[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_282":283,"_284":285},"routes/_app.x.$handle.$name",{"_98":97,"_31":42,"_107":86,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":121,"_122":24,"_123":124,"_125":56,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",13,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","RELEASE_V3_6.md","latestPath","fileId","91abb694-a377-11f1-899c-1607ee4eb77e","name","fileType","content","# RUMBO R2 Deployer Controller V3.6 — Broker Autopilot\n\nStatus: **PASS / FAIL_CLOSED / DEPLOY_DISABLED / APP_CUSTODY_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_DEPLOYER_CONTROLLER_V3_6_BROKER_AUTOPILOT`.\n\nV3.6 advances the trust chain to broker `R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT` and authorizer `DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED` with receipt schema v3.5.\n\nIt adds a narrow hashed service-token path for `POST /v3/jit/prepare-activation` only. The service bearer cannot call preflight, execute, ledger or other root-only deployment controls. Every successful JIT preparation records `invocation_mode` and remains DRAFT-only, no direct ref write, no merge, no deploy, exact static pins, main drift abort and signed-observer next gate.\n\nBranch selftest evaluation: `01a04c52-8e4d-756a-af7d-3c52a9a9e7f1` — PASS.\n\nCross-service service-auth evaluation: `01a04c53-16e5-7272-96e9-83c58fc66fb4` — PASS. The broker service token reached the JIT endpoint and failed only at `CUSTODY_NOT_READY`; the same token was rejected with 401 by `/v3/execute`. The observer service token likewise reached `/v1/observe` and was rejected by `/v1/ledger`.\n\nIndependent static audit: **23/23 PASS** covering broker/authorizer pins, v3.5 receipt verification, v3.6 ledger schema, hashed service auth, JIT-only service scope, root-only execution/preflight, DRAFT-only JIT, no ref write, no JIT merge, update-branch, exact pins, main revalidation, strict native/review gates, exact head merge, post-merge readback, deploy gate and global NO_GO.\n\n`R2_ALLOW_DEPLOY` remains false/absent. `production_go=false`.\n","createdAt",["D",1787986936544],"branchVersion","branchId","dfa215e8-66c9-4a6e-ab36-8d1fbc319426","id","dc841a2e-8ac0-491d-b8e5-ee9e11dc6e2a","rumbo-r2-deployer",["D",1787974891297],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Fail-closed RUMBO R2 deployer controller","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","862fe8ba-a35b-11f1-8a2b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","dc841a2e8ac0491db8e5ee9e11dc6e2a","tursoHostname","dc841a2e8ac0491db8e5ee9e11dc6e2a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789539031988],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":52,"_103":104,"_105":24},"branch",{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":91,"_92":47,"_93":41,"_94":62,"_95":42,"_96":97},"isOwned","v3-6-broker-autopilot","projectId","forkedBranchId","05a3146a-0d13-441a-b505-9ff526f70e96","forkedBranchVersion",17,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":277,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":278,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":279,"_81":280,"_83":281,"_85":24},"tree",[232,233,234,235,236,237,238,239,240,241,242],"files",[232,233,234,235,236,237,238,239,240,241,242],"counts",{"_220":60,"_221":222,"_223":60,"_224":225,"_226":227},"contents",[137,138,139,140,141,142,143,144,145,146,147],"upstreamProject","upstreamBranch",{"_40":89,"_35":130,"_131":132,"_31":133,"_87":41,"_13":134,"_88":-5,"_90":-5,"_135":136,"_44":-5,"_85":24,"_46":47,"_96":97,"_61":62,"_95":42},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787974891297],"updatedAt",["D",1787988946009],"main",20,"lockfileKey","1787988946607-esm.town_v_sebas1_rumbo-r2-deployer@20-main",{"_40":214,"_31":215,"_29":216,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":217,"_13":60,"_32":20,"_33":218,"_23":24,"_158":-5,"_26":219},{"_40":208,"_31":209,"_29":210,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":211,"_13":60,"_32":20,"_33":212,"_23":24,"_158":-5,"_26":213},{"_40":202,"_31":203,"_29":204,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":205,"_13":60,"_32":20,"_33":206,"_23":24,"_158":-5,"_26":207},{"_40":196,"_31":197,"_29":198,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":199,"_13":60,"_32":20,"_33":200,"_23":24,"_158":-5,"_26":201},{"_40":190,"_31":191,"_29":192,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":193,"_13":60,"_32":20,"_33":194,"_23":24,"_158":-5,"_26":195},{"_40":184,"_31":185,"_29":186,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":187,"_13":60,"_32":20,"_33":188,"_23":24,"_158":-5,"_26":189},{"_40":178,"_31":179,"_29":180,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":181,"_13":60,"_32":20,"_33":182,"_23":24,"_158":-5,"_26":183},{"_40":172,"_31":173,"_29":174,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":175,"_13":60,"_32":20,"_33":176,"_23":24,"_158":-5,"_26":177},{"_40":169,"_31":27,"_29":30,"_151":-5,"_38":39,"_37":14,"_153":56,"_35":170,"_13":60,"_32":20,"_33":34,"_23":24,"_158":-5,"_26":171},{"_40":160,"_31":161,"_29":162,"_151":-5,"_38":39,"_37":163,"_153":56,"_35":164,"_13":165,"_32":166,"_33":167,"_23":24,"_158":-5,"_26":168},{"_40":148,"_31":149,"_29":150,"_151":-5,"_38":39,"_37":152,"_153":56,"_35":154,"_13":155,"_32":156,"_33":157,"_23":24,"_158":-5,"_26":159},"4b120520-abd8-40a9-b754-cd89ad3f6237","selftest.ts","01a04c47-4934-7165-a0c3-cdefa449758f","parentId",12,"latest",["D",1787986865359],1,"script","const base=\"https://sebas1--01a04c4749347165a0c3c83a8ed514e2.web.val.run\";\nconst root=Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\");\nif(!root)throw new Error(\"ROOT_TOKEN_MISSING\");\nconst headers={Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\nconst fixture={\n \"schema\": \"rumbo-r2-dedicated-authorizer-consumption/v3.5\",\n \"authorizer_implementation\": \"DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED\",\n \"authorization_id\": \"c9c1458d-50fd-4b02-9ad1-9b125b6267eb\",\n \"action\": \"TEST_ONLY\",\n \"repository_identity_sha256\": \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\",\n \"pr_number\": 999,\n \"base_sha\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n \"head_sha\": \"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\",\n \"package_sha256\": \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\",\n \"evidence_sha256\": \"5b4773c2d06d6b983a590fb91dc793f80d975bdd24e8828b35e901124f779c95\",\n \"observer_receipt_sha256\": null,\n \"request_sha256\": \"d7c004e046392bcc9a5ed49fce969c28a7ff65cfeb99b60a09a8b7b61c9361b2\",\n \"consumed_at\": \"2026-08-29T07:00:47.377Z\",\n \"consumer\": \"deployer-v3-6-fixture\",\n \"merge_authorized\": false,\n \"production_go\": false,\n \"consumed\": true,\n \"receipt_sha256\": \"8db0997c3ddf5acf8c79c5c8aadf0595a271bc64d3a030eaff234965881839a6\",\n \"receipt_signature\": {\n \"alg\": \"ES256\",\n \"kid\": \"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\",\n \"signature_b64url\": \"Md8suGX2mUNmzw65C_dlT3SJSGHSw1ntlUFrRDl6iINmOVEOIsDmEvYIU37h8b0lrAl-cVhXBGBoFcuORm9bSg\"\n }\n};\n\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nfunction canonicalReceipt(v:any){\n return {\n schema:v.schema,\n authorizer_implementation:v.authorizer_implementation,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nasync function localVerify(v:any,jwk:JsonWebKey):Promise{\n const canon=canonical(canonicalReceipt(v));\n if(await sha256(canon)!==v.receipt_sha256)return false;\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n return await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},key,b64urlDecode(v.receipt_signature.signature_b64url),new TextEncoder().encode(canon)\n );\n}\n\nconst healthRes=await fetch(base+\"/health\");\nconst health:any=await healthRes.json();\nconst localValid=healthRes.status===200?await localVerify(fixture,health.authorizer?.verify_jwk):false;\nconst localTamper=healthRes.status===200?await localVerify({...fixture,authorizer_implementation:\"OLD_IMPLEMENTATION\"},health.authorizer?.verify_jwk):true;\n\nconst unauthJit=await fetch(base+\"/v3/jit/prepare-activation\",{method:\"POST\"});\nconst jitRes=await fetch(base+\"/v3/jit/prepare-activation\",{method:\"POST\",headers,body:\"{}\"});\nconst jitBody:any=await jitRes.json();\n\nconst unauthLedger=await fetch(base+\"/v3/ledger\");\nconst retiredV2=await fetch(base+\"/v2/prepare\",{method:\"POST\",headers,body:\"{}\"});\nconst retiredV1=await fetch(base+\"/v1/prepare\",{method:\"POST\",headers,body:\"{}\"});\n\nconst downgraded={...fixture,authorizer_implementation:\"DEDICATED_R2_AUTHORIZER_V3_3_BROKER_CHAIN_PINNED\"};\nconst downgradeRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:downgraded})});\nconst tampered={...fixture,evidence_sha256:\"f\".repeat(64)};\nconst tamperedRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:tampered})});\nconst forgedMerge={...fixture,action:\"MERGE_PR\",merge_authorized:true,observer_receipt_sha256:\"a\".repeat(64),evidence_sha256:\"a\".repeat(64)};\nconst forgedMergeRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:forgedMerge})});\n\nconst prepareRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:fixture})});\nconst prepared:any=await prepareRes.json();\nif(prepareRes.status!