[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_270":271,"_272":273},"routes/_app.x.$handle.$name",{"_98":97,"_31":42,"_107":86,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":121,"_122":24,"_123":124,"_125":56,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",20,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","RELEASE_V3_5.md","latestPath","fileId","0f7b9b08-a377-11f1-b674-1607ee4eb77e","name","fileType","content","# RUMBO R2 Dedicated Authorizer V3.5 — Observer V1.5 Pin\n\nStatus: **PASS / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED`.\n\nV3.5 advances the trust chain to observer `R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT` and broker provenance `R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT`.\n\nThe signed observer receipt must now carry a valid invocation mode (`ROOT` or `BROKER_AUTOPILOT`). All previous controls remain: exact repository/PR/base/head/package binding, observer freshness, ES256 signature verification, native enforcement requirement, evidence SHA equal to observer receipt SHA for merge authority, one-time authorization tokens, replay protection, and global NO_GO.\n\nSigned authorizer schemas advance to v3.5.\n\nBasic selftest evaluation after cleanup: `01a04c4f-e5b6-75d4-afc1-b6d966894e26` — PASS.\n\nPositive V1.5 observer-chain evaluation: `01a04c4e-f496-73eb-9036-52a0257a372f` — PASS. Valid V1.5/Broker V1.2 signed receipt accepted; observer downgrade, broker downgrade, invalid invocation mode, binding mismatch and signature tamper rejected. Temporary diagnostic route/file were removed before release.\n\nStatic source audit: **12/12 PASS**. `MERGE_PR` remains disabled and `production_go=false`.\n","createdAt",["D",1787986718125],"branchVersion","branchId","070030c0-d221-43c2-a14e-1643c3b5fad4","id","c407813c-3b2b-489f-a186-e17f90eccf60","rumbo-r2-authorizer",["D",1787974602620],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Dedicated fail-closed RUMBO R2 authorizer","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","da1a7e96-a35a-11f1-816f-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","c407813c3b2b489fa186e17f90eccf60","tursoHostname","c407813c3b2b489fa186e17f90eccf60-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789539031988],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":52,"_103":104,"_105":24},"branch",{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":91,"_92":47,"_93":41,"_94":62,"_95":42,"_96":97},"isOwned","v3-5-observer-v1-5-pin","projectId","forkedBranchId","3bec92a5-228b-4d7e-8a94-d7a3be5df58e","forkedBranchVersion",15,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":265,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":266,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":267,"_81":268,"_83":269,"_85":24},"tree",[224,225,226,227,228,229,230,231,232,233],"files",[224,225,226,227,228,229,230,231,232,233],"counts",{"_212":60,"_213":214,"_215":60,"_216":217,"_218":219},"contents",[137,138,139,140,141,142,143,144,145,146],"upstreamProject","upstreamBranch",{"_40":89,"_35":130,"_131":132,"_31":133,"_87":41,"_13":134,"_88":-5,"_90":-5,"_135":136,"_44":-5,"_85":24,"_46":47,"_96":97,"_61":62,"_95":42},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787974602620],"updatedAt",["D",1787988816758],"main",18,"lockfileKey","1787988817144-esm.town_v_sebas1_rumbo-r2-authorizer@18-main",{"_40":206,"_31":207,"_29":208,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":209,"_13":60,"_32":20,"_33":210,"_23":24,"_156":-5,"_26":211},{"_40":200,"_31":201,"_29":202,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":203,"_13":60,"_32":20,"_33":204,"_23":24,"_156":-5,"_26":205},{"_40":194,"_31":195,"_29":196,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":197,"_13":60,"_32":20,"_33":198,"_23":24,"_156":-5,"_26":199},{"_40":188,"_31":189,"_29":190,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":191,"_13":60,"_32":20,"_33":192,"_23":24,"_156":-5,"_26":193},{"_40":182,"_31":183,"_29":184,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":185,"_13":60,"_32":20,"_33":186,"_23":24,"_156":-5,"_26":187},{"_40":176,"_31":177,"_29":178,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":179,"_13":60,"_32":20,"_33":180,"_23":24,"_156":-5,"_26":181},{"_40":169,"_31":170,"_29":171,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":173,"_13":60,"_32":20,"_33":174,"_23":24,"_156":-5,"_26":175},{"_40":166,"_31":27,"_29":30,"_150":-5,"_38":39,"_37":14,"_151":56,"_35":167,"_13":60,"_32":20,"_33":34,"_23":24,"_156":-5,"_26":168},{"_40":158,"_31":159,"_29":160,"_150":-5,"_38":39,"_37":134,"_151":56,"_35":161,"_13":162,"_32":163,"_33":164,"_23":24,"_156":-5,"_26":165},{"_40":147,"_31":148,"_29":149,"_150":-5,"_38":39,"_37":91,"_151":56,"_35":152,"_13":153,"_32":154,"_33":155,"_23":24,"_156":-5,"_26":157},"e104551b-f00b-485e-9b9c-fa3aa503cd33","selftest.ts","01a04c49-5387-76da-a41c-1d757730cf80","parentId","latest",["D",1787986579069],7,"script","const base = \"https://sebas1--01a04c49538776daa41c1b3f4795d1ae.web.val.run\";\nconst root = Deno.env.get(\"R2_AUTH_ROOT_TOKEN\");\nif (!root) throw new Error(\"ROOT_TOKEN_MISSING\");\n\nconst headers = {Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\nconst repo = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst pkg = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst baseSha = \"1ad77acefc7326595c50d7b0edffa81a2188e737\";\nconst headSha = \"d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7\";\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\") + \"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nasync function verifyES256(canon:string,sig:string,jwk:JsonWebKey):Promise{\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n return await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},key,b64urlDecode(sig),new TextEncoder().encode(canon)\n );\n}\nasync function verifyV3Receipt(v:any,jwk:JsonWebKey):Promise{\n const receipt={\n schema:v.schema,\n authorizer_implementation:v.authorizer_implementation,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n const canon=canonical(receipt);\n if(await sha256(canon)!==v.receipt_sha256)return false;\n return await verifyES256(canon,String(v.receipt_signature?.signature_b64url||\"\"),jwk);\n}\n\nconst healthRes=await fetch(base+\"/health\");\nconst health:any=await healthRes.json();\n\nconst unauthV3=await fetch(base+\"/v3/ledger\");\nconst invalidRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"TEST_ONLY\",repository_identity_sha256:\"0\".repeat(64),pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"1\".repeat(64)\n })\n});\n\nconst v1MergeIssueRes=await fetch(base+\"/v1/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"MERGE_PR\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"2\".repeat(64)\n })\n});\nconst v1MergeConsumeRes=await fetch(base+\"/v1/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"MERGE_PR\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"2\".repeat(64),\n authorization_id:\"00000000-0000-4000-8000-000000000000\",\n token:\"A\".repeat(43),consumer:\"selftest\"\n })\n});\n\nconst v3MergeDisabledRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n action:\"MERGE_PR\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:\"3\".repeat(64),\n observer_receipt:{}\n })\n});\n\nconst rb=new Uint8Array(32);crypto.getRandomValues(rb);\nconst uniqueEvidence=[...rb].