[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_226":227,"_228":229},"routes/_app.x.$handle.$name",{"_98":97,"_31":42,"_107":86,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":121,"_122":24,"_123":124,"_125":56,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",13,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","RELEASE_V3_1.md","latestPath","fileId","73cb40f4-a363-11f1-922b-1607ee4eb77e","name","fileType","content","# RUMBO R2 Deployer Controller V3.1 — Authorizer Pin + Review Proof\n\nStatus: **PASS / DEPLOY_DISABLED / CREDENTIAL_PENDING / PRODUCTION_NO_GO**\n\nImplementation:\n\n`R2_DEPLOYER_CONTROLLER_V3_1_AUTHORIZER_PINNED_REVIEW_PROOF`\n\nV3.1 closes two rollback/enforcement gaps found during self-audit.\n\n## Authorizer anti-downgrade\n\nThe deployer now requires:\n\n- receipt schema:\n `rumbo-r2-dedicated-authorizer-consumption/v3.1`\n- signed field:\n `authorizer_implementation=DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED`\n\nA receipt from the prior V3 authorizer is rejected even if it uses the same ES256 signing\nkey. This prevents a stale implementation from bypassing observer revision pinning.\n\n## Native enforcement strictness\n\nClassic protection counts only if:\n\n- at least one approving review is required;\n- force pushes are explicitly disabled;\n- deletions are explicitly disabled.\n\nRuleset protection counts only if:\n\n- active and targeting main/default;\n- pull-request rule exists;\n- at least one approval is required;\n- non-fast-forward rule exists;\n- deletion rule exists.\n\n## Actual review fulfillment\n\nProvider preflight now fetches the PR review set, reduces to the latest review per reviewer,\nexcludes the PR author, and requires the number of current APPROVED reviewers to meet or\nexceed the live native required-approval count.\n\nThus configuration alone is no longer enough; the exact PR must have fulfilled review\nrequirements before provider merge.\n\nAll earlier exact base/head, current-main equality, native revalidation, exact head SHA\nmerge and post-merge main readback checks remain.\n\n## Validation\n\nEvaluation:\n\n`01a04bcf-4a9f-7714-9aff-290f8b7bbb50`\n\nResult: **PASS**.\n\nValidated:\n\n- authorizer V3.1 signed fixture → valid;\n- implementation downgrade/tamper → invalid;\n- V2/V1 provider paths → retired 410;\n- forged merge receipt → rejected;\n- provider preflight without dedicated credential → 424;\n- TEST_ONLY execute → 403;\n- durable ledger/audit chain → PASS;\n- production_go → false.\n\nFixture receipt SHA-256:\n\n`1ac50f804258d37a21d5be84c73317efade62b803edd8913b3f800703b2624a3`\n\nStatic source audit: **PASS**.\n\nActual provider execution remains impossible because deploy enablement and the dedicated\nGitHub App credential remain absent.\n","createdAt",["D",1787978296483],"branchVersion","branchId","743d46bd-62e2-4390-b7c4-61f4f5894d6d","id","dc841a2e-8ac0-491d-b8e5-ee9e11dc6e2a","rumbo-r2-deployer",["D",1787974891297],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Fail-closed RUMBO R2 deployer controller","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","862fe8ba-a35b-11f1-8a2b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","dc841a2e8ac0491db8e5ee9e11dc6e2a","tursoHostname","dc841a2e8ac0491db8e5ee9e11dc6e2a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789539031988],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":52,"_103":104,"_105":24},"branch",{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":91,"_92":47,"_93":41,"_94":62,"_95":42,"_96":97},"isOwned","v3-1-authorizer-pin-review-proof","projectId","forkedBranchId","05a3146a-0d13-441a-b505-9ff526f70e96","forkedBranchVersion",7,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":221,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":222,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":223,"_81":224,"_83":225,"_85":24},"tree",[196,197,198,199,200,201],"files",[196,197,198,199,200,201],"counts",{"_185":60,"_186":91,"_187":60,"_188":189,"_190":191},"contents",[137,138,139,140,141,142],"upstreamProject","upstreamBranch",{"_40":89,"_35":130,"_131":132,"_31":133,"_87":41,"_13":134,"_88":-5,"_90":-5,"_135":136,"_44":-5,"_85":24,"_46":47,"_96":97,"_61":62,"_95":42},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787974891297],"updatedAt",["D",1787988946009],"main",20,"lockfileKey","1787988946607-esm.town_v_sebas1_rumbo-r2-deployer@20-main",{"_40":179,"_31":180,"_29":181,"_146":-5,"_38":39,"_37":150,"_148":56,"_35":182,"_13":60,"_32":20,"_33":183,"_23":24,"_153":-5,"_26":184},{"_40":173,"_31":174,"_29":175,"_146":-5,"_38":39,"_37":150,"_148":56,"_35":176,"_13":60,"_32":20,"_33":177,"_23":24,"_153":-5,"_26":178},{"_40":167,"_31":168,"_29":169,"_146":-5,"_38":39,"_37":150,"_148":56,"_35":170,"_13":60,"_32":20,"_33":171,"_23":24,"_153":-5,"_26":172},{"_40":164,"_31":27,"_29":30,"_146":-5,"_38":39,"_37":14,"_148":56,"_35":165,"_13":60,"_32":20,"_33":34,"_23":24,"_153":-5,"_26":166},{"_40":155,"_31":156,"_29":157,"_146":-5,"_38":39,"_37":158,"_148":56,"_35":159,"_13":160,"_32":161,"_33":162,"_23":24,"_153":-5,"_26":163},{"_40":143,"_31":144,"_29":145,"_146":-5,"_38":39,"_37":147,"_148":56,"_35":149,"_13":150,"_32":151,"_33":152,"_23":24,"_153":-5,"_26":154},"6e7fcfea-57e5-49a2-8829-e3963e30d983","selftest.ts","01a04bcd-9162-770b-8a00-5234a631b62e","parentId",12,"latest",["D",1787978268601],1,"script","const base=\"https://sebas1--01a04bcd9162770b8a004eb51c811776.web.val.run\";\nconst root=Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\");\nif(!root)throw new Error(\"ROOT_TOKEN_MISSING\");\nconst headers={Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\nconst fixture={\n \"schema\": \"rumbo-r2-dedicated-authorizer-consumption/v3.1\",\n \"authorizer_implementation\": \"DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED\",\n \"authorization_id\": \"37338547-dc60-41ae-9a06-8657a8548fe8\",\n \"action\": \"TEST_ONLY\",\n \"repository_identity_sha256\": \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\",\n \"pr_number\": 412,\n \"base_sha\": \"1ad77acefc7326595c50d7b0edffa81a2188e737\",\n \"head_sha\": \"d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7\",\n \"package_sha256\": \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\",\n \"evidence_sha256\": \"f46d752dba8d9ab7b88ea964c136356375b71f7409836564903bde34cba22e6f\",\n \"observer_receipt_sha256\": null,\n \"request_sha256\": \"67ce21498539c87f44fc5ad9656174d27906d12b99bed9fdb1f2fdb60d9d2f37\",\n \"consumed_at\": \"2026-08-29T04:35:53.280Z\",\n \"consumer\": \"deployer-v3-1-fixture\",\n \"merge_authorized\": false,\n \"production_go\": false,\n \"consumed\": true,\n \"receipt_sha256\": \"1ac50f804258d37a21d5be84c73317efade62b803edd8913b3f800703b2624a3\",\n \"receipt_signature\": {\n \"alg\": \"ES256\",\n \"kid\": \"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\",\n \"signature_b64url\": \"BIyOUzBUmBPHIwSgg-qEgGpSjmCtH90jo7tOMn-VyS7yMeHDUDYZEucYmUal3rxLfFCpgizDJ2S8gxv3A-6ucg\"\n }\n};\n\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nfunction canonicalReceipt(v:any){\n return {\n schema:v.schema,\n authorizer_implementation:v.authorizer_implementation,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nasync function localVerify(v:any,jwk:JsonWebKey):Promise{\n const canon=canonical(canonicalReceipt(v));\n if(await sha256(canon)!==v.receipt_sha256)return false;\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n return await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},key,b64urlDecode(v.receipt_signature.signature_b64url),new TextEncoder().encode(canon)\n );\n}\n\nconst healthRes=await fetch(base+\"/health\");\nconst health:any=await healthRes.json();\nconst localValid=healthRes.status===200?await localVerify(fixture,health.authorizer?.verify_jwk):false;\nconst localTamper=healthRes.status===200?await localVerify({...fixture,authorizer_implementation:\"OLD_IMPLEMENTATION\"},health.authorizer?.verify_jwk):true;\n\nconst unauthLedger=await fetch(base+\"/v3/ledger\");\nconst retiredV2=await fetch(base+\"/v2/prepare\",{method:\"POST\",headers,body:\"{}\"});\nconst retiredV1=await fetch(base+\"/v1/prepare\",{method:\"POST\",headers,body:\"{}\"});\n\nconst downgraded={...fixture,authorizer_implementation:\"DEDICATED_R2_AUTHORIZER_V3_OBSERVER_GATED\"};\nconst downgradeRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:downgraded})});\nconst tampered={...fixture,evidence_sha256:\"f\".repeat(64)};\nconst tamperedRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:tampered})});\nconst forgedMerge={...fixture,action:\"MERGE_PR\",merge_authorized:true,observer_receipt_sha256:\"a\".repeat(64),evidence_sha256:\"a\".repeat(64)};\nconst forgedMergeRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:forgedMerge})});\n\nconst prepareRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:fixture})});\nconst prepared:any=await prepareRes.json();\nif(prepareRes.status!==201&&prepareRes.status!==409)throw new Error(`PREPARE_${prepareRes.status}_${prepared.error||\"UNKNOWN\"}`);\nif(prepareRes.status===409&&prepared.status!==\"PREPARED\")throw new Error(\"EXISTING_PLAN_NOT_PREPARED\");\nconst planId=String(prepared.plan_id||\"\");\nif(!planId)throw new Error(\"PLAN_ID_MISSING\");\n\nconst preflightRes=await fetch(base+\"/v3/preflight\",{method:\"POST\",headers,body:JSON.stringify({plan_id:planId})});\nconst preflight:any=await preflightRes.json();\nconst executeRes=await fetch(base+\"/v3/execute\",{method:\"POST\",headers,body:JSON.stringify({plan_id:planId})});\nconst execute:any=await executeRes.json();\nconst duplicateRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:fixture})});\n\nconst ledgerRes=await fetch(base+\"/v3/ledger\",{headers});\nconst ledger:any=await ledgerRes.json();\nconst plan=Array.isArray(ledger.records)?ledger.records.find((x:any)=>String(x.plan_id)===planId):null;\nconst secretLeak=Array.isArray(ledger.records)&&ledger.records.some((x:any)=>Object.prototype.hasOwnProperty.call(x,\"authorizer_signature_b64url\"));\nconst auditRes=await fetch(base+\"/v3/audit\",{headers});\nconst audit:any=await auditRes.json();\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"R2_DEPLOYER_CONTROLLER_V3_1_AUTHORIZER_PINNED_REVIEW_PROOF\"&&\n health.root_token_configured===true&&\n health.deploy_enabled===false&&\n health.provider_credential_configured===false&&\n health.provider_adapter===\"GITHUB_REST_2026_03_10_IMPLEMENTED\"&&\n health.production_go===false&&\n health.authorizer?.implementation===\"DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED\"&&\n health.authorizer?.receipt_schema===\"rumbo-r2-dedicated-authorizer-consumption/v3.1\"&&\n health.authorizer?.observer_receipt_required_for_merge===true&&\n health.execution_policy?.native_enforcement_required===true&&\n health.execution_policy?.minimum_native_approving_reviews===1&&\n health.execution_policy?.actual_review_approval_fulfillment_required===true&&\n health.execution_policy?.pr_author_approval_not_counted===true&&\n health.execution_policy?.current_main_must_equal_bound_base===true&&\n health.execution_policy?.exact_head_sha_merge===true&&\n health.execution_policy?.post_merge_main_readback_required===true&&\n localValid===true&&\n localTamper===false&&\n unauthLedger.status===401&&\n retiredV2.status===410&&\n retiredV1.status===410&&\n downgradeRes.status===400&&\n tamperedRes.status===400&&\n forgedMergeRes.status===400&&\n (prepareRes.status===201||prepareRes.status===409)&&\n preflightRes.status===424&&preflight.error===\"PROVIDER_CREDENTIAL_NOT_CONFIGURED\"&&\n executeRes.status===403&&execute.error===\"AUTHORIZER_ACTION_NOT_MERGE_PR\"&&\n duplicateRes.status===409&&\n ledgerRes.status===200&&ledger.production_go===false&&\n plan?.authorizer_action===\"TEST_ONLY\"&&plan?.observer_receipt_sha256===null&&\n secretLeak===false&&\n auditRes.status===200&&audit.audit_chain_ok===true&&audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n local_authorizer_v31_fixture_verified:localValid,\n implementation_tamper_verified:localTamper,\n unauthenticated_ledger:unauthLedger.status,\n v2_retired:retiredV2.status,\n