-python; charset=utf-8\",\n \"Content-Disposition\":\"attachment; filename=codex_device_bootstrap_r8_v3.py\",\n \"X-SHA256\":\"6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5\",\n \"Cache-Control\":\"no-store\"\n }\n });\n});\n\napp.get(\"/v1/bootstrap/skill/metadata\", (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n return c.json({\n release:\"GPT_CODEX_CONTEXT_BRIDGE_V1_6\",\n protocol:\"gpt-codex-context-bridge/v2\",\n skill_name:\"gpt-codex-context-bridge\",\n skill_zip_sha256:\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n encoding:\"binary/zip\",\n source_blob:\"bridge/v1.6/gpt-codex-context-bridge-skill.zip.b64\",\n claim_boundary:\"Skill bytes are canonical V1.6 bytes; installing/running them in the user's real Codex runtime remains a separate acceptance gate.\"\n });\n});\n\napp.get(\"/v1/bootstrap/skill\", async (c) => {\n const role = roleFrom(c.req.raw); if (!role) return c.json({error:\"UNAUTHORIZED\"},401);\n const res = await blob.get(\"bridge/v1.6/gpt-codex-context-bridge-skill.zip.b64\");\n const b64 = await res.text();\n const raw = Uint8Array.from(atob(b64), ch => ch.charCodeAt(0));\n return new Response(raw, {\n status:200,\n headers:{\n \"Content-Type\":\"application/zip\",\n \"Content-Disposition\":\"attachment; filename=gpt-codex-context-bridge.zip\",\n \"X-SHA256\":\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\",\n \"Cache-Control\":\"no-store\"\n }\n });\n});\n\napp.onError((err,c) => { console.error(err); return c.json({error:\"INTERNAL_ERROR\"},500); });\nexport default app.fetch;\n",[248],"f519f4fa-18aa-4033-9f75-f107e68e47a9","codex_device_bootstrap_r8_v3.py","225cb8fa-a35a-11f1-9d56-1607ee4eb77e",22,["D",1787974628459],5,"#!/usr/bin/env python3\nfrom __future__ import annotations\nimport calendar,hashlib,io,json,os,platform,re,secrets,shutil,subprocess,sys,tempfile,time,urllib.error,urllib.parse,urllib.request,zipfile\nfrom pathlib import Path\n\nBASE=\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\"\nLANE=\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\"\nCID=\"303a5235-c328-4e8e-b0f6-a699b656df79\"\nCSHA=\"c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157\"\nRELEASE=\"GPT_CODEX_CONTEXT_BRIDGE_V1_6\"\nRELEASE_SHA=\"cdbbb59d96a4a45d943f6d14a610e3cdbf451cc9480ed9300a170f60bef39e0b\"\nSKILL_SHA=\"152dee3cf1bf86e81539e3f334f74d8bf630937d516b0a88a60463c9f0feb068\"\nPLUGIN=\"rumbo-gpt-codex-continuity\"\nVERSION=\"1.2.0\"\nMANIFEST_SHA=\"c0f12562dbee00f897b7f0d164b35845f7388ec996c19b371c0ccf6e0fb12d27\"\nDEADLINE=\"2026-08-30T03:15:00Z\"\nMANIFEST='{\"name\": \"rumbo-gpt-codex-continuity\", \"version\": \"1.2.0\", \"description\": \"RUMBO GPT-Codex continuity bridge with isolated real-runtime local-read attestation.\", \"author\": {\"name\": \"RUMBO\"}, \"skills\": \"./skills/\", \"interface\": {\"displayName\": \"RUMBO GPT-Codex Continuity\", \"shortDescription\": \"Durable evidence-bound GPT↔Codex continuity.\", \"longDescription\": \"Canonical GPT-Codex Context Bridge V1.6 plus isolated real-runtime local-read attestation.\", \"developerName\": \"RUMBO\", \"category\": \"Productivity\", \"capabilities\": [], \"defaultPrompt\": \"Use the GPT-Codex continuity bridge and preserve fail-closed project state.\"}}'\nSTATE=Path.home()/\".agents\"/\"rumbo\"/\"gpt-codex-continuity-v3\"\nRECEIPT=STATE/\"runtime-acceptance-receipt-v3.json\"\n\ndef H(b:bytes)->str: return hashlib.sha256(b).hexdigest()\ndef A(path:Path,b:bytes):\n path.parent.mkdir(parents=True,exist_ok=True)\n t=path.with_suffix(path.suffix+\".tmp\")\n t.write_bytes(b); os.replace(t,path)\n try: os.chmod(path,0o600)\n except OSError: pass\n\ndef R(cmd,**kw):\n return subprocess.run([str(x) for x in cmd],text=True,capture_output=True,**kw)\n\ndef C(method,path,body=None,token=None,ok=(200,)):\n headers={\"User-Agent\":\"rumbo-codex-bootstrap-r8/3.0\"}\n data=None if body is None else json.dumps(body,separators=(\",\",\":\")).encode()\n if data is not None: headers[\"Content-Type\"]=\"application/json\"\n if token: headers[\"Authorization\"]=\"Bearer \"+token\n req=urllib.request.Request(BASE+path,data=data,headers=headers,method=method)\n try:\n with urllib.request.urlopen(req,timeout=30) as x: status,raw=x.status,x.read()\n except urllib.error.HTTPError as e:\n status,raw=e.code,e.read()\n if status not in ok:\n raise RuntimeError(f\"{path} HTTP {status}: {raw[:600].decode(errors='replace')}\")\n return status,raw\n\ndef J(method,path,body=None,token=None,ok=(200,)):\n s,b=C(method,path,body,token,ok)\n return s,json.loads(b.decode())\n\ndef metadata_self_check():\n _,m=J(\"GET\",\"/v1/bootstrap/codex-device/metadata\")\n own=H(Path(__file__).read_bytes())\n if m.get(\"implementation_revision\")!=\"R8-ISOLATED-LOCAL-READ-ATTESTATION\":\n raise RuntimeError(\"unexpected relay revision\")\n if m.get(\"schema\")!=\"rumbo-codex-device-bootstrap/v3\":\n raise RuntimeError(\"unexpected metadata schema\")\n if m.get(\"acceptance_lane\")!=LANE or m.get(\"challenge_message_id\")!=CID or m.get(\"challenge_message_sha256\")!=CSHA:\n raise RuntimeError(\"acceptance metadata mismatch\")\n if m.get(\"launcher_sha256\")!=own:\n raise RuntimeError(\"bootstrap self-hash mismatch\")\n if m.get(\"plugin_manifest_sha256\")!=MANIFEST_SHA or m.get(\"plugin_version\")!=VERSION:\n raise RuntimeError(\"plugin metadata mismatch\")\n if m.get(\"acceptance_not_after_utc\")!=DEADLINE:\n raise RuntimeError(\"deadline metadata mismatch\")\n\ndef isolated_codex_env():\n codex=shutil.which(\"codex\")\n if not codex: raise RuntimeError(\"Codex CLI not found on PATH\")\n original=Path(os.environ.get(\"CODEX_HOME\") or (Path.home()/\".codex\")).expanduser()\n td=tempfile.TemporaryDirectory(prefix=\"rumbo-codex-home-r8-\")\n iso=Path(td.name)\n auth=original/\"auth.json\"\n if auth.is_file():\n shutil.copy2(auth,iso/\"auth.json\")\n try: os.chmod(iso/\"auth.json\",0o600)\n except OSError: pass\n env=os.environ.copy()\n for k in list(env):\n if k.startswith(\"CODEX_\"):\n env.pop(k,None)\n env[\"CODEX_HOME\"]=str(iso)\n gh=R([codex,\"--help\"],env=env,timeout=30)\n eh=R([codex,\"exec\",\"--help\"],env=env,timeout=30)\n gtxt=(gh.stdout or \"\")+(gh.stderr or \"\"); etxt=(eh.stdout or \"\")+(eh.stderr or \"\")\n if gh.returncode or eh.returncode or \"--ask-for-approval\" not in gtxt or \"--sandbox\" not in gtxt:\n td.cleanup(); raise RuntimeError(\"Codex global safety flags unavailable; no pairing started\")\n for flag in (\"--ignore-user-config\",\"--ignore-rules\",\"--ephemeral\",\"--output-schema\",\"--output-last-message\"):\n if flag not in etxt:\n td.cleanup(); raise RuntimeError(\"Codex exec safety capability missing: \"+flag)\n status=R([codex,\"login\",\"status\"],env=env,timeout=30)\n if status.returncode:\n td.cleanup()\n raise RuntimeError(\"isolated Codex auth unavailable; no pairing started\")\n return td,codex,env\n\ndef pair():\n _,s=J(\"POST\",\"/v1/pair/codex/device/start\",{\"client_label\":f\"codex-r8:{platform.node()[:48]}\",\"bootstrap_script_sha256\":H(Path(__file__).read_bytes()),\"acceptance_lane\":LANE,\"challenge_message_id\":CID,\"challenge_message_sha256\":CSHA},ok=(201,))\n print(\"\\nRUMBO DEVICE PAIRING R8\\nCódigo:\",s[\"user_code\"],\"\\nPegá ese código en el chat RUMBO/ChatGPT. No compartas device_code.\\n\")\n end=time.time()+int(s.get(\"expires_in_seconds\",900))\n while time.time()=calendar.timegm(time.strptime(DEADLINE,\"%Y-%m-%dT%H:%M:%SZ\")):\n raise RuntimeError(\"challenge expired\")\n for k,v in {\n \"canonical_release\":RELEASE,\n \"canonical_release_sha256\":RELEASE_SHA,\n \"canonical_skill_sha256\":SKILL_SHA,\n \"expected_plugin_name\":PLUGIN,\n \"expected_plugin_version\":VERSION\n }.items():\n if p.get(k)!