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nconst binding={\n action:\"TEST_ONLY\",repository_identity_sha256:repo,pr_number:412,\n base_sha:baseSha,head_sha:headSha,package_sha256:pkg,evidence_sha256:uniqueEvidence\n};\n\nconst testOnlyWithObserverRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,\n body:JSON.stringify({...binding,observer_receipt:{synthetic:true}})\n});\n\nconst issueRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,body:JSON.stringify({...binding,ttl_seconds:300})\n});\nconst issue:any=await issueRes.json();\nif(issueRes.status!==201)throw new Error(`V3_ISSUE_FAILED_${issueRes.status}_${issue.error||\"UNKNOWN\"}`);\n\nconst wrongRes=await fetch(base+\"/v3/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n ...binding,observer_receipt_sha256:null,\n authorization_id:issue.authorization_id,token:\"B\".repeat(43),consumer:\"selftest-wrong\"\n })\n});\n\nconst consumeRes=await fetch(base+\"/v3/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n ...binding,observer_receipt_sha256:null,\n authorization_id:issue.authorization_id,token:issue.token,consumer:\"selftest-v3\"\n })\n});\nconst consume:any=await consumeRes.json();\nconst signedV3Valid=consumeRes.status===200\n ? await verifyV3Receipt(consume,health.receipt_signature?.verify_jwk)\n : false;\nconst tamperedV3Valid=consumeRes.status===200\n ? await verifyV3Receipt({...consume,head_sha:\"f\".repeat(40)},health.receipt_signature?.verify_jwk)\n : true;\n\nconst replayRes=await fetch(base+\"/v3/consume\",{\n method:\"POST\",headers,\n body:JSON.stringify({\n ...binding,observer_receipt_sha256:null,\n authorization_id:issue.authorization_id,token:issue.token,consumer:\"selftest-replay\"\n })\n});\nconst duplicateRes=await fetch(base+\"/v3/authorize\",{\n method:\"POST\",headers,body:JSON.stringify({...binding,ttl_seconds:300})\n});\n\nconst ledgerRes=await fetch(base+\"/v3/ledger\",{headers});\nconst ledger:any=await ledgerRes.json();\nconst tokenHashLeak=Array.isArray(ledger.records)&&ledger.records.some((r:any)=>Object.prototype.hasOwnProperty.call(r,\"token_sha256\"));\n\nconst auditRes=await fetch(base+\"/v1/audit\",{headers});\nconst audit:any=await auditRes.json();\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED\"&&\n health.root_token_configured===true&&\n health.receipt_signing_key_configured===true&&\n health.receipt_signature?.alg===\"ES256\"&&\n health.receipt_signature?.kid===\"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\"&&\n health.observer_trust_root?.implementation===\"R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT\"&&\n health.observer_trust_root?.broker_implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\"&&\n health.observer_trust_root?.signing_kid===\"aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8\"&&\n health.observer_trust_root?.merge_requires_native_enforcement===true&&\n health.observer_trust_root?.max_issue_age_seconds===300&&\n health.observer_trust_root?.max_consume_age_seconds===600&&\n health.merge_authorization_enabled===false&&\n health.production_go===false&&\n unauthV3.status===401&&\n invalidRes.status===400&&\n v1MergeIssueRes.status===410&&\n v1MergeConsumeRes.status===410&&\n v3MergeDisabledRes.status===423&&\n testOnlyWithObserverRes.status===400&&\n issueRes.status===201&&\n issue.schema===\"rumbo-r2-dedicated-authorizer-issuance/v3.5\"&&\n issue.authorizer_implementation===\"DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED\"&&\n issue.action===\"TEST_ONLY\"&&\n issue.observer_receipt_sha256===null&&\n issue.merge_authorized===false&&\n issue.production_go===false&&\n wrongRes.status===403&&\n consumeRes.status===200&&\n consume.schema===\"rumbo-r2-dedicated-authorizer-consumption/v3.5\"&&\n consume.authorizer_implementation===\"DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED\"&&\n consume.observer_receipt_sha256===null&&\n consume.merge_authorized===false&&\n consume.production_go===false&&\n signedV3Valid===true&&\n tamperedV3Valid===false&&\n replayRes.status===409&&\n duplicateRes.status===409&&\n ledgerRes.status===200&&\n ledger.schema===\"rumbo-r2-dedicated-authorizer-ledger/v3.5\"&&\n ledger.observer_gate_required_for_merge===true&&\n tokenHashLeak===false&&\n auditRes.status===200&&\n audit.audit_chain_ok===true&&\n audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n unauthenticated_v3_ledger:unauthV3.status,\n invalid_binding:invalidRes.status,\n v1_merge_issue_retired:v1MergeIssueRes.status,\n v1_merge_consume_retired:v1MergeConsumeRes.status,\n v3_merge_gate_disabled:v3MergeDisabledRes.status,\n test_only_with_observer_rejected:testOnlyWithObserverRes.status,\n v3_test_issue:issueRes.status,\n wrong_token:wrongRes.status,\n v3_test_consume:consumeRes.status,\n signed_v3_receipt_verified:signedV3Valid,\n tampered_v3_receipt_verified:tamperedV3Valid,\n replay:replayRes.status,\n duplicate:duplicateRes.status,\n ledger:ledgerRes.status,\n token_hash_leak:tokenHashLeak,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n authorization_id:issue.authorization_id,\n request_sha256:issue.request_sha256,\n receipt_sha256:consume.receipt_sha256,\n observer_gate_required_for_merge:true,\n merge_authorization_enabled:false,\n production_go:false\n},null,2));\nif(!pass)Deno.exit(1);\n","label",[148],"1aebe8f3-cbba-442d-97ba-256a8d6387ac","main.tsx","01a04c49-5387-76da-a41c-1b3f4795d1ae",["D",1787986688517],9,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\n\nconst IMPLEMENTATION = \"DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED\";\nconst OBSERVER_IMPLEMENTATION = \"R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT\";\nconst BROKER_IMPLEMENTATION = \"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\";\nconst SIGNING_KEY_ID = \"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\";\nconst OBSERVER_SIGNING_KEY_ID = \"aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8\";\nconst OBSERVER_VERIFY_JWK: JsonWebKey = {\n kty:\"EC\",crv:\"P-256\",\n x:\"lYPzwJFKYb5YZsikYx57Wr6TfkwwNyog15s0BN_p8fA\",\n y:\"9bVfI4jPqeN-yt2KQjz9MgmsDjLpbqzs1pw1DcgPwHQ\",\n key_ops:[\"verify\"],ext:true\n};\nconst OBSERVER_REPO_FULL = \"fscfede-beep/rumbo-control-queue\";\nconst OBSERVER_REPOSITORY_ID = 1314199389;\nconst OBSERVER_OWNER_ID = 293577326;\nconst MAX_OBSERVER_ISSUE_AGE_SECONDS = 300;\nconst MAX_OBSERVER_CONSUME_AGE_SECONDS = 600;\nconst RECEIPT_VERIFY_JWK = {\n kty:\"EC\",crv:\"P-256\",\n x:\"TV0M-YRfRzqMB6dTZIhLOu7w21Tkgul-lUns7HwpHy4\",\n y:\"mRWAIOykqSBgsAXqC9t3OOmk3KLljPH935lilXma-W4\",\n key_ops:[\"verify\"],ext:true\n};\nconst REPOSITORY_IDENTITY_SHA256 = \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst CONTROL_PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst SHA256_RE = /^[a-f0-9]{64}$/;\nconst GIT_SHA_RE = /^[a-f0-9]{40}$/;\nconst MAX_BODY_BYTES = 64 * 1024;\nconst MIN_TTL_SECONDS = 60;\nconst MAX_TTL_SECONDS = 900;\n\ntype GuardAction = \"TEST_ONLY\" | \"MERGE_PR\";\ntype Binding = {\n action: GuardAction;\n repository_identity_sha256: string;\n pr_number: number;\n base_sha: string;\n head_sha: string;\n package_sha256: string;\n evidence_sha256: string;\n};\n\ntype ObserverVerification = {\n ok: boolean;\n error?: string;\n receipt_sha256?: string;\n observed_at?: string;\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS authorizations (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_authorizations_status ON authorizations(status,expires_at)`,\n `CREATE TABLE IF NOT EXISTS authorizations_v3 (\n authorization_id TEXT PRIMARY KEY,\n action TEXT NOT NULL CHECK(action IN ('TEST_ONLY','MERGE_PR')),\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n observer_receipt_sha256 TEXT,\n observer_observed_at TEXT,\n request_sha256 TEXT NOT NULL UNIQUE,\n token_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('ISSUED','CONSUMED','REVOKED','EXPIRED')),\n issued_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n consumer TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_authorizations_v3_status ON authorizations_v3(status,expires_at)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_authorizations_v3_observer\n ON authorizations_v3(observer_receipt_sha256)\n WHERE observer_receipt_sha256 IS NOT NULL`,\n `CREATE TABLE IF NOT EXISTS audit_events (\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n authorization_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_prev_unique ON audit_events(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_event_object_unique\n ON audit_events(event_type,authorization_id)\n WHERE authorization_id IS NOT NULL`\n]);\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n const aa = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (aa.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < aa.length; i++) diff |= aa[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction authorized(req: Request): boolean {\n const expected = Deno.env.get(\"R2_AUTH_ROOT_TOKEN\") || \"\";\n const observed = bearer(req);\n return !!expected && !!observed && constantTimeEqual(expected, observed);\n}\n\nfunction canonical(v: unknown): string {\n if (v === null || typeof v !== \"object\") return JSON.stringify(v);\n if (Array.isArray(v)) return \"[\" + v.map(canonical).join(\",\") + \"]\";\n const o = v as Record;\n return \"{\" + Object.keys(o).sort().map(k => JSON.stringify(k) + \":\" + canonical(o[k])).join(\",\") + \"}\";\n}\n\nasync function sha256(s: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return [...new Uint8Array(digest)].map(x => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction b64url(bytes: Uint8Array): string {\n const binary = Array.from(bytes, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\n\nfunction b64urlDecode(s:string):Uint8Array {\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\n\nasync function verifyObserverReceipt(v:any,binding:Binding,maxAgeSeconds:number):Promise {\n if(!v||typeof v!==\"object\")return {ok:false,error:\"OBSERVER_RECEIPT_MISSING\"};\n if(v.schema!==\"rumbo-r2-github-observer-receipt/v1\")return {ok:false,error:\"OBSERVER_SCHEMA_INVALID\"};\n if(v.observer_implementation!==OBSERVER_IMPLEMENTATION)return {ok:false,error:\"OBSERVER_IMPLEMENTATION_MISMATCH\"};\n if(v.broker_implementation!==BROKER_IMPLEMENTATION)return {ok:false,error:\"BROKER_IMPLEMENTATION_MISMATCH\"};\n if(v.authoritative_for!==\"R2_GITHUB_PR_SNAPSHOT_ONLY\")return {ok:false,error:\"OBSERVER_AUTHORITY_SCOPE_INVALID\"};\n if(v.invocation_mode!==\"ROOT\"&&v.invocation_mode!==\"BROKER_AUTOPILOT\")return {ok:false,error:\"OBSERVER_INVOCATION_MODE_INVALID\"};\n if(v.production_go!==false)return {ok:false,error:\"OBSERVER_PRODUCTION_GO_INVALID\"};\n if(v.repository?.full_name!==OBSERVER_REPO_FULL||\n Number(v.repository?.id)!==OBSERVER_REPOSITORY_ID||\n Number(v.repository?.owner_id)!==OBSERVER_OWNER_ID){\n return {ok:false,error:\"OBSERVER_REPOSITORY_IDENTITY_MISMATCH\"};\n }\n if(Number(v.pr_number)!==binding.pr_number||\n String(v.base_sha)!==binding.base_sha||\n String(v.head_sha)!==binding.head_sha||\n String(v.package_sha256)!==binding.package_sha256){\n return {ok:false,error:\"OBSERVER_BINDING_MISMATCH\"};\n }\n if(v.observation_status!==\"OBSERVATION_PASS\"||Number(v.blocking_count)!==0){\n return {ok:false,error:\"OBSERVER_NOT_PASS\"};\n }\n if(v.native_enforcement?.proven!==true||v.merge_ready!==true){\n return {ok:false,error:\"OBSERVER_NATIVE_ENFORCEMENT_NOT_PROVEN\"};\n }\n const observedAt=String(v.observed_at||\"\");\n const observedMs=Date.parse(observedAt);\n const ageSeconds=(Date.now()-observedMs)/1000;\n if(!Number.isFinite(ageSeconds)||ageSeconds< -60||ageSeconds>maxAgeSeconds){\n return {ok:false,error:\"OBSERVER_RECEIPT_STALE\"};\n }\n if(!SHA256_RE.test(String(v.receipt_sha256||\"\"))){\n return {ok:false,error:\"OBSERVER_RECEIPT_HASH_INVALID\"};\n }\n if(v.receipt_signature?.alg!==\"ES256\"||\n v.receipt_signature?.kid!==OBSERVER_SIGNING_KEY_ID||\n !/^[A-Za-z0-9_-]{80,128}$/.test(String(v.receipt_signature?.signature_b64url||\"\"))){\n return {ok:false,error:\"OBSERVER_SIGNATURE_METADATA_INVALID\"};\n }\n\n const {receipt_sha256,receipt_signature,...unsigned}=v;\n const canon=canonical(unsigned);\n const computed=await sha256(canon);\n if(!constantTimeEqual(computed,String(receipt_sha256))){\n return {ok:false,error:\"OBSERVER_RECEIPT_HASH_MISMATCH\"};\n }\n let key:CryptoKey;\n try{\n key=await crypto.subtle.importKey(\"jwk\",OBSERVER_VERIFY_JWK,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n }catch{\n return {ok:false,error:\"OBSERVER_VERIFY_KEY_IMPORT_FAILED\"};\n }\n let sig:Uint8Array;\n try{sig=b64urlDecode(String(receipt_signature.signature_b64url));}\n catch{return {ok:false,error:\"OBSERVER_SIGNATURE_ENCODING_INVALID\"};}\n const verified=await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},key,sig,new TextEncoder().encode(canon)\n );\n if(!verified)return {ok:false,error:\"OBSERVER_SIGNATURE_INVALID\"};\n if(binding.evidence_sha256!==String(receipt_sha256)){\n return {ok:false,error:\"EVIDENCE_MUST_EQUAL_OBSERVER_RECEIPT_SHA256\"};\n }\n return {ok:true,receipt_sha256:String(receipt_sha256),observed_at:observedAt};\n}\n\nasync function signCanonicalReceipt(canonicalReceipt: string): Promise {\n const raw = Deno.env.get(\"R2_RECEIPT_SIGNING_JWK_V1\") || \"\";\n if (!raw) throw new Error(\"RECEIPT_SIGNING_KEY_NOT_CONFIGURED\");\n const jwk = JSON.parse(raw);\n const key = await crypto.subtle.importKey(\n \"jwk\", jwk, {name:\"ECDSA\",namedCurve:\"P-256\"}, false, [\"sign\"]\n );\n const signature = await crypto.subtle.sign(\n {name:\"ECDSA\",hash:\"SHA-256\"}, key, new TextEncoder().encode(canonicalReceipt)\n );\n return b64url(new Uint8Array(signature));\n}\n\nfunction randomToken(bytes = 32): string {\n const raw = new Uint8Array(bytes);\n crypto.getRandomValues(raw);\n const binary = Array.from(raw, b => String.fromCharCode(b)).join(\"\");\n return btoa(binary).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\nasync function bodyJson(c: any): Promise {\n const len = Number(c.req.header(\"content-length\") || \"0\");\n if (Number.isFinite(len) && len > MAX_BODY_BYTES) throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt = await c.req.text();\n if (new TextEncoder().encode(txt).length > MAX_BODY_BYTES) throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt || \"{}\");\n}\n\nfunction parseBinding(v: any): Binding | null {\n const action = String(v?.action || \"\") as GuardAction;\n const repository_identity_sha256 = String(v?.repository_identity_sha256 || \"\");\n const pr_number = Number(v?.pr_number);\n const base_sha = String(v?.base_sha || \"\");\n const head_sha = String(v?.head_sha || \"\");\n const package_sha256 = String(v?.package_sha256 || \"\");\n const evidence_sha256 = String(v?.evidence_sha256 || \"\");\n\n if (action !== \"TEST_ONLY\" && action !== \"MERGE_PR\") return null;\n if (repository_identity_sha256 !