v1_retired:retiredV1.status,\n downgraded_authorizer_receipt_prepare:downgradeRes.status,\n tampered_receipt_prepare:tamperedRes.status,\n forged_merge_prepare:forgedMergeRes.status,\n prepare:prepareRes.status,\n provider_preflight_without_credential:preflightRes.status,\n execute_test_only:executeRes.status,\n duplicate_prepare:duplicateRes.status,\n ledger:ledgerRes.status,\n signature_bytes_leaked_in_ledger:secretLeak,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n plan_id:planId,\n authorizer_receipt_sha256:fixture.receipt_sha256,\n provider_adapter:health.provider_adapter,\n review_fulfillment_required:true,\n deploy_enabled:false,\n production_go:false\n},null,2));\nif(!pass)Deno.exit(1);\n","label",[144],"b43a23ad-5cfa-45e3-ae62-8a697060d9e5","main.tsx","01a04bcd-9162-770b-8a00-4eb51c811776",11,["D",1787978234369],10,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app=new Hono();\n\nconst IMPLEMENTATION=\"R2_DEPLOYER_CONTROLLER_V3_1_AUTHORIZER_PINNED_REVIEW_PROOF\";\nconst REPO_OWNER=\"fscfede-beep\";\nconst REPO_NAME=\"rumbo-control-queue\";\nconst REPO_FULL=`${REPO_OWNER}/${REPO_NAME}`;\nconst REPOSITORY_ID=1314199389;\nconst OWNER_ID=293577326;\nconst DEFAULT_BRANCH=\"main\";\nconst REPO_IDENTITY_SHA256=\"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst PACKAGE_SHA256=\"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst AUTHORIZER_IMPLEMENTATION=\"DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED\";\nconst AUTHORIZER_SIGNING_KID=\"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\";\nconst AUTHORIZER_VERIFY_JWK:JsonWebKey={\n kty:\"EC\",crv:\"P-256\",\n x:\"TV0M-YRfRzqMB6dTZIhLOu7w21Tkgul-lUns7HwpHy4\",\n y:\"mRWAIOykqSBgsAXqC9t3OOmk3KLljPH935lilXma-W4\",\n key_ops:[\"verify\"],ext:true\n};\nconst API_VERSION=\"2026-03-10\";\nconst MAX_BODY=64*1024;\nconst MAX_EXEC_RECEIPT_AGE_SECONDS=900;\nconst MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS=300;\nconst SHA256_RE=/^[a-f0-9]{64}$/;\nconst GIT_SHA_RE=/^[a-f0-9]{40}$/;\nconst B64URL_RE=/^[A-Za-z0-9_-]{80,128}$/;\n\ntype AuthorizerAction=\"TEST_ONLY\"|\"MERGE_PR\";\ntype VerifiedReceipt={\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.1\";\n authorizer_implementation:string;\n authorization_id:string;\n action:AuthorizerAction;\n repository_identity_sha256:string;\n pr_number:number;\n base_sha:string;\n head_sha:string;\n package_sha256:string;\n evidence_sha256:string;\n observer_receipt_sha256:string|null;\n request_sha256:string;\n consumed_at:string;\n consumer:string;\n merge_authorized:boolean;\n production_go:false;\n consumed:true;\n receipt_sha256:string;\n receipt_signature:{alg:\"ES256\";kid:string;signature_b64url:string};\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS deploy_plans_v3(\n plan_id TEXT PRIMARY KEY,\n authorizer_action TEXT NOT NULL CHECK(authorizer_action IN ('TEST_ONLY','MERGE_PR')),\n authorizer_authorization_id TEXT NOT NULL UNIQUE,\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n observer_receipt_sha256 TEXT,\n authorizer_request_sha256 TEXT NOT NULL,\n authorizer_receipt_sha256 TEXT NOT NULL UNIQUE,\n authorizer_signature_kid TEXT NOT NULL,\n authorizer_consumed_at TEXT NOT NULL,\n authorizer_merge_authorized INTEGER NOT NULL CHECK(authorizer_merge_authorized IN (0,1)),\n request_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('PREPARED','CANCELLED','EXECUTED')),\n created_at TEXT NOT NULL,\n executed_at TEXT,\n provider_merge_sha TEXT,\n provider_main_readback_sha TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_deploy_plans_v3_status ON deploy_plans_v3(status,created_at)`,\n `CREATE TABLE IF NOT EXISTS deploy_audit_v3(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n plan_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v3_prev ON deploy_audit_v3(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v3_event_plan\n ON deploy_audit_v3(event_type,plan_id)\n WHERE plan_id IS NOT NULL`\n]);\n\nfunction bearer(req:Request):string{\n const h=req.headers.get(\"authorization\")||\"\";\n return h.startsWith(\"Bearer \")?h.slice(7):\"\";\n}\nfunction ct(a:string,b:string):boolean{\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0;for(let i=0;i;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nasync function bodyJson(c:any):Promise{\n const len=Number(c.req.header(\"content-length\")||\"0\");\n if(Number.isFinite(len)&&len>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt=await c.req.text();\n if(new TextEncoder().encode(txt).length>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt||\"{}\");\n}\nfunction canonicalReceipt(v:any){\n return {\n schema:v.schema,\n authorizer_implementation:v.authorizer_implementation,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nfunction structuralReceiptCheck(v:any):v is VerifiedReceipt{\n if(!v||typeof v!==\"object\")return false;\n if(v.schema!==\"rumbo-r2-dedicated-authorizer-consumption/v3.1\")return false;\n if(v.authorizer_implementation!==AUTHORIZER_IMPLEMENTATION)return false;\n if(typeof v.authorization_id!==\"string\"||v.authorization_id.length<16||v.authorization_id.length>128)return false;\n if(v.action!==\"TEST_ONLY\"&&v.action!==\"MERGE_PR\")return false;\n if(v.repository_identity_sha256!==REPO_IDENTITY_SHA256)return false;\n if(!Number.isSafeInteger(v.pr_number)||v.pr_number<=0)return false;\n if(!GIT_SHA_RE.test(String(v.base_sha||\"\"))||!GIT_SHA_RE.test(String(v.head_sha||\"\")))return false;\n if(v.package_sha256!==PACKAGE_SHA256)return false;\n if(!SHA256_RE.test(String(v.evidence_sha256||\"\"))||!SHA256_RE.test(String(v.request_sha256||\"\")))return false;\n if(v.observer_receipt_sha256!==null&&!SHA256_RE.test(String(v.observer_receipt_sha256||\"\")))return false;\n if(!Number.isFinite(Date.parse(String(v.consumed_at||\"\"))))return false;\n if(typeof v.consumer!==\"string\"||!/^[A-Za-z0-9_.:-]{1,128}$/.test(v.consumer))return false;\n if(v.consumed!==true||v.production_go!==false)return false;\n if(typeof v.merge_authorized!==\"boolean\"||v.merge_authorized!==(v.action===\"MERGE_PR\"))return false;\n if(v.action===\"MERGE_PR\"&&(!v.observer_receipt_sha256||v.evidence_sha256!