[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_250":251,"_252":253},"routes/_app.x.$handle.$name",{"_98":97,"_31":42,"_107":86,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":121,"_122":24,"_123":124,"_125":56,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",19,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","RELEASE_V3_3.md","latestPath","fileId","555c535c-a367-11f1-a59c-1607ee4eb77e","name","fileType","content","# RUMBO R2 Dedicated Authorizer V3.3 — Broker Chain Pin\n\nStatus: **PASS / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `DEDICATED_R2_AUTHORIZER_V3_3_BROKER_CHAIN_PINNED`.\n\nRequired observer: `R2_GITHUB_OBSERVER_V1_3_BROKER_IMPLEMENTATION_PINNED`.\nRequired broker provenance inside the signed observer receipt: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\n\nThe authorizer now rejects both observer implementation downgrade and broker implementation downgrade before any merge authority can be issued. Signed authorizer schemas advance to v3.3.\n\nA temporary branch-only verifier was used to test the real observer ES256 chain and was removed before release. Evaluation `01a04be8-8d45-733a-b286-050e167baa16` passed: valid signed observer receipt accepted; broker downgrade rejected with `BROKER_IMPLEMENTATION_MISMATCH`; observer downgrade rejected; binding mismatch rejected; signature tamper rejected.\n\nThe permanent selftest evaluation `01a04be8-d8d1-7758-bbd8-1aef1d73ddbc` also passed after the diagnostic route was removed.\n\nTEST_ONLY receipt SHA-256: `28e52c4f9c6607f2bb4a5326e5be70b0bd757eabf0fe9495408f00e38504bcea`.\n\nStatic audit: PASS. Merge authorization remains disabled and `production_go=false`.\n","createdAt",["D",1787979963416],"branchVersion","branchId","1eff6f86-71ba-4702-9abe-d98185472583","id","c407813c-3b2b-489f-a186-e17f90eccf60","rumbo-r2-authorizer",["D",1787974602620],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Dedicated fail-closed RUMBO R2 authorizer","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","da1a7e96-a35a-11f1-816f-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","c407813c3b2b489fa186e17f90eccf60","tursoHostname","c407813c3b2b489fa186e17f90eccf60-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789539031988],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":52,"_103":104,"_105":24},"branch",{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":91,"_92":47,"_93":41,"_94":62,"_95":42,"_96":97},"isOwned","v3-3-broker-chain-pin","projectId","forkedBranchId","3bec92a5-228b-4d7e-8a94-d7a3be5df58e","forkedBranchVersion",11,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":245,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":246,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":247,"_81":248,"_83":249,"_85":24},"tree",[212,213,214,215,216,217,218,219],"files",[212,213,214,215,216,217,218,219],"counts",{"_200":60,"_201":202,"_203":60,"_204":205,"_206":207},"contents",[137,138,139,140,141,142,143,144],"upstreamProject","upstreamBranch",{"_40":89,"_35":130,"_131":132,"_31":133,"_87":41,"_13":134,"_88":-5,"_90":-5,"_135":136,"_44":-5,"_85":24,"_46":47,"_96":97,"_61":62,"_95":42},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787974602620],"updatedAt",["D",1787988816758],"main",18,"lockfileKey","1787988817144-esm.town_v_sebas1_rumbo-r2-authorizer@18-main",{"_40":194,"_31":195,"_29":196,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":197,"_13":60,"_32":20,"_33":198,"_23":24,"_155":-5,"_26":199},{"_40":188,"_31":189,"_29":190,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":191,"_13":60,"_32":20,"_33":192,"_23":24,"_155":-5,"_26":193},{"_40":182,"_31":183,"_29":184,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":185,"_13":60,"_32":20,"_33":186,"_23":24,"_155":-5,"_26":187},{"_40":176,"_31":177,"_29":178,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":179,"_13":60,"_32":20,"_33":180,"_23":24,"_155":-5,"_26":181},{"_40":169,"_31":170,"_29":171,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":173,"_13":60,"_32":20,"_33":174,"_23":24,"_155":-5,"_26":175},{"_40":166,"_31":27,"_29":30,"_148":-5,"_38":39,"_37":14,"_150":56,"_35":167,"_13":60,"_32":20,"_33":34,"_23":24,"_155":-5,"_26":168},{"_40":157,"_31":158,"_29":159,"_148":-5,"_38":39,"_37":160,"_150":56,"_35":161,"_13":162,"_32":163,"_33":164,"_23":24,"_155":-5,"_26":165},{"_40":145,"_31":146,"_29":147,"_148":-5,"_38":39,"_37":149,"_150":56,"_35":151,"_13":152,"_32":153,"_33":154,"_23":24,"_155":-5,"_26":156},"0053c43d-7c4f-4187-922e-0d41bdf9994b","selftest.ts","01a04be7-0b7b-72cb-9e77-00704b24bbd5","parentId",14,"latest",["D",1787979895146],7,"script","const base = \"https://sebas1--01a04be70b7b72cb9e76fdc9c4137ad8.web.val.run\";\nconst root = Deno.env.get(\"R2_AUTH_ROOT_TOKEN\");\nif (!root) throw new Error(\"ROOT_TOKEN_MISSING\");\n\nconst headers = {Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\nconst repo = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst pkg = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst baseSha = \"1ad77acefc7326595c50d7b0edffa81a2188e737\";\nconst headSha = \"d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7\";\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\") + \"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nasync function verifyES256(canon:string,sig:string,jwk:JsonWebKey):Promise{\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n return await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},key,b64urlDecode(sig),new TextEncoder().encode(canon)\n );\n}\nasync function verifyV3Receipt(v:any,jwk:JsonWebKey):Promise{\n const receipt={\n schema:v.schema,\n authorizer_implementation:v.authorizer_implementation,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n const canon=canonical(receipt);\n if(await sha256(canon)!==v.receipt_sha256)return false;\n return await verifyES256(canon,String(v.receipt_signature?.signature_b64url||\"\"),jwk);\n}\n\nconst healthRes=await fetch(base+\"/health\");\nconst health:any=await healthRes.json();\n\nconst unauthV3=await fetch(base+\"/v3/ledger\");\nconst invalidRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"TEST_ONLY\",repository_identity_sha256:\"0\".repeat(64),pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"1\".repeat(64)\n })\n});\n\nconst v1MergeIssueRes=await fetch(base+\"/v1/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"MERGE_PR\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"2\".repeat(64)\n })\n});\nconst v1MergeConsumeRes=await fetch(base+\"/v1/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"MERGE_PR\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"2\".repeat(64),\n authorization_id:\"00000000-0000-4000-8000-000000000000\",\n token:\"A\".repeat(43),consumer:\"selftest\"\n })\n});\n\nconst v3MergeDisabledRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"MERGE_PR\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"3\".repeat(64),\n observer_receipt:{}\n })\n});\n\nconst rb=new Uint8Array(32);crypto.getRandomValues(rb);\nconst uniqueEvidence=[...rb].