==201&&prepareRes.status!==409)throw new Error(`PREPARE_${prepareRes.status}_${prepared.error||\"UNKNOWN\"}`);\nif(prepareRes.status===409&&prepared.status!==\"PREPARED\")throw new Error(\"EXISTING_PLAN_NOT_PREPARED\");\nconst planId=String(prepared.plan_id||\"\");\nif(!planId)throw new Error(\"PLAN_ID_MISSING\");\n\nconst preflightRes=await fetch(base+\"/v3/preflight\",{method:\"POST\",headers,body:JSON.stringify({plan_id:planId})});\nconst preflight:any=await preflightRes.json();\nconst executeRes=await fetch(base+\"/v3/execute\",{method:\"POST\",headers,body:JSON.stringify({plan_id:planId})});\nconst execute:any=await executeRes.json();\nconst duplicateRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:fixture})});\n\nconst ledgerRes=await fetch(base+\"/v3/ledger\",{headers});\nconst ledger:any=await ledgerRes.json();\nconst plan=Array.isArray(ledger.records)?ledger.records.find((x:any)=>String(x.plan_id)===planId):null;\nconst secretLeak=Array.isArray(ledger.records)&&ledger.records.some((x:any)=>Object.prototype.hasOwnProperty.call(x,\"authorizer_signature_b64url\"));\nconst auditRes=await fetch(base+\"/v3/audit\",{headers});\nconst audit:any=await auditRes.json();\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"R2_DEPLOYER_CONTROLLER_V3_6_BROKER_AUTOPILOT\"&&\n health.jit_activation_policy?.endpoint===\"POST /v3/jit/prepare-activation\"&&\n health.jit_activation_policy?.dormant_branch===\"audit/continuity-r2-r4-reconciled-20260828\"&&\n health.jit_activation_policy?.create_draft_only===true&&\n health.jit_activation_policy?.update_branch_via_pull_requests_write===true&&\n health.jit_activation_policy?.direct_ref_write_forbidden===true&&\n health.jit_activation_policy?.main_revalidation_required===true&&\n health.jit_activation_policy?.observer_required_after_preparation===true&&\n health.jit_activation_policy?.merge_authorized===false&&\n health.jit_activation_policy?.deploy_enabled===false&&\n health.root_token_configured===true&&\n health.broker_autopilot_token_hash_configured===true&&\n health.broker_autopilot_plaintext_token_persisted_here===false&&\n health.broker_autopilot_scope===\"JIT_PREPARE_ONLY\"&&\n health.deploy_enabled===false&&\n health.direct_github_token_path_retired===true&&\n health.github_broker?.expected_implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\"&&\n health.github_broker?.observed_implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\"&&\n health.github_broker?.role===\"deployer\"&&\n health.github_broker?.role_token_configured===true&&\n health.github_broker?.health_status===200&&\n health.github_broker?.broker_ready===false&&\n health.provider_credential_ready===false&&\n health.provider_adapter===\"GITHUB_REST_2026_03_10_IMPLEMENTED\"&&\n health.production_go===false&&\n health.authorizer?.implementation===\"DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED\"&&\n health.authorizer?.receipt_schema===\"rumbo-r2-dedicated-authorizer-consumption/v3.5\"&&\n health.authorizer?.observer_receipt_required_for_merge===true&&\n health.execution_policy?.native_enforcement_required===true&&\n health.execution_policy?.minimum_native_approving_reviews===1&&\n health.execution_policy?.actual_review_approval_fulfillment_required===true&&\n health.execution_policy?.pr_author_approval_not_counted===true&&\n health.execution_policy?.current_main_must_equal_bound_base===true&&\n health.execution_policy?.exact_head_sha_merge===true&&\n health.execution_policy?.post_merge_main_readback_required===true&&\n localValid===true&&\n localTamper===false&&\n unauthJit.status===401&&\n jitRes.status===424&&\n jitBody.error===\"GITHUB_BROKER_NOT_READY\"&&\n jitBody.reason===\"CUSTODY_NOT_READY\"&&\n jitBody.jit_activation_prepared===false&&\n jitBody.merge_authorized===false&&\n jitBody.deploy_enabled===false&&\n jitBody.production_go===false&&\n unauthLedger.status===401&&\n retiredV2.status===410&&\n retiredV1.status===410&&\n downgradeRes.status===400&&\n tamperedRes.status===400&&\n forgedMergeRes.status===400&&\n (prepareRes.status===201||prepareRes.status===409)&&\n preflightRes.status===424&&preflight.error===\"GITHUB_BROKER_NOT_READY\"&&preflight.reason===\"CUSTODY_NOT_READY\"&&\n executeRes.status===403&&execute.error===\"AUTHORIZER_ACTION_NOT_MERGE_PR\"&&\n duplicateRes.status===409&&\n ledgerRes.status===200&&\n ledger.schema===\"rumbo-r2-deployer-ledger/v3.6\"&&\n ledger.direct_github_token_path_retired===true&&\n ledger.broker_role_token_configured===true&&\n ledger.broker_ready===false&&\n ledger.production_go===false&&\n plan?.authorizer_action===\"TEST_ONLY\"&&plan?.observer_receipt_sha256===null&&\n secretLeak===false&&\n auditRes.status===200&&audit.audit_chain_ok===true&&audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n direct_github_token_path_retired:health.direct_github_token_path_retired,\n broker_expected_implementation:health.github_broker?.expected_implementation,\n broker_observed_implementation:health.github_broker?.observed_implementation,\n broker_role_token_configured:health.github_broker?.role_token_configured,\n broker_ready:health.github_broker?.broker_ready,\n local_authorizer_v35_fixture_verified:localValid,\n implementation_tamper_verified:localTamper,\n unauthenticated_jit_prepare:unauthJit.status,\n jit_prepare_without_broker_custody:jitRes.status,\n jit_prepare_block_reason:jitBody.reason,\n unauthenticated_ledger:unauthLedger.status,\n v2_retired:retiredV2.status,\n v1_retired:retiredV1.status,\n downgraded_authorizer_receipt_prepare:downgradeRes.status,\n tampered_receipt_prepare:tamperedRes.status,\n forged_merge_prepare:forgedMergeRes.status,\n prepare:prepareRes.status,\n provider_preflight_without_broker_custody:preflightRes.status,\n execute_test_only:executeRes.status,\n duplicate_prepare:duplicateRes.status,\n ledger:ledgerRes.status,\n signature_bytes_leaked_in_ledger:secretLeak,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n plan_id:planId,\n authorizer_receipt_sha256:fixture.receipt_sha256,\n provider_adapter:health.provider_adapter,\n review_fulfillment_required:true,\n deploy_enabled:false,\n production_go:false\n},null,2));\nif(!pass)Deno.exit(1);\n","label",[149],"7928f961-7932-4bf5-b451-0c5277293f3c","main.tsx","01a04c47-4934-7165-a0c3-c83a8ed514e2",11,["D",1787986829029],10,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app=new Hono();\n\nconst IMPLEMENTATION=\"R2_DEPLOYER_CONTROLLER_V3_6_BROKER_AUTOPILOT\";\nconst GITHUB_BROKER_BASE=\"https://sebas1--cec0f0e4a36311f1a6461607ee4eb77e.web.val.run\";\nconst GITHUB_BROKER_IMPLEMENTATION=\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\";\nconst REPO_OWNER=\"fscfede-beep\";\nconst REPO_NAME=\"rumbo-control-queue\";\nconst REPO_FULL=`${REPO_OWNER}/${REPO_NAME}`;\nconst REPOSITORY_ID=1314199389;\nconst OWNER_ID=293577326;\nconst DEFAULT_BRANCH=\"main\";\nconst REPO_IDENTITY_SHA256=\"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst PACKAGE_SHA256=\"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst DORMANT_R2_BRANCH=\"audit/continuity-r2-r4-reconciled-20260828\";\nconst R2_STATIC_PINS:Record={\n \".github/workflows/continuity-r2-observe.yml\":\"3d5dd465aad367cde5eabfff2ba7033865ceef8b\",\n \"tools/continuity-r2/EXPECTED_PACKAGE.json\":\"1260b3516219341c63107dca1cc1b21a1ecb9ba0\",\n \"tools/continuity-r2/snapshot_guard.py\":\"752f12df05d0b6b1bc122cbe61a3145458fdd074\"\n};\nconst R2_REQUIRED_DYNAMIC_FILES=[\n \"tools/continuity-r2/LIVE_STATE.json\",\n \"tools/continuity-r2/README.md\"\n];\nconst AUTHORIZER_IMPLEMENTATION=\"DEDICATED_R2_AUTHORIZER_V3_5_OBSERVER_V1_5_PINNED\";\nconst AUTHORIZER_SIGNING_KID=\"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\";\nconst AUTHORIZER_VERIFY_JWK:JsonWebKey={\n kty:\"EC\",crv:\"P-256\",\n x:\"TV0M-YRfRzqMB6dTZIhLOu7w21Tkgul-lUns7HwpHy4\",\n y:\"mRWAIOykqSBgsAXqC9t3OOmk3KLljPH935lilXma-W4\",\n key_ops:[\"verify\"],ext:true\n};\nconst API_VERSION=\"2026-03-10\";\nconst MAX_BODY=64*1024;\nconst MAX_EXEC_RECEIPT_AGE_SECONDS=900;\nconst MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS=300;\nconst SHA256_RE=/^[a-f0-9]{64}$/;\nconst GIT_SHA_RE=/^[a-f0-9]{40}$/;\nconst B64URL_RE=/^[A-Za-z0-9_-]{80,128}$/;\n\ntype AuthorizerAction=\"TEST_ONLY\"|\"MERGE_PR\";\ntype VerifiedReceipt={\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.5\";\n authorizer_implementation:string;\n authorization_id:string;\n action:AuthorizerAction;\n repository_identity_sha256:string;\n pr_number:number;\n base_sha:string;\n head_sha:string;\n package_sha256:string;\n evidence_sha256:string;\n observer_receipt_sha256:string|null;\n request_sha256:string;\n consumed_at:string;\n consumer:string;\n merge_authorized:boolean;\n production_go:false;\n consumed:true;\n receipt_sha256:string;\n receipt_signature:{alg:\"ES256\";kid:string;signature_b64url:string};\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS deploy_plans_v3(\n plan_id TEXT PRIMARY KEY,\n authorizer_action TEXT NOT NULL CHECK(authorizer_action IN ('TEST_ONLY','MERGE_PR')),\n authorizer_authorization_id