==v.observer_receipt_sha256))return false;\n if(v.action===\"TEST_ONLY\"&&v.observer_receipt_sha256!==null)return false;\n if(!SHA256_RE.test(String(v.receipt_sha256||\"\")))return false;\n if(v.receipt_signature?.alg!==\"ES256\"||v.receipt_signature?.kid!==AUTHORIZER_SIGNING_KID)return false;\n if(!B64URL_RE.test(String(v.receipt_signature?.signature_b64url||\"\")))return false;\n return true;\n}\nasync function verifyAuthorizerReceipt(v:any):Promise<{ok:true;receipt:VerifiedReceipt}|{ok:false;error:string}>{\n if(!structuralReceiptCheck(v))return {ok:false,error:\"INVALID_AUTHORIZER_V3_RECEIPT_STRUCTURE\"};\n const canon=canonical(canonicalReceipt(v));\n const computed=await sha256(canon);\n if(!ct(computed,String(v.receipt_sha256)))return {ok:false,error:\"AUTHORIZER_RECEIPT_HASH_MISMATCH\"};\n let key:CryptoKey;\n try{key=await crypto.subtle.importKey(\"jwk\",AUTHORIZER_VERIFY_JWK,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);}\n catch{return {ok:false,error:\"AUTHORIZER_VERIFY_KEY_IMPORT_FAILED\"};}\n let sig:Uint8Array;\n try{sig=b64urlDecode(String(v.receipt_signature.signature_b64url));}\n catch{return {ok:false,error:\"AUTHORIZER_SIGNATURE_ENCODING_INVALID\"};}\n const valid=await crypto.subtle.verify({name:\"ECDSA\",hash:\"SHA-256\"},key,sig,new TextEncoder().encode(canon));\n if(!valid)return {ok:false,error:\"AUTHORIZER_RECEIPT_SIGNATURE_INVALID\"};\n return {ok:true,receipt:v};\n}\nasync function github(path:string,method=\"GET\",body?:unknown){\n const token=Deno.env.get(\"R2_GITHUB_APP_TOKEN\")||\"\";\n if(!token)return {status:0,json:null,text:\"GITHUB_APP_TOKEN_NOT_CONFIGURED\"};\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${token}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-deployer/3\",\n \"Content-Type\":\"application/json\"\n },\n body:body===undefined?undefined:JSON.stringify(body)\n });\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n}\nasync function nativeEnforcement(){\n const protection=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/branches/${DEFAULT_BRANCH}/protection`);\n let classic=false;\n let classicRequiredApprovals=0;\n if(protection.status===200&&protection.json){\n const j=protection.json;\n classicRequiredApprovals=Number(j.required_pull_request_reviews?.required_approving_review_count||0);\n classic=classicRequiredApprovals>=1 &&\n j.allow_force_pushes?.enabled===false &&\n j.allow_deletions?.enabled===false;\n }\n\n const list=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets`);\n let ruleset=false;\n let rulesetRequiredApprovals=0;\n const rulesets:any[]=[];\n if(list.status===200&&Array.isArray(list.json)){\n for(const item of list.json){\n if(item?.enforcement!==\"active\"||item?.target!==\"branch\"||!item?.id)continue;\n const detail=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets/${item.id}`);\n if(detail.status!==200||!detail.json)continue;\n const rules=detail.json.rules||[];\n const types=new Set(rules.map((r:any)=>String(r.type)));\n const include=(detail.json.conditions?.ref_name?.include||[]).map(String);\n const targetsMain=include.includes(\"~DEFAULT_BRANCH\")||include.includes(\"refs/heads/main\")||include.includes(\"main\");\n const pullRule=rules.find((r:any)=>String(r.type)===\"pull_request\");\n const required=Number(pullRule?.parameters?.required_approving_review_count||0);\n const protects=targetsMain &&\n types.has(\"pull_request\") &&\n types.has(\"non_fast_forward\") &&\n types.has(\"deletion\") &&\n required>=1;\n rulesets.push({id:item.id,targets_main:targetsMain,required_approvals:required,types:[...types],protects});\n if(protects){\n ruleset=true;\n rulesetRequiredApprovals=Math.max(rulesetRequiredApprovals,required);\n }\n }\n }\n\n const requiredApprovals=Math.max(classic?classicRequiredApprovals:0,ruleset?rulesetRequiredApprovals:0);\n return {\n proven:classic||ruleset,\n classic,\n ruleset,\n required_approvals:requiredApprovals,\n classic_required_approvals:classicRequiredApprovals,\n ruleset_required_approvals:rulesetRequiredApprovals,\n protection_status:protection.status,\n rulesets_status:list.status,\n inspected_rulesets:rulesets\n };\n}\nasync function providerPreflight(row:any){\n const checks:any[]=[];\n const add=(name:string,ok:boolean,detail:any)=>checks.push({name,status:ok?\"PASS\":\"FAIL\",detail});\n\n const repo=await github(`/repos/${REPO_OWNER}/${REPO_NAME}`);\n add(\"repo_api\",repo.status===200,repo.status);\n add(\"repo_id\",Number(repo.json?.id)===REPOSITORY_ID,repo.json?.id);\n add(\"owner_id\",Number(repo.json?.owner?.id)===OWNER_ID,repo.json?.owner?.id);\n add(\"private_repo\",repo.json?.private===true,repo.json?.private);\n add(\"default_branch\",repo.json?.default_branch===DEFAULT_BRANCH,repo.json?.default_branch);\n\n const pr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}`);\n add(\"pr_api\",pr.status===200,pr.status);\n add(\"pr_open\",pr.json?.state===\"open\",pr.json?.state);\n add(\"pr_ready\",pr.json?.draft===false,pr.json?.draft);\n add(\"base_main\",pr.json?.base?.ref===DEFAULT_BRANCH,pr.json?.base?.ref);\n add(\"base_sha_exact\",pr.json?.base?.sha===row.base_sha,pr.json?.base?.sha);\n add(\"head_sha_exact\",pr.json?.head?.sha===row.head_sha,pr.json?.head?.sha);\n\n const cmp=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/compare/${row.base_sha}...${row.head_sha}`);\n add(\"compare_api\",cmp.status===200,cmp.status);\n add(\"head_descends_from_base\",cmp.json?.behind_by===0&&Number(cmp.json?.ahead_by)>=1,{ahead_by:cmp.json?.ahead_by,behind_by:cmp.json?.behind_by});\n\n const main=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n add(\"main_ref_api\",main.status===200,main.status);\n add(\"current_main_equals_bound_base\",main.json?.object?.sha===row.base_sha,main.json?.object?.sha);\n\n const native=await nativeEnforcement();\n add(\"native_enforcement\",native.proven,native);\n\n const reviews=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}/reviews?per_page=100`);\n add(\"reviews_api\",reviews.status===200,reviews.status);\n const latestByReviewer=new Map();\n if(reviews.status===200&&Array.isArray(reviews.json)){\n for(const review of reviews.json){\n const login=String(review?.user?.login||\"\");\n if(!login)continue;\n const prior=latestByReviewer.get(login);\n const currentTime=Date.parse(String(review?.submitted_at||\"\"))||Number(review?.id||0);\n const priorTime=prior?