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nconst binding={\n action:\"TEST_ONLY\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:uniqueEvidence\n};\n\nconst testOnlyWithObserverRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({...binding,observer_receipt:{synthetic:true}})\n});\n\nconst issueRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,body:JSON.stringify({...binding,ttl_seconds:300})\n});\nconst issue:any=await issueRes.json();\nif(issueRes.status!==201)throw new Error(`V3_ISSUE_FAILED_${issueRes.status}_${issue.error||\"UNKNOWN\"}`);\n\nconst wrongRes=await fetch(base+\"/v3/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n ...binding,observer_receipt_sha256:null,\n authorization_id:issue.authorization_id,token:\"B\".repeat(43),consumer:\"selftest-wrong\"\n })\n});\n\nconst consumeRes=await fetch(base+\"/v3/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n ...binding,observer_receipt_sha256:null,\n authorization_id:issue.authorization_id,token:issue.token,consumer:\"selftest-v3\"\n })\n});\nconst consume:any=await consumeRes.json();\nconst signedV3Valid=consumeRes.status===200\n ? await verifyV3Receipt(consume,health.receipt_signature?.verify_jwk)\n : false;\nconst tamperedV3Valid=consumeRes.status===200\n ? await verifyV3Receipt({...consume,head_sha:\"f\".repeat(40)},health.receipt_signature?.verify_jwk)\n : true;\n\nconst replayRes=await fetch(base+\"/v3/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n ...binding,observer_receipt_sha256:null,\n authorization_id:issue.authorization_id,token:issue.token,consumer:\"selftest-replay\"\n })\n});\nconst duplicateRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,body:JSON.stringify({...binding,ttl_seconds:300})\n});\n\nconst ledgerRes=await fetch(base+\"/v3/ledger\",{headers});\nconst ledger:any=await ledgerRes.json();\nconst tokenHashLeak=Array.isArray(ledger.records)&&ledger.records.some((r:any)=>Object.prototype.hasOwnProperty.call(r,\"token_sha256\"));\n\nconst auditRes=await fetch(base+\"/v1/audit\",{headers});\nconst audit:any=await auditRes.json();\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"DEDICATED_R2_AUTHORIZER_V3_3_BROKER_CHAIN_PINNED\"&&\n health.root_token_configured===true&&\n health.receipt_signing_key_configured===true&&\n health.receipt_signature?.alg===\"ES256\"&&\n health.receipt_signature?.kid===\"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\"&&\n health.observer_trust_root?.implementation===\"R2_GITHUB_OBSERVER_V1_3_BROKER_IMPLEMENTATION_PINNED\"&&\n health.observer_trust_root?.broker_implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE\"&&\n health.observer_trust_root?.signing_kid===\"aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8\"&&\n health.observer_trust_root?.merge_requires_native_enforcement===true&&\n health.observer_trust_root?.max_issue_age_seconds===300&&\n health.observer_trust_root?.max_consume_age_seconds===600&&\n health.merge_authorization_enabled===false&&\n health.production_go===false&&\n unauthV3.status===401&&\n invalidRes.status===400&&\n v1MergeIssueRes.status===410&&\n v1MergeConsumeRes.status===410&&\n v3MergeDisabledRes.status===423&&\n testOnlyWithObserverRes.status===400&&\n issueRes.status===201&&\n issue.schema===\"rumbo-r2-dedicated-authorizer-issuance/v3.3\"&&\n issue.authorizer_implementation===\"DEDICATED_R2_AUTHORIZER_V3_3_BROKER_CHAIN_PINNED\"&&\n issue.action===\"TEST_ONLY\"&&\n issue.observer_receipt_sha256===null&&\n issue.merge_authorized===false&&\n issue.production_go===false&&\n wrongRes.status===403&&\n consumeRes.status===200&&\n consume.schema===\"rumbo-r2-dedicated-authorizer-consumption/v3.3\"&&\n consume.authorizer_implementation===\"DEDICATED_R2_AUTHORIZER_V3_3_BROKER_CHAIN_PINNED\"&&\n consume.observer_receipt_sha256===null&&\n consume.merge_authorized===false&&\n consume.production_go===false&&\n signedV3Valid===true&&\n tamperedV3Valid===false&&\n replayRes.status===409&&\n duplicateRes.status===409&&\n ledgerRes.status===200&&\n ledger.schema===\"rumbo-r2-dedicated-authorizer-ledger/v3.3\"&&\n ledger.observer_gate_required_for_merge===true&&\n tokenHashLeak===false&&\n auditRes.status===200&&\n audit.audit_chain_ok===true&&\n audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n unauthenticated_v3_ledger:unauthV3.status,\n invalid_binding:invalidRes.status,\n v1_merge_issue_retired:v1MergeIssueRes.status,\n v1_merge_consume_retired:v1MergeConsumeRes.status,\n v3_merge_gate_disabled:v3MergeDisabledRes.status,\n test_only_with_observer_rejected:testOnlyWithObserverRes.status,\n v3_test_issue:issueRes.status,\n wrong_token:wrongRes.status,\n v3_test_consume:consumeRes.status,\n signed_v3_receipt_verified:signedV3Valid,\n tampered_v3_receipt_verified:tamperedV3Valid,\n replay:replayRes.status,\n duplicate:duplicateRes.status,\n ledger:ledgerRes.status,\n token_hash_leak:tokenHashLeak,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n authorization_id:issue.authorization_id,\n request_sha256:issue.request_sha256,\n receipt_sha256:consume.receipt_sha256,\n observer_gate_required_for_merge:true,\n merge_authorization_enabled:false,\n production_go:false\n},null,2));\nif(!pass)Deno.exit(1);\n","label",[146],"ae762963-d205-4121-b114-37afd019609c","main.tsx","01a04be7-0b7b-72cb-9e76-fdc9c4137ad8",17,["D",1787979938225],8,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\n\nconst IMPLEMENTATION = \"DEDICATED_R2_AUTHORIZER_V3_3_BROKER_CHAIN_PINNED\";\nconst OBSERVER_IMPLEMENTATION = \"R2_GITHUB_OBSERVER_V1_3_BROKER_IMPLEMENTATION_PINNED\";\nconst BROKER_IMPLEMENTATION = \"R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE\";\nconst SIGNING_KEY_ID = \"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\";\nconst OBSERVER_SIGNING_KEY_ID = \"aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8\";\nconst OBSERVER_VERIFY_JWK: JsonWebKey = {\n kty:\"EC\",crv:\"P-256\",\n x:\"lYPzwJFKYb5YZsikYx57Wr6TfkwwNyog15s0BN_p8fA\",\n y:\"9bVfI4jPqeN-yt2KQjz9MgmsDjLpbqzs1pw1DcgPwHQ\",\n key_ops:[\"verify\"],ext:true\n};\nconst OBSERVER_REPO_FULL = \"fscfede-beep/rumbo-control-queue\";\nconst OBSERVER_REPOSITORY_ID = 1314199389;\nconst OBSERVER_OWNER_ID = 293577326;\nconst MAX_OBSERVER_ISSUE_AGE_SECONDS = 300;\nconst MAX_OBSERVER_CONSUME_AGE_SECONDS = 600;\nconst RECEIPT_VERIFY_JWK = {\n kty:\"EC\",crv:\"P-256\",\n x:\"TV0M-YRfRzqMB6dTZIhLOu7w21Tkgul-lUns7HwpHy4\",\n y:\"mRWAIOykqSBgsAXqC9t3OOmk3KLljPH935lilXma-W4\",\n key_ops:[\"verify\"],ext:true\n};\nconst REPOSITORY_IDENTITY_SHA256 = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst CONTROL_PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst SHA256_RE = /^[a-f0-9]{64}$/;\nconst GIT_SHA_RE = /^[a-f0-9]{40}$/;\nconst MAX_BODY_BYTES = 64 * 1024;\nconst MIN_TTL_SECONDS = 60;\nconst MAX_TTL_SECONDS = 900;\n\ntype GuardAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype Binding = {\n action: GuardAction;\n repository_identity_sha256: string;\n pr_number: number;\n base_sha: string;\n head_sha: string;\n package_sha256: string;\n evidence_sha256: string;\n};\n\ntype ObserverVerification = {\n ok: boolean;\n error?: string;\n receipt_sha256?: string;\n observed_at?: string;\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS authorizations (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_authorizations_status ON authorizations(status,expires_at)`,\n `CREATE TABLE IF NOT EXISTS authorizations_v3 (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n observer_receipt_sha256 TEXT,\n observer_observed_at TEXT,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_authorizations_v3_status ON authorizations_v3(status,expires_at)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_authorizations_v3_observer\n ON authorizations_v3(observer_receipt_sha256)\n WHERE observer_receipt_sha256 IS NOT NULL`,\n `CREATE TABLE IF NOT EXISTS audit_events (\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n authorization_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_unique ON audit_events(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_event_object_unique\n ON audit_events(event_type,authorization_id)\n WHERE authorization_id IS NOT NULL`\n]);\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n const aa = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < aa.length; i++) diff |= aa[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction authorized(req: Request): boolean {\n const expected = Deno.env.get(\"R2_AUTH_ROOT_TOKEN\") || \"\";\n const observed = bearer(req);\n return !!expected && !!observed && constantTimeEqual(expected, observed);\n}\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k) + \":\" + canonical(o[k])).join(\",\") + \"}\";\n}\n\nasync function sha256(s: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(digest)].map(x => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction b64url(bytes: Uint8Array): string {\n const binary = Array.from(bytes, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\n\nfunction b64urlDecode(s:string):Uint8Array {\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\n\nasync function verifyObserverReceipt(v:any,binding:Binding,maxAgeSeconds:number):Promise {\n if(!v||typeof v!==\"object\")return {ok:false,error:\"OBSERVER_RECEIPT_MISSING\"};\n if(v.schema!==\"rumbo-r2-github-observer-receipt/v1\")return {ok:false,error:\"OBSERVER_SCHEMA_INVALID\"};\n if(v.observer_implementation!==OBSERVER_IMPLEMENTATION)return {ok:false,error:\"OBSERVER_IMPLEMENTATION_MISMATCH\"};\n if(v.broker_implementation!==BROKER_IMPLEMENTATION)return {ok:false,error:\"BROKER_IMPLEMENTATION_MISMATCH\"};\n if(v.authoritative_for!==\"R2_GITHUB_PR_SNAPSHOT_ONLY\")return {ok:false,error:\"OBSERVER_AUTHORITY_SCOPE_INVALID\"};\n if(v.production_go!==false)return {ok:false,error:\"OBSERVER_PRODUCTION_GO_INVALID\"};\n if(v.repository?.full_name!==OBSERVER_REPO_FULL||\n Number(v.repository?.id)!==OBSERVER_REPOSITORY_ID||\n Number(v.repository?.owner_id)!==OBSERVER_OWNER_ID){\n return {ok:false,error:\"OBSERVER_REPOSITORY_IDENTITY_MISMATCH\"};\n }\n if(Number(v.pr_number)!==binding.pr_number||\n String(v.base_sha)!==binding.base_sha||\n String(v.head_sha)!==binding.head_sha||\n String(v.package_sha256)!==binding.package_sha256){\n return {ok:false,error:\"OBSERVER_BINDING_MISMATCH\"};\n }\n if(v.observation_status!==\"OBSERVATION_PASS\"||Number(v.blocking_count)!==0){\n return {ok:false,error:\"OBSERVER_NOT_PASS\"};\n }\n if(v.native_enforcement?.proven!==true||v.merge_ready!==true){\n return {ok:false,error:\"OBSERVER_NATIVE_ENFORCEMENT_NOT_PROVEN\"};\n }\n const observedAt=String(v.observed_at||\"\");\n const observedMs=Date.parse(observedAt);\n const ageSeconds=(Date.now()-observedMs)/1000;\n if(!Number.isFinite(ageSeconds)||ageSeconds< -60||ageSeconds>maxAgeSeconds){\n return {ok:false,error:\"OBSERVER_RECEIPT_STALE\"};\n }\n if(!SHA256_RE.test(String(v.receipt_sha256||\"\"))){\n return {ok:false,error:\"OBSERVER_RECEIPT_HASH_INVALID\"};\n }\n if(v.receipt_signature?.alg!==\"ES256\"||\n v.receipt_signature?.kid!==OBSERVER_SIGNING_KEY_ID||\n !/^[A-Za-z0-9_-]{80,128}$/.test(String(v.receipt_signature?.signature_b64url||\"\"))){\n return {ok:false,error:\"OBSERVER_SIGNATURE_METADATA_INVALID\"};\n }\n\n const {receipt_sha256,receipt_signature,...unsigned}=v;\n const canon=canonical(unsigned);\n const computed=await sha256(canon);\n if(!constantTimeEqual(computed,String(receipt_sha256))){\n return {ok:false,error:\"OBSERVER_RECEIPT_HASH_MISMATCH\"};\n }\n let key:CryptoKey;\n try{\n key=await crypto.subtle.importKey(\"jwk\",OBSERVER_VERIFY_JWK,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n }catch{\n return {ok:false,error:\"OBSERVER_VERIFY_KEY_IMPORT_FAILED\"};\n }\n let sig:Uint8Array;\n try{sig=b64urlDecode(String(receipt_signature.signature_b64url));}\n catch{return {ok:false,error:\"OBSERVER_SIGNATURE_ENCODING_INVALID\"};}\n const verified=await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},key,sig,new TextEncoder().encode(canon)\n );\n if(!verified)return {ok:false,error:\"OBSERVER_SIGNATURE_INVALID\"};\n if(binding.evidence_sha256!