TEXT NOT NULL UNIQUE,\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n observer_receipt_sha256 TEXT,\n authorizer_request_sha256 TEXT NOT NULL,\n authorizer_receipt_sha256 TEXT NOT NULL UNIQUE,\n authorizer_signature_kid TEXT NOT NULL,\n authorizer_consumed_at TEXT NOT NULL,\n authorizer_merge_authorized INTEGER NOT NULL CHECK(authorizer_merge_authorized IN (0,1)),\n request_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('PREPARED','CANCELLED','EXECUTED')),\n created_at TEXT NOT NULL,\n executed_at TEXT,\n provider_merge_sha TEXT,\n provider_main_readback_sha TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_deploy_plans_v3_status ON deploy_plans_v3(status,created_at)`,\n `CREATE TABLE IF NOT EXISTS deploy_audit_v3(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n plan_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v3_prev ON deploy_audit_v3(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v3_event_plan\n ON deploy_audit_v3(event_type,plan_id)\n WHERE plan_id IS NOT NULL`\n]);\n\nfunction bearer(req:Request):string{\n const h=req.headers.get(\"authorization\")||\"\";\n return h.startsWith(\"Bearer \")?h.slice(7):\"\";\n}\nfunction ct(a:string,b:string):boolean{\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0;for(let i=0;i{\n const expectedHash=Deno.env.get(\"R2_BROKER_JIT_AUTOPILOT_TOKEN_SHA256\")||\"\";\n const observed=bearer(req);\n if(!expectedHash||!observed)return false;\n const observedHash=await sha256(observed);\n return ct(expectedHash,observedHash);\n}\nasync function jitAuthorized(req:Request):Promise<\"ROOT\"|\"BROKER_AUTOPILOT\"|null>{\n if(authorized(req))return \"ROOT\";\n if(await brokerAutopilotAuthorized(req))return \"BROKER_AUTOPILOT\";\n return null;\n}\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nasync function bodyJson(c:any):Promise{\n const len=Number(c.req.header(\"content-length\")||\"0\");\n if(Number.isFinite(len)&&len>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt=await c.req.text();\n if(new TextEncoder().encode(txt).length>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt||\"{}\");\n}\nfunction canonicalReceipt(v:any){\n return {\n schema:v.schema,\n authorizer_implementation:v.authorizer_implementation,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nfunction structuralReceiptCheck(v:any):v is VerifiedReceipt{\n if(!v||typeof v!==\"object\")return false;\n if(v.schema!==\"rumbo-r2-dedicated-authorizer-consumption/v3.5\")return false;\n if(v.authorizer_implementation!==AUTHORIZER_IMPLEMENTATION)return false;\n if(typeof v.authorization_id!==\"string\"||v.authorization_id.length<16||v.authorization_id.length>128)return false;\n if(v.action!==\"TEST_ONLY\"&&v.action!==\"MERGE_PR\")return false;\n if(v.repository_identity_sha256!==REPO_IDENTITY_SHA256)return false;\n if(!Number.isSafeInteger(v.pr_number)||v.pr_number<=0)return false;\n if(!GIT_SHA_RE.test(String(v.base_sha||\"\"))||!GIT_SHA_RE.test(String(v.head_sha||\"\")))return false;\n if(v.package_sha256!==PACKAGE_SHA256)return false;\n if(!SHA256_RE.test(String(v.evidence_sha256||\"\"))||!SHA256_RE.test(String(v.request_sha256||\"\")))return false;\n if(v.observer_receipt_sha256!==null&&!SHA256_RE.test(String(v.observer_receipt_sha256||\"\")))return false;\n if(!Number.isFinite(Date.parse(String(v.consumed_at||\"\"))))return false;\n if(typeof v.consumer!==\"string\"||!/^[A-Za-z0-9_.:-]{1,128}$/.test(v.consumer))return false;\n if(v.consumed!==true||v.production_go!==false)return false;\n if(typeof v.merge_authorized!==\"boolean\"||v.merge_authorized!==(v.action===\"MERGE_PR\"))return false;\n if(v.action===\"MERGE_PR\"&&(!v.observer_receipt_sha256||v.evidence_sha256!==v.observer_receipt_sha256))return false;\n if(v.action===\"TEST_ONLY\"&&v.observer_receipt_sha256!==null)return false;\n if(!SHA256_RE.test(String(v.receipt_sha256||\"\")))return false;\n if(v.receipt_signature?.alg!==\"ES256\"||v.receipt_signature?.kid!==AUTHORIZER_SIGNING_KID)return false;\n if(!B64URL_RE.test(String(v.receipt_signature?.signature_b64url||\"\")))return false;\n return true;\n}\nasync function verifyAuthorizerReceipt(v:any):Promise<{ok:true;receipt:VerifiedReceipt}|{ok:false;error:string}>{\n if(!structuralReceiptCheck(v))return {ok:false,error:\"INVALID_AUTHORIZER_V3_RECEIPT_STRUCTURE\"};\n const canon=canonical(canonicalReceipt(v));\n const computed=await sha256(canon);\n if(!ct(computed,String(v.receipt_sha256)))return {ok:false,error:\"AUTHORIZER_RECEIPT_HASH_MISMATCH\"};\n let key:CryptoKey;\n try{key=await crypto.subtle.importKey(\"jwk\",AUTHORIZER_VERIFY_JWK,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);}\n catch{return {ok:false,error:\"AUTHORIZER_VERIFY_KEY_IMPORT_FAILED\"};}\n let sig:Uint8Array;\n try{sig=b64urlDecode(String(v.receipt_signature.signature_b64url));}\n catch{return {ok:false,error:\"AUTHORIZER_SIGNATURE_ENCODING_INVALID\"};}\n const valid=await crypto.subtle.verify({name:\"ECDSA\",hash:\"SHA-256\"},key,sig,new TextEncoder().encode(canon));\n if(!valid)return {ok:false,error:\"AUTHORIZER_RECEIPT_SIGNATURE_INVALID\"};\n return {ok:true,receipt:v};\n}\nlet brokerTokenCache:{token:string;expires_at_ms:number}|null=null;\n\nasync function brokerHealth(){\n try{\n const res=await fetch(GITHUB_BROKER_BASE+\"/health\",{headers:{\"User-Agent\":\"rumbo-r2-deployer/3.2\"}});\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n }catch(e){\n return {status:0,json:null,text:String(e)};\n }\n}\n\nasync function getGithubToken():Promise<{ok:true;token:string;expires_at:string}|{ok:false;error:string}>{\n if(brokerTokenCache&&brokerTokenCache.expires_at_ms>Date.now()+60_000){\n return {ok:true,token:brokerTokenCache.token,expires_at:new Date(brokerTokenCache.expires_at_ms).toISOString()};\n }\n const roleToken=Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\")||\"\";\n if(!roleToken)return {ok:false,error:\"GITHUB_BROKER_ROLE_TOKEN_NOT_CONFIGURED\"};\n let res:Response;\n try{\n res=await fetch(GITHUB_BROKER_BASE+\"/v1/token/deployer\",{\n method:\"POST\",\n headers:{Authorization:`Bearer ${roleToken}`,\"User-Agent\":\"rumbo-r2-deployer/3.2\"}\n });\n }catch{\n return {ok:false,error:\"GITHUB_BROKER_UNREACHABLE\"};\n }\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n if(res.status!==200||!json){\n return {ok:false,error:String(json?.error||`GITHUB_BROKER_HTTP_${res.status}`)};\n }\n const expiresAt=Date.parse(String(json.expires_at||\"\"));\n const perms=json.permissions||{};\n const valid=\n typeof json.token===\"string\"&&json.token.length>20&&\n Number(json.repository_id)===REPOSITORY_ID&&\n json.broker_implementation===GITHUB_BROKER_IMPLEMENTATION&&\n json.role===\"deployer\"&&\n perms.contents===\"read\"&&\n perms.pull_requests===\"write\"&&\n perms.administration===\"read\"&&\n json.production_go===false&&\n Number.isFinite(expiresAt)&&expiresAt>Date.now()+60_000;\n if(!valid)return {ok:false,error:\"GITHUB_BROKER_TOKEN_CONTRACT_INVALID\"};\n brokerTokenCache={token:String(json.token),expires_at_ms:expiresAt};\n return {ok:true,token:String(json.token),expires_at:String(json.expires_at)};\n}\n\nasync function github(path:string,method=\"GET\",body?:unknown){\n const tokenResult=await getGithubToken();\n if(!tokenResult.ok)return {status:0,json:null,text:tokenResult.error};\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${tokenResult.token}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-deployer/3.2\",\n \"Content-Type\":\"application/json\"\n },\n body:body===undefined?undefined:JSON.stringify(body)\n });\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n}\n\nasync function verifyJitBootstrapFiles(){\n const evidence:any={static:{},dynamic:{}};\n for(const [path,expectedSha] of Object.entries(R2_STATIC_PINS)){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/contents/${path}?ref=${encodeURIComponent(DORMANT_R2_BRANCH)}`);\n const actual=String(r.json?.sha||\"\");\n evidence.static[path]={status:r.status,expected_git_blob_sha:expectedSha,actual_git_blob_sha:actual,match:r.status===200&&actual===expectedSha};\n if(r.status!==200||actual!==expectedSha)return {ok:false,error:\"R2_STATIC_PIN_MISMATCH\",evidence};\n }\n for(const path of R2_REQUIRED_DYNAMIC_FILES){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/contents/${path}?ref=${encodeURIComponent(DORMANT_R2_BRANCH)}`);\n const actual=String(r.json?.sha||\"\");\n evidence.dynamic[path]={status:r.status,git_blob_sha:actual,present:r.status===200&&/^[a-f0-9]{40}$/.test(actual)};\n if(r.status!==200||!/^[a-f0-9]{40}$/.test(actual))return {ok:false,error:\"R2_DYNAMIC_FILE_MISSING\",evidence};\n }\n return {ok:true,evidence};\n}\n\nasync function currentMainSha(){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n const sha=String(r.json?.object?.sha||\"\");\n if(r.status!==200||!GIT_SHA_RE.test(sha))return {ok:false,error:\"CURRENT_MAIN_UNREADABLE\",status:r.status,sha:null};\n return {ok:true,sha,status:r.status};\n}\n\nasync function readDormantBranch(){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/branches/${encodeURIComponent(DORMANT_R2_BRANCH)}`);\n const sha=String(r.json?.commit?.sha||\"\");\n if(r.status!