== REPOSITORY_IDENTITY_SHA256) return null;\n if (!Number.isSafeInteger(pr_number) || pr_number <= 0) return null;\n if (!GIT_SHA_RE.test(base_sha) || !GIT_SHA_RE.test(head_sha)) return null;\n if (package_sha256 !== CONTROL_PACKAGE_SHA256) return null;\n if (!SHA256_RE.test(evidence_sha256)) return null;\n\n return {action,repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256};\n}\n\nasync function audit(event_type: string, authorization_id: string | null, object_sha256: string | null) {\n if (authorization_id) {\n const existing = await sqlite.execute({\n sql: \"SELECT event_sha256 FROM audit_events WHERE event_type=? AND authorization_id=? LIMIT 1\",\n args: [event_type, authorization_id]\n });\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n\n for (let attempt = 0; attempt < 8; attempt++) {\n const last = await sqlite.execute(\"SELECT event_sha256 FROM audit_events ORDER BY seq DESC LIMIT 1\");\n const prev = String(last.rows[0]?.event_sha256 || \"0\".repeat(64));\n const created_at = new Date().toISOString();\n const event = {event_type,authorization_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256 = await sha256(canonical(event));\n try {\n await sqlite.execute({\n sql: `INSERT INTO audit_events(event_type,authorization_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,\n args: [event_type,authorization_id,object_sha256,prev,event_sha256,created_at]\n });\n return event_sha256;\n } catch (e) {\n if (authorization_id) {\n const existing = await sqlite.execute({\n sql: \"SELECT event_sha256 FROM audit_events WHERE event_type=? AND authorization_id=? LIMIT 1\",\n args: [event_type, authorization_id]\n });\n if (existing.rows.length) return String(existing.rows[0].event_sha256);\n }\n if (!String(e).includes(\"UNIQUE\")) throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\", (c) => c.json({\n service:\"rumbo-r2-authorizer\",\n implementation:IMPLEMENTATION,\n status:\"ok\",\n production_go:false\n}));\n\napp.get(\"/health\", (c) => c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_AUTH_ROOT_TOKEN\"),\n receipt_signing_key_configured:!!Deno.env.get(\"R2_RECEIPT_SIGNING_JWK_V1\"),\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KEY_ID,verify_jwk:RECEIPT_VERIFY_JWK},\n observer_trust_root:{\n implementation:OBSERVER_IMPLEMENTATION,\n broker_implementation:BROKER_IMPLEMENTATION,\n receipt_schema:\"rumbo-r2-github-observer-receipt/v1\",\n signing_kid:OBSERVER_SIGNING_KEY_ID,\n verify_jwk:OBSERVER_VERIFY_JWK,\n max_issue_age_seconds:MAX_OBSERVER_ISSUE_AGE_SECONDS,\n max_consume_age_seconds:MAX_OBSERVER_CONSUME_AGE_SECONDS,\n merge_requires_native_enforcement:true\n },\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n repository_identity_sha256:REPOSITORY_IDENTITY_SHA256,\n package_sha256:CONTROL_PACKAGE_SHA256,\n ttl_seconds:{min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},\n capabilities:[\n \"dedicated-external-authorizer\",\n \"exact-pr-binding\",\n \"one-time-token-ledger\",\n \"audit-hash-chain\",\n \"signed-consumption-receipts\",\n \"offline-public-key-verification\",\n \"signed-observer-receipt-verification\",\n \"native-enforcement-required-for-merge\",\n \"v1-merge-path-retired\",\n \"v3-observer-gated-merge\",\n \"fail-closed-merge-gate\"\n ],\n production_go:false\n}), 200, {\"Cache-Control\":\"no-store\"});\n\napp.post(\"/v1/authorize\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if (binding.action === \"MERGE_PR\") {\n return c.json({\n error:\"V1_MERGE_PATH_RETIRED_USE_V3_OBSERVER_GATED\",\n replacement:\"/v3/authorize\",\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < MIN_TTL_SECONDS || ttl > MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const request_sha256 = await sha256(canonical(binding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM authorizations WHERE request_sha256=? LIMIT 1\",\n args:[request_sha256]\n });\n if (prior.rows.length) {\n const row:any = prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const raw_token = randomToken();\n const token_sha256 = await sha256(raw_token);\n const authorization_id = crypto.randomUUID();\n const issued = new Date();\n const issued_at = issued.toISOString();\n const expires_at = new Date(issued.getTime() + ttl * 1000).toISOString();\n\n await sqlite.execute({\n sql:`INSERT INTO authorizations(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorization_id,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n request_sha256,token_sha256,issued_at,expires_at\n ]\n });\n\n try {\n await audit(\"AUTHORIZATION_ISSUED\",authorization_id,request_sha256);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n throw e;\n }\n\n return c.json({\n authorized:true,\n authorization_id,\n action:binding.action,\n request_sha256,\n token:raw_token,\n token_type:\"One-Time\",\n issued_at,\n expires_at,\n merge_authorized:binding.action === \"MERGE_PR\",\n production_go:false,\n note:\"Raw one-time token is returned only at issuance; only SHA-256 is persisted.\"\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/consume\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if (binding.action === \"MERGE_PR\") {\n return c.json({\n error:\"V1_MERGE_PATH_RETIRED_USE_V3_OBSERVER_GATED\",\n replacement:\"/v3/consume\",\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorization_id = String(b.authorization_id || \"\");\n const raw_token = String(b.token || \"\");\n const consumer = String(b.consumer || \"\");\n if (!authorization_id || !/^[A-Za-z0-9_-]{43,128}$/.test(raw_token)) {\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if (!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)) {\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const request_sha256 = await sha256(canonical(binding));\n const rs = await sqlite.execute({sql:\"SELECT * FROM authorizations WHERE authorization_id=? LIMIT 1\",args:[authorization_id]});\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status,authorization_id},409,{\"Cache-Control\":\"no-store\"});\n }\n if (!constantTimeEqual(String(row.request_sha256),request_sha256)) {\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const observed_token_sha256 = await sha256(raw_token);\n if (!constantTimeEqual(String(row.token_sha256),observed_token_sha256)) {\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumed_at = new Date().toISOString();\n const updated:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumed_at,consumer,authorization_id]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) {\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt = {\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v2\",\n authorization_id,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n request_sha256,\n consumed_at,\n consumer,\n merge_authorized:binding.action === \"MERGE_PR\",\n production_go:false\n };\n const receipt_canonical = canonical(receipt);\n const receipt_sha256 = await sha256(receipt_canonical);\n const receipt_signature_b64url = await signCanonicalReceipt(receipt_canonical);\n await audit(\"AUTHORIZATION_CONSUMED\",authorization_id,receipt_sha256);\n\n return c.json({\n ...receipt,\n consumed:true,\n receipt_sha256,\n receipt_signature:{\n alg:\"ES256\",\n kid:SIGNING_KEY_ID,\n signature_b64url:receipt_signature_b64url\n }\n },200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/authorize\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const binding = parseBinding(b);\n if (!binding) return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n let observerReceiptSha:string|null=null;\n let observerObservedAt:string|null=null;\n\n if (binding.action === \"MERGE_PR\") {\n if (Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") !