==String(receipt_sha256)){\n return {ok:false,error:\"EVIDENCE_MUST_EQUAL_OBSERVER_RECEIPT_SHA256\"};\n }\n return {ok:true,receipt_sha256:String(receipt_sha256),observed_at:observedAt};\n}\n\nasync function signCanonicalReceipt(canonicalReceipt: string): Promise {\n const raw = Deno.env.get(\"R2_RECEIPT_SIGNING_JWK_V1\") || \"\";\n if (!raw) throw new Error(\"RECEIPT_SIGNING_KEY_NOT_CONFIGURED\");\n const jwk = JSON.parse(raw);\n const key = await crypto.subtle.importKey(\n \"jwk\", jwk, {name:\"ECDSA\",namedCurve:\"P-256\"}, false, [\"sign\"]\n );\n const signature = await crypto.subtle.sign(\n {name:\"ECDSA\",hash:\"SHA-256\"}, key, new TextEncoder().encode(canonicalReceipt)\n );\n return b64url(new Uint8Array(signature));\n}\n\nfunction randomToken(bytes = 32): string {\n const raw = new Uint8Array(bytes);\n crypto.getRandomValues(raw);\n const binary = Array.from(raw, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\nasync function bodyJson(c: any): Promise {\n const len = Number(c.req.header(\"content-length\") || \"0\");\n if (Number.isFinite(len) && len > MAX_BODY_BYTES) throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt = await c.req.text();\n if (new TextEncoder().encode(txt).length > MAX_BODY_BYTES) throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt || \"{}\");\n}\n\nfunction parseBinding(v: any): Binding | null {\n const action = String(v?.action || \"\") as GuardAction;\n const repository_identity_sha256 = String(v?.repository_identity_sha256 || \"\");\n const pr_number = Number(v?.pr_number);\n const base_sha = String(v?.base_sha || \"\");\n const head_sha = String(v?.head_sha || \"\");\n const package_sha256 = String(v?.package_sha256 || \"\");\n const evidence_sha256 = String(v?.evidence_sha256 || \"\");\n\n if (action !== \"TEST_ONLY\" && action !== \"MERGE_PR\") return null;\n if (repository_identity_sha256 !== REPOSITORY_IDENTITY_SHA256) return null;\n if (!Number.isSafeInteger(pr_number) || pr_number <= 0) return null;\n if (!GIT_SHA_RE.test(base_sha) || !GIT_SHA_RE.test(head_sha)) return null;\n if (package_sha256 !== CONTROL_PACKAGE_SHA256) return null;\n if (!SHA256_RE.test(evidence_sha256)) return null;\n\n return {action,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256};\n}\n\nasync function audit(event_type: string, authorization_id: string | null, object_sha256: string | null) {\n if (authorization_id) {\n const existing = await sqlite.execute({\n sql: \"SELECT event_sha256 FROM audit_events WHERE event_type=? AND authorization_id=? LIMIT 1\",\n args: [event_type, authorization_id]\n });\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n\n for (let attempt = 0; attempt < 8; attempt++) {\n const last = await sqlite.execute(\"SELECT event_sha256 FROM audit_events ORDER BY seq DESC LIMIT 1\");\n const prev = String(last.rows[0]?.event_sha256 || \"0\".repeat(64));\n const created_at = new Date().toISOString();\n const event = {event_type,authorization_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256 = await sha256(canonical(event));\n try {\n await sqlite.execute({\n sql: `INSERT INTO audit_events(event_type,authorization_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,\n args: [event_type,authorization_id,object_sha256,prev,event_sha256,created_at]\n });\n return event_sha256;\n } catch (e) {\n if (authorization_id) {\n const existing = await sqlite.execute({\n sql: \"SELECT event_sha256 FROM audit_events WHERE event_type=? AND authorization_id=? LIMIT 1\",\n args: [event_type, authorization_id]\n });\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\", (c) => c.json({\n service:\"rumbo-r2-authorizer\",\n implementation:IMPLEMENTATION,\n status:\"ok\",\n production_go:false\n}));\n\napp.get(\"/health\", (c) => c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_AUTH_ROOT_TOKEN\"),\n receipt_signing_key_configured:!!Deno.env.get(\"R2_RECEIPT_SIGNING_JWK_V1\"),\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KEY_ID,verify_jwk:RECEIPT_VERIFY_JWK},\n observer_trust_root:{\n implementation:OBSERVER_IMPLEMENTATION,\n broker_implementation:BROKER_IMPLEMENTATION,\n receipt_schema:\"rumbo-r2-github-observer-receipt/v1\",\n signing_kid:OBSERVER_SIGNING_KEY_ID,\n verify_jwk:OBSERVER_VERIFY_JWK,\n max_issue_age_seconds:MAX_OBSERVER_ISSUE_AGE_SECONDS,\n max_consume_age_seconds:MAX_OBSERVER_CONSUME_AGE_SECONDS,\n merge_requires_native_enforcement:true\n },\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n repository_identity_sha256:REPOSITORY_IDENTITY_SHA256,\n package_sha256:CONTROL_PACKAGE_SHA256,\n ttl_seconds:{min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},\n capabilities:[\n \"dedicated-external-authorizer\",\n \"exact-pr-binding\",\n \"one-time-token-ledger\",\n \"audit-hash-chain\",\n \"signed-consumption-receipts\",\n \"offline-public-key-verification\",\n \"signed-observer-receipt-verification\",\n \"native-enforcement-required-for-merge\",\n \"v1-merge-path-retired\",\n \"v3-observer-gated-merge\",\n \"fail-closed-merge-gate\"\n ],\n production_go:false\n}), 200, {\"Cache-Control\":\"no-store\"});\n\napp.post(\"/v1/authorize\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if (binding.action === \"MERGE_PR\") {\n return c.json({\n error:\"V1_MERGE_PATH_RETIRED_USE_V3_OBSERVER_GATED\",\n replacement:\"/v3/authorize\",\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < MIN_TTL_SECONDS || ttl > MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const request_sha256 = await sha256(canonical(binding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM authorizations WHERE request_sha256=? LIMIT 1\",\n args:[request_sha256]\n });\n if (prior.rows.length) {\n const row:any = prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const raw_token = randomToken();\n const token_sha256 = await sha256(raw_token);\n const authorization_id = crypto.randomUUID();\n const issued = new Date();\n const issued_at = issued.toISOString();\n const expires_at = new Date(issued.getTime() + ttl * 1000).toISOString();\n\n await sqlite.execute({\n sql:`INSERT INTO authorizations(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorization_id,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n request_sha256,token_sha256,issued_at,expires_at\n ]\n });\n\n try {\n await audit(\"AUTHORIZATION_ISSUED\",authorization_id,request_sha256);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n throw e;\n }\n\n return c.json({\n authorized:true,\n authorization_id,\n action:binding.action,\n request_sha256,\n token:raw_token,\n token_type:\"One-Time\",\n issued_at,\n expires_at,\n merge_authorized:binding.action === \"MERGE_PR\",\n production_go:false,\n note:\"Raw one-time token is returned only at issuance; only SHA-256 is persisted.