=v: raise RuntimeError(\"challenge binding mismatch: \"+k)\n ex=p.get(\"required_codex_execution\") or {}\n must={\n \"mode\":\"codex exec\",\"ephemeral\":True,\"sandbox\":\"read-only\",\"ask_for_approval\":\"never\",\n \"skip_git_repo_check\":True,\"dangerous_bypass_forbidden\":True,\"model_override_forbidden\":True,\n \"isolated_codex_home\":True,\"user_config_inherited\":False,\"project_config_inherited\":False,\n \"local_read_challenge_required\":True,\"hidden_local_nonce_not_in_prompt\":True\n }\n if any(ex.get(k)!=v for k,v in must.items()): raise RuntimeError(\"execution contract mismatch\")\n return ch\n\ndef workdir(token):\n _,raw=C(\"GET\",\"/v1/bootstrap/skill\",token=token)\n if H(raw)!=SKILL_SHA: raise RuntimeError(\"skill hash mismatch\")\n td=tempfile.TemporaryDirectory(prefix=\"rumbo-codex-r8-work-\"); root=Path(td.name)\n with zipfile.ZipFile(io.BytesIO(raw)) as z:\n pre=\"gpt-codex-context-bridge/\"\n for n in z.namelist():\n if n.endswith(\"/\"): continue\n if not n.startswith(pre): raise RuntimeError(\"unexpected skill layout\")\n rel=Path(n[len(pre):])\n if rel.is_absolute() or \"..\" in rel.parts: raise RuntimeError(\"unsafe skill path\")\n d=root/\"skills\"/\"gpt-codex-context-bridge\"/rel\n d.parent.mkdir(parents=True,exist_ok=True); d.write_bytes(z.read(n))\n mp=root/\".codex-plugin\"/\"plugin.json\"\n A(mp,(json.dumps(json.loads(MANIFEST),ensure_ascii=False,indent=2)+\"\\n\").encode())\n if H(mp.read_bytes())!=MANIFEST_SHA: raise RuntimeError(\"manifest hash mismatch\")\n hidden=secrets.token_hex(32)+\"\\n\"\n hidden_path=root/\"RUNTIME_LOCAL_READ_CHALLENGE.txt\"\n A(hidden_path,hidden.encode())\n return td,root,H(hidden_path.read_bytes())\n\ndef codex_run(codex,env,root,ch,local_read_sha):\n version=R([codex,\"--version\"],env=env,timeout=30)\n if version.returncode: raise RuntimeError(\"codex --version failed\")\n with tempfile.TemporaryDirectory(prefix=\"rumbo-codex-r8-out-\") as od:\n od=Path(od); schema_path=od/\"schema.json\"; last_path=od/\"last.json\"\n schema={\n \"type\":\"object\",\"additionalProperties\":False,\n \"required\":[\"task_completed\",\"challenge_nonce\",\"challenge_message_id\",\"challenge_message_sha256\",\n \"canonical_release\",\"canonical_release_sha256\",\"canonical_skill_sha256\",\n \"plugin_name\",\"plugin_version\",\"plugin_manifest_sha256\",\n \"local_read_challenge_sha256\",\"runtime_nonce\",\"production_go\",\"secrets_exposed\"],\n \"properties\":{\n \"task_completed\":{\"type\":\"boolean\"},\"challenge_nonce\":{\"type\":\"string\"},\n \"challenge_message_id\":{\"type\":\"string\"},\"challenge_message_sha256\":{\"type\":\"string\"},\n \"canonical_release\":{\"type\":\"string\"},\"canonical_release_sha256\":{\"type\":\"string\"},\n \"canonical_skill_sha256\":{\"type\":\"string\"},\"plugin_name\":{\"type\":\"string\"},\n \"plugin_version\":{\"type\":\"string\"},\"plugin_manifest_sha256\":{\"type\":\"string\",\"pattern\":\"^[0-9a-f]{64}$\"},\n \"local_read_challenge_sha256\":{\"type\":\"string\",\"pattern\":\"^[0-9a-f]{64}$\"},\n \"runtime_nonce\":{\"type\":\"string\",\"pattern\":\"^[0-9a-f]{64}$\"},\n \"production_go\":{\"type\":\"boolean\"},\"secrets_exposed\":{\"type\":\"boolean\"}\n }\n }\n schema_path.write_text(json.dumps(schema),encoding=\"utf-8\")\n cp=ch[\"payload\"]\n prompt=f\"\"\"REAL CODEX RUNTIME ACCEPTANCE V3 ONLY.\nRead these local files using read-only tools:\n- .codex-plugin/plugin.json\n- skills/gpt-codex-context-bridge/SKILL.md\n- RUNTIME_LOCAL_READ_CHALLENGE.txt\nCompute SHA-256 of plugin.json and RUNTIME_LOCAL_READ_CHALLENGE.txt using local read-only commands.\nExtract plugin name and version from plugin.json.\nDo NOT return the raw contents of RUNTIME_LOCAL_READ_CHALLENGE.txt.\nGenerate a separate fresh random 32-byte runtime nonce as 64 lowercase hex.\nReturn only JSON matching the supplied schema.\nBind these server values exactly:\nchallenge_nonce={cp['challenge_nonce']}\nchallenge_message_id={CID}\nchallenge_message_sha256={CSHA}\ncanonical_release={RELEASE}\ncanonical_release_sha256={RELEASE_SHA}\ncanonical_skill_sha256={SKILL_SHA}\nproduction_go=false\nsecrets_exposed=false\ntask_completed=true\nIf any local read or hash fails, set task_completed=false.\n\"\"\"\n cmd=[\n codex,\n \"--ask-for-approval\",\"never\",\n \"--sandbox\",\"read-only\",\n \"exec\",\n \"--ignore-user-config\",\n \"--ignore-rules\",\n \"--skip-git-repo-check\",\n \"--ephemeral\",\n \"--json\",\n \"--output-schema\",str(schema_path),\n \"--output-last-message\",str(last_path),\n \"-C\",str(root),\n prompt\n ]\n p=R(cmd,cwd=root,env=env,timeout=360)\n if p.returncode or not last_path.is_file():\n raise RuntimeError(\"codex exec failed: \"+(p.stderr or p.stdout)[-2000:])\n last=last_path.read_bytes()\n o=json.loads(last.decode())\n checks=[\n o.get(\"task_completed\") is True,\n o.get(\"challenge_nonce\")==cp[\"challenge_nonce\"],\n o.get(\"challenge_message_id\")==CID,\n o.get(\"challenge_message_sha256\")==CSHA,\n o.get(\"canonical_release\")==RELEASE,\n o.get(\"canonical_release_sha256\")==RELEASE_SHA,\n o.get(\"canonical_skill_sha256\")==SKILL_SHA,\n o.get(\"plugin_name\")==PLUGIN,\n o.get(\"plugin_version\")==VERSION,\n o.get(\"plugin_manifest_sha256\")==MANIFEST_SHA,\n o.get(\"local_read_challenge_sha256\")==local_read_sha,\n bool(re.fullmatch(r\"[0-9a-f]{64}\",str(o.get(\"runtime_nonce\",\"\")))),\n o.get(\"production_go\") is False,\n o.get(\"secrets_exposed\") is False\n ]\n if not all(checks): raise RuntimeError(\"Codex output/local-read binding failed\")\n thread_id=None\n for line in (p.stdout or \"\").splitlines():\n try: e=json.loads(line)\n except Exception: continue\n if e.get(\"type\")==\"thread.started\" and isinstance(e.get(\"thread_id\"),str):\n thread_id=e[\"thread_id\"]; break\n return {\n \"codex_cli_version\":(version.stdout or version.stderr).strip()[:300],\n \"codex_thread_id\":thread_id,\n \"codex_runtime_nonce\":o[\"runtime_nonce\"],\n \"codex_local_read_challenge_sha256\":o[\"local_read_challenge_sha256\"],\n \"codex_last_message_sha256\":H(last),\n \"codex_exec_events_sha256\":H((p.stdout or \"\").encode()),\n \"codex_exec_exit_code\":0,\n \"codex_cli_contract_preflight\":True,\n \"codex_output_bindings_exact\":True,\n \"codex_local_read_proof_exact\":True,\n \"codex_execution\":{\n \"mode\":\"codex exec\",\"ephemeral\":True,\"sandbox\":\"read-only\",\"ask_for_approval\":\"never\",\n \"dangerous_bypass_used\":False,\"model_override_used\":False,\"skip_git_repo_check\":True,\n \"isolated_codex_home\":True,\"user_config_inherited\":False,\"project_config_inherited\":False,\n \"ignore_user_config\":True,\"ignore_rules\":True\n }\n }\n\ndef main():\n if sys.version_info<(3,11): raise SystemExit(\"Python 3.11+ required\")\n metadata_self_check()\n codex_home,codex,env=isolated_codex_env()\n try:\n token,pairing=pair()\n ch=challenge(token)\n work_tmp,root,local_read_sha=workdir(token)\n try:\n runtime=codex_run(codex,env,root,ch,local_read_sha)\n finally:\n work_tmp.cleanup()\n if not pairing.get(\"confirmed\"):\n _,q=J(\"POST\",\"/v1/pair/codex/confirm\",{\"pairing_id\":\"codex-v4\"},token)\n if not q.get(\"confirmed\"): raise RuntimeError(\"pairing confirm failed\")\n rec={\n \"schema\":\"rumbo.codex-real-runtime-receipt/v3\",\n \"device_pairing_session_id\":pairing.get(\"device_pairing_session_id\"),\n \"challenge_message_id\":CID,\"challenge_message_sha256\":CSHA,\n \"challenge_nonce\":ch[\"payload\"][\"challenge_nonce\"],\"acceptance_not_after_utc\":DEADLINE,\n \"canonical_release\":RELEASE,\"canonical_release_sha256\":RELEASE_SHA,\"canonical_skill_sha256\":SKILL_SHA,\n \"plugin_name\":PLUGIN,\"plugin_version\":VERSION,\"local_plugin_manifest_sha256\":MANIFEST_SHA,\n **runtime,\n \"fail_closed_project_gates_preserved\":True,\"secrets_exposed\":False,\"production_go\":False,\n \"bootstrap_script_sha256\":H(Path(__file__).read_bytes()),\n \"created_at_utc\":time.strftime(\"%Y-%m-%dT%H:%M:%SZ\",time.gmtime())\n }\n A(RECEIPT,(json.dumps(rec,ensure_ascii=False,indent=2)+\"\\n\").encode())\n receipt_sha=H(RECEIPT.read_bytes())\n _,ack=J(\"POST\",\"/v1/acks\",{\"message_id\":CID,\"message_sha256\":CSHA},token)\n