(Date.parse(String(prior?.submitted_at||\"\"))||Number(prior?.id||0)):-1;\n if(currentTime>=priorTime)latestByReviewer.set(login,review);\n }\n }\n const authorLogin=String(pr.json?.user?.login||\"\");\n const approved=[...latestByReviewer.entries()]\n .filter(([login,review])=>login!==authorLogin&&String(review?.state||\"\").toUpperCase()===\"APPROVED\")\n .map(([login])=>login);\n const requiredApprovals=Number(native.required_approvals||0);\n add(\"required_review_approvals\",\n native.proven&&requiredApprovals>=1&&approved.length>=requiredApprovals,\n {required:requiredApprovals,approved_count:approved.length,approved_reviewers:approved,author:authorLogin}\n );\n\n return {\n ok:checks.every(x=>x.status===\"PASS\"),\n checks,\n native,\n required_approvals:requiredApprovals,\n approved_reviewers:approved,\n current_main_sha:main.json?.object?.sha||null\n };\n}\nasync function audit(event_type:string,plan_id:string|null,object_sha256:string|null){\n if(plan_id){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM deploy_audit_v3 WHERE event_type=? AND plan_id=? LIMIT 1\",args:[event_type,plan_id]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n for(let i=0;i<8;i++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM deploy_audit_v3 ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,plan_id,object_sha256,prev_event_sha256:prev,created_at};\n const h=await sha256(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO deploy_audit_v3(event_type,plan_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,plan_id,object_sha256,prev,h,created_at]});\n return h;\n }catch(e){if(!String(e).includes(\"UNIQUE\"))throw e;}\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-deployer\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\napp.get(\"/health\",c=>c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\"),\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n provider_credential_configured:!!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"),\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID,default_branch:DEFAULT_BRANCH},\n package_sha256:PACKAGE_SHA256,\n authorizer:{\n implementation:AUTHORIZER_IMPLEMENTATION,\n receipt_schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.1\",\n signature_alg:\"ES256\",\n signing_kid:AUTHORIZER_SIGNING_KID,\n verify_jwk:AUTHORIZER_VERIFY_JWK,\n observer_receipt_required_for_merge:true\n },\n execution_policy:{\n required_authorizer_action:\"MERGE_PR\",\n observer_receipt_required:true,\n max_prepare_merge_receipt_age_seconds:MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS,\n max_execute_receipt_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,\n current_main_must_equal_bound_base:true,\n pr_must_be_ready_not_draft:true,\n native_enforcement_required:true,\n minimum_native_approving_reviews:1,\n actual_review_approval_fulfillment_required:true,\n pr_author_approval_not_counted:true,\n exact_head_sha_merge:true,\n post_merge_main_readback_required:true,\n test_only_never_executable:true\n },\n capabilities:[\n \"signed-authorizer-v3-verification\",\n \"observer-linked-merge-authority\",\n \"github-rest-provider-preflight\",\n \"exact-live-main-base-revalidation\",\n \"native-enforcement-revalidation\",\n \"required-review-approval-fulfillment\",\n \"pr-author-excluded-from-approval-count\",\n \"authorizer-implementation-anti-downgrade\",\n \"exact-head-sha-merge\",\n \"post-merge-main-readback\",\n \"fail-closed-provider-credential\",\n \"audit-hash-chain\"\n ],\n production_go:false\n}),200,{\"Cache-Control\":\"no-store\"});\n\napp.post(\"/v3/prepare\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c);\n const verified=await verifyAuthorizerReceipt(b?.authorizer_receipt);\n if(!verified.ok)return c.json({error:verified.error,production_go:false},400,{\"Cache-Control\":\"no-store\"});\n const r=verified.receipt;\n\n if(r.action===\"MERGE_PR\"){\n const age=(Date.now()-Date.parse(r.consumed_at))/1000;\n if(!Number.isFinite(age)||age< -60||age>MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS){\n return c.json({error:\"MERGE_AUTHORIZER_RECEIPT_STALE\",production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n if(!r.observer_receipt_sha256||r.evidence_sha256!==r.observer_receipt_sha256){\n return c.json({error:\"OBSERVER_LINK_REQUIRED_FOR_MERGE\",production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n }\n\n const planBinding={\n authorizer_action:r.action,\n authorizer_authorization_id:r.authorization_id,\n repository_identity_sha256:r.repository_identity_sha256,\n pr_number:r.pr_number,\n base_sha:r.base_sha,\n head_sha:r.head_sha,\n package_sha256:r.package_sha256,\n evidence_sha256:r.evidence_sha256,\n observer_receipt_sha256:r.observer_receipt_sha256,\n authorizer_request_sha256:r.request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n authorizer_signature_kid:r.receipt_signature.kid,\n authorizer_consumed_at:r.consumed_at,\n authorizer_merge_authorized:r.merge_authorized\n };\n const request_sha256=await sha256(canonical(planBinding));\n const prior=await sqlite.execute({sql:\"SELECT plan_id,status FROM deploy_plans_v3 WHERE request_sha256=? LIMIT 1\",args:[request_sha256]});\n if(prior.rows.length)return c.json({error:\"PLAN_ALREADY_EXISTS\",plan_id:prior.rows[0].plan_id,status:prior.rows[0].status,request_sha256,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const plan_id=crypto.randomUUID(),created_at=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO deploy_plans_v3(\n plan_id,authorizer_action,authorizer_authorization_id,repository_identity_sha256,\n pr_number,base_sha,head_sha,package_sha256,evidence_sha256,observer_receipt_sha256,\n authorizer_request_sha256,authorizer_receipt_sha256,authorizer_signature_kid,\n authorizer_consumed_at,authorizer_merge_authorized,request_sha256,status,created_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'PREPARED',?)