\"\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/consume\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if (binding.action === \"MERGE_PR\") {\n return c.json({\n error:\"V1_MERGE_PATH_RETIRED_USE_V3_OBSERVER_GATED\",\n replacement:\"/v3/consume\",\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorization_id = String(b.authorization_id || \"\");\n const raw_token = String(b.token || \"\");\n const consumer = String(b.consumer || \"\");\n if (!authorization_id || !/^[A-Za-z0-9_-]{43,128}$/.test(raw_token)) {\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)) {\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const request_sha256 = await sha256(canonical(binding));\n const rs = await sqlite.execute({sql:\"SELECT * FROM authorizations WHERE authorization_id=? LIMIT 1\",args:[authorization_id]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status,authorization_id},409,{\"Cache-Control\":\"no-store\"});\n }\n if (!constantTimeEqual(String(row.request_sha256),request_sha256)) {\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const observed_token_sha256 = await sha256(raw_token);\n if (!constantTimeEqual(String(row.token_sha256),observed_token_sha256)) {\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumed_at = new Date().toISOString();\n const updated:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumed_at,consumer,authorization_id]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt = {\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v2\",\n authorization_id,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n request_sha256,\n consumed_at,\n consumer,\n merge_authorized:binding.action === \"MERGE_PR\",\n production_go:false\n };\n const receipt_canonical = canonical(receipt);\n const receipt_sha256 = await sha256(receipt_canonical);\n const receipt_signature_b64url = await signCanonicalReceipt(receipt_canonical);\n await audit(\"AUTHORIZATION_CONSUMED\",authorization_id,receipt_sha256);\n\n return c.json({\n ...receipt,\n consumed:true,\n receipt_sha256,\n receipt_signature:{\n alg:\"ES256\",\n kid:SIGNING_KEY_ID,\n signature_b64url:receipt_signature_b64url\n }\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/authorize\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n let observerReceiptSha:string|null=null;\n let observerObservedAt:string|null=null;\n\n if (binding.action === \"MERGE_PR\") {\n if (Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const verified = await verifyObserverReceipt(\n b.observer_receipt,\n binding,\n MAX_OBSERVER_ISSUE_AGE_SECONDS\n );\n if (!verified.ok) {\n return c.json({\n error:verified.error || \"OBSERVER_RECEIPT_INVALID\",\n production_go:false\n },403,{\"Cache-Control\":\"no-store\"});\n }\n observerReceiptSha=verified.receipt_sha256!;\n observerObservedAt=verified.observed_at!;\n } else if (b.observer_receipt !== undefined && b.observer_receipt !== null) {\n return c.json({error:\"TEST_ONLY_MUST_NOT_CARRY_OBSERVER_MERGE_RECEIPT\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < MIN_TTL_SECONDS || ttl > MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorityBinding = {...binding,observer_receipt_sha256:observerReceiptSha};\n const request_sha256 = await sha256(canonical(authorityBinding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM authorizations_v3 WHERE request_sha256=? LIMIT 1\",\n args:[request_sha256]\n });\n if (prior.rows.length) {\n const row:any=prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256,\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const raw_token=randomToken();\n const token_sha256=await sha256(raw_token);\n const authorization_id=crypto.randomUUID();\n const issued=new Date();\n const issued_at=issued.toISOString();\n const expires_at=new Date(issued.getTime()+ttl*1000).toISOString();\n\n await sqlite.execute({\n sql:`INSERT INTO authorizations_v3(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,observer_receipt_sha256,observer_observed_at,\n request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorization_id,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n observerReceiptSha,observerObservedAt,request_sha256,token_sha256,issued_at,expires_at\n ]\n });\n\n try {\n await audit(\"V3_AUTHORIZATION_ISSUED\",authorization_id,request_sha256);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n throw e;\n }\n\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-issuance/v3.3\",\n authorizer_implementation:IMPLEMENTATION,\n authorized:true,\n authorization_id,\n action:binding.action,\n request_sha256,\n observer_receipt_sha256:observerReceiptSha,\n token:raw_token,\n token_type:\"One-Time\",\n issued_at,\n expires_at,\n merge_authorized:binding.action===\"MERGE_PR\",\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/consume\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b=await bodyJson(c);\n const binding=parseBinding(b);\n if(!binding)return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if(binding.action===\"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\")!==\"true\"){\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorization_id=String(b.authorization_id||\"\");\n const raw_token=String(b.token||\"\");\n const consumer=String(b.consumer||\"\");\n const suppliedObserverSha=b.observer_receipt_sha256===null||b.observer_receipt_sha256===undefined\n ? null : String(b.observer_receipt_sha256);\n\n if(!authorization_id||!/^[A-Za-z0-9_-]{43,128}$/.test(raw_token)){\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if(!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)){\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if(suppliedObserverSha!==null&&!SHA256_RE.test(suppliedObserverSha)){\n return c.json({error:\"INVALID_OBSERVER_RECEIPT_SHA256\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorityBinding={...binding,observer_receipt_sha256:suppliedObserverSha};\n const request_sha256=await sha256(canonical(authorityBinding));\n const rs=await sqlite.execute({\n sql:\"SELECT * FROM authorizations_v3 WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if(!rs.rows.length)return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n\n if(String(row.status)===\"ISSUED\" && Date.parse(String(row.expires_at))<=Date.now()){\n const expired:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(expired?.rowsAffected??0)===1){\n await audit(\"V3_AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if(String(row.status)!