==200||!GIT_SHA_RE.test(sha))return {ok:false,error:\"DORMANT_R2_BRANCH_UNREADABLE\",status:r.status,sha:null};\n return {ok:true,sha,status:r.status};\n}\n\nasync function compareMainToHead(mainSha:string,headSha:string){\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/compare/${mainSha}...${headSha}`);\n if(r.status!==200||!r.json)return {ok:false,error:\"JIT_COMPARE_UNREADABLE\",status:r.status};\n return {\n ok:true,\n status:String(r.json.status||\"\"),\n ahead_by:Number(r.json.ahead_by||0),\n behind_by:Number(r.json.behind_by||0),\n merge_base_sha:String(r.json.merge_base_commit?.sha||\"\")\n };\n}\n\nasync function openDormantActivationPr(){\n const q=`/repos/${REPO_OWNER}/${REPO_NAME}/pulls?state=open&base=${encodeURIComponent(DEFAULT_BRANCH)}&head=${encodeURIComponent(REPO_OWNER+\":\"+DORMANT_R2_BRANCH)}&per_page=20`;\n const list=await github(q);\n if(list.status!==200||!Array.isArray(list.json))return {ok:false,error:\"JIT_PR_LIST_UNREADABLE\",status:list.status};\n\n if(list.json.length>1)return {ok:false,error:\"AMBIGUOUS_MULTIPLE_JIT_PRS\",count:list.json.length};\n if(list.json.length===1){\n const pr=list.json[0];\n if(pr?.draft!==true)return {ok:false,error:\"EXISTING_JIT_PR_NOT_DRAFT\",pr_number:Number(pr?.number||0)};\n return {ok:true,created:false,pr};\n }\n\n const body=[\n \"RUMBO R2 JIT activation candidate.\",\n \"\",\n \"This PR is prepared only after the dedicated external observer substrate is available.\",\n \"It carries the sealed R2 bootstrap candidate and remains DRAFT.\",\n \"\",\n \"This PR does NOT imply MERGE_PR authorization, deployment, PRODUCT_GO or PRODUCTION_GO.\",\n \"Native private-repository enforcement, signed external observation, independent review and all downstream gates remain required.\"\n ].join(\"\\n\");\n const created=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls`,\"POST\",{\n title:\"continuity: JIT R2 observer activation candidate\",\n head:DORMANT_R2_BRANCH,\n base:DEFAULT_BRANCH,\n body,\n draft:true,\n maintainer_can_modify:false\n });\n if(created.status!==201||!created.json?.number)return {ok:false,error:\"JIT_PR_CREATE_FAILED\",status:created.status,message:created.json?.message||null};\n if(created.json?.draft!==true)return {ok:false,error:\"JIT_PR_CREATED_NOT_DRAFT\",pr_number:Number(created.json.number)};\n return {ok:true,created:true,pr:created.json};\n}\n\nasync function refreshJitPrAgainstMain(prNumber:number,expectedHeadSha:string,mainSha:string){\n let cmp=await compareMainToHead(mainSha,expectedHeadSha);\n if(!cmp.ok)return cmp;\n\n if(cmp.behind_by===0&&cmp.merge_base_sha===mainSha){\n return {ok:true,updated:false,head_sha:expectedHeadSha,compare:cmp};\n }\n\n const upd=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${prNumber}/update-branch`,\"PUT\",{\n expected_head_sha:expectedHeadSha\n });\n if(upd.status!==202){\n return {ok:false,error:\"JIT_UPDATE_BRANCH_FAILED\",status:upd.status,message:upd.json?.message||null,compare_before:cmp};\n }\n\n let last:any=null;\n for(let i=0;i<8;i++){\n await new Promise(r=>setTimeout(r,500));\n const pr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${prNumber}`);\n if(pr.status!==200||!pr.json){last={status:pr.status};continue;}\n const headSha=String(pr.json?.head?.sha||\"\");\n if(!GIT_SHA_RE.test(headSha)){last={status:pr.status,head_sha:headSha};continue;}\n const post=await compareMainToHead(mainSha,headSha);\n last={status:pr.status,head_sha:headSha,compare:post};\n if(post.ok&&post.behind_by===0&&post.merge_base_sha===mainSha){\n return {ok:true,updated:true,head_sha:headSha,compare:post};\n }\n }\n return {ok:false,error:\"JIT_UPDATE_BRANCH_NOT_CONVERGED\",last};\n}\n\nasync function nativeEnforcement(){\n const protection=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/branches/${DEFAULT_BRANCH}/protection`);\n let classic=false;\n let classicRequiredApprovals=0;\n if(protection.status===200&&protection.json){\n const j=protection.json;\n classicRequiredApprovals=Number(j.required_pull_request_reviews?.required_approving_review_count||0);\n classic=classicRequiredApprovals>=1 &&\n j.allow_force_pushes?.enabled===false &&\n j.allow_deletions?.enabled===false;\n }\n\n const list=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets`);\n let ruleset=false;\n let rulesetRequiredApprovals=0;\n const rulesets:any[]=[];\n if(list.status===200&&Array.isArray(list.json)){\n for(const item of list.json){\n if(item?.enforcement!==\"active\"||item?.target!==\"branch\"||!item?.id)continue;\n const detail=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets/${item.id}`);\n if(detail.status!==200||!detail.json)continue;\n const rules=detail.json.rules||[];\n const types=new Set(rules.map((r:any)=>String(r.type)));\n const include=(detail.json.conditions?.ref_name?.include||[]).map(String);\n const targetsMain=include.includes(\"~DEFAULT_BRANCH\")||include.includes(\"refs/heads/main\")||include.includes(\"main\");\n const pullRule=rules.find((r:any)=>String(r.type)===\"pull_request\");\n const required=Number(pullRule?.parameters?.required_approving_review_count||0);\n const protects=targetsMain &&\n types.has(\"pull_request\") &&\n types.has(\"non_fast_forward\") &&\n types.has(\"deletion\") &&\n required>=1;\n rulesets.push({id:item.id,targets_main:targetsMain,required_approvals:required,types:[...types],protects});\n if(protects){\n ruleset=true;\n rulesetRequiredApprovals=Math.max(rulesetRequiredApprovals,required);\n }\n }\n }\n\n const requiredApprovals=Math.max(classic?classicRequiredApprovals:0,ruleset?rulesetRequiredApprovals:0);\n return {\n proven:classic||ruleset,\n classic,\n ruleset,\n required_approvals:requiredApprovals,\n classic_required_approvals:classicRequiredApprovals,\n ruleset_required_approvals:rulesetRequiredApprovals,\n protection_status:protection.status,\n rulesets_status:list.status,\n inspected_rulesets:rulesets\n };\n}\nasync function providerPreflight(row:any){\n const checks:any[]=[];\n const add=(name:string,ok:boolean,detail:any)=>checks.push({name,status:ok?\"PASS\":\"FAIL\",detail});\n\n const repo=await github(`/repos/${REPO_OWNER}/${REPO_NAME}`);\n add(\"repo_api\",repo.status===200,repo.status);\n add(\"repo_id\",Number(repo.json?.id)===REPOSITORY_ID,repo.json?.id);\n add(\"owner_id\",Number(repo.json?.owner?.id)===OWNER_ID,repo.json?.owner?.id);\n add(\"private_repo\",repo.json?.private===true,repo.json?.private);\n add(\"default_branch\",repo.json?.default_branch===DEFAULT_BRANCH,repo.json?.default_branch);\n\n const pr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}`);\n add(\"pr_api\",pr.status===200,pr.status);\n add(\"pr_open\",pr.json?.state===\"open\",pr.json?.state);\n add(\"pr_ready\",pr.json?.draft===false,pr.json?.draft);\n add(\"base_main\",pr.json?.base?.ref===DEFAULT_BRANCH,pr.json?.base?.ref);\n add(\"base_sha_exact\",pr.json?.base?.sha===row.base_sha,pr.json?.base?.sha);\n add(\"head_sha_exact\",pr.json?.head?.sha===row.head_sha,pr.json?.head?.sha);\n\n const cmp=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/compare/${row.base_sha}...${row.head_sha}`);\n add(\"compare_api\",cmp.status===200,cmp.status);\n add(\"head_descends_from_base\",cmp.json?.behind_by===0&&Number(cmp.json?.ahead_by)>=1,{ahead_by:cmp.json?.ahead_by,behind_by:cmp.json?.behind_by});\n\n const main=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n add(\"main_ref_api\",main.status===200,main.status);\n add(\"current_main_equals_bound_base\",main.json?.object?.sha===row.base_sha,main.json?.object?.sha);\n\n const native=await nativeEnforcement();\n add(\"native_enforcement\",native.proven,native);\n\n const reviews=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}/reviews?per_page=100`);\n add(\"reviews_api\",reviews.status===200,reviews.status);\n const latestByReviewer=new Map();\n if(reviews.status===200&&Array.isArray(reviews.json)){\n for(const review of reviews.json){\n const login=String(review?.user?.login||\"\");\n if(!login)continue;\n const prior=latestByReviewer.get(login);\n const currentTime=Date.parse(String(review?.submitted_at||\"\"))||Number(review?.id||0);\n const priorTime=prior?(Date.parse(String(prior?.submitted_at||\"\"))||Number(prior?.id||0)):-1;\n if(currentTime>=priorTime)latestByReviewer.set(login,review);\n }\n }\n const authorLogin=String(pr.json?.user?.login||\"\");\n const approved=[...latestByReviewer.entries()]\n .filter(([login,review])=>login!