`,args:[\n plan_id,r.action,r.authorization_id,r.repository_identity_sha256,r.pr_number,r.base_sha,r.head_sha,\n r.package_sha256,r.evidence_sha256,r.observer_receipt_sha256,r.request_sha256,r.receipt_sha256,\n r.receipt_signature.kid,r.consumed_at,r.merge_authorized?1:0,request_sha256,created_at\n ]});\n await audit(\"V3_PLAN_PREPARED\",plan_id,request_sha256);\n\n const blocked_by:string[]=[];\n if(r.action!==\"MERGE_PR\"||!r.merge_authorized)blocked_by.push(\"AUTHORIZER_ACTION_NOT_MERGE_PR\");\n if(r.action===\"MERGE_PR\"&&!r.observer_receipt_sha256)blocked_by.push(\"OBSERVER_RECEIPT_MISSING\");\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\")blocked_by.push(\"R2_ALLOW_DEPLOY_FALSE\");\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"))blocked_by.push(\"GITHUB_APP_CREDENTIAL_NOT_CONFIGURED\");\n\n return c.json({\n prepared:true,plan_id,request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n observer_receipt_sha256:r.observer_receipt_sha256,\n authorizer_signature_verified:true,\n authorizer_action:r.action,\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n executable:blocked_by.length===0,\n blocked_by,\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/preflight\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v3 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"))return c.json({error:\"PROVIDER_CREDENTIAL_NOT_CONFIGURED\",plan_id,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n const result=await providerPreflight(rs.rows[0]);\n return c.json({plan_id,...result,production_go:false},result.ok?200:409,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/execute\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v3 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)!==\"PREPARED\")return c.json({error:\"PLAN_NOT_PREPARED\",status:row.status,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n if(String(row.authorizer_action)!==\"MERGE_PR\"||Number(row.authorizer_merge_authorized)!==1){\n return c.json({error:\"AUTHORIZER_ACTION_NOT_MERGE_PR\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n if(!row.observer_receipt_sha256||String(row.evidence_sha256)!==String(row.observer_receipt_sha256)){\n return c.json({error:\"OBSERVER_LINK_REQUIRED_FOR_MERGE\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const age=(Date.now()-Date.parse(String(row.authorizer_consumed_at||\"\")))/1000;\n if(!Number.isFinite(age)||age< -60||age>MAX_EXEC_RECEIPT_AGE_SECONDS){\n return c.json({error:\"AUTHORIZER_RECEIPT_STALE\",plan_id,max_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\"){\n return c.json({error:\"DEPLOY_DISABLED\",plan_id,production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\")){\n return c.json({error:\"PROVIDER_CREDENTIAL_NOT_CONFIGURED\",plan_id,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n }\n\n const pre=await providerPreflight(row);\n if(!pre.ok){\n await audit(\"V3_PROVIDER_PREFLIGHT_NO_GO\",plan_id,await sha256(canonical(pre.checks)));\n return c.json({error:\"PROVIDER_PREFLIGHT_NO_GO\",plan_id,checks:pre.checks,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const merge=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}/merge`,\"PUT\",{\n sha:String(row.head_sha),\n merge_method:\"merge\"\n });\n if(merge.status!==200||merge.json?.merged!==true||!GIT_SHA_RE.test(String(merge.json?.sha||\"\"))){\n await audit(\"V3_PROVIDER_MERGE_FAILED\",plan_id,await sha256(merge.text||\"\"));\n return c.json({error:\"PROVIDER_MERGE_FAILED\",plan_id,status:merge.status,message:merge.json?.message||null,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n const mergeSha=String(merge.json.sha);\n\n const main=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n const mainSha=String(main.json?.object?.sha||\"\");\n if(main.status!==200||mainSha!==mergeSha){\n await audit(\"V3_POST_MERGE_READBACK_FAILED\",plan_id,await sha256(canonical({mergeSha,mainSha,status:main.status})));\n return c.json({error:\"POST_MERGE_MAIN_READBACK_MISMATCH\",plan_id,merge_sha:mergeSha,main_sha:mainSha,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const executed_at=new Date().toISOString();\n const updated:any=await sqlite.execute({\n sql:\"UPDATE deploy_plans_v3 SET status='EXECUTED',executed_at=?,provider_merge_sha=?,provider_main_readback_sha=? WHERE plan_id=? AND status='PREPARED'\",\n args:[executed_at,mergeSha,mainSha,plan_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"EXECUTION_LEDGER_RACE\",plan_id,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"V3_PROVIDER_MERGE_EXECUTED\",plan_id,mergeSha);\n\n return c.json({\n executed:true,\n plan_id,\n provider:\"GITHUB_REST\",\n merged_pr:Number(row.pr_number),\n merge_sha:mergeSha,\n main_readback_sha:mainSha,\n observer_receipt_sha256:String(row.observer_receipt_sha256),\n authorizer_receipt_sha256:String(row.authorizer_receipt_sha256),\n product_production_go:false,\n production_go:false,\n note:\"This executes only the gated R2 observer-installation PR merge. It is not product production authorization.\"\n },200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/cancel\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const updated:any=await sqlite.execute({sql:\"UPDATE deploy_plans_v3 SET status='CANCELLED' WHERE plan_id=? AND status='PREPARED'\",args:[plan_id]});\n if(Number(updated?.rowsAffected??0)!==1)return c.json({error:\"PLAN_NOT_CANCELLABLE\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"V3_PLAN_CANCELLED\",plan_id,null);\n return c.json({cancelled:true,plan_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v3/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT plan_id,authorizer_action,authorizer_authorization_id,\n repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256,\n observer_receipt_sha256,authorizer_request_sha256,authorizer_receipt_sha256,\n authorizer_signature_kid,authorizer_consumed_at,authorizer_merge_authorized,\n request_sha256,status,created_at,executed_at,provider_merge_sha,provider_main_readback_sha\n FROM deploy_plans_v3 ORDER BY created_at DESC LIMIT 100`);\n return c.json({\n schema:\"rumbo-r2-deployer-ledger/v3\",\n implementation:IMPLEMENTATION,\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n provider_credential_configured:!!