if not ack.get(\"acked\"): raise RuntimeError(\"challenge ACK failed\")\n payload={\n \"kind\":\"runtime_acceptance_response_v3\",\n \"device_pairing_session_id\":rec[\"device_pairing_session_id\"],\n \"challenge_nonce\":rec[\"challenge_nonce\"],\"challenge_message_id\":CID,\"challenge_message_sha256\":CSHA,\n \"canonical_release\":RELEASE,\"canonical_release_sha256\":RELEASE_SHA,\"canonical_skill_sha256\":SKILL_SHA,\n \"plugin_name\":PLUGIN,\"plugin_version\":VERSION,\"local_plugin_manifest_sha256\":MANIFEST_SHA,\n \"local_runtime_receipt_sha256\":receipt_sha,\"bootstrap_script_sha256\":rec[\"bootstrap_script_sha256\"],\n **runtime,\n \"runtime_claim\":\"ACTUAL_CODEX_CLI_EXEC_ISOLATED_READ_ONLY_LOCAL_READ_PROVEN\",\n \"fail_closed_project_gates_preserved\":True,\"secrets_exposed\":False,\"production_go\":False\n }\n _,res=J(\"POST\",\"/v1/messages\",{\n \"lane\":LANE,\"base_revision\":1,\n \"request_id\":\"runtime-acceptance-v3-\"+CID.replace(\"-\",\"\"),\n \"payload\":payload\n },token,ok=(200,201))\n print(\"\\nRUNTIME_ACCEPTANCE_V3_RESPONSE=PUBLISHED\")\n print(\"response_message_id=\",res.get(\"id\"))\n print(\"response_message_sha256=\",res.get(\"message_sha256\"))\n print(\"local_runtime_receipt_sha256=\",receipt_sha)\n print(\"NEXT_GATE=PENDING_CHATGPT_SEMANTIC_REVIEW_AND_ACK\")\n finally:\n codex_home.cleanup()\n\nif __name__==\"__main__\": raise SystemExit(main())\n",[257],"9f47a319-80bd-4d52-b828-f4fdf99a48ad","acceptance_selftest.ts","01a04b8e-f2f5-718d-89db-3bba3004572f",42,["D",1787974983539],"const base=\"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\";\nconst lane=\"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\";\nconst gpt=Deno.env.get(\"GPT_TOKEN_V4\"), admin=Deno.env.get(\"ADMIN_TOKEN_V4\");\nif(!gpt||!admin) throw new Error(\"R8_REQUIRED_ENV_MISSING\");\nconst healthRes=await fetch(base+\"/health\",{cache:\"no-store\"}), health=await healthRes.json();\nif(healthRes.status!==200||health.implementation_revision!==\"R8-ISOLATED-LOCAL-READ-ATTESTATION\"||health.production_go!==false) throw new Error(\"R8_HEALTH\");\nconst unauth=await fetch(base+\"/v1/acceptance/\"+lane,{cache:\"no-store\"});\nif(unauth.status!==401) throw new Error(\"R8_UNAUTH_ACCEPTANCE\");\nconst ar=await fetch(base+\"/v1/acceptance/\"+lane,{headers:{authorization:\"Bearer \"+gpt},cache:\"no-store\"}), a=await ar.json();\nconst allowed=new Set([\"CHALLENGE_CONTRACT_MISMATCH\",\"PENDING_CODEX_ACK\",\"CHALLENGE_EXPIRED_NO_CODEX_ACK\",\"CODEX_ACK_AFTER_DEADLINE\",\"PENDING_CODEX_RESPONSE\",\"AMBIGUOUS_MULTIPLE_CODEX_RESPONSES\",\"INVALID_CODEX_RESPONSE\",\"PENDING_CHATGPT_ACK\",\"PASS_RUNTIME_ROUNDTRIP\"]);\nif(ar.status!==200||!allowed.has(a.state)||a.production_go!==false) throw new Error(\"R8_ACCEPTANCE_STATE\");\nif(a.state===\"PENDING_CODEX_ACK\"&&(a.evidence?.challenge_message_id!==\"303a5235-c328-4e8e-b0f6-a699b656df79\"||a.evidence?.challenge_message_sha256!==\"c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157\")) throw new Error(\"R8_CHALLENGE_DRIFT\");\nif(a.state===\"PASS_RUNTIME_ROUNDTRIP\"&&(a.mechanical_checks_passed!==true||!a.evidence?.gpt_ack_id||a.production_go!==false)) throw new Error(\"R8_FALSE_PASS\");\nconst sr=await fetch(base+\"/v1/state/\"+lane,{headers:{authorization:\"Bearer \"+gpt},cache:\"no-store\"}), s=await sr.json();\nif(sr.status!==200||Number(s.state?.revision)!==1||s.state?.checkpoint_sha256!==\"762b65bc2ca570b71d31b616e2f80eb0660158ae4f06235fa015bdc251376563\") throw new Error(\"R8_STATE_DRIFT\");\nconst au=await fetch(base+\"/v1/audit\",{headers:{authorization:\"Bearer \"+admin},cache:\"no-store\"}), audit=await au.json();\nif(au.status!==200||audit.audit_chain_ok!==true) throw new Error(\"R8_AUDIT\");\nconsole.log(JSON.stringify({selftest:\"PASS\",implementation_revision:health.implementation_revision,acceptance_state:a.state,mechanical_checks_passed:a.mechanical_checks_passed,lane_revision:s.state.revision,lane_checkpoint_sha256:s.state.checkpoint_sha256,audit_chain_ok:true,audit_event_count:audit.count,production_go:false},null,2));",[265],"21d8e8e5-6597-483f-83b1-2a40edd34cee","RUN_RUMBO_CODEX_R8.ps1","61ef0364-a35b-11f1-8319-1607ee4eb77e",35,["D",1787974830507],"$ErrorActionPreference = \"Stop\"\n$Base = \"https://sebas1--01a04afcc88b766f9e893c0c81cf30bc.web.val.run\"\n$ExpectedRevision = \"R8-ISOLATED-LOCAL-READ-ATTESTATION\"\n$ExpectedSchema = \"rumbo-codex-device-bootstrap/v3\"\n$ExpectedLane = \"CODEX_REAL_RUNTIME_ACCEPTANCE_V3\"\n$ExpectedChallengeId = \"303a5235-c328-4e8e-b0f6-a699b656df79\"\n$ExpectedChallengeSha = \"c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157\"\n\nfunction Fail([string]$Message) {\n Write-Error $Message\n exit 1\n}\n\nif (-not (Get-Command codex -ErrorAction SilentlyContinue)) {\n Fail \"Codex CLI no esta disponible en PATH.\"\n}\n\n$PythonExe = $null\n$PythonPrefix = @()\nif (Get-Command py -ErrorAction SilentlyContinue) {\n $PythonExe = \"py\"\n $PythonPrefix = @(\"-3.11\")\n} elseif (Get-Command python -ErrorAction SilentlyContinue) {\n $PythonExe = \"python\"\n} else {\n Fail \"Python 3.11+ no esta disponible.\"\n}\n\n& $PythonExe @PythonPrefix -c \"import sys; raise SystemExit(0 if sys.version_info >= (3,11) else 2)\"\nif ($LASTEXITCODE -ne 0) {\n Fail \"Se requiere Python 3.11+.\"\n}\n\n$Meta = Invoke-RestMethod -Method Get -Uri \"$Base/v1/bootstrap/codex-device/metadata\" -Headers @{\"Cache-Control\"=\"no-store\"}\nif ($Meta.implementation_revision -ne $ExpectedRevision) { Fail \"Relay revision inesperada.\" }\nif ($Meta.schema -ne $ExpectedSchema) { Fail \"Bootstrap schema inesperado.\" }\nif ($Meta.acceptance_lane -ne $ExpectedLane) { Fail \"Acceptance lane inesperada.\" }\nif ($Meta.challenge_message_id -ne $ExpectedChallengeId) { Fail \"Challenge ID inesperado.\" }\nif ($Meta.challenge_message_sha256 -ne $ExpectedChallengeSha) { Fail \"Challenge SHA inesperado.\" }\nif ($Meta.production_go -ne $false) { Fail \"production_go debe permanecer false.\" }\n\n$Deadline = [DateTimeOffset]::Parse($Meta.acceptance_not_after_utc)\nif ([DateTimeOffset]::UtcNow -ge $Deadline) {\n Fail \"El challenge R8 expiro; no ejecutar evidencia stale.\"\n}\n\n$Temp = Join-Path ([System.IO.Path]::GetTempPath()) (\"rumbo-codex-r8-\" + [Guid]::NewGuid().ToString(\"N\") + \".py\")\ntry {\n Invoke-WebRequest -UseBasicParsing -Uri \"$Base/v1/bootstrap/codex-device.py\" -OutFile $Temp -Headers @{\"Cache-Control\"=\"no-store\"}\n $Hash = (Get-FileHash -Algorithm SHA256 -Path $Temp).Hash.ToLowerInvariant()\n if ($Hash -ne [string]$Meta.launcher_sha256) {\n Fail \"SHA-256 del launcher R8 no coincide con metadata.\"\n }\n $Length = (Get-Item $Temp).Length\n if ($Length -ne [int64]$Meta.launcher_bytes) {\n Fail \"Tamano del launcher R8 no coincide con metadata.\"\n }\n\n Write-Host \"R8 bootstrap verificado: $Hash\"\n Write-Host \"Cuando aparezca el codigo XXXX-XXXX, pegalo en el chat RUMBO/ChatGPT. No compartas device_code.\"\n & $PythonExe @PythonPrefix -B $Temp\n $ExitCode = $LASTEXITCODE\n if ($ExitCode -ne 0) {\n Fail \"El bootstrap R8 termino con codigo $ExitCode.\"\n }\n} finally {\n Remove-Item -LiteralPath $Temp -Force -ErrorAction SilentlyContinue\n}\n",[272],"2e6ec50c-5f62-407e-b198-3c4aae9cabcc","README.md","01a04b8e-f2f5-718d-89db-34fd1d20402d",40,["D",1787974941118],"# RUMBO Continuity Relay\n\nLive durable relay for material continuity between ChatGPT-side workflows and a Codex/local runtime.\n\n## Protocol\n\n`rumbo-continuity-relay/v1`\n\nCurrent implementation: `R8-ISOLATED-LOCAL-READ-ATTESTATION` (R5 pairing recovery, R3 external guard and earlier continuity evidence preserved; V1/V2 runtime-acceptance lanes superseded by V3).\n\n## R8 real-runtime acceptance\n\nActive lane: `CODEX_REAL_RUNTIME_ACCEPTANCE_V3`.