==authorLogin&&String(review?.state||\"\").toUpperCase()===\"APPROVED\")\n .map(([login])=>login);\n const requiredApprovals=Number(native.required_approvals||0);\n add(\"required_review_approvals\",\n native.proven&&requiredApprovals>=1&&approved.length>=requiredApprovals,\n {required:requiredApprovals,approved_count:approved.length,approved_reviewers:approved,author:authorLogin}\n );\n\n return {\n ok:checks.every(x=>x.status===\"PASS\"),\n checks,\n native,\n required_approvals:requiredApprovals,\n approved_reviewers:approved,\n current_main_sha:main.json?.object?.sha||null\n };\n}\nasync function audit(event_type:string,plan_id:string|null,object_sha256:string|null){\n if(plan_id){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM deploy_audit_v3 WHERE event_type=? AND plan_id=? LIMIT 1\",args:[event_type,plan_id]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n for(let i=0;i<8;i++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM deploy_audit_v3 ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,plan_id,object_sha256,prev_event_sha256:prev,created_at};\n const h=await sha256(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO deploy_audit_v3(event_type,plan_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,plan_id,object_sha256,prev,h,created_at]});\n return h;\n }catch(e){if(!String(e).includes(\"UNIQUE\"))throw e;}\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-deployer\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\napp.get(\"/health\",async c=>{\n const broker=await brokerHealth();\n const brokerReady=broker.status===200&&broker.json?.implementation===GITHUB_BROKER_IMPLEMENTATION&&broker.json?.broker_ready===true;\n const roleTokenConfigured=!!Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\");\n return c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\"),\n broker_autopilot_token_hash_configured:!!Deno.env.get(\"R2_BROKER_JIT_AUTOPILOT_TOKEN_SHA256\"),\n broker_autopilot_plaintext_token_persisted_here:false,\n broker_autopilot_scope:\"JIT_PREPARE_ONLY\",\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n direct_github_token_path_retired:true,\n github_broker:{\n base:GITHUB_BROKER_BASE,\n expected_implementation:GITHUB_BROKER_IMPLEMENTATION,\n observed_implementation:broker.json?.implementation||null,\n role:\"deployer\",\n role_token_configured:roleTokenConfigured,\n health_status:broker.status,\n broker_ready:brokerReady\n },\n provider_credential_ready:roleTokenConfigured&&brokerReady,\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID,default_branch:DEFAULT_BRANCH},\n package_sha256:PACKAGE_SHA256,\n authorizer:{\n implementation:AUTHORIZER_IMPLEMENTATION,\n receipt_schema:\"rumbo-r2-dedicated-authorizer-consumption/v3.5\",\n signature_alg:\"ES256\",\n signing_kid:AUTHORIZER_SIGNING_KID,\n verify_jwk:AUTHORIZER_VERIFY_JWK,\n observer_receipt_required_for_merge:true\n },\n jit_activation_policy:{\n endpoint:\"POST /v3/jit/prepare-activation\",\n dormant_branch:DORMANT_R2_BRANCH,\n create_draft_only:true,\n update_branch_via_pull_requests_write:true,\n direct_ref_write_forbidden:true,\n exact_static_blob_pins:R2_STATIC_PINS,\n required_dynamic_files:R2_REQUIRED_DYNAMIC_FILES,\n main_revalidation_required:true,\n observer_required_after_preparation:true,\n merge_authorized:false,\n deploy_enabled:false\n },\n execution_policy:{\n required_authorizer_action:\"MERGE_PR\",\n observer_receipt_required:true,\n max_prepare_merge_receipt_age_seconds:MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS,\n max_execute_receipt_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,\n current_main_must_equal_bound_base:true,\n pr_must_be_ready_not_draft:true,\n native_enforcement_required:true,\n minimum_native_approving_reviews:1,\n actual_review_approval_fulfillment_required:true,\n pr_author_approval_not_counted:true,\n exact_head_sha_merge:true,\n post_merge_main_readback_required:true,\n test_only_never_executable:true\n },\n capabilities:[\n \"signed-authorizer-v3.5-verification\",\n \"broker-post-install-autopilot-jit-only\",\n \"hashed-service-token-auth\",\n \"observer-linked-merge-authority\",\n \"github-app-broker-jit-token\",\n \"no-durable-github-installation-token\",\n \"github-rest-provider-preflight\",\n \"jit-draft-pr-activation-preparation\",\n \"jit-update-branch-with-pull-requests-write\",\n \"jit-static-bootstrap-pin-revalidation\",\n \"jit-main-drift-abort\",\n \"no-direct-ref-write-for-jit\",\n \"exact-live-main-base-revalidation\",\n \"native-enforcement-revalidation\",\n \"required-review-approval-fulfillment\",\n \"pr-author-excluded-from-approval-count\",\n \"authorizer-implementation-anti-downgrade\",\n \"exact-head-sha-merge\",\n \"post-merge-main-readback\",\n \"fail-closed-provider-credential\",\n \"audit-hash-chain\"\n ],\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v3/jit/prepare-activation\",async c=>{\n const authMode=await jitAuthorized(c.req.raw);\n if(!authMode)return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\"){\n return c.json({error:\"DEPLOY_MUST_REMAIN_DISABLED_DURING_JIT_PREP\",production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n\n const tokenCheck=await getGithubToken();\n if(!tokenCheck.ok){\n return c.json({\n error:\"GITHUB_BROKER_NOT_READY\",\n reason:tokenCheck.error,\n jit_activation_prepared:false,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },424,{\"Cache-Control\":\"no-store\"});\n }\n\n const main0=await currentMainSha();\n if(!main0.ok)return c.json({...main0,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n\n const branch0=await readDormantBranch();\n if(!branch0.ok)return c.json({...branch0,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n\n const pins0=await verifyJitBootstrapFiles();\n if(!pins0.ok)return c.json({...pins0,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const allOpen=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls?state=open&base=${encodeURIComponent(DEFAULT_BRANCH)}&per_page=100`);\n if(allOpen.status!==200||!Array.isArray(allOpen.json)){\n return c.json({error:\"OPEN_PR_SET_UNREADABLE\",status:allOpen.status,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n }\n const otherR2=allOpen.json.filter((p:any)=>\n String(p?.head?.ref||\"\")!==DORMANT_R2_BRANCH &&\n (\n String(p?.title||\"\").toLowerCase().includes(\"jit r2\") ||\n String(p?.title||\"\").toLowerCase().includes(\"r2 observer activation\") ||\n String(p?.head?.ref||\"\").startsWith(\"audit/continuity-r2\")\n )\n );\n if(otherR2.length){\n return c.json({\n error:\"OTHER_R2_ACTIVATION_PR_OPEN\",\n pr_numbers:otherR2.map((p:any)=>Number(p.number)),\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const opened=await openDormantActivationPr();\n if(!opened.ok)return c.json({...opened,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n const prNumber=Number(opened.pr?.number||0);\n const initialHead=String(opened.pr?.head?.sha||\"\");\n const initialBase=String(opened.pr?.base?.sha||\"\");\n if(!Number.isSafeInteger(prNumber)||prNumber<=0||!GIT_SHA_RE.test(initialHead)||!GIT_SHA_RE.test(initialBase)){\n return c.json({error:\"JIT_PR_COORDINATES_INVALID\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n if(opened.pr?.draft!==true||String(opened.pr?.head?.ref||\"\")!==DORMANT_R2_BRANCH||String(opened.pr?.base?.ref||\"\")!==DEFAULT_BRANCH){\n return c.json({error:\"JIT_PR_CONTRACT_INVALID\",pr_number:prNumber,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const refreshed=await refreshJitPrAgainstMain(prNumber,initialHead,String(main0.sha));\n if(!refreshed.ok)return c.json({...refreshed,pr_number:prNumber,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const pins1=await verifyJitBootstrapFiles();\n if(!pins1.ok)return c.json({...pins1,pr_number:prNumber,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const main1=await currentMainSha();\n if(!main1.ok)return c.json({...main1,pr_number:prNumber,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n if(main1.sha!==main0.sha){\n await audit(\"V3_JIT_MAIN_DRIFT_ABORT\",String(prNumber),await sha256(canonical({main0:main0.sha,main1:main1.sha})));\n return c.json({\n error:\"MAIN_DRIFT_DURING_JIT_PREP\",\n pr_number:prNumber,\n observed_main_before:main0.sha,\n observed_main_after:main1.sha,\n retry_required:true,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const finalPr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${prNumber}`);\n if(finalPr.status!==200||!finalPr.json)return c.json({error:\"FINAL_JIT_PR_UNREADABLE\",pr_number:prNumber,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n const finalHead=String(finalPr.json?.head?.sha||\"\");\n const finalBase=String(finalPr.json?.base?.sha||\"\");\n if(\n finalPr.json?.draft!==true||\n String(finalPr.json?.head?.ref||\"\")!==DORMANT_R2_BRANCH||\n String(finalPr.json?.base?.ref||\"\")!==DEFAULT_BRANCH||\n finalBase!==main1.sha||\n !GIT_SHA_RE.test(finalHead)\n ){\n return c.json({\n error:\"FINAL_JIT_PR_CONTRACT_INVALID\",\n pr_number:prNumber,\n final_base_sha:finalBase||null,\n final_head_sha:finalHead||null,\n production_go:false\n },409,{\"Cache-Control\":\"no-store\"});\n }\n\n const lineage=await compareMainToHead(String(main1.sha),finalHead);\n if(!lineage.ok||lineage.behind_by!==0||lineage.merge_base_sha!