== \"true\") {\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const verified = await verifyObserverReceipt(\n b.observer_receipt,\n binding,\n MAX_OBSERVER_ISSUE_AGE_SECONDS\n );\n if (!verified.ok) {\n return c.json({\n error:verified.error || \"OBSERVER_RECEIPT_INVALID\",\n production_go:false\n },403,{\"Cache-Control\":\"no-store\"});\n }\n observerReceiptSha=verified.receipt_sha256!;\n observerObservedAt=verified.observed_at!;\n } else if (b.observer_receipt !== undefined && b.observer_receipt !== null) {\n return c.json({error:\"TEST_ONLY_MUST_NOT_CARRY_OBSERVER_MERGE_RECEIPT\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const ttl = b.ttl_seconds === undefined ? 300 : Number(b.ttl_seconds);\n if (!Number.isSafeInteger(ttl) || ttl < MIN_TTL_SECONDS || ttl > MAX_TTL_SECONDS) {\n return c.json({error:\"INVALID_TTL\",min:MIN_TTL_SECONDS,max:MAX_TTL_SECONDS},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorityBinding = {...binding,observer_receipt_sha256:observerReceiptSha};\n const request_sha256 = await sha256(canonical(authorityBinding));\n const prior = await sqlite.execute({\n sql:\"SELECT authorization_id,status,expires_at FROM authorizations_v3 WHERE request_sha256=? LIMIT 1\",\n args:[request_sha256]\n });\n if (prior.rows.length) {\n const row:any=prior.rows[0];\n return c.json({\n error:\"AUTHORIZATION_ALREADY_EXISTS\",\n authorization_id:row.authorization_id,\n status:row.status,\n expires_at:row.expires_at,\n request_sha256,\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const raw_token=randomToken();\n const token_sha256=await sha256(raw_token);\n const authorization_id=crypto.randomUUID();\n const issued=new Date();\n const issued_at=issued.toISOString();\n const expires_at=new Date(issued.getTime()+ttl*1000).toISOString();\n\n await sqlite.execute({\n sql:`INSERT INTO authorizations_v3(\n authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,observer_receipt_sha256,observer_observed_at,\n request_sha256,token_sha256,status,issued_at,expires_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?, 'ISSUED', ?,?)`,\n args:[\n authorization_id,binding.action,binding.repository_identity_sha256,binding.pr_number,\n binding.base_sha,binding.head_sha,binding.package_sha256,binding.evidence_sha256,\n observerReceiptSha,observerObservedAt,request_sha256,token_sha256,issued_at,expires_at\n ]\n });\n\n try {\n await audit(\"V3_AUTHORIZATION_ISSUED\",authorization_id,request_sha256);\n } catch (e) {\n await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n throw e;\n }\n\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-issuance/v3.5\",\n authorizer_implementation:IMPLEMENTATION,\n authorized:true,\n authorization_id,\n action:binding.action,\n request_sha256,\n observer_receipt_sha256:observerReceiptSha,\n token:raw_token,\n token_type:\"One-Time\",\n issued_at,\n expires_at,\n merge_authorized:binding.action===\"MERGE_PR\",\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/consume\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b=await bodyJson(c);\n const binding=parseBinding(b);\n if(!binding)return c.json({error:\"INVALID_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n\n if(binding.action===\"MERGE_PR\" && Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\")!==\"true\"){\n return c.json({error:\"MERGE_AUTHORIZATION_DISABLED\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorization_id=String(b.authorization_id||\"\");\n const raw_token=String(b.token||\"\");\n const consumer=String(b.consumer||\"\");\n const suppliedObserverSha=b.observer_receipt_sha256===null||b.observer_receipt_sha256===undefined\n ? null : String(b.observer_receipt_sha256);\n\n if(!authorization_id||!/^[A-Za-z0-9_-]{43,128}$/.test(raw_token)){\n return c.json({error:\"INVALID_CONSUMPTION_REQUEST\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if(!/^[A-Za-z0-9_.:-]{1,128}$/.test(consumer)){\n return c.json({error:\"INVALID_CONSUMER\"},400,{\"Cache-Control\":\"no-store\"});\n }\n if(suppliedObserverSha!==null&&!SHA256_RE.test(suppliedObserverSha)){\n return c.json({error:\"INVALID_OBSERVER_RECEIPT_SHA256\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const authorityBinding={...binding,observer_receipt_sha256:suppliedObserverSha};\n const request_sha256=await sha256(canonical(authorityBinding));\n const rs=await sqlite.execute({\n sql:\"SELECT * FROM authorizations_v3 WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if(!rs.rows.length)return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n\n if(String(row.status)===\"ISSUED\" && Date.parse(String(row.expires_at))<=Date.now()){\n const expired:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(expired?.rowsAffected??0)===1){\n await audit(\"V3_AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if(String(row.status)!==\"ISSUED\"){\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status,authorization_id},409,{\"Cache-Control\":\"no-store\"});\n }\n if(!constantTimeEqual(String(row.request_sha256),request_sha256)){\n return c.json({error:\"BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const rowObserver=row.observer_receipt_sha256===null?null:String(row.observer_receipt_sha256);\n if(rowObserver!==suppliedObserverSha){\n return c.json({error:\"OBSERVER_RECEIPT_BINDING_MISMATCH\"},409,{\"Cache-Control\":\"no-store\"});\n }\n if(binding.action===\"MERGE_PR\"){\n if(!rowObserver||!row.observer_observed_at){\n return c.json({error:\"OBSERVER_RECEIPT_REQUIRED\"},409,{\"Cache-Control\":\"no-store\"});\n }\n const observerAge=(Date.now()-Date.parse(String(row.observer_observed_at)))/1000;\n if(!Number.isFinite(observerAge)||observerAge< -60||observerAge>MAX_OBSERVER_CONSUME_AGE_SECONDS){\n return c.json({\n error:\"OBSERVER_RECEIPT_STALE_AT_CONSUME\",\n max_age_seconds:MAX_OBSERVER_CONSUME_AGE_SECONDS,\n production_go:false\n },410,{\"Cache-Control\":\"no-store\"});\n }\n }\n\n const observed_token_sha256=await sha256(raw_token);\n if(!constantTimeEqual(String(row.token_sha256),observed_token_sha256)){\n return c.json({error:\"TOKEN_MISMATCH\"},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const consumed_at=new Date().toISOString();\n const updated:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='CONSUMED',consumed_at=?,consumer=? WHERE authorization_id=? AND status='ISSUED' AND consumed_at IS NULL\",\n args:[consumed_at,consumer,authorization_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receipt={\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.5\",\n authorizer_implementation:IMPLEMENTATION,\n authorization_id,\n action:binding.action,\n repository_identity_sha256:binding.repository_identity_sha256,\n pr_number:binding.pr_number,\n base_sha:binding.base_sha,\n head_sha:binding.head_sha,\n package_sha256:binding.package_sha256,\n evidence_sha256:binding.evidence_sha256,\n observer_receipt_sha256:rowObserver,\n request_sha256,\n consumed_at,\n consumer,\n merge_authorized:binding.action===\"MERGE_PR\",\n production_go:false\n };\n const canon=canonical(receipt);\n const receipt_sha256=await sha256(canon);\n const signature=await signCanonicalReceipt(canon);\n await audit(\"V3_AUTHORIZATION_CONSUMED\",authorization_id,receipt_sha256);\n\n return c.json({\n ...receipt,\n consumed:true,\n receipt_sha256,\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KEY_ID,signature_b64url:signature}\n },200,{\"Cache-Control\":\"no-store\"});\n } catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/revoke\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c);\n const authorization_id=String(b.authorization_id||\"\");\n if(!authorization_id)return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({\n sql:\"SELECT status,request_sha256,expires_at FROM authorizations_v3 WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if(!rs.rows.length)return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)===\"ISSUED\"&&Date.parse(String(row.expires_at))<=Date.now()){\n const expired:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(expired?.rowsAffected??0)===1){\n await audit(\"V3_AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if(String(row.status)!