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"),\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v3/audit\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM deploy_audit_v3 ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,plan_id:r.plan_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-deployer-audit/v3\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.all(\"/v2/*\",c=>c.json({error:\"V2_RETIRED_USE_V3_OBSERVER_LINKED_AUTHORIZATION\",replacement_prepare:\"/v3/prepare\",production_go:false},410,{\"Cache-Control\":\"no-store\"}));\napp.all(\"/v1/*\",c=>c.json({error:\"V1_RETIRED_USE_V3_OBSERVER_LINKED_AUTHORIZATION\",replacement_prepare:\"/v3/prepare\",production_go:false},410,{\"Cache-Control\":\"no-store\"}));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\nexport default app.fetch;\n",[156],"ec0c2fe6-f5be-43f7-b732-22e0224ead9b",["D",1787978296483],[27],"a97f49ba-d99b-4009-ab7f-05a7ce807a41","RELEASE_V3.md","01a04bcd-9162-770b-8a00-48605f5b91a5",["D",1787978158429],"# RUMBO R2 Deployer Controller V3 — GitHub REST Adapter\n\nStatus: **PASS / LIVE_CANDIDATE / DEPLOY_DISABLED / CREDENTIAL_PENDING / PRODUCTION_NO_GO**\n\nV3 implements the provider adapter that V2 intentionally left unbound.\n\nImplementation:\n\n`R2_DEPLOYER_CONTROLLER_V3_GITHUB_REST_ADAPTER`\n\nProvider adapter:\n\n`GITHUB_REST_2026_03_10_IMPLEMENTED`\n\n## Trusted authorizer\n\nRequired authorizer:\n\n`DEDICATED_R2_AUTHORIZER_V3_OBSERVER_GATED`\n\nRequired receipt:\n\n`rumbo-r2-dedicated-authorizer-consumption/v3`\n\nThe deployer pins the authorizer ES256 public key and independently verifies the full\nreceipt before plan admission.\n\nFor `MERGE_PR`, the signed receipt must contain a non-null observer receipt SHA-256 and\nthat SHA must equal `evidence_sha256`.\n\n## Provider preflight\n\nBefore any provider mutation, the adapter re-reads GitHub and requires:\n\n- exact repository id `1314199389`;\n- exact owner id `293577326`;\n- private repository;\n- default branch `main`;\n- exact PR number from signed authorization;\n- PR still open;\n- PR no longer draft;\n- PR base still `main`;\n- PR base SHA exactly equals the signed base;\n- PR head SHA exactly equals the signed head;\n- compare API proves head descends from base;\n- current live `main` equals the signed base SHA;\n- native branch/ruleset enforcement is proven live.\n\nAny mismatch fails closed before merge.\n\n## Merge operation\n\nIf all gates are satisfied, the adapter uses GitHub's merge endpoint with the exact\nauthorized head SHA and then requires `main` readback to equal the returned merge SHA.\n\nThe execution ledger is marked EXECUTED only after that exact post-merge readback.\n\nThis merge is scoped only to installation of the R2 observer bootstrap. The response\nretains `product_production_go=false` and `production_go=false`.\n\n## Current fail-closed state\n\n- `R2_ALLOW_DEPLOY`: false/absent;\n- dedicated GitHub App credential: absent;\n- provider adapter code: implemented;\n- provider mutation: impossible under current gates;\n- production_go: false.\n\n## Validation\n\nBranch evaluation:\n\n`01a04bc8-ae80-7681-bb0b-711eb437cef1`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- signed authorizer V3 fixture verifies → true;\n- modified signed fixture verifies → false;\n- unauthenticated V3 ledger → 401;\n- V2 endpoint retired → 410;\n- V1 endpoint retired → 410;\n- tampered receipt admission → 400;\n- forged TEST_ONLY→MERGE_PR receipt → 400;\n- valid signed TEST_ONLY plan → 201;\n- provider preflight without dedicated credential → 424;\n- TEST_ONLY execute → 403;\n- duplicate plan → 409;\n- signature bytes projected by ledger → false;\n- audit chain → PASS;\n- production_go → false.\n\nFixture authorizer receipt SHA-256:\n\n`25d86f0213156af385df003cf8cb63a30de2ae7191b9442593d881e136ad2b53`\n\n## Static source audit\n\nPASS:\n\n- authorizer private signing material absent;\n- exact repository identity pinned;\n- observer-link invariant present for MERGE_PR;\n- current-main/base equality revalidated;\n- native enforcement revalidated;\n- exact authorized head SHA supplied to merge endpoint;\n- post-merge main readback required;\n- V2 provider path retired;\n- signature bytes omitted from ledger projection;\n- production-go remains false.\n\n## Claim boundary\n\nThe provider adapter is now implemented. Provider execution is **not live** because the\ndedicated GitHub App credential and deploy enable flag remain absent.\n\nNo product production authorization is created by this controller.\n",[168],"47a21d73-ddc8-4b78-894b-fc34180a87e3","RELEASE_V2.md","01a04bcd-9162-770b-8a00-46091dbead07",["D",1787978158429],"# RUMBO R2 Deployer Controller V2 — Signed Authorization\n\nStatus: **PASS / LIVE_CANDIDATE / PROVIDER_UNBOUND / PRODUCTION_NO_GO**\n\nV2 closes the trust gap in V1 where a caller could supply an arbitrary\n`authorizer_receipt_sha256`. Deployment planning now accepts only a complete signed\nconsumption receipt from the dedicated R2 authorizer V2 and verifies it offline.\n\n## Pinned authorizer trust root\n\nRequired authorizer:\n\n`DEDICATED_R2_AUTHORIZER_V2_SIGNED_RECEIPTS`\n\nReceipt schema:\n\n`rumbo-r2-dedicated-authorizer-consumption/v2`\n\nAlgorithm:\n\n`ES256 / ECDSA P-256 + SHA-256`\n\nPinned signing key id:\n\n`bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY`\n\nOnly the public verification JWK is embedded in the deployer.\n\n## Plan admission\n\n`POST /v2/prepare` verifies:\n\n- exact receipt schema;\n- repository identity;\n- PR number;\n- Git base/head SHA syntax;\n- sealed control-package SHA-256;\n- evidence and request SHA-256;\n- consumed timestamp;\n- exact production-go false;\n- exact action/merge-authorized consistency;\n- receipt SHA-256 recomputation;\n- signing algorithm and key id;\n- ES256 signature under the pinned public key.