==main1.sha){\n return c.json({error:\"FINAL_JIT_LINEAGE_INVALID\",pr_number:prNumber,lineage,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const receiptBasis={\n pr_number:prNumber,\n base_sha:String(main1.sha),\n head_sha:finalHead,\n head_branch:DORMANT_R2_BRANCH,\n static_pins:R2_STATIC_PINS,\n package_sha256:PACKAGE_SHA256\n };\n const preparation_sha256=await sha256(canonical(receiptBasis));\n await audit(\"V3_JIT_ACTIVATION_PREPARED\",String(prNumber),preparation_sha256);\n\n return c.json({\n schema:\"rumbo-r2-jit-activation-preparation/v1\",\n implementation:IMPLEMENTATION,\n invocation_mode:authMode,\n jit_activation_prepared:true,\n pr_created:opened.created,\n pr_number:prNumber,\n pr_draft:true,\n base_sha:String(main1.sha),\n head_sha:finalHead,\n head_branch:DORMANT_R2_BRANCH,\n branch_refresh_performed:refreshed.updated,\n main_revalidated_after_refresh:true,\n static_pins_verified:true,\n dynamic_files_present:true,\n preparation_sha256,\n next_gate:\"SIGNED_EXTERNAL_OBSERVER\",\n merge_authorized:false,\n deploy_enabled:false,\n product_production:\"NO_GO\",\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/prepare\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c);\n const verified=await verifyAuthorizerReceipt(b?.authorizer_receipt);\n if(!verified.ok)return c.json({error:verified.error,production_go:false},400,{\"Cache-Control\":\"no-store\"});\n const r=verified.receipt;\n\n if(r.action===\"MERGE_PR\"){\n const age=(Date.now()-Date.parse(r.consumed_at))/1000;\n if(!Number.isFinite(age)||age< -60||age>MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS){\n return c.json({error:\"MERGE_AUTHORIZER_RECEIPT_STALE\",production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n if(!r.observer_receipt_sha256||r.evidence_sha256!==r.observer_receipt_sha256){\n return c.json({error:\"OBSERVER_LINK_REQUIRED_FOR_MERGE\",production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n }\n\n const planBinding={\n authorizer_action:r.action,\n authorizer_authorization_id:r.authorization_id,\n repository_identity_sha256:r.repository_identity_sha256,\n pr_number:r.pr_number,\n base_sha:r.base_sha,\n head_sha:r.head_sha,\n package_sha256:r.package_sha256,\n evidence_sha256:r.evidence_sha256,\n observer_receipt_sha256:r.observer_receipt_sha256,\n authorizer_request_sha256:r.request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n authorizer_signature_kid:r.receipt_signature.kid,\n authorizer_consumed_at:r.consumed_at,\n authorizer_merge_authorized:r.merge_authorized\n };\n const request_sha256=await sha256(canonical(planBinding));\n const prior=await sqlite.execute({sql:\"SELECT plan_id,status FROM deploy_plans_v3 WHERE request_sha256=? LIMIT 1\",args:[request_sha256]});\n if(prior.rows.length)return c.json({error:\"PLAN_ALREADY_EXISTS\",plan_id:prior.rows[0].plan_id,status:prior.rows[0].status,request_sha256,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const plan_id=crypto.randomUUID(),created_at=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO deploy_plans_v3(\n plan_id,authorizer_action,authorizer_authorization_id,repository_identity_sha256,\n pr_number,base_sha,head_sha,package_sha256,evidence_sha256,observer_receipt_sha256,\n authorizer_request_sha256,authorizer_receipt_sha256,authorizer_signature_kid,\n authorizer_consumed_at,authorizer_merge_authorized,request_sha256,status,created_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'PREPARED',?)`,args:[\n plan_id,r.action,r.authorization_id,r.repository_identity_sha256,r.pr_number,r.base_sha,r.head_sha,\n r.package_sha256,r.evidence_sha256,r.observer_receipt_sha256,r.request_sha256,r.receipt_sha256,\n r.receipt_signature.kid,r.consumed_at,r.merge_authorized?1:0,request_sha256,created_at\n ]});\n await audit(\"V3_PLAN_PREPARED\",plan_id,request_sha256);\n\n const blocked_by:string[]=[];\n if(r.action!==\"MERGE_PR\"||!r.merge_authorized)blocked_by.push(\"AUTHORIZER_ACTION_NOT_MERGE_PR\");\n if(r.action===\"MERGE_PR\"&&!r.observer_receipt_sha256)blocked_by.push(\"OBSERVER_RECEIPT_MISSING\");\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\")blocked_by.push(\"R2_ALLOW_DEPLOY_FALSE\");\n const broker=await brokerHealth();\n const brokerRoleConfigured=!!Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\");\n const brokerReady=broker.status===200&&broker.json?.implementation===GITHUB_BROKER_IMPLEMENTATION&&broker.json?.broker_ready===true;\n if(!brokerRoleConfigured)blocked_by.push(\"GITHUB_BROKER_ROLE_TOKEN_NOT_CONFIGURED\");\n else if(!brokerReady)blocked_by.push(\"GITHUB_BROKER_NOT_READY\");\n\n return c.json({\n prepared:true,plan_id,request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n observer_receipt_sha256:r.observer_receipt_sha256,\n authorizer_signature_verified:true,\n authorizer_action:r.action,\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n executable:blocked_by.length===0,\n blocked_by,\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/preflight\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v3 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const tokenCheck=await getGithubToken();\n if(!tokenCheck.ok)return c.json({\n error:\"GITHUB_BROKER_NOT_READY\",\n reason:tokenCheck.error,\n plan_id,\n production_go:false\n },424,{\"Cache-Control\":\"no-store\"});\n const result=await providerPreflight(rs.rows[0]);\n return c.json({plan_id,...result,production_go:false},result.ok?200:409,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/execute\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v3 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)!==\"PREPARED\")return c.json({error:\"PLAN_NOT_PREPARED\",status:row.status,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n if(String(row.authorizer_action)!==\"MERGE_PR\"||Number(row.authorizer_merge_authorized)!==1){\n return c.json({error:\"AUTHORIZER_ACTION_NOT_MERGE_PR\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n if(!row.observer_receipt_sha256||String(row.evidence_sha256)!==String(row.observer_receipt_sha256)){\n return c.json({error:\"OBSERVER_LINK_REQUIRED_FOR_MERGE\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const age=(Date.now()-Date.parse(String(row.authorizer_consumed_at||\"\")))/1000;\n if(!Number.isFinite(age)||age< -60||age>MAX_EXEC_RECEIPT_AGE_SECONDS){\n return c.json({error:\"AUTHORIZER_RECEIPT_STALE\",plan_id,max_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\"){\n return c.json({error:\"DEPLOY_DISABLED\",plan_id,production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n const tokenCheck=await getGithubToken();\n if(!tokenCheck.ok){\n return c.json({\n error:\"GITHUB_BROKER_NOT_READY\",\n reason:tokenCheck.error,\n plan_id,\n production_go:false\n },424,{\"Cache-Control\":\"no-store\"});\n }\n\n const pre=await providerPreflight(row);\n if(!pre.ok){\n await audit(\"V3_PROVIDER_PREFLIGHT_NO_GO\",plan_id,await sha256(canonical(pre.checks)));\n return c.json({error:\"PROVIDER_PREFLIGHT_NO_GO\",plan_id,checks:pre.checks,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const merge=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}/merge`,\"PUT\",{\n sha:String(row.head_sha),\n merge_method:\"merge\"\n });\n if(merge.status!==200||merge.json?.merged!==true||!GIT_SHA_RE.test(String(merge.json?.sha||\"\"))){\n await audit(\"V3_PROVIDER_MERGE_FAILED\",plan_id,await sha256(merge.text||\"\"));\n return c.json({error:\"PROVIDER_MERGE_FAILED\",plan_id,status:merge.status,message:merge.json?.message||null,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n const mergeSha=String(merge.json.sha);\n\n const main=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n const mainSha=String(main.json?.object?.sha||\"\");\n if(main.status!==200||mainSha!==mergeSha){\n await audit(\"V3_POST_MERGE_READBACK_FAILED\",plan_id,await sha256(canonical({mergeSha,mainSha,status:main.status})));\n return c.json({error:\"POST_MERGE_MAIN_READBACK_MISMATCH\",plan_id,merge_sha:mergeSha,main_sha:mainSha,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const executed_at=new Date().toISOString();\n const updated:any=await sqlite.execute({\n sql:\"UPDATE deploy_plans_v3 SET status='EXECUTED',executed_at=?,provider_merge_sha=?,provider_main_readback_sha=? WHERE plan_id=? AND status='PREPARED'\",\n args:[executed_at,mergeSha,mainSha,plan_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"EXECUTION_LEDGER_RACE\",plan_id,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"V3_PROVIDER_MERGE_EXECUTED\",plan_id,mergeSha);\n\n return c.json({\n executed:true,\n plan_id,\n provider:\"GITHUB_REST\",\n merged_pr:Number(row.pr_number),\n merge_sha:mergeSha,\n main_readback_sha:mainSha,\n observer_receipt_sha256:String(row.observer_receipt_sha256),\n authorizer_receipt_sha256:String(row.authorizer_receipt_sha256),\n product_production_go:false,\n production_go:false,\n note:\"This executes only the gated R2 observer-installation PR merge. It is not product production authorization.\"\n },200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/cancel\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const updated:any=await sqlite.execute({sql:\"UPDATE deploy_plans_v3 SET status='CANCELLED' WHERE plan_id=? AND status='PREPARED'\",args:[plan_id]});\n if(Number(updated?.rowsAffected??0)!