\n\nExact challenge:\n- id: `303a5235-c328-4e8e-b0f6-a699b656df79`\n- message SHA-256: `c9ad9641b690078d91f6eab6961d67f01a22e179ecaf5b27408cba629a840157`\n- checkpoint SHA-256: `762b65bc2ca570b71d31b616e2f80eb0660158ae4f06235fa015bdc251376563`\n- deadline: `2026-08-30T03:15:00Z`\n\nR8 closes two R7 proof gaps: inherited Codex user configuration could weaken an explicit read-only exec, and the expected plugin manifest hash was supplied to the model. R8 instead uses an isolated temporary `CODEX_HOME`, requires `--ask-for-approval never`, `--sandbox read-only`, `exec --ignore-user-config --ignore-rules --ephemeral`, and checks those CLI capabilities before device pairing begins.\n\nThe launcher creates a fresh local file `RUNTIME_LOCAL_READ_CHALLENGE.txt`. Its content/hash are not supplied in the prompt. The Codex turn must read and hash that file and the local plugin manifest; the launcher compares those results to locally computed values before it confirms pairing, ACKs the challenge or publishes a response.\n\nThe response is also bound to the exact approved device session. The relay verifies the session's R8 bootstrap hash, V3 challenge identity, GPT/admin approval, bearer delivery, `codex-v4` confirmation and matching device-code SHA before runtime evidence can pass mechanically.\n\nPython launcher v3.0:\n- path: `GET /v1/bootstrap/codex-device.py`\n- bytes: 16,984\n- SHA-256: `6ac584713b6520c964a4410660eeabe2abd7b57f2b9f54e0a93266108918a3a5`\n- embedded credentials: none\n\nWindows wrapper:\n- path: `GET /v1/bootstrap/codex-device.ps1`\n- bytes: 2,929\n- SHA-256: `b278b6db8c177453c45a85982017851357a6431f73cdd722dc478d7ed391fc3a`\n\nThe Windows wrapper validates relay revision/schema/challenge/deadline, Codex availability, Python >=3.11, downloaded launcher SHA and exact byte length before execution.\n\nDevice-code flow remains fail-closed:\n1. exact R8 launcher starts a hash-bound V3 session;\n2. local process shows only the short `XXXX-XXXX` human code;\n3. GPT/admin approves that code;\n4. bearer is delivered only to the matching secret device code;\n5. actual isolated Codex exec must pass local-read proof;\n6. exact challenge ACK and reverse response are published;\n7. ChatGPT performs separate semantic review and final ACK.\n\nV1/V2 Codex ACKs/responses and stale device launchers are rejected after R8. `production_go` remains false throughout.\n\nPrepared code, synthetic tests, plugin listing, a device approval, or even a valid Codex reverse response do not by themselves authorize project production. Until the real Windows runtime completes the V3 roundtrip and the final ChatGPT semantic ACK exists, full federation remains NO_GO.\n\n## R2 external authorization guard\n\nR3-GUARD adds an external, fail-closed authorization surface for the RUMBO Continuity R2 control package.\n\nProperties:\n\n- controller bearer is held only as an encrypted Val Town environment variable;\n- target repository is bound by an opaque immutable repository-identity SHA-256;\n- control package is pinned to one exact SHA-256;\n- authorization binds exactly to action, PR number, base SHA, head SHA, package SHA-256 and evidence SHA-256;\n- raw one-time authorization tokens are returned only at issuance;\n- only token SHA-256 values are persisted;\n- authorizations have a 60–900 second TTL;\n- exact request bindings cannot be re-issued because request SHA-256 is unique;\n- consumption is atomic and one-time;\n- replay, token mismatch, binding mismatch and stale/expired authorization fail closed;\n- ledger reads never expose token hashes;\n- guard lifecycle events are added to the existing audit hash chain;\n- `production_go` is always false on this surface.\n\n### Merge gate\n\n`MERGE_PR` issuance **and consumption** are disabled unless the runtime environment explicitly contains:\n\n`R2_ALLOW_MERGE_AUTHORIZATION=true`\n\nThat variable is intentionally absent. Therefore this runtime cannot presently authorize a PR merge.\n\nA green guard receipt is not product GO and cannot substitute for live GitHub-side observation of the exact PR state.\n\n## Guard endpoints\n\nAll guard endpoints require the dedicated R2 guard bearer except public health.\n\n- `POST /v1/guard/authorize`\n- `POST /v1/guard/consume`\n- `POST /v1/guard/revoke`\n- `GET /v1/guard/authorizations/:id`\n- `GET /v1/guard/ledger`\n\nThe temporary self-test route used during branch validation was removed before promotion.\n\n## Guard validation evidence\n\nThe branch implementation was exercised against the live Val Town runtime with an internal bearer self-test that did not expose the bearer or one-time token.\n\nFinal adversarial matrix:\n\n- unauthenticated ledger → 401;\n- merge issuance while disabled → 423;\n- invalid repository binding → 400;\n- TTL below policy → 400;\n- TEST_ONLY issuance → 201;\n- invalid consumer label → 400 with authorization still ISSUED;\n- exact TEST_ONLY consumption → 200;\n- consumed-token replay → 409;\n- duplicate exact authorization request → 409;\n- read of an expired fixture → effective status EXPIRED without mutating on read;\n- revoke of expired authorization → 410 and durable EXPIRED state;\n- pre-existing MERGE_PR fixture consumption while merge gate disabled → 423;\n- revoked merge fixture → 200;\n- ledger read → 200;\n- token-hash leakage check → false.\n\nValidated receipt SHA-256:\n\n`90d2e2fd1691b523e0a0ab182ad2f41dd9a6d8dd6ec2f06d8af19c24a58e82ab`\n\nThe live health endpoint remained 200 after removal of the temporary self-test route.\n\n## Continuity endpoints\n\n- `GET /health`\n- `GET /v1/state/:lane`\n- `GET /v1/inbox?lane=...`\n- `POST /v1/messages`\n- `POST /v1/acks`\n- `GET /v1/acceptance/CODEX_REAL_RUNTIME_ACCEPTANCE_V1` (GPT/admin; read-only)\n- `GET /v1/audit` (admin only)\n\n## Boundary\n\nThe relay is a transport, evidence surface and external fail-closed authorization ledger. It does not replace lane-scoped CURRENT authority, the RUMBO continuity capsule, GitHub branch/ruleset enforcement, a dedicated GitHub App, an independent deployer, or project production authorization.\n\nA real Codex-runtime roundtrip remains a separate acceptance gate until the user's actual Codex/local runtime executes the client and produces a receipt.\n",[279],"147e0ff2-3ac6-4358-9879-3882814e5c05",["D",1787975016752],[27],"42ed7917-ce1b-4070-a5ec-5bb24e7ac924","R6_DEVICE_BOOTSTRAP_RELEASE.md","01a04b8e-f2f4-7230-af1c-626a0bfb09dc",["D",1787974054647],"# RUMBO Continuity Relay — R6-DEVICE-BOOTSTRAP Release Evidence\n\nDate: 2026-08-28/29 UTC\nBranch: r6-device-bootstrap\nFork baseline: main version 50\nBranch version before this receipt: 39\nScope: secretless real-device bootstrap for the existing Codex runtime acceptance gate\nProduction: NO_GO\n\n## Objective and preserved authority\n\nThe durable gate remains CODEX_REAL_RUNTIME_ACCEPTANCE_V1. R6 does not replace R5 pairing recovery, R4 acceptance verification, R3 fail-closed external guard, or the exact challenge.\n\nExact challenge:\n- id: f7ca12d8-226a-43b9-9fc0-bd9ede8548af\n- message SHA-256: 70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979\n- lane checkpoint SHA-256: d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962\n- live acceptance state during branch validation: PENDING_CODEX_ACK\n\n## Problem solved\n\nThe remaining physical gate depended on a pre-shared pairing secret and an opaque activation ZIP whose latest sidecar was observable but whose bytes/regeneration receipt were not available in the current File Library surface.\n\nR6 introduces a public device-code bootstrap with no embedded credentials:\n1. real Codex host starts a device session;\n2. server returns a 256-bit device code plus a short human code;\n3. only the short code is pasted into an authenticated RUMBO/ChatGPT conversation;\n4. GPT/admin approval atomically authorizes that exact hash-bound device session;\n5. the local host polls using the secret device code and only then receives the Codex bearer;\n6. local bootstrap confirms pairing, reconstructs and verifies the plugin, ACKs the exact challenge, and publishes the nonce-bound reverse response;\n7. final ChatGPT semantic review/ACK remains separate.