\n\nThe plan is derived from the verified receipt rather than duplicate caller-supplied\nbinding fields.\n\nV1 unsigned endpoints are retired with HTTP 410.\n\n## Execution policy\n\nA cryptographically valid `TEST_ONLY` receipt may be stored as a non-executable\nevidence plan, but `POST /v2/execute` rejects it with:\n\n`AUTHORIZER_ACTION_NOT_MERGE_PR`\n\nbefore checking the deployment enable flag.\n\nFor an executable path, all of the following would be required:\n\n1. signed authorizer action `MERGE_PR`;\n2. signed `merge_authorized=true`;\n3. receipt age <= 900 seconds;\n4. `R2_ALLOW_DEPLOY=true`;\n5. a dedicated GitHub App provider credential;\n6. a provider adapter.\n\nThe current runtime fails closed before those conditions:\n\n- deploy enabled: false;\n- GitHub App credential: absent;\n- provider adapter: `NOT_BOUND`;\n- production_go: false.\n\n## Adversarial validation\n\nBranch evaluation:\n\n`01a04ba9-dcc8-767a-9cae-18783c6e0100`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- pinned signed fixture verifies → true;\n- tampered local fixture verifies → false;\n- unauthenticated ledger → 401;\n- V1 unsigned endpoint → 410;\n- tampered signed receipt admission → 400;\n- forged TEST_ONLY→MERGE_PR elevation → 400;\n- unsigned V1 receipt admission → 400;\n- valid signed TEST_ONLY prepare → 201;\n- execute TEST_ONLY plan → 403;\n- duplicate prepare → 409;\n- ledger → 200;\n- signature bytes exposed by ledger → false;\n- audit → 200;\n- audit chain valid → true.\n\nFixture authorizer receipt SHA-256:\n\n`e493623c38a1028e7263311300cb558cc8b69665a718ae9c0845a78e9b03602b`\n\n## Claim boundary\n\nThe deployer controller now independently authenticates authorizer receipts. This closes\nreceipt authenticity and action-escalation gaps between authorization custody and\ndeployment planning.\n\nActual provider execution is still not live and remains impossible under current gates.\nNo merge, deployment or product-production authorization is implied.\n",[174],"a65c1790-cccd-420d-a36e-277b800b5dcc","RELEASE_V1.md","01a04bcd-9162-770b-8a00-4049c1f6da27",["D",1787978158429],"# RUMBO R2 Deployer Controller V1\n\nStatus: **LIVE_CANDIDATE / FAIL_CLOSED / PROVIDER_UNBOUND / PRODUCTION_NO_GO**\n\nThis service creates an independent deployment-control boundary separate from both the\ncontinuity relay and the dedicated R2 authorizer.\n\n## Current safety state\n\n- controller bearer: encrypted environment variable `R2_DEPLOY_ROOT_TOKEN`;\n- deploy enable gate `R2_ALLOW_DEPLOY`: absent / false;\n- GitHub App provider credential `R2_GITHUB_APP_TOKEN`: absent;\n- provider adapter: `NOT_BOUND`;\n- product production: false.\n\n## Binding contract\n\nEvery prepared deployment plan binds exactly to:\n\n- repository identity SHA-256;\n- PR number;\n- base SHA;\n- head SHA;\n- sealed package SHA-256;\n- evidence SHA-256;\n- dedicated-authorizer consumption receipt SHA-256.\n\nExact duplicate plans are rejected.\n\n## Execute behavior\n\n`POST /v1/execute` fails closed in this order:\n\n1. plan must exist and remain PREPARED;\n2. `R2_ALLOW_DEPLOY=true` must be explicitly present;\n3. a dedicated GitHub App credential must be configured;\n4. a provider adapter must be implemented.\n\nAt present step 2 fails with HTTP 423. No provider-side mutation can occur.\n\n## Adversarial self-test\n\nVal Town evaluation:\n\n`01a04b9c-9389-760a-be16-a819d85ebf7f`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- unauthenticated ledger → 401;\n- invalid binding → 400;\n- prepare → 201;\n- execute while disabled → 423;\n- duplicate prepare → 409;\n- cancel → 200;\n- execute cancelled plan → 409;\n- ledger → 200;\n- audit → 200;\n- audit chain valid → true.\n\nTest plan request SHA-256:\n\n`4fdc1f93766e2b457c58ae02189b6666c075dc8fadef9c6a9afd2e1ee3d4f5c4`\n\n## Claim boundary\n\nThe external deployer **controller runtime** exists and is live fail-closed.\n\nActual provider deployment remains unresolved because no dedicated GitHub App provider\ncredential or provider adapter is bound. This is intentional and must not be reported as\n`EXTERNAL_DEPLOYER_EXECUTION_LIVE`.\n",[180],"pulls","branches","forks","envVars",{"_192":194,"_195":60},"connections",{"_192":60,"_193":60},"count","unfilledCount",3,"emptyCount",{"_40":179,"_31":180,"_29":181,"_146":-5,"_38":39,"_37":150,"_148":56,"_35":218,"_13":60,"_32":20,"_33":183,"_23":24,"_153":-5,"_203":219,"_26":220},{"_40":173,"_31":174,"_29":175,"_146":-5,"_38":39,"_37":150,"_148":56,"_35":215,"_13":60,"_32":20,"_33":177,"_23":24,"_153":-5,"_203":216,"_26":217},{"_40":167,"_31":168,"_29":169,"_146":-5,"_38":39,"_37":150,"_148":56,"_35":212,"_13":60,"_32":20,"_33":171,"_23":24,"_153":-5,"_203":213,"_26":214},{"_40":164,"_31":27,"_29":30,"_146":-5,"_38":39,"_37":14,"_148":56,"_35":209,"_13":60,"_32":20,"_33":34,"_23":24,"_153":-5,"_203":210,"_26":211},{"_40":155,"_31":156,"_29":157,"_146":-5,"_38":39,"_37":158,"_148":56,"_35":206,"_13":160,"_32":161,"_33":162,"_23":24,"_153":-5,"_203":207,"_26":208},{"_40":143,"_31":144,"_29":145,"_146":-5,"_38":39,"_37":147,"_148":56,"_35":202,"_13":150,"_32":151,"_33":152,"_23":24,"_153":-5,"_203":204,"_26":205},["D",1787978268601],"children",[],[144],["D",1787978234369],[],[156],["D",1787978296483],[],[27],["D",1787978158429],[],[168],["D",1787978158429],[],[174],["D",1787978158429],[],[180],["D",1787974891297],["D",1789539031988],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":52,"_103":104,"_105":24},{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":91,"_92":47,"_93":41,"_94":62,"_95":42,"_96":97},"ctx",{"_79":-5,"_127":259,"_260":261,"_262":263,"_264":24,"_265":24,"_266":24,"_267":56,"_268":-5,"_269":-7,"_270":-7,"_271":60,"_272":24,"_273":24,"_274":-5,"_275":24,"_276":24,"_277":24,"_278":-5},"ENV",{"_230":231,"_232":233,"_234":133,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256,"_257":258},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v13