==1)return c.json({error:\"PLAN_NOT_CANCELLABLE\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"V3_PLAN_CANCELLED\",plan_id,null);\n return c.json({cancelled:true,plan_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v3/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT plan_id,authorizer_action,authorizer_authorization_id,\n repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256,\n observer_receipt_sha256,authorizer_request_sha256,authorizer_receipt_sha256,\n authorizer_signature_kid,authorizer_consumed_at,authorizer_merge_authorized,\n request_sha256,status,created_at,executed_at,provider_merge_sha,provider_main_readback_sha\n FROM deploy_plans_v3 ORDER BY created_at DESC LIMIT 100`);\n const broker=await brokerHealth();\n const brokerReady=broker.status===200&&broker.json?.implementation===GITHUB_BROKER_IMPLEMENTATION&&broker.json?.broker_ready===true;\n return c.json({\n schema:\"rumbo-r2-deployer-ledger/v3.6\",\n implementation:IMPLEMENTATION,\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n direct_github_token_path_retired:true,\n broker_role_token_configured:!!Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\"),\n broker_ready:brokerReady,\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v3/audit\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM deploy_audit_v3 ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,plan_id:r.plan_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-deployer-audit/v3\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.all(\"/v2/*\",c=>c.json({error:\"V2_RETIRED_USE_V3_OBSERVER_LINKED_AUTHORIZATION\",replacement_prepare:\"/v3/prepare\",production_go:false},410,{\"Cache-Control\":\"no-store\"}));\napp.all(\"/v1/*\",c=>c.json({error:\"V1_RETIRED_USE_V3_OBSERVER_LINKED_AUTHORIZATION\",replacement_prepare:\"/v3/prepare\",production_go:false},410,{\"Cache-Control\":\"no-store\"}));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\nexport default app.fetch;\n",[161],"e071d03e-020c-4232-8a6d-50410f31fbab",["D",1787986936544],[27],"2b4f4ee3-e4fa-4b8f-8ec3-d9aafff30a68","RELEASE_V3_5.md","01a04c47-4934-7165-a0c3-c41caa5da6bc",["D",1787986135362],"# RUMBO R2 Deployer Controller V3.5 — JIT Activation Preparer\n\nStatus: **PASS / JIT_PREPARER_READY / BROKER_CUSTODY_PENDING / DEPLOY_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `R2_DEPLOYER_CONTROLLER_V3_5_JIT_ACTIVATION_PREPARER`.\n\nV3.5 adds a fail-closed JIT activation preparation endpoint without adding Git ref write or merge authority:\n\n`POST /v3/jit/prepare-activation`\n\nThe endpoint is root-authenticated, requires the dedicated GitHub App broker to be ready, refuses to operate while deploy is enabled, verifies all five dormant R2 bootstrap files, pins the three static Git blobs, creates/reuses only one DRAFT R2 activation PR, refreshes that PR against exact current `main` through GitHub's pull-request `update-branch` API, revalidates `main` after refresh, aborts on main drift, rechecks static pins, verifies final lineage, and emits only a preparation receipt for the next signed-external-observer gate.\n\nIt does not call Git ref write endpoints and does not call a merge endpoint. It returns `merge_authorized=false`, `deploy_enabled=false`, `product_production=NO_GO`, and `production_go=false`.\n\nSelftest evaluation while broker custody is intentionally unavailable: `01a04c0b-7f91-7519-8a4a-0286b5f2dd36` — PASS. Unauthenticated JIT preparation returned 401; authenticated preparation stopped at broker custody with 424 `CUSTODY_NOT_READY` before any GitHub mutation.\n\nIndependent static source audit: **19/19 PASS** across draft-only behavior, no direct ref write, no merge endpoint, exact static pins, five-file verification, duplicate R2 PR guard, pre/post main revalidation, post-refresh pin recheck, final lineage, audit event, unchanged authorizer pin, preserved merge gates and global NO_GO.\n\nThe provider adapter remains `GITHUB_REST_2026_03_10_IMPLEMENTED`. Actual JIT PR creation is deliberately impossible until the dedicated GitHub App is created and installed on the exact private repository.\n",[173],"1a12b87a-d88a-4b88-b9c9-0f44b6a48ff1","RELEASE_V3_4.md","01a04c47-4934-7165-a0c3-c06ab12f62a3",["D",1787986135362],"# RUMBO R2 Deployer Controller V3.4 — Authorizer V3.4 Pin\n\nStatus: **PASS / DEPLOY_DISABLED / BROKER_CUSTODY_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_DEPLOYER_CONTROLLER_V3_4_AUTHORIZER_V3_4_PINNED`.\n\nRequired broker: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\nRequired authorizer: `DEDICATED_R2_AUTHORIZER_V3_4_OBSERVER_V1_4_PINNED` with signed consumption schema `rumbo-r2-dedicated-authorizer-consumption/v3.4`.\n\nThe deployer now rejects V3.3 and older authorizer receipts. Direct GitHub token custody remains retired; GitHub access is broker-issued JIT installation-token only.\n\nValidation evaluation: `01a04bff-ff6f-717a-87c3-49b2b2abfcf1` — PASS. The V3.4 authorizer fixture verified cryptographically; authorizer downgrade, receipt tamper and forged merge failed; TEST_ONLY execution failed closed; broker-unready provider preflight returned 424; duplicate preparation failed; ledger projected no signature bytes; audit chain passed.\n\nFixture authorizer receipt SHA-256: `72ba564de3da05f44b4ff7951b6c3fc98420554b408ee851dd88e51360193705`.\n\nStatic source audit: PASS across broker and authorizer anti-downgrade, exact repository/permission contract, no durable installation-token persistence, live-main/base binding, native enforcement, independent APPROVED review fulfillment, exact head merge, post-merge main readback and explicit deploy flag.\n\n`R2_ALLOW_DEPLOY` remains false/absent; broker custody remains pending; `production_go=false`.\n",[179],"95e03da6-e709-4584-8e41-510dddcd09fc","RELEASE_V3_3.md","01a04c47-4934-7165-a0c3-bc4c0d0886ae",["D",1787986135362],"# RUMBO R2 Deployer Controller V3.3 — Broker Chain Pin\n\nStatus: **PASS / BROKER_CHAIN_PINNED / DEPLOY_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `R2_DEPLOYER_CONTROLLER_V3_3_BROKER_CHAIN_PINNED`.\n\nRequired broker: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\nRequired authorizer: `DEDICATED_R2_AUTHORIZER_V3_3_BROKER_CHAIN_PINNED` with signed receipt schema `rumbo-r2-dedicated-authorizer-consumption/v3.3`.\n\nThe deployer rejects stale broker or authorizer implementations, uses only broker-issued JIT GitHub App installation tokens, and retains exact repository scope and permissions. Direct `R2_GITHUB_APP_TOKEN` custody is retired.\n\nAll execution gates remain fail-closed: signed observer-linked merge authority, current main equals bound base, exact PR head, strict native enforcement, actual independent approved-review fulfillment, exact head SHA merge, post-merge main readback, and explicit deploy enablement.\n\nValidation evaluation: `01a04beb-2836-753b-bbc8-59ef9ae52934` — PASS.\n\nFixture authorizer receipt SHA-256: `380ca77d19c6b998e3afa72e13cd7bdc72addcc24f7f9419503ddd0ad7fb80d0`.\n\nStatic source audit: PASS across broker pinning, authorizer anti-downgrade, no direct token environment path, no durable installation-token persistence, strict native/review checks, exact merge binding and post-merge readback.\n\n`R2_ALLOW_DEPLOY` remains false/absent; broker custody remains pending; `production_go=false`.\n",[185],"5aae7c58-dc57-4d48-9555-550a927f8e70","RELEASE_V3_2.md","01a04c47-4934-7165-a0c3-b8475316759d",["D",1787986135362],"# RUMBO R2 Deployer Controller V3.2 — Broker JIT\n\nStatus: **PASS / BROKER_WIRED / DEPLOY_DISABLED / PRODUCTION_NO_GO**\n\nImplementation: `R2_DEPLOYER_CONTROLLER_V3_2_BROKER_JIT_AUTHORIZER_PINNED`.\n\nRequired authorizer: `DEDICATED_R2_AUTHORIZER_V3_2_OBSERVER_BROKER_PINNED` with signed schema `rumbo-r2-dedicated-authorizer-consumption/v3.2`.\n\nThe direct `R2_GITHUB_APP_TOKEN` path is retired. Provider access now comes only from `R2_GITHUB_APP_CUSTODY_BROKER_V1` through a deployer-scoped role bearer. The returned JIT installation token is accepted only when it is for repository id `1314199389` with exactly `contents:read`, `pull_requests:write`, and `administration:read`; it is held only in process memory until shortly before expiry.\n\nAll previous merge gates remain: signed observer-linked authority, live main equals bound base, exact PR head, strict native enforcement, actual independent APPROVED review fulfillment, exact authorized head SHA merge, and post-merge main readback.\n\nValidation evaluation: `01a04be2-0ac5-7071-b4e2-ec49fea504db` — PASS.\n\nFixture authorizer receipt SHA-256: `460004f5b7f44cdaf5e5e3b6e8f7ae4e7fc3f7760fdda6a43e1c55f02488890e`.\n\nStatic audit: PASS. `R2_ALLOW_DEPLOY` remains false/absent; broker custody is not yet installed; `production_go=false`.\n",[191],"1c717659-5948-44f9-9c9d-54317f3ed71d","RELEASE_V3_1.md","01a04c47-4934-7165-a0c3-b6157cc6aa9b",["D",1787986135362],"# RUMBO R2 Deployer Controller V3.1 — Authorizer Pin + Review Proof\n\nStatus: **PASS / DEPLOY_DISABLED / CREDENTIAL_PENDING / PRODUCTION_NO_GO**\n\nImplementation:\n\n`R2_DEPLOYER_CONTROLLER_V3_1_AUTHORIZER_PINNED_REVIEW_PROOF`\n\nV3.1 closes two rollback/enforcement gaps found during self-audit.\n\n## Authorizer anti-downgrade\n\nThe deployer now requires:\n\n- receipt schema:\n `rumbo-r2-dedicated-authorizer-consumption/v3.1`\n- signed field:\n `authorizer_implementation=DEDICATED_R2_AUTHORIZER_V3_1_OBSERVER_REVISION_PINNED`\n\nA receipt from the prior V3 authorizer is rejected even if it uses the same ES256 signing\nkey. This prevents a stale implementation from bypassing observer revision pinning.\n\n## Native enforcement strictness\n\nClassic protection counts only if:\n\n- at least one approving review is required;\n- force pushes are explicitly disabled;\n- deletions are explicitly disabled.