\n\n## Server security properties\n\n- raw device/user codes are never persisted; only SHA-256 values are stored;\n- 32-byte device-code entropy;\n- unbiased short-code generation via rejection sampling;\n- pending-session limits: 3 per client fingerprint, 100 global;\n- client fingerprint stores only SHA-256 of network/user-agent material;\n- approval requires GPT/admin bearer;\n- start cannot approve;\n- pre-approval poll returns 202 and no bearer;\n- approval is atomic against expiry;\n- device/token-delivery sensitive changes compensate audit-append failure;\n- real pairing issue/reissue paths compensate audit-append failure;\n- active pairing from another channel fails closed;\n- production_go=false throughout.\n\n## Public bootstrap launcher\n\nPath: /v1/bootstrap/codex-device.py\nMetadata path: /v1/bootstrap/codex-device/metadata\nLauncher version: 1.3\nPython minimum: 3.11\nBytes: 13,466\nSHA-256: 5bd101b674bcc4cc6f6e842d285c486857cb73b20211c375706067eba71fbcd6\nEmbedded credentials: false\n\nLauncher properties:\n- canonical V1.6 Skill ZIP SHA verification;\n- safe ZIP path validation;\n- clean plugin staging rather than hybrid overlay;\n- official-format .codex-plugin/plugin.json and personal marketplace entry;\n- plugin, cache and marketplace backups;\n- rollback of plugin/cache/marketplace on handled installation failure;\n- codex plugin add invocation;\n- plugin list check plus material cached-SKILL byte verification;\n- exact-byte runtime receipt SHA;\n- receipt binds exact challenge id/SHA, challenge nonce and bootstrap script SHA;\n- crash/retry resume verifies manifest, marketplace, plugin list and cache before reuse;\n- exact challenge ACK only;\n- deterministic idempotent reverse-response request id;\n- final ChatGPT ACK is never fabricated.\n\nLocal sandbox syntax compilation of these exact bytes: PASS.\n\n## Branch tests\n\nBootstrap HTTP integrity:\n- evaluation id: 01a04b79-fc0c-779d-8dd6-b1428bf9a932\n- HTTP 200\n- bytes: 13,466 exact\n- body SHA-256: exact\n- X-SHA256: exact\n- launcher v1.3 marker: PASS\n- exact receipt-byte hash marker: PASS\n- resume verifier: PASS\n- nonce receipt binding: PASS\n- plugin/marketplace/cache rollback markers: PASS\n\nDevice separation self-test:\n- final evaluation id: 01a04b7a-34c5-71bd-b230-3f314a00c4ce\n- start: HTTP 201\n- pre-approval poll: HTTP 202\n- unauthenticated approval: HTTP 401\n- GPT approval: HTTP 200\n- approval replay: IDEMPOTENT_PASS\n- token delivered: false\n- real codex-v4 pairing touched: false\n- fixture cleanup: PASS\n\nNote: an earlier self-test evaluation printed all functional checks PASS but ended with a false cleanup failure because the test used 0 || -1. Database inspection proved the row had been deleted. The test assertion was corrected to nullish handling and the final evaluation above passed. Synthetic approval audit events are preserved in the append-only audit chain and are not represented as real runtime evidence.\n\nIntegrated branch regression:\n- evaluation id: 01a04b7a-222f-77bf-9a1b-b08e25952f67\n- implementation: R6-DEVICE-BOOTSTRAP\n- acceptance: PENDING_CODEX_ACK\n- lane revision: 1\n- checkpoint exact: PASS\n- audit_chain_ok: true\n- launcher metadata exact: PASS\n- production_go: false\n- real_codex_runtime: NOT_PROVEN_BY_THIS_TEST\n\nFinal static/adversarial audit:\n- 26/26 security/invariant checks PASS\n- R5 pairing recovery preserved\n- R4 acceptance verifier preserved\n- R2_ALLOW_MERGE_AUTHORIZATION absent\n- no self-test HTTP route\n- no literal bearer/API/GitHub credential in launcher\n- no production promotion path added\n\n## Database boundary after branch tests\n\n- real pairing id codex-v4: no row\n- device self-test fixture rows: none\n- challenge ACK: NOT_PROVEN\n- Codex reverse response: NOT_PROVEN\n- final GPT ACK: NOT_PROVEN\n\n## Promotion boundary\n\nR6 branch may be promoted because it makes the physical gate safer and recoverable without performing that gate.\n\nPromotion does NOT mean:\n- REAL_CODEX_RUNTIME_PASS\n- REAL_CODEX_ACK\n- REAL_CODEX_RESPONSE\n- FINAL_CHATGPT_ACK\n- PRODUCT_GO\n- PRODUCTION_GO\n\nAfter promotion, main must be revalidated for health, launcher bytes/hash, device separation, acceptance/checkpoint, audit chain, zero codex-v4 row, and remote-device availability.\n",[289],"213728f4-fef1-4bac-9814-9da50b699ed7","R5_POST_PROMOTION_RECEIPT.md","01a04b8e-f2f4-7230-af1c-5f4f065c6a97",["D",1787974054647],"# RUMBO Continuity Relay — R5 Post-Promotion Receipt\n\nEffective UTC: 2026-08-29T02:47Z\nPromoted target: main\nPromotion commit/version: main 49\nImplementation: R5-PAIRING-RECOVERY\nProduction: NO_GO\n\n## Promotion receipt\n\nBranch r5-pairing-recovery was forked from main version 48 and merged only after main was re-read at the same version 48. Merge result: SUCCESS, target main version 49.\n\n## Post-merge verification on main\n\nHealth:\n- HTTP 200\n- implementation_revision: R5-PAIRING-RECOVERY\n- pairing-expiry-recovery capability: present\n- pairing-constant-time-code-check capability: present\n- merge_authorization_enabled: false\n- production_go: false\n\nSynthetic pairing regression:\n- evaluation id: 01a04b6a-643a-748c-b502-207898cf4510\n- result: PASS\n- pure state cases: 6\n- SQLite expiry reissue: PASS\n- SQLite atomic confirm: PASS\n- production_pairing_touched: false\n\nAcceptance regression:\n- evaluation id: 01a04b6a-7069-716e-9477-7ef12f256275\n- result: PASS\n- implementation_revision: R5-PAIRING-RECOVERY\n- unauthenticated acceptance: HTTP 401\n- state: PENDING_CODEX_ACK\n- lane revision: 1\n- checkpoint SHA-256: d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962\n- audit_chain_ok: true\n- audit event count: 33\n- production_go: false\n- challenge id: f7ca12d8-226a-43b9-9fc0-bd9ede8548af\n- challenge message SHA-256: 70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979\n\nDatabase after regressions:\n- codex-v4 rows: 0\n- r5-selftest-expired rows: 0\n\nPost-promotion static audit:\n- all checked invariants: PASS\n- R4 acceptance route preserved\n- no self-test HTTP route\n- pairing code constant-time comparison present\n- expired reissue atomic condition present\n- confirm-before-expiry atomic condition present\n- production_go=false retained\n- merge-enabling environment variable absent\n- no literal OpenAI/GitHub token pattern in source\n\nRemote execution surface:\n- connected Remote Desktop Commander devices: 0\n- actual user Codex process: NOT_OBSERVED\n\n## Activation-package reconciliation\n\nThe latest indexed sidecar for RUMBO_CODEX_REAL_RUNTIME_ACTIVATION_CURRENT.zip reports SHA-256:\n8db386dfe56569916da7a62c59499fcb2d7e6c8d82f7da647511a9a8c8d50943\n\nThe ZIP bytes and a regeneration receipt are not available through the current File Library index. Therefore:\n- ACTIVATION_CURRENT_SIDECAR = OBSERVED\n- ACTIVATION_CURRENT_BYTES = NOT_PROVEN\n- ACTIVATION_CURRENT_EXECUTION = NOT_PROVEN\n\nR5 does not depend on that opaque package.\n\n## Truth boundary\n\nR5_MAIN = PASS_LIVE\nPAIRING_RECOVERY = PASS_LIVE\nACCEPTANCE_VERIFIER = PASS_LIVE\nAUDIT_CHAIN = PASS\nREAL_CODEX_PAIRING_V4 = NOT_PROVEN\nREAL_CODEX_ACK = NOT_PROVEN\nREAL_CODEX_RESPONSE = NOT_PROVEN\nFINAL_CHATGPT_ACK = NOT_PROVEN\nFULL_FEDERATED_RUNTIME = NO_GO\nPRODUCTION = NO_GO\n\nThe next valid promotion requires evidence from the user's actual Codex runtime. No synthetic test, release ZIP, plugin listing, prepared launcher, TEST_ONLY PR binding, or activation sidecar can substitute for that receipt.\n",[295],"bb104eee-3076-43e0-a1ab-06cf5e34591d","R5_PAIRING_RECOVERY_RELEASE.md","01a04b8e-f2f4-7230-af1c-58b90df74663",["D",1787974054647],"# RUMBO Continuity Relay — R5-PAIRING-RECOVERY Release Evidence\n\nDate: 2026-08-28/29 UTC\nBranch: r5-pairing-recovery\nFork baseline: main version 48\nScope: Codex V4 bootstrap liveness/security hardening only\nProduction: NO_GO\n\n## Recovered objective and gate\n\nThe durable CURRENT requires one real user Codex execution on lane CODEX_REAL_RUNTIME_ACCEPTANCE_V1. R4 already verifies that roundtrip fail-closed. R5 does not change that gate.