==\"ISSUED\"){\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status,authorization_id},409,{\"Cache-Control\":\"no-store\"});\n }\n if(!constantTimeEqual(String(row.request_sha256),request_sha256)){\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const rowObserver=row.observer_receipt_sha256===null?null:String(row.observer_receipt_sha256);\n if(rowObserver!==suppliedObserverSha){\n return c.json({error:\"OBSERVER_RECEIPT_BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n if(binding.action===\"MERGE_PR\"){\n if(!rowObserver||!row.observer_observed_at){\n return c.json({error:\"OBSERVER_RECEIPT_REQUIRED\"},409,{\"Cache-Control\":\"no-store\"});\n }\n const observerAge=(Date.now()-Date.parse(String(row.observer_observed_at)))/1000;\n if(!Number.isFinite(observerAge)||observerAge< -60||observerAge>MAX_OBSERVER_CONSUME_AGE_SECONDS){\n return c.json({\n error:\"OBSERVER_RECEIPT_STALE_AT_CONSUME\",\n max_age_seconds:MAX_OBSERVER_CONSUME_AGE_SECONDS,\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n }\n\n const observed_token_sha256=await sha256(raw_token);\n if(!constantTimeEqual(String(row.token_sha256),observed_token_sha256)){\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumed_at=new Date().toISOString();\n const updated:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumed_at,consumer,authorization_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt={\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.3\",\n authorizer_implementation:IMPLEMENTATION,\n authorization_id,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n observer_receipt_sha256:rowObserver,\n request_sha256,\n consumed_at,\n consumer,\n merge_authorized:binding.action===\"MERGE_PR\",\n production_go:false\n };\n const canon=canonical(receipt);\n const receipt_sha256=await sha256(canon);\n const signature=await signCanonicalReceipt(canon);\n await audit(\"V3_AUTHORIZATION_CONSUMED\",authorization_id,receipt_sha256);\n\n return c.json({\n ...receipt,\n consumed:true,\n receipt_sha256,\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KEY_ID,signature_b64url:signature}\n },200,{\"Cache-Control\":\"no-store\"});\n } catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/revoke\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c);\n const authorization_id=String(b.authorization_id||\"\");\n if(!authorization_id)return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({\n sql:\"SELECT status,request_sha256,expires_at FROM authorizations_v3 WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if(!rs.rows.length)return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)===\"ISSUED\"&&Date.parse(String(row.expires_at))<=Date.now()){\n const expired:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(expired?.rowsAffected??0)===1){\n await audit(\"V3_AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if(String(row.status)!==\"ISSUED\"){\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"V3_AUTHORIZATION_REVOKED\",authorization_id,String(row.request_sha256));\n return c.json({revoked:true,authorization_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v3/ledger\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const now=new Date().toISOString();\n const rs=await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,observer_receipt_sha256,observer_observed_at,request_sha256,\n status,CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM authorizations_v3 ORDER BY issued_at DESC LIMIT 100`,\n args:[now]\n });\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-ledger/v3.3\",\n implementation:IMPLEMENTATION,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\")===\"true\",\n observer_gate_required_for_merge:true,\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/revoke\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const authorization_id = String(b.authorization_id || \"\");\n if (!authorization_id) return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n\n const rs = await sqlite.execute({\n sql:\"SELECT status,request_sha256,expires_at FROM authorizations WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const updated:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n\n await audit(\"AUTHORIZATION_REVOKED\",authorization_id,String(row.request_sha256));\n return c.json({revoked:true,authorization_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/ledger\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rawLimit = Number(c.req.query(\"limit\") || \"50\");\n const limit = Number.isSafeInteger(rawLimit) ? Math.max(1,Math.min(100,rawLimit)) : 50;\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM authorizations ORDER BY issued_at DESC LIMIT ?`,\n args:[now,limit]\n });\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-ledger/v1\",\n implementation:IMPLEMENTATION,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute(\"SELECT * FROM audit_events ORDER BY seq ASC\");\n let prev = \"0\".repeat(64);\n let ok = true;\n for (const r of rs.rows as any[]) {\n const event = {\n event_type:r.event_type,\n authorization_id:r.authorization_id,\n object_sha256:r.object_sha256,\n prev_event_sha256:r.prev_event_sha256,\n created_at:r.created_at\n };\n const computed = await sha256(canonical(event));\n if (String(r.prev_event_sha256) !== prev || String(r.event_sha256) !== computed) ok = false;\n prev = String(r.event_sha256);\n }\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-audit/v1\",\n audit_chain_ok:ok,\n count:rs.rows.length,\n tail_sha256:prev,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.onError((err,c) => {\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n",[158],"1f67a5e9-ba62-49a1-8329-5a74033fa3e7",["D",1787979963416],[27],"e3b1b147-2cb0-48e0-9077-34f81fb55592","RELEASE_V3_2.md","01a04be7-0b7b-72cb-9e76-fa1352693ee7",1,["D",1787979828094],"# RUMBO R2 Dedicated Authorizer V3.2 — Observer Broker Pin\n\nStatus: **PASS / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `DEDICATED_R2_AUTHORIZER_V3_2_OBSERVER_BROKER_PINNED`\n\nRequired observer: `R2_GITHUB_OBSERVER_V1_2_BROKER_JIT`.\n\nV3.2 pins the broker-wired observer implementation, retains exact repository/PR/base/head/package binding, ES256 verification, native-enforcement proof, freshness windows, evidence binding, replay prevention, and `production_go=false`. Older observer implementations fail with `OBSERVER_IMPLEMENTATION_MISMATCH`.