==\"ISSUED\"){\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n const updated:any=await sqlite.execute({\n sql:\"UPDATE authorizations_v3 SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"V3_AUTHORIZATION_REVOKED\",authorization_id,String(row.request_sha256));\n return c.json({revoked:true,authorization_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v3/ledger\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const now=new Date().toISOString();\n const rs=await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,observer_receipt_sha256,observer_observed_at,request_sha256,\n status,CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM authorizations_v3 ORDER BY issued_at DESC LIMIT 100`,\n args:[now]\n });\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-ledger/v3.5\",\n implementation:IMPLEMENTATION,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\")===\"true\",\n observer_gate_required_for_merge:true,\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/revoke\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try {\n const b = await bodyJson(c);\n const authorization_id = String(b.authorization_id || \"\");\n if (!authorization_id) return c.json({error:\"INVALID_AUTHORIZATION_ID\"},400,{\"Cache-Control\":\"no-store\"});\n\n const rs = await sqlite.execute({\n sql:\"SELECT status,request_sha256,expires_at FROM authorizations WHERE authorization_id=? LIMIT 1\",\n args:[authorization_id]\n });\n if (!rs.rows.length) return c.json({error:\"AUTHORIZATION_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any = rs.rows[0];\n\n if (String(row.status) === \"ISSUED\" && Date.parse(String(row.expires_at)) <= Date.now()) {\n const expired:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='EXPIRED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(expired?.rowsAffected ?? 0) === 1) {\n await audit(\"AUTHORIZATION_EXPIRED\",authorization_id,String(row.request_sha256));\n }\n return c.json({error:\"AUTHORIZATION_EXPIRED\",authorization_id},410,{\"Cache-Control\":\"no-store\"});\n }\n if (String(row.status) !== \"ISSUED\") {\n return c.json({error:\"AUTHORIZATION_NOT_ISSUED\",status:row.status},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const updated:any = await sqlite.execute({\n sql:\"UPDATE authorizations SET status='REVOKED' WHERE authorization_id=? AND status='ISSUED'\",\n args:[authorization_id]\n });\n if (Number(updated?.rowsAffected ?? 0) !== 1) return c.json({error:\"AUTHORIZATION_RACE_LOST\"},409,{\"Cache-Control\":\"no-store\"});\n\n await audit(\"AUTHORIZATION_REVOKED\",authorization_id,String(row.request_sha256));\n return c.json({revoked:true,authorization_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n } catch (e) {\n return c.json({error:String(e?.message || e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/ledger\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rawLimit = Number(c.req.query(\"limit\") || \"50\");\n const limit = Number.isSafeInteger(rawLimit) ? Math.max(1,Math.min(100,rawLimit)) : 50;\n const now = new Date().toISOString();\n const rs = await sqlite.execute({\n sql:`SELECT authorization_id,action,repository_identity_sha256,pr_number,base_sha,head_sha,\n package_sha256,evidence_sha256,request_sha256,status,\n CASE WHEN status='ISSUED' AND expires_at<=? THEN 'EXPIRED' ELSE status END AS effective_status,\n issued_at,expires_at,consumed_at,consumer\n FROM authorizations ORDER BY issued_at DESC LIMIT ?`,\n args:[now,limit]\n });\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-ledger/v1\",\n implementation:IMPLEMENTATION,\n merge_authorization_enabled:Deno.env.get(\"R2_ALLOW_MERGE_AUTHORIZATION\") === \"true\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\", async (c) => {\n if (!authorized(c.req.raw)) return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs = await sqlite.execute(\"SELECT * FROM audit_events ORDER BY seq ASC\");\n let prev = \"0\".repeat(64);\n let ok = true;\n for (const r of rs.rows as any[]) {\n const event = {\n event_type:r.event_type,\n authorization_id:r.authorization_id,\n object_sha256:r.object_sha256,\n prev_event_sha256:r.prev_event_sha256,\n created_at:r.created_at\n };\n const computed = await sha256(canonical(event));\n if (String(r.prev_event_sha256) !== prev || String(r.event_sha256) !== computed) ok = false;\n prev = String(r.event_sha256);\n }\n return c.json({\n schema:\"rumbo-r2-dedicated-authorizer-audit/v1\",\n audit_chain_ok:ok,\n count:rs.rows.length,\n tail_sha256:prev,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.onError((err,c) => {\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n",[159],"6b23a870-9343-404b-aa14-afc0159a33de",["D",1787986718125],[27],"c37d689c-a8db-4bda-a73c-dfb98e5eecae","RELEASE_V3_4.md","01a04c49-5387-76da-a41c-16e595b98dd6",1,["D",1787986269067],"# RUMBO R2 Dedicated Authorizer V3.4 — Observer V1.4 Pin\n\nStatus: **PASS / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `DEDICATED_R2_AUTHORIZER_V3_4_OBSERVER_V1_4_PINNED`.\n\nRequired observer implementation: `R2_GITHUB_OBSERVER_V1_4_JIT_DERIVED_GITHUB_AUTHORITY`.\nRequired broker provenance: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\n\nV3.4 advances the anti-downgrade chain to the JIT-derived GitHub authority observer. Older observer implementations and older broker provenance are rejected before merge authority can be issued. Signed authorizer issuance, consumption and ledger schemas advance to v3.4.\n\nPositive cryptographic chain test evaluation: `01a04bfd-c052-74a3-b539-7411a361d553` — PASS. A valid V1.4 observer ES256 receipt was accepted; V1.3 observer downgrade, broker downgrade, binding mismatch and signature tamper were rejected. The temporary diagnostic route and test file were removed before release.\n\nPermanent selftest after cleanup: `01a04bfe-0ef7-71f4-a776-f0dfcbef40c4` — PASS.\n\nTEST_ONLY receipt SHA-256: `a147703866ae5e0108210f7f52083cdf33b7d56fb228cf94d8cf0d3b1df56137`.\n\nStatic source audit: PASS. `MERGE_PR` remains disabled, native enforcement remains mandatory, evidence must equal the signed observer receipt SHA-256 for merge authority, and `production_go=false`.\n",[170],"51574239-d062-413f-ae15-9c2b8c2b0160","RELEASE_V3_3.md","01a04c49-5387-76da-a41c-114c25c827d5",["D",1787986269067],"# RUMBO R2 Dedicated Authorizer V3.3 — Broker Chain Pin\n\nStatus: **PASS / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `DEDICATED_R2_AUTHORIZER_V3_3_BROKER_CHAIN_PINNED`.\n\nRequired observer: `R2_GITHUB_OBSERVER_V1_3_BROKER_IMPLEMENTATION_PINNED`.