\n\nExact challenge remains:\n- message id: f7ca12d8-226a-43b9-9fc0-bd9ede8548af\n- message SHA-256: 70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979\n- checkpoint SHA-256: d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962\n- state during validation: PENDING_CODEX_ACK\n\n## Defect reproduced by source audit\n\nThe R4 pairing route used the fixed real pairing id codex-v4. Once an unconfirmed issuance exceeded its ten-minute expiry, every subsequent valid pairing request returned PAIRING_EXPIRED. No re-issuance path existed, so a lost/abandoned first attempt could permanently block the only real-runtime gate.\n\nAdditional hardening findings:\n- pairing-code comparison used ordinary string equality even though constantTimeEqual already existed;\n- confirmation expiry was checked before a later unconditional UPDATE, leaving a narrow time-of-check/time-of-use race.\n\n## R5 implementation\n\nAdded pairing_state.ts with explicit fail-closed states:\n- ISSUE_NEW\n- REDELIVER_ACTIVE\n- REISSUE_EXPIRED\n- ALREADY_CONFIRMED\n- INVALID_EXISTING_SESSION\n\nPair issue now:\n- compares the V4 pairing code with constantTimeEqual;\n- redelivers an active unconfirmed issuance;\n- atomically reissues an expired unconfirmed session using the same fixed pairing id;\n- rejects confirmed or malformed state;\n- detects issue/reissue races;\n- emits CODEX_PAIRING_REISSUED_AFTER_EXPIRY only after a successful atomic reissue.\n\nPair confirmation now:\n- rejects invalid timestamps;\n- returns retryable PAIRING_EXPIRED at the expiry boundary;\n- atomically confirms only while expires_at is still in the future;\n- re-reads after a lost race and returns confirmed-idempotent, expired-retryable, or fail-closed race state.\n\nNo real pairing was issued by validation.\n\n## Tests\n\nSynthetic pairing state + SQLite regression:\n- file: r5_pairing_selftest.ts\n- branch file version: 8\n- evaluation id: 01a04b67-a25c-731b-8fe8-5d21ab141684\n- pure state cases: 6 PASS\n- expired-session atomic reissue: PASS\n- atomic confirmation: PASS\n- synthetic fixture cleanup: PASS\n- production_pairing_touched: false\n\nBranch HTTP regression:\n- file: r5_branch_regression.ts\n- branch file version: 12\n- evaluation id: 01a04b69-aaae-7148-b28c-0dc5ddd28407\n- branch health: R5-PAIRING-RECOVERY / HTTP 200\n- acceptance: PENDING_CODEX_ACK\n- lane revision: 1\n- checkpoint SHA-256 exact: PASS\n- audit_chain_ok: true\n- production_go: false\n- real_codex_runtime: NOT_PROVEN_BY_THIS_TEST\n\nNegative HTTP checks:\n- wrong pairing code: HTTP 403 PAIRING_DENIED\n- unauthenticated confirmation: HTTP 401\n\nPost-test database check:\n- codex-v4 rows: 0\n- r5-selftest-expired rows: 0\n\n## Static security audit\n\nThirteen source/runtime invariants passed:\n- R5 revision marker present;\n- R4 acceptance route preserved;\n- exactly one pair-issue route;\n- exactly one pair-confirm route;\n- no self-test HTTP route;\n- constant-time pairing-code comparison present;\n- expired reissue is atomic;\n- confirmation expiry is atomic;\n- reissue event is audited;\n- production_go=false invariant retained;\n- no literal OpenAI key pattern;\n- no literal GitHub token pattern;\n- R2_ALLOW_MERGE_AUTHORIZATION environment variable absent.\n\n## Preserved predecessor work\n\nR5 preserves:\n- R4-ACCEPTANCE-GUARD state machine and exact acceptance challenge;\n- R3-GUARD external TEST_ONLY authorizer;\n- PR #412 as the active TEST_ONLY successor binding;\n- merge authorization disabled;\n- production NO_GO.\n\n## Truth boundary\n\nR5_PAIRING_RECOVERY_IMPLEMENTATION = PASS_BRANCH\nR5_SYNTHETIC_REGRESSION = PASS\nR5_BRANCH_HTTP_REGRESSION = PASS\nREAL_CODEX_PAIRING_V4 = NOT_PROVEN\nREAL_CODEX_ACK = NOT_PROVEN\nREAL_CODEX_RESPONSE = NOT_PROVEN\nFINAL_CHATGPT_ACK = NOT_PROVEN\nFULL_FEDERATED_RUNTIME = NO_GO\nPRODUCTION = NO_GO\n\n## Promotion condition\n\nThis branch may be merged into the relay because it repairs the bootstrap path without consuming the bootstrap. Merge does not authorize or simulate the real runtime. After merge, health, synthetic pairing regression, acceptance regression, database absence of codex-v4, and audit-chain validity must be rechecked on main.\n",[301],"668b73c5-7e00-40e3-9a66-ac09b0dc9899","R4_PR412_SUCCESSOR_BIND.md","01a04b8e-f2f4-7230-af1c-577cc7c29f08",["D",1787974054647],"# RUMBO R4 — Successor PR #412 Exact TEST_ONLY Binding\n\nStatus: **PASS / MERGE_NOT_AUTHORIZED / PRODUCTION_NO_GO**\n\nThis record supersedes the historical PR #392 binding for active continuity work.\n\n## Exact GitHub binding\n\n- PR: `412`\n- base SHA observed at binding precheck: `1ad77acefc7326595c50d7b0edffa81a2188e737`\n- head SHA: `d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7`\n- changed files: 5\n- PR state: OPEN / DRAFT\n- mergeable at precheck: true\n- branch relation at precheck: 7 ahead / 4 behind current main\n\nRepository identity SHA-256:\n\n`59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23`\n\nControl package SHA-256:\n\n`afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\n## External evidence object\n\nCanonical evidence SHA-256:\n\n`67613e277793d67e574db7af2399084e454209af492b78dbff2c8c99e0ff5b8b`\n\nScope:\n\n`TEST_ONLY_SUCCESSOR_PR_HEAD_BINDING_NO_MERGE_NO_PRODUCTION`\n\nThe evidence object also recorded:\n\n- runtime `R4-ACCEPTANCE-GUARD`;\n- HTTP runtime file version 40;\n- guard configured true;\n- merge authorization enabled false;\n- `production_go=false`;\n- Codex runtime acceptance `PENDING_CODEX_ACK`;\n- observer run `33229303565` queued at binding precheck.\n\n## One-time transaction\n\nVal Town evaluation ID:\n\n`01a04b5f-19d9-73cd-a69c-a81df8bad877`\n\nResult:\n\n- selftest: PASS\n- authorization ID: `5ea45798-b901-42c3-bd6a-bc3998f6c2a8`\n- request SHA-256: `28ca0c6ec5eeb5b1f54554b863cfe03c02e94876a95dee38b44713cca6b37c2d`\n- consumption receipt SHA-256: `f2fbfe727122a89f3833d97a54b9497d29d860f5bf1efdabeef76ceca708195f`\n- merge_authorized: false\n- production_go: false\n\nThe dedicated guard bearer and raw one-time token were used only inside the Val Town runtime and were not logged. The temporary self-test script was deleted after the single successful execution.\n\n## Claim boundary\n\nThis proves a live, exact, one-time TEST_ONLY authorization for the stated PR #412 snapshot.\n\nIt does not authorize merging, deployment, product production, or bypass of any unresolved trust-root gate. If the PR head or relevant base evidence changes, this receipt becomes historical and a new exact binding is required.\n",[307],"e785e2a9-445e-4fcb-b47e-a83fd1ff3efd","R4_PR392_FINAL_BIND.md","01a04b8e-f2f4-7230-af1c-500f9122674a",["D",1787974054647],"# RUMBO R4 — PR #392 Final Head Binding\n\nStatus: **TEST_ONLY_BINDING_PASS / MERGE_NOT_AUTHORIZED / PRODUCTION_NO_GO**\n\nThis record binds the live external R2 guard to the exact current GitHub PR #392 head without granting merge or production authority.\n\n## GitHub binding\n\n- repository identity SHA-256: `59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23`\n- PR: `392`\n- base SHA: `fd66dc70415c2aefcd654b9f01ce5b3c4d115a7f`\n- head SHA: `bcfb38f46438535cd200d10a2cde3bcb4f7aafc2`\n- control package SHA-256: `afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\nThe PR was observed OPEN, DRAFT, mergeable, with five changed files when the evidence object was constructed.