\n\nSigned schemas move to v3.2 for issuance, consumption, and ledger.\n\nValidation evaluation: `01a04bde-6403-70fa-b459-8be0457b4910` — PASS.\n\nTest receipt SHA-256: `45e70523adf8f3375dda21bf00d3a5a49244d56e667e286fa525421b02507eee`.\n\nStatic audit: PASS. Merge authorization remains disabled; no product-production authority is created.\n",[170],"60b4d956-61a6-4338-a7d1-724921173a6f","RELEASE_V3_1.md","01a04be7-0b7b-72cb-9e76-f512e8a937c8",["D",1787979828094],"# RUMBO R2 Dedicated Authorizer V3.1 — Observer Revision Pinning\n\nStatus: **PASS / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nImplementation:\n\n`DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED`\n\nV3.1 closes a rollback path found during self-audit.\n\nV3 already required a signed observer receipt, native enforcement and exact\n`evidence_sha256 = observer_receipt_sha256`. However, an older observer implementation\nusing the same receipt schema and signing key could still produce a cryptographically valid\nreceipt.\n\nV3.1 requires the signed observer field:\n\n`observer_implementation=R2_GITHUB_OBSERVER_V1_1_NATIVE_REVIEW_HARDENING`\n\nAny older implementation now fails with `OBSERVER_IMPLEMENTATION_MISMATCH`.\n\nThe authorizer's own consumption receipt is also revision-bound:\n\n- schema: `rumbo-r2-dedicated-authorizer-consumption/v3.1`;\n- signed field:\n `authorizer_implementation=DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED`.\n\nThis gives downstream deployers an explicit anti-downgrade field instead of relying only\non a stable signing key.\n\n## Validation\n\nEvaluation:\n\n`01a04bcc-bdd9-77ec-af9e-641e8d22a43a`\n\nResult: **PASS**.\n\nReceipt SHA-256:\n\n`7173d3c8134e1588933e11aa70f066be89ba161c5520a44f31352cd2e1e7d74c`\n\nThe legacy V1 merge path remains HTTP 410, the global merge flag remains disabled,\none-time/replay protections remain active, signatures verify, tampering fails, audit chain\npasses and `production_go=false`.\n\nStatic audit: **PASS**.\n",[177],"bfb05e48-ad43-4cd7-9e52-abe670bc3c68","RELEASE_V3.md","01a04be7-0b7b-72cb-9e76-f3b8b2a19329",["D",1787979828094],"# RUMBO R2 Dedicated Authorizer V3 — Observer-Gated Merge\n\nStatus: **PASS / LIVE_CANDIDATE / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nV3 closes the remaining authorization-policy gap between an independently observed\nGitHub PR snapshot and a future `MERGE_PR` authorization.\n\n## Observer trust root\n\nRequired observer:\n\n`R2_GITHUB_OBSERVER_V1`\n\nObserver receipt schema:\n\n`rumbo-r2-github-observer-receipt/v1`\n\nPinned observer signing key id:\n\n`aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8`\n\nOnly the observer public P-256 verification key is embedded here. The observer private\nsigning key is not present in the authorizer source.\n\n## Merge admission\n\nLegacy V1 `MERGE_PR` issue and consume paths are retired with HTTP 410.\n\nThe new V3 path requires all of the following before a merge authorization can even be\nissued:\n\n1. global `R2_ALLOW_MERGE_AUTHORIZATION=true`;\n2. exact repository/PR/base/head/package binding;\n3. a signed `R2_GITHUB_OBSERVER_V1` receipt;\n4. observer scope exactly `R2_GITHUB_PR_SNAPSHOT_ONLY`;\n5. observer `production_go=false`;\n6. exact observer repository identity;\n7. observer `OBSERVATION_PASS` with zero blocking checks;\n8. `native_enforcement.proven=true`;\n9. `merge_ready=true`;\n10. receipt freshness <= 300 seconds;\n11. exact ES256 signature under the pinned observer public key;\n12. `evidence_sha256` equal to the observer receipt SHA-256.\n\nAt consumption, the observer binding must remain identical and its observation age must\nremain <= 600 seconds.\n\nThus neither a stale observer result nor a valid result without native branch/ruleset\nenforcement can authorize merge.\n\n## TEST_ONLY\n\n`TEST_ONLY` remains available through V3 without observer authority.\n\nA TEST_ONLY request carrying an observer merge receipt is rejected, preventing accidental\nauthority mixing.\n\nSuccessful V3 TEST_ONLY consumption emits a signed authorizer receipt using the existing\nauthorizer ES256 custody key.\n\n## Current fail-closed state\n\nThe global merge flag remains absent/false.\n\nTherefore `MERGE_PR` currently fails with HTTP 423 before any merge authority can be\nissued.\n\nProduct production remains false.\n\n## Validation\n\nBranch evaluation:\n\n`01a04bc6-1812-72cf-bbbf-8bf50289ec48`\n\nResult: **PASS**.\n\nValidated matrix:\n\n- health → 200;\n- unauthenticated V3 ledger → 401;\n- invalid binding → 400;\n- legacy V1 merge issue → 410;\n- legacy V1 merge consume → 410;\n- V3 merge while global gate disabled → 423;\n- TEST_ONLY carrying observer receipt → 400;\n- V3 TEST_ONLY issue → 201;\n- wrong token → 403;\n- V3 TEST_ONLY consume → 200;\n- signed V3 authorizer receipt verifies → true;\n- modified signed receipt verifies → false;\n- replay → 409;\n- duplicate request → 409;\n- V3 ledger → 200;\n- token hash exposed by ledger → false;\n- audit chain → PASS;\n- production_go → false.\n\nTest receipt SHA-256:\n\n`ef6e154110336e9322cf089af4de37a0c124986e0df2d041ac7c7d2350cd624b`\n\n## Static source audit\n\nPASS:\n\n- observer private signing material is absent;\n- authorizer private signing material is absent;\n- observer public key is pinned;\n- observer receipt hash is bound to `evidence_sha256`;\n- native enforcement is mandatory for merge;\n- both legacy merge entry points are retired;\n- observer freshness limits exist at issue and consume;\n- V3 ledger does not project token hashes;\n- `production_go=false` remains pervasive.\n\n## Claim boundary\n\nThis version makes a future merge authorization cryptographically dependent on fresh,\nindependent GitHub observation plus proven native enforcement.\n\nBecause native private-repository enforcement is not currently available on the user's\nplan and the dedicated GitHub App credential is not yet bound, this new merge path cannot\nbecome live by accident.\n",[183],"c1115eac-f08b-4bd0-b0df-a0d10c45b4cb","RELEASE_V2.md","01a04be7-0b7b-72cb-9e76-efad2614bd2f",["D",1787979828094],"# RUMBO R2 Dedicated Authorizer V2 — Signed Receipts\n\nStatus: **PASS / LIVE_CANDIDATE / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nV2 hardens the independent R2 authorizer by making every successful consumption receipt\ncryptographically verifiable outside the authorizer database.