\nRequired broker provenance inside the signed observer receipt: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\n\nThe authorizer now rejects both observer implementation downgrade and broker implementation downgrade before any merge authority can be issued. Signed authorizer schemas advance to v3.3.\n\nA temporary branch-only verifier was used to test the real observer ES256 chain and was removed before release. Evaluation `01a04be8-8d45-733a-b286-050e167baa16` passed: valid signed observer receipt accepted; broker downgrade rejected with `BROKER_IMPLEMENTATION_MISMATCH`; observer downgrade rejected; binding mismatch rejected; signature tamper rejected.\n\nThe permanent selftest evaluation `01a04be8-d8d1-7758-bbd8-1aef1d73ddbc` also passed after the diagnostic route was removed.\n\nTEST_ONLY receipt SHA-256: `28e52c4f9c6607f2bb4a5326e5be70b0bd757eabf0fe9495408f00e38504bcea`.\n\nStatic audit: PASS. Merge authorization remains disabled and `production_go=false`.\n",[177],"5c4ce35b-b664-4a9b-ba28-7f4b2e799389","RELEASE_V3_2.md","01a04c49-5387-76da-a41c-0fc9e2d33713",["D",1787986269067],"# RUMBO R2 Dedicated Authorizer V3.2 — Observer Broker Pin\n\nStatus: **PASS / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `DEDICATED_R2_AUTHORIZER_V3_2_OBSERVER_BROKER_PINNED`\n\nRequired observer: `R2_GITHUB_OBSERVER_V1_2_BROKER_JIT`.\n\nV3.2 pins the broker-wired observer implementation, retains exact repository/PR/base/head/package binding, ES256 verification, native-enforcement proof, freshness windows, evidence binding, replay prevention, and `production_go=false`. Older observer implementations fail with `OBSERVER_IMPLEMENTATION_MISMATCH`.\n\nSigned schemas move to v3.2 for issuance, consumption, and ledger.\n\nValidation evaluation: `01a04bde-6403-70fa-b459-8be0457b4910` — PASS.\n\nTest receipt SHA-256: `45e70523adf8f3375dda21bf00d3a5a49244d56e667e286fa525421b02507eee`.\n\nStatic audit: PASS. Merge authorization remains disabled; no product-production authority is created.\n",[183],"1a60ce47-533f-4b30-a82b-c713c902a5e5","RELEASE_V3_1.md","01a04c49-5387-76da-a41c-0ad4c7f2e608",["D",1787986269067],"# RUMBO R2 Dedicated Authorizer V3.1 — Observer Revision Pinning\n\nStatus: **PASS / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nImplementation:\n\n`DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED`\n\nV3.1 closes a rollback path found during self-audit.\n\nV3 already required a signed observer receipt, native enforcement and exact\n`evidence_sha256 = observer_receipt_sha256`. However, an older observer implementation\nusing the same receipt schema and signing key could still produce a cryptographically valid\nreceipt.\n\nV3.1 requires the signed observer field:\n\n`observer_implementation=R2_GITHUB_OBSERVER_V1_1_NATIVE_REVIEW_HARDENING`\n\nAny older implementation now fails with `OBSERVER_IMPLEMENTATION_MISMATCH`.\n\nThe authorizer's own consumption receipt is also revision-bound:\n\n- schema: `rumbo-r2-dedicated-authorizer-consumption/v3.1`;\n- signed field:\n `authorizer_implementation=DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED`.\n\nThis gives downstream deployers an explicit anti-downgrade field instead of relying only\non a stable signing key.\n\n## Validation\n\nEvaluation:\n\n`01a04bcc-bdd9-77ec-af9e-641e8d22a43a`\n\nResult: **PASS**.\n\nReceipt SHA-256:\n\n`7173d3c8134e1588933e11aa70f066be89ba161c5520a44f31352cd2e1e7d74c`\n\nThe legacy V1 merge path remains HTTP 410, the global merge flag remains disabled,\none-time/replay protections remain active, signatures verify, tampering fails, audit chain\npasses and `production_go=false`.\n\nStatic audit: **PASS**.\n",[189],"44f719bc-81a5-41ed-a8c0-6764ec2f64f4","RELEASE_V3.md","01a04c49-5387-76da-a41c-05561457fe58",["D",1787986269067],"# RUMBO R2 Dedicated Authorizer V3 — Observer-Gated Merge\n\nStatus: **PASS / LIVE_CANDIDATE / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nV3 closes the remaining authorization-policy gap between an independently observed\nGitHub PR snapshot and a future `MERGE_PR` authorization.\n\n## Observer trust root\n\nRequired observer:\n\n`R2_GITHUB_OBSERVER_V1`\n\nObserver receipt schema:\n\n`rumbo-r2-github-observer-receipt/v1`\n\nPinned observer signing key id:\n\n`aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8`\n\nOnly the observer public P-256 verification key is embedded here. The observer private\nsigning key is not present in the authorizer source.\n\n## Merge admission\n\nLegacy V1 `MERGE_PR` issue and consume paths are retired with HTTP 410.\n\nThe new V3 path requires all of the following before a merge authorization can even be\nissued:\n\n1. global `R2_ALLOW_MERGE_AUTHORIZATION=true`;\n2. exact repository/PR/base/head/package binding;\n3. a signed `R2_GITHUB_OBSERVER_V1` receipt;\n4. observer scope exactly `R2_GITHUB_PR_SNAPSHOT_ONLY`;\n5. observer `production_go=false`;\n6. exact observer repository identity;\n7. observer `OBSERVATION_PASS` with zero blocking checks;\n8. `native_enforcement.proven=true`;\n9. `merge_ready=true`;\n10. receipt freshness <= 300 seconds;\n11. exact ES256 signature under the pinned observer public key;\n12. `evidence_sha256` equal to the observer receipt SHA-256.\n\nAt consumption, the observer binding must remain identical and its observation age must\nremain <= 600 seconds.\n\nThus neither a stale observer result nor a valid result without native branch/ruleset\nenforcement can authorize merge.\n\n## TEST_ONLY\n\n`TEST_ONLY` remains available through V3 without observer authority.\n\nA TEST_ONLY request carrying an observer merge receipt is rejected, preventing accidental\nauthority mixing.\n\nSuccessful V3 TEST_ONLY consumption emits a signed authorizer receipt using the existing\nauthorizer ES256 custody key.\n\n## Current fail-closed state\n\nThe global merge flag remains absent/false.\n\nTherefore `MERGE_PR` currently fails with HTTP 423 before any merge authority can be\nissued.\n\nProduct production remains false.\n\n## Validation\n\nBranch evaluation:\n\n`01a04bc6-1812-72cf-bbbf-8bf50289ec48`\n\nResult: **PASS**.\n\nValidated matrix:\n\n- health → 200;\n- unauthenticated V3 ledger → 401;\n- invalid binding → 400;\n- legacy V1 merge issue → 410;\n- legacy V1 merge consume → 410;\n- V3 merge while global gate disabled → 423;\n- TEST_ONLY carrying observer receipt → 400;\n- V3 TEST_ONLY issue → 201;\n- wrong token → 403;\n- V3 TEST_ONLY consume → 200;\n- signed V3 authorizer receipt verifies → true;\n- modified signed receipt verifies → false;\n- replay → 409;\n- duplicate request → 409;\n- V3 ledger → 200;\n- token hash exposed by ledger → false;\n- audit chain → PASS;\n- production_go → false.\n\nTest receipt SHA-256:\n\n`ef6e154110336e9322cf089af4de37a0c124986e0df2d041ac7c7d2350cd624b`\n\n## Static source audit\n\nPASS:\n\n- observer private signing material is absent;\n- authorizer private signing material is absent;\n- observer public key is pinned;\n- observer receipt hash is bound to `evidence_sha256`;\n- native enforcement is mandatory for merge;\n- both legacy merge entry points are retired;\n- observer freshness limits exist at issue and consume;\n- V3 ledger does not project token hashes;\n- `production_go=false` remains pervasive.\n\n## Claim boundary\n\nThis version makes a future merge authorization cryptographically dependent on fresh,\nindependent GitHub observation plus proven native enforcement.