\n\n## External runtime binding\n\nRuntime: `sebas1/rumbo-continuity-relay`\n\nImplementation observed before issuance:\n\n`R4-ACCEPTANCE-GUARD`\n\nRuntime guard state:\n\n- configured: true\n- merge authorization enabled: false\n- production_go: false\n\nThe Codex real-runtime acceptance verifier remained fail-closed at:\n\n`PENDING_CODEX_ACK`\n\nChallenge message SHA-256:\n\n`70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979`\n\n## Evidence object\n\nCanonical evidence SHA-256:\n\n`2abe5bb70059597092668a7c1d50534a069aacb6f84d92037e7db21a2bf14914`\n\nScope:\n\n`TEST_ONLY_FINAL_PR_HEAD_BINDING_NO_MERGE_NO_PRODUCTION`\n\n## One-time authorization transaction\n\nA branch-scoped script used the encrypted `R2_GUARD_TOKEN_V1` environment variable to call the live main runtime. The bearer and the raw one-time token were never logged.\n\nResult:\n\n- authorize: PASS\n- consume: PASS\n- one-time authorization ID: `6c54a26a-4cf3-4893-87ff-233c5351cc3d`\n- request SHA-256: `76629d5646aca94992c6248b24d1713d8ebf795214f5b2f8716265955c1bf196`\n- consumption receipt SHA-256: `7a73164985f7f19e26fdd755f83387adc1bc2729aa193dbb15330df0c8cf8c15`\n- merge_authorized: false\n- production_go: false\n\nVal Town evaluation ID:\n\n`01a04b5b-0efc-7728-8cc1-a86bd8d43430`\n\n## Safety audit\n\nThe runtime was independently re-audited before this transaction:\n\n- five guard routes present;\n- five guard routes require the dedicated guard bearer;\n- no raw guard bearer embedded in source;\n- merge authorization blocked at both issuance and consumption;\n- no public guard self-test route;\n- unauthenticated ledger access returns 401;\n- guard token hashes are not projected by ledger/status reads;\n- `production_go=false` remains invariant;\n- R4 acceptance verifier is read-only and currently reports `PENDING_CODEX_ACK`;\n- acceptance self-test returned PASS while preserving `production_go=false`.\n\nThe temporary PR-binding script was deleted from the release branch after its single successful execution.\n\n## Claim boundary\n\nThis record proves only that the external fail-closed authorizer could issue and atomically consume one TEST_ONLY authorization bound to the exact PR #392 head above.\n\nIt does **not** prove or authorize:\n\n- `MERGE_PR`\n- `GITHUB_OBSERVER_VALIDATED`\n- `DEDICATED_GITHUB_APP_CUSTODY`\n- `EXTERNAL_DEPLOYER_LIVE`\n- `PRODUCT_GO`\n- `PRODUCTION_GO`\n\nPR #392 must remain draft while the private GitHub-hosted observer is unable to obtain a runner and until the remaining trust-root gates are satisfied.\n",[313],"22f899e2-de67-4263-92f0-604c790c9ec2","R4_ACCEPTANCE_RELEASE.md","01a04b8e-f2f4-7230-af1c-4d2b00a92908",["D",1787974054647],"# RUMBO Continuity Relay — R4-ACCEPTANCE-GUARD Release Evidence\n\nDate: 2026-08-28/29 UTC\nScope: GPT↔Codex continuity relay / real-runtime acceptance verification only\nBaseline reconciled: main branch version 37 (R3-GUARD merge)\nProduction: NO_GO\n\n## Why R4 exists\n\nThe durable CURRENT V6 correctly required one real Codex runtime execution but had no live read-only endpoint that converted the exact acceptance-lane evidence into an explicit fail-closed state machine.\n\nR4 adds that verifier without changing the acceptance challenge, issuing an ACK, creating a message, consuming pairing, authorizing a project action or promoting production.\n\n## Preserved concurrent work\n\nR3-GUARD was detected as a concurrent same-scope mutation after the earlier relay baseline was read. It was reconciled before R4 edits.\n\nR4 preserves:\n- external R2 authorizer;\n- one-time-token ledger;\n- exact PR/base/head/package/evidence binding;\n- merge authorization disabled unless separately enabled;\n- production_go=false.\n\n## New protected endpoint\n\nGET /v1/acceptance/CODEX_REAL_RUNTIME_ACCEPTANCE_V1\n\nAuthorization: GPT or admin bearer only.\nMutation behavior: none.\n\nFail-closed states:\n- CHALLENGE_NOT_PROVEN\n- AMBIGUOUS_CHALLENGE_SET\n- CHALLENGE_CONTRACT_MISMATCH\n- PENDING_CODEX_ACK\n- PENDING_CODEX_RESPONSE\n- AMBIGUOUS_MULTIPLE_CODEX_RESPONSES\n- INVALID_CODEX_RESPONSE\n- PENDING_CHATGPT_ACK\n- PASS_RUNTIME_ROUNDTRIP\n\nPASS requires:\n1. exactly one stored GPT→Codex acceptance challenge;\n2. challenge contract contains all seven declared acceptance requirements;\n3. exact Codex ACK bound to challenge message id + message SHA-256;\n4. exactly one Codex→GPT reverse response;\n5. exact challenge nonce;\n6. valid SHA-256 syntax for local plugin manifest and local runtime receipt;\n7. exact final GPT ACK bound to reverse message id + message SHA-256.\n\nPENDING_CHATGPT_ACK keeps manual semantic review explicit. PASS proves only continuity transport/runtime binding; it never grants project production authorization.\n\n## Live release regression\n\nSelf-test file: acceptance_selftest.ts\nSelf-test file version: 45\nEvaluation ID: 01a04b59-7aa6-74ed-a388-865ee2e1437c\nResult: PASS\n\nObserved:\n- implementation_revision = R4-ACCEPTANCE-GUARD\n- unauthenticated acceptance request = HTTP 401\n- authenticated acceptance state = PENDING_CODEX_ACK\n- mechanical_checks_passed = false\n- lane revision = 1\n- lane checkpoint SHA-256 = d97d464ac817879c733f26249518faf3833a48c8e00a14d7ebed389af9a70962\n- audit_chain_ok = true\n- audit event count at release test = 29\n- production_go = false\n\nExact challenge:\n- message id = f7ca12d8-226a-43b9-9fc0-bd9ede8548af\n- message SHA-256 = 70d6702195fca8666fd31d15084993c8ce4a7e191bd692984c0b1429c92f5979\n- acked_at = null\n\nReal pairing:\n- pairing id codex-v4 rows observed = 0\n- therefore production pairing is NOT_ISSUED / NOT_CONFIRMED.\n\n## Source versions at seal preparation\n\n- main.tsx = version 40\n- README.md = version 44\n- acceptance_selftest.ts = version 45\n- R3_GUARD_RELEASE.md = version 37\n\n## Reconciliation with durable CURRENT\n\nSECOND_BRAIN_CONTINUITY_CURRENT_V6 remains semantically correct for the gate:\n- actual Codex runtime requires one real execution;\n- full federated runtime remains NO_GO until real Codex response and final ChatGPT ACK.\n\nIts relay implementation label is now stale relative to the live relay because R3-GUARD and R4-ACCEPTANCE-GUARD were promoted afterward. This release evidence is an append-only live implementation delta; it does not silently rewrite the durable CURRENT pointer.\n\n## Truth boundary\n\nR4_IMPLEMENTATION = PASS_LIVE\nR4_SELFTEST = PASS\nAUDIT_CHAIN = PASS\nREAL_CODEX_PAIRING_V4 = NOT_PROVEN\nREAL_CODEX_ACK = NOT_PROVEN\nREAL_CODEX_RESPONSE = NOT_PROVEN\nFINAL_CHATGPT_ACK = NOT_PROVEN\nFULL_FEDERATED_RUNTIME = NO_GO\nPRODUCTION = NO_GO\n\n## Next gate\n\nThe only valid next promotion event is a real user Codex/local runtime:\n1. performs V4 pairing/bootstrap;\n2. consumes this exact challenge;\n3. ACKs this exact challenge id + SHA-256;\n4. publishes one reverse response with the same nonce plus local manifest/runtime receipt SHA-256 values;\n5. then ChatGPT performs semantic review and exact final ACK.\n\nNo simulation, static package, activation ZIP, self-test or prepared launcher may substitute for that receipt.\n",[319],"30a4dffd-56bd-4e4d-8055-e722758f0b6b","R3_GUARD_RELEASE.md","01a04b8e-f2f4-7230-af1c-4b0e1a6da906",["D",1787974054647],"# RUMBO Continuity Relay — R3-GUARD Release Evidence\n\nDate: 2026-08-28/29 UTC \nBranch: `r2-guard-v1` \nSource file: `main.tsx` version 23 before this evidence-file commit \nPrior main baseline: version 36\n\n## Scope\n\nR3-GUARD adds a fail-closed external authorization runtime and durable one-time-token ledger for the RUMBO Continuity R2 control package.\n\nIt does **not** grant product production approval, does not deploy the product, does not provide native GitHub branch protection, and does not claim dedicated GitHub App custody.