\n\n## Signing boundary\n\nAlgorithm:\n\n`ES256 / ECDSA P-256 + SHA-256`\n\nSigning key id:\n\n`bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY`\n\nThe private P-256 JWK exists only in encrypted environment variable\n`R2_RECEIPT_SIGNING_JWK_V1`.\n\nThe corresponding public JWK is exposed by `GET /health` and may be pinned by downstream\nverifiers. The private key is not present in source or response payloads.\n\n## Receipt contract\n\nSuccessful `POST /v1/consume` now returns schema:\n\n`rumbo-r2-dedicated-authorizer-consumption/v2`\n\nThe signature covers the exact canonical receipt object, including:\n\n- authorization id;\n- action;\n- repository identity SHA-256;\n- PR number;\n- base and head Git SHA;\n- sealed package SHA-256;\n- evidence SHA-256;\n- request SHA-256;\n- consumed timestamp;\n- consumer;\n- merge-authorized state;\n- production-go state.\n\nThe response includes:\n\n- `receipt_sha256`;\n- `receipt_signature.alg=ES256`;\n- exact signing key id;\n- base64url signature.\n\n## Adversarial validation\n\nBranch evaluation:\n\n`01a04ba6-7c96-71ee-888f-953a2f36529f`\n\nResult: **PASS**.\n\nAdditional V2 checks:\n\n- signing key configured: true;\n- signed receipt verification: true;\n- modified receipt verification: false;\n- receipt SHA-256 recomputation: exact;\n- replay still rejected;\n- token hash still absent from read APIs;\n- audit chain valid;\n- `MERGE_PR` still disabled at issuance and consumption;\n- `production_go=false`.\n\nValidated test receipt SHA-256:\n\n`ea6091f0d05f4c5ddd6693728fe6ec41fa39bb627f4128a74fb1ebc597a60756`\n\n## Downstream consequence\n\nThe deployer no longer needs to trust an arbitrary caller-supplied\n`authorizer_receipt_sha256`. It can verify a signed consumption receipt offline using\nonly the pinned public key.\n\nThis closes the receipt-authenticity gap between authorization custody and deployment\nplanning. It does not enable merge or deployment.\n",[189],"4af68bc8-51a9-4ed5-8336-afed3f176e0d","RELEASE_V1.md","01a04be7-0b7b-72cb-9e76-ebdba6763a80",["D",1787979828094],"# RUMBO R2 Dedicated Authorizer V1\n\nStatus: **LIVE_CANDIDATE / FAIL_CLOSED / PRODUCTION_NO_GO**\n\nThis val separates R2 authorization custody from the general continuity relay.\n\n## Identity pins\n\n- repository identity SHA-256:\n `59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23`\n- control package SHA-256:\n `afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\n## Security properties\n\n- dedicated encrypted controller bearer `R2_AUTH_ROOT_TOKEN`;\n- no raw bearer in source;\n- exact binding to action, PR number, base/head SHA, package SHA-256 and evidence SHA-256;\n- one-time random token returned only at issuance;\n- only token SHA-256 persisted;\n- TTL 60–900 seconds;\n- duplicate exact request rejection;\n- atomic single consumption;\n- replay rejection;\n- token mismatch rejection;\n- binding mismatch rejection;\n- expiry/revoke states;\n- independent audit hash chain;\n- ledger and audit endpoints require the dedicated bearer;\n- token hashes are not projected by ledger reads;\n- `production_go=false` invariant.\n\n## Merge gate\n\n`MERGE_PR` is checked at both issuance and consumption.\n\nIt remains disabled because:\n\n`R2_ALLOW_MERGE_AUTHORIZATION`\n\nis intentionally absent.\n\n## Live adversarial test\n\nVal Town evaluation:\n\n`01a04b98-76d2-7582-919e-e052f8b1ca26`\n\nResult: **PASS**.\n\nObserved matrix:\n\n- health → 200\n- unauthenticated ledger → 401\n- invalid repository binding → 400\n- MERGE_PR issue while disabled → 423\n- MERGE_PR consume while disabled → 423\n- TEST_ONLY issue → 201\n- wrong one-time token → 403\n- exact consume → 200\n- replay → 409\n- duplicate exact authorize → 409\n- ledger → 200\n- token-hash leakage → false\n- audit → 200\n- audit chain valid → true\n\nTest receipt SHA-256:\n\n`9c01ae930da60c2c724bcfafe10fc0d77c3f8ac79e510d4e2d6aa4f9a5563e8d`\n\nAudit tail SHA-256:\n\n`8173af91ee447e9bf0d0aa7a0beb66a88dd5ebf44a5cd4674f45eb769cb59ec9`\n\n## Boundary\n\nThis service can issue and consume exact fail-closed authorization receipts.\n\nIt does not observe GitHub independently, does not hold a GitHub App credential, does not deploy, and cannot grant product production approval.\n",[195],"pulls","branches",10,"forks","envVars",{"_208":210,"_211":60},"connections",{"_208":60,"_209":60},"count","unfilledCount",2,"emptyCount",{"_40":194,"_31":195,"_29":196,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":242,"_13":60,"_32":20,"_33":198,"_23":24,"_155":-5,"_221":243,"_26":244},{"_40":188,"_31":189,"_29":190,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":239,"_13":60,"_32":20,"_33":192,"_23":24,"_155":-5,"_221":240,"_26":241},{"_40":182,"_31":183,"_29":184,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":236,"_13":60,"_32":20,"_33":186,"_23":24,"_155":-5,"_221":237,"_26":238},{"_40":176,"_31":177,"_29":178,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":233,"_13":60,"_32":20,"_33":180,"_23":24,"_155":-5,"_221":234,"_26":235},{"_40":169,"_31":170,"_29":171,"_148":-5,"_38":39,"_37":172,"_150":56,"_35":230,"_13":60,"_32":20,"_33":174,"_23":24,"_155":-5,"_221":231,"_26":232},{"_40":166,"_31":27,"_29":30,"_148":-5,"_38":39,"_37":14,"_150":56,"_35":227,"_13":60,"_32":20,"_33":34,"_23":24,"_155":-5,"_221":228,"_26":229},{"_40":157,"_31":158,"_29":159,"_148":-5,"_38":39,"_37":160,"_150":56,"_35":224,"_13":162,"_32":163,"_33":164,"_23":24,"_155":-5,"_221":225,"_26":226},{"_40":145,"_31":146,"_29":147,"_148":-5,"_38":39,"_37":149,"_150":56,"_35":220,"_13":152,"_32":153,"_33":154,"_23":24,"_155":-5,"_221":222,"_26":223},["D",1787979895146],"children",[],[146],["D",1787979938225],[],[158],["D",1787979963416],[],[27],["D",1787979828094],[],[170],["D",1787979828094],[],[177],["D",1787979828094],[],[183],["D",1787979828094],[],[189],["D",1787979828094],[],[195],["D",1787974602620],["D",1789539031988],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":52,"_103":104,"_105":24},{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":91,"_92":47,"_93":41,"_94":62,"_95":42,"_96":97},"ctx",{"_79":-5,"_127":283,"_284":285,"_286":287,"_288":24,"_289":24,"_290":24,"_291":56,"_292":-5,"_293":-7,"_294":-7,"_295":60,"_296":24,"_297":24,"_298":-5,"_299":24,"_300":24,"_301":24,"_302":-5},"ENV",{"_254":255,"_256":257,"_258":133,"_259":260,"_261":262,"_263":264,"_265":266,"_267":268,"_269":270,"_271":272,"_273":274,"_275":276,"_277":278,"_279":280,"_281":282},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v19