\n\nBecause native private-repository enforcement is not currently available on the user's\nplan and the dedicated GitHub App credential is not yet bound, this new merge path cannot\nbecome live by accident.\n",[195],"2c454719-132c-4305-b1d4-60856401d210","RELEASE_V2.md","01a04c49-5387-76da-a41c-0370e96ce86e",["D",1787986269067],"# RUMBO R2 Dedicated Authorizer V2 — Signed Receipts\n\nStatus: **PASS / LIVE_CANDIDATE / MERGE_DISABLED / PRODUCTION_NO_GO**\n\nV2 hardens the independent R2 authorizer by making every successful consumption receipt\ncryptographically verifiable outside the authorizer database.\n\n## Signing boundary\n\nAlgorithm:\n\n`ES256 / ECDSA P-256 + SHA-256`\n\nSigning key id:\n\n`bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY`\n\nThe private P-256 JWK exists only in encrypted environment variable\n`R2_RECEIPT_SIGNING_JWK_V1`.\n\nThe corresponding public JWK is exposed by `GET /health` and may be pinned by downstream\nverifiers. The private key is not present in source or response payloads.\n\n## Receipt contract\n\nSuccessful `POST /v1/consume` now returns schema:\n\n`rumbo-r2-dedicated-authorizer-consumption/v2`\n\nThe signature covers the exact canonical receipt object, including:\n\n- authorization id;\n- action;\n- repository identity SHA-256;\n- PR number;\n- base and head Git SHA;\n- sealed package SHA-256;\n- evidence SHA-256;\n- request SHA-256;\n- consumed timestamp;\n- consumer;\n- merge-authorized state;\n- production-go state.\n\nThe response includes:\n\n- `receipt_sha256`;\n- `receipt_signature.alg=ES256`;\n- exact signing key id;\n- base64url signature.\n\n## Adversarial validation\n\nBranch evaluation:\n\n`01a04ba6-7c96-71ee-888f-953a2f36529f`\n\nResult: **PASS**.\n\nAdditional V2 checks:\n\n- signing key configured: true;\n- signed receipt verification: true;\n- modified receipt verification: false;\n- receipt SHA-256 recomputation: exact;\n- replay still rejected;\n- token hash still absent from read APIs;\n- audit chain valid;\n- `MERGE_PR` still disabled at issuance and consumption;\n- `production_go=false`.\n\nValidated test receipt SHA-256:\n\n`ea6091f0d05f4c5ddd6693728fe6ec41fa39bb627f4128a74fb1ebc597a60756`\n\n## Downstream consequence\n\nThe deployer no longer needs to trust an arbitrary caller-supplied\n`authorizer_receipt_sha256`. It can verify a signed consumption receipt offline using\nonly the pinned public key.\n\nThis closes the receipt-authenticity gap between authorization custody and deployment\nplanning. It does not enable merge or deployment.\n",[201],"8b63cb33-d8d3-424a-ab53-55be39125cb4","RELEASE_V1.md","01a04c49-5387-76da-a41b-fc41ffa5feec",["D",1787986269067],"# RUMBO R2 Dedicated Authorizer V1\n\nStatus: **LIVE_CANDIDATE / FAIL_CLOSED / PRODUCTION_NO_GO**\n\nThis val separates R2 authorization custody from the general continuity relay.\n\n## Identity pins\n\n- repository identity SHA-256:\n `59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23`\n- control package SHA-256:\n `afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\n## Security properties\n\n- dedicated encrypted controller bearer `R2_AUTH_ROOT_TOKEN`;\n- no raw bearer in source;\n- exact binding to action, PR number, base/head SHA, package SHA-256 and evidence SHA-256;\n- one-time random token returned only at issuance;\n- only token SHA-256 persisted;\n- TTL 60–900 seconds;\n- duplicate exact request rejection;\n- atomic single consumption;\n- replay rejection;\n- token mismatch rejection;\n- binding mismatch rejection;\n- expiry/revoke states;\n- independent audit hash chain;\n- ledger and audit endpoints require the dedicated bearer;\n- token hashes are not projected by ledger reads;\n- `production_go=false` invariant.\n\n## Merge gate\n\n`MERGE_PR` is checked at both issuance and consumption.\n\nIt remains disabled because:\n\n`R2_ALLOW_MERGE_AUTHORIZATION`\n\nis intentionally absent.\n\n## Live adversarial test\n\nVal Town evaluation:\n\n`01a04b98-76d2-7582-919e-e052f8b1ca26`\n\nResult: **PASS**.\n\nObserved matrix:\n\n- health → 200\n- unauthenticated ledger → 401\n- invalid repository binding → 400\n- MERGE_PR issue while disabled → 423\n- MERGE_PR consume while disabled → 423\n- TEST_ONLY issue → 201\n- wrong one-time token → 403\n- exact consume → 200\n- replay → 409\n- duplicate exact authorize → 409\n- ledger → 200\n- token-hash leakage → false\n- audit → 200\n- audit chain valid → true\n\nTest receipt SHA-256:\n\n`9c01ae930da60c2c724bcfafe10fc0d77c3f8ac79e510d4e2d6aa4f9a5563e8d`\n\nAudit tail SHA-256:\n\n`8173af91ee447e9bf0d0aa7a0beb66a88dd5ebf44a5cd4674f45eb769cb59ec9`\n\n## Boundary\n\nThis service can issue and consume exact fail-closed authorization receipts.\n\nIt does not observe GitHub independently, does not hold a GitHub App credential, does not deploy, and cannot grant product production approval.\n",[207],"pulls","branches",10,"forks","envVars",{"_220":222,"_223":60},"connections",{"_220":60,"_221":60},"count","unfilledCount",2,"emptyCount",{"_40":206,"_31":207,"_29":208,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":262,"_13":60,"_32":20,"_33":210,"_23":24,"_156":-5,"_235":263,"_26":264},{"_40":200,"_31":201,"_29":202,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":259,"_13":60,"_32":20,"_33":204,"_23":24,"_156":-5,"_235":260,"_26":261},{"_40":194,"_31":195,"_29":196,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":256,"_13":60,"_32":20,"_33":198,"_23":24,"_156":-5,"_235":257,"_26":258},{"_40":188,"_31":189,"_29":190,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":253,"_13":60,"_32":20,"_33":192,"_23":24,"_156":-5,"_235":254,"_26":255},{"_40":182,"_31":183,"_29":184,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":250,"_13":60,"_32":20,"_33":186,"_23":24,"_156":-5,"_235":251,"_26":252},{"_40":176,"_31":177,"_29":178,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":247,"_13":60,"_32":20,"_33":180,"_23":24,"_156":-5,"_235":248,"_26":249},{"_40":169,"_31":170,"_29":171,"_150":-5,"_38":39,"_37":172,"_151":56,"_35":244,"_13":60,"_32":20,"_33":174,"_23":24,"_156":-5,"_235":245,"_26":246},{"_40":166,"_31":27,"_29":30,"_150":-5,"_38":39,"_37":14,"_151":56,"_35":241,"_13":60,"_32":20,"_33":34,"_23":24,"_156":-5,"_235":242,"_26":243},{"_40":158,"_31":159,"_29":160,"_150":-5,"_38":39,"_37":134,"_151":56,"_35":238,"_13":162,"_32":163,"_33":164,"_23":24,"_156":-5,"_235":239,"_26":240},{"_40":147,"_31":148,"_29":149,"_150":-5,"_38":39,"_37":91,"_151":56,"_35":234,"_13":153,"_32":154,"_33":155,"_23":24,"_156":-5,"_235":236,"_26":237},["D",1787986579069],"children",[],[148],["D",1787986688517],[],[159],["D",1787986718125],[],[27],["D",1787986269067],[],[170],["D",1787986269067],[],[177],["D",1787986269067],[],[183],["D",1787986269067],[],[189],["D",1787986269067],[],[195],["D",1787986269067],[],[201],["D",1787986269067],[],[207],["D",1787974602620],["D",1789539031988],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":52,"_103":104,"_105":24},{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":91,"_92":47,"_93":41,"_94":62,"_95":42,"_96":97},"ctx",{"_79":-5,"_127":303,"_304":305,"_306":307,"_308":24,"_309":24,"_310":24,"_311":56,"_312":-5,"_313":-7,"_314":-7,"_315":60,"_316":24,"_317":24,"_318":-5,"_319":24,"_320":24,"_321":24,"_322":-5},"ENV",{"_274":275,"_276":277,"_278":133,"_279":280,"_281":282,"_283":284,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300,"_301":302},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v20