\n\n## Exact package pin\n\n`afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\nLocal package evidence retained by the R2 control lane:\n\n- unit tests: 105/105 PASS\n- blackbox: 43/43 PASS\n- static groups: 9/9 PASS\n- manifest entries: 99/99 verified\n\n## Runtime safety properties\n\n- dedicated encrypted guard bearer; no bearer value in source;\n- exact opaque repository-identity SHA-256 pin;\n- exact PR/base/head/package/evidence binding;\n- one-time random token, persisted only as SHA-256;\n- 60–900 second TTL;\n- duplicate exact request rejection;\n- atomic single consumption;\n- replay rejection;\n- exact binding mismatch rejection;\n- expiry enforcement;\n- guard lifecycle events hash-chained through the existing audit ledger;\n- protected ledger/status endpoints;\n- token hashes omitted from read APIs;\n- `production_go=false` invariant;\n- `MERGE_PR` blocked at both issuance and consumption unless an explicit runtime gate is enabled.\n\nThe merge-enabling environment variable is intentionally absent.\n\n## Live adversarial self-test V2\n\nTrace ID:\n\n`01a04b54d32f71f6a6603bbca17a4e44`\n\nHTTP result: 200.\n\nChecks:\n\n- unauthorized ledger: 401\n- merge issuance disabled: 423\n- invalid repository binding: 400\n- invalid TTL: 400\n- TEST_ONLY authorize: 201\n- invalid consumer: 400; state remained ISSUED\n- TEST_ONLY consume: 200\n- replay: 409\n- duplicate authorize: 409\n- effective expired read: 200 / EXPIRED\n- revoke expired authorization: 410 / durable EXPIRED\n- MERGE_PR fixture consume while disabled: 423\n- merge fixture revoke: 200\n- ledger: 200\n- token-hash leakage: false\n\nTEST_ONLY consumption receipt SHA-256:\n\n`90d2e2fd1691b523e0a0ab182ad2f41dd9a6d8dd6ec2f06d8af19c24a58e82ab`\n\nTemporary self-test and housekeeping HTTP routes were removed before release.\n\n## Final static audit\n\n- guard routes present: 5\n- guard routes with explicit bearer check: 5\n- self-test routes present: 0\n- raw guard bearer embedded in source: false\n- merge-disabled branches present at issuance and consumption: true\n- public/authenticated ledger projection includes token SHA-256: false\n- production-go false markers retained: true\n\n## Post-cleanup live check\n\n`GET /health` returned 200 with:\n\n- implementation revision `R3-GUARD`\n- guard configured: true\n- merge authorization enabled: false\n- production_go: false\n\n## Promotion boundary\n\nPromotion of this branch means only:\n\n`EXTERNAL_AUTHORIZER_LIVE_FAIL_CLOSED` \n`ONE_TIME_TOKEN_LEDGER_LIVE`\n\nIt does not mean:\n\n`GITHUB_OBSERVER_VALIDATED` \n`DEDICATED_GITHUB_APP_CUSTODY` \n`EXTERNAL_DEPLOYER_LIVE` \n`PRODUCT_GO` \n`PRODUCTION_GO`\n",[325],"325447a4-56c0-4741-82d7-246239e10719","components","01a04b8e-f2f4-7230-af1c-4680b4b74165",["D",1787974054647],"directory",[331],"pulls","branches",26,"forks","envVars",{"_344":252,"_346":60},"connections",{"_344":60,"_345":60},"count","unfilledCount","emptyCount",{"_40":330,"_31":331,"_29":332,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":449,"_13":60,"_32":334,"_33":-5,"_23":24,"_173":-5,"_374":450,"_26":451},{"_40":324,"_31":325,"_29":326,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":446,"_13":60,"_32":20,"_33":328,"_23":24,"_173":-5,"_374":447,"_26":448},{"_40":318,"_31":319,"_29":320,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":443,"_13":60,"_32":20,"_33":322,"_23":24,"_173":-5,"_374":444,"_26":445},{"_40":312,"_31":313,"_29":314,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":440,"_13":60,"_32":20,"_33":316,"_23":24,"_173":-5,"_374":441,"_26":442},{"_40":306,"_31":307,"_29":308,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":437,"_13":60,"_32":20,"_33":310,"_23":24,"_173":-5,"_374":438,"_26":439},{"_40":300,"_31":301,"_29":302,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":434,"_13":60,"_32":20,"_33":304,"_23":24,"_173":-5,"_374":435,"_26":436},{"_40":294,"_31":295,"_29":296,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":431,"_13":60,"_32":20,"_33":298,"_23":24,"_173":-5,"_374":432,"_26":433},{"_40":288,"_31":289,"_29":290,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":428,"_13":60,"_32":20,"_33":292,"_23":24,"_173":-5,"_374":429,"_26":430},{"_40":285,"_31":27,"_29":30,"_167":-5,"_38":39,"_37":14,"_169":56,"_35":425,"_13":60,"_32":20,"_33":34,"_23":24,"_173":-5,"_374":426,"_26":427},{"_40":278,"_31":279,"_29":280,"_167":-5,"_38":39,"_37":281,"_169":56,"_35":422,"_13":207,"_32":20,"_33":283,"_23":24,"_173":-5,"_374":423,"_26":424},{"_40":271,"_31":272,"_29":273,"_167":-5,"_38":39,"_37":274,"_169":56,"_35":419,"_13":60,"_32":20,"_33":276,"_23":24,"_173":-5,"_374":420,"_26":421},{"_40":264,"_31":265,"_29":266,"_167":-5,"_38":39,"_37":267,"_169":56,"_35":416,"_13":207,"_32":171,"_33":269,"_23":24,"_173":-5,"_374":417,"_26":418},{"_40":256,"_31":257,"_29":258,"_167":-5,"_38":39,"_37":259,"_169":56,"_35":413,"_13":261,"_32":20,"_33":262,"_23":24,"_173":-5,"_374":414,"_26":415},{"_40":247,"_31":248,"_29":249,"_167":-5,"_38":39,"_37":250,"_169":56,"_35":410,"_13":252,"_32":253,"_33":254,"_23":24,"_173":-5,"_374":411,"_26":412},{"_40":241,"_31":242,"_29":243,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":407,"_13":60,"_32":171,"_33":245,"_23":24,"_173":-5,"_374":408,"_26":409},{"_40":235,"_31":236,"_29":237,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":404,"_13":60,"_32":171,"_33":239,"_23":24,"_173":-5,"_374":405,"_26":406},{"_40":229,"_31":230,"_29":231,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":401,"_13":60,"_32":171,"_33":233,"_23":24,"_173":-5,"_374":402,"_26":403},{"_40":223,"_31":224,"_29":225,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":398,"_13":60,"_32":171,"_33":227,"_23":24,"_173":-5,"_374":399,"_26":400},{"_40":217,"_31":218,"_29":219,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":395,"_13":60,"_32":171,"_33":221,"_23":24,"_173":-5,"_374":396,"_26":397},{"_40":211,"_31":212,"_29":213,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":392,"_13":60,"_32":171,"_33":215,"_23":24,"_173":-5,"_374":393,"_26":394},{"_40":204,"_31":205,"_29":206,"_167":-5,"_38":39,"_37":207,"_169":56,"_35":389,"_13":60,"_32":171,"_33":209,"_23":24,"_173":-5,"_374":390,"_26":391},{"_40":197,"_31":198,"_29":199,"_167":-5,"_38":39,"_37":200,"_169":24,"_35":386,"_13":60,"_32":171,"_33":202,"_23":24,"_173":-5,"_374":387,"_26":388},{"_40":190,"_31":191,"_29":192,"_167":-5,"_38":39,"_37":193,"_169":56,"_35":383,"_13":178,"_32":171,"_33":195,"_23":24,"_173":-5,"_374":384,"_26":385},{"_40":182,"_31":183,"_29":184,"_167":-5,"_38":39,"_37":185,"_169":56,"_35":380,"_13":187,"_32":171,"_33":188,"_23":24,"_173":-5,"_374":381,"_26":382},{"_40":175,"_31":176,"_29":177,"_167":-5,"_38":39,"_37":178,"_169":24,"_35":377,"_13":60,"_32":171,"_33":180,"_23":24,"_173":-5,"_374":378,"_26":379},{"_40":164,"_31":165,"_29":166,"_167":-5,"_38":39,"_37":168,"_169":24,"_35":373,"_13":60,"_32":171,"_33":172,"_23":24,"_173":-5,"_374":375,"_26":376},["D",1787974845505],"children",[],[165],["D",1787974072914],[],[176],["D",1787974957496],[],[183],["D",1787974708224],[],[191],["D",1787974432105],[],[198],["D",1787974054647],[],[205],["D",1787974054647],[],[212],["D",1787974054647],[],[218],["D",1787974054647],[],[224],["D",1787974054647],[],[230],["D",1787974054647],[],[236],["D",1787974054647],[],[242],["D",1787974876824],[],[248],["D",1787974628459],[],[257],["D",1787974983539],[],[265],["D",1787974830507],[],[272],["D",1787974941118],[],[279],["D",1787975016752],[],[27],["D",1787974054647],[],[289],["D",1787974054647],[],[295],["D",1787974054647],[],[301],["D",1787974054647],[],[307],["D",1787974054647],[],[313],["D",1787974054647],[],[319],["D",1787974054647],[],[325],["D",1787974054647],[],[331],["D",1787964475423],["D",1789531243171],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":52,"_104":105,"_106":24},{"_13":86,"_31":87,"_40":39,"_88":41,"_89":90,"_91":92,"_93":47,"_94":41,"_95":62,"_96":42,"_97":98},"ctx",{"_79":-5,"_128":490,"_491":492,"_493":494,"_495":24,"_496":24,"_497":24,"_498":56,"_499":-5,"_500":-7,"_501":-7,"_502":60,"_503":24,"_504":24,"_505":-5,"_506":24,"_507":24,"_508":24,"_509":-5},"ENV",{"_461":462,"_463":464,"_465":134,"_466":467,"_468":469,"_470":471,"_472":473,"_474":475,"_476":477,"_478":479,"_480":481,"_482":483,"_484":485,"_486":487,"_488":489},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v43