\n\nRuleset protection counts only if:\n\n- active and targeting main/default;\n- pull-request rule exists;\n- at least one approval is required;\n- non-fast-forward rule exists;\n- deletion rule exists.\n\n## Actual review fulfillment\n\nProvider preflight now fetches the PR review set, reduces to the latest review per reviewer,\nexcludes the PR author, and requires the number of current APPROVED reviewers to meet or\nexceed the live native required-approval count.\n\nThus configuration alone is no longer enough; the exact PR must have fulfilled review\nrequirements before provider merge.\n\nAll earlier exact base/head, current-main equality, native revalidation, exact head SHA\nmerge and post-merge main readback checks remain.\n\n## Validation\n\nEvaluation:\n\n`01a04bcf-4a9f-7714-9aff-290f8b7bbb50`\n\nResult: **PASS**.\n\nValidated:\n\n- authorizer V3.1 signed fixture → valid;\n- implementation downgrade/tamper → invalid;\n- V2/V1 provider paths → retired 410;\n- forged merge receipt → rejected;\n- provider preflight without dedicated credential → 424;\n- TEST_ONLY execute → 403;\n- durable ledger/audit chain → PASS;\n- production_go → false.\n\nFixture receipt SHA-256:\n\n`1ac50f804258d37a21d5be84c73317efade62b803edd8913b3f800703b2624a3`\n\nStatic source audit: **PASS**.\n\nActual provider execution remains impossible because deploy enablement and the dedicated\nGitHub App credential remain absent.\n",[197],"441597c6-2b63-4082-80df-e5ca2850f773","RELEASE_V3.md","01a04c47-4934-7165-a0c3-b3a49ba606a3",["D",1787986135362],"# RUMBO R2 Deployer Controller V3 — GitHub REST Adapter\n\nStatus: **PASS / LIVE_CANDIDATE / DEPLOY_DISABLED / CREDENTIAL_PENDING / PRODUCTION_NO_GO**\n\nV3 implements the provider adapter that V2 intentionally left unbound.\n\nImplementation:\n\n`R2_DEPLOYER_CONTROLLER_V3_GITHUB_REST_ADAPTER`\n\nProvider adapter:\n\n`GITHUB_REST_2026_03_10_IMPLEMENTED`\n\n## Trusted authorizer\n\nRequired authorizer:\n\n`DEDICATED_R2_AUTHORIZER_V3_OBSERVER_GATED`\n\nRequired receipt:\n\n`rumbo-r2-dedicated-authorizer-consumption/v3`\n\nThe deployer pins the authorizer ES256 public key and independently verifies the full\nreceipt before plan admission.\n\nFor `MERGE_PR`, the signed receipt must contain a non-null observer receipt SHA-256 and\nthat SHA must equal `evidence_sha256`.\n\n## Provider preflight\n\nBefore any provider mutation, the adapter re-reads GitHub and requires:\n\n- exact repository id `1314199389`;\n- exact owner id `293577326`;\n- private repository;\n- default branch `main`;\n- exact PR number from signed authorization;\n- PR still open;\n- PR no longer draft;\n- PR base still `main`;\n- PR base SHA exactly equals the signed base;\n- PR head SHA exactly equals the signed head;\n- compare API proves head descends from base;\n- current live `main` equals the signed base SHA;\n- native branch/ruleset enforcement is proven live.\n\nAny mismatch fails closed before merge.\n\n## Merge operation\n\nIf all gates are satisfied, the adapter uses GitHub's merge endpoint with the exact\nauthorized head SHA and then requires `main` readback to equal the returned merge SHA.\n\nThe execution ledger is marked EXECUTED only after that exact post-merge readback.\n\nThis merge is scoped only to installation of the R2 observer bootstrap. The response\nretains `product_production_go=false` and `production_go=false`.\n\n## Current fail-closed state\n\n- `R2_ALLOW_DEPLOY`: false/absent;\n- dedicated GitHub App credential: absent;\n- provider adapter code: implemented;\n- provider mutation: impossible under current gates;\n- production_go: false.\n\n## Validation\n\nBranch evaluation:\n\n`01a04bc8-ae80-7681-bb0b-711eb437cef1`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- signed authorizer V3 fixture verifies → true;\n- modified signed fixture verifies → false;\n- unauthenticated V3 ledger → 401;\n- V2 endpoint retired → 410;\n- V1 endpoint retired → 410;\n- tampered receipt admission → 400;\n- forged TEST_ONLY→MERGE_PR receipt → 400;\n- valid signed TEST_ONLY plan → 201;\n- provider preflight without dedicated credential → 424;\n- TEST_ONLY execute → 403;\n- duplicate plan → 409;\n- signature bytes projected by ledger → false;\n- audit chain → PASS;\n- production_go → false.\n\nFixture authorizer receipt SHA-256:\n\n`25d86f0213156af385df003cf8cb63a30de2ae7191b9442593d881e136ad2b53`\n\n## Static source audit\n\nPASS:\n\n- authorizer private signing material absent;\n- exact repository identity pinned;\n- observer-link invariant present for MERGE_PR;\n- current-main/base equality revalidated;\n- native enforcement revalidated;\n- exact authorized head SHA supplied to merge endpoint;\n- post-merge main readback required;\n- V2 provider path retired;\n- signature bytes omitted from ledger projection;\n- production-go remains false.\n\n## Claim boundary\n\nThe provider adapter is now implemented. Provider execution is **not live** because the\ndedicated GitHub App credential and deploy enable flag remain absent.\n\nNo product production authorization is created by this controller.\n",[203],"c8e46ea6-0dd0-48bf-b1a0-b2bbfb132eb0","RELEASE_V2.md","01a04c47-4934-7165-a0c3-adf218933e8f",["D",1787986135362],"# RUMBO R2 Deployer Controller V2 — Signed Authorization\n\nStatus: **PASS / LIVE_CANDIDATE / PROVIDER_UNBOUND / PRODUCTION_NO_GO**\n\nV2 closes the trust gap in V1 where a caller could supply an arbitrary\n`authorizer_receipt_sha256`. Deployment planning now accepts only a complete signed\nconsumption receipt from the dedicated R2 authorizer V2 and verifies it offline.\n\n## Pinned authorizer trust root\n\nRequired authorizer:\n\n`DEDICATED_R2_AUTHORIZER_V2_SIGNED_RECEIPTS`\n\nReceipt schema:\n\n`rumbo-r2-dedicated-authorizer-consumption/v2`\n\nAlgorithm:\n\n`ES256 / ECDSA P-256 + SHA-256`\n\nPinned signing key id:\n\n`bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY`\n\nOnly the public verification JWK is embedded in the deployer.\n\n## Plan admission\n\n`POST /v2/prepare` verifies:\n\n- exact receipt schema;\n- repository identity;\n- PR number;\n- Git base/head SHA syntax;\n- sealed control-package SHA-256;\n- evidence and request SHA-256;\n- consumed timestamp;\n- exact production-go false;\n- exact action/merge-authorized consistency;\n- receipt SHA-256 recomputation;\n- signing algorithm and key id;\n- ES256 signature under the pinned public key.\n\nThe plan is derived from the verified receipt rather than duplicate caller-supplied\nbinding fields.\n\nV1 unsigned endpoints are retired with HTTP 410.\n\n## Execution policy\n\nA cryptographically valid `TEST_ONLY` receipt may be stored as a non-executable\nevidence plan, but `POST /v2/execute` rejects it with:\n\n`AUTHORIZER_ACTION_NOT_MERGE_PR`\n\nbefore checking the deployment enable flag.\n\nFor an executable path, all of the following would be required:\n\n1. signed authorizer action `MERGE_PR`;\n2. signed `merge_authorized=true`;\n3. receipt age <= 900 seconds;\n4. `R2_ALLOW_DEPLOY=true`;\n5. a dedicated GitHub App provider credential;\n6. a provider adapter.\n\nThe current runtime fails closed before those conditions:\n\n- deploy enabled: false;\n- GitHub App credential: absent;\n- provider adapter: `NOT_BOUND`;\n- production_go: false.\n\n## Adversarial validation\n\nBranch evaluation:\n\n`01a04ba9-dcc8-767a-9cae-18783c6e0100`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- pinned signed fixture verifies → true;\n- tampered local fixture verifies → false;\n- unauthenticated ledger → 401;\n- V1 unsigned endpoint → 410;\n- tampered signed receipt admission → 400;\n- forged TEST_ONLY→MERGE_PR elevation → 400;\n- unsigned V1 receipt admission → 400;\n- valid signed TEST_ONLY prepare → 201;\n- execute TEST_ONLY plan → 403;\n- duplicate prepare → 409;\n- ledger → 200;\n- signature bytes exposed by ledger → false;\n- audit → 200;\n- audit chain valid → true.\n\nFixture authorizer receipt SHA-256:\n\n`e493623c38a1028e7263311300cb558cc8b69665a718ae9c0845a78e9b03602b`\n\n## Claim boundary\n\nThe deployer controller now independently authenticates authorizer receipts. This closes\nreceipt authenticity and action-escalation gaps between authorization custody and\ndeployment planning.\n\nActual provider execution is still not live and remains impossible under current gates.\nNo merge, deployment or product-production authorization is implied.\n",[209],"8673f0cc-6095-4cc7-a9c1-dbbd6f839012","RELEASE_V1.md","01a04c47-4934-7165-a0c3-a83aa1490ab1",["D",1787986135362],"# RUMBO R2 Deployer Controller V1\n\nStatus: **LIVE_CANDIDATE / FAIL_CLOSED / PROVIDER_UNBOUND / PRODUCTION_NO_GO**\n\nThis service creates an independent deployment-control boundary separate from both the\ncontinuity relay and the dedicated R2 authorizer.\n\n## Current safety state\n\n- controller bearer: encrypted environment variable `R2_DEPLOY_ROOT_TOKEN`;\n- deploy enable gate `R2_ALLOW_DEPLOY`: absent / false;\n- GitHub App provider credential `R2_GITHUB_APP_TOKEN`: absent;\n- provider adapter: `NOT_BOUND`;\n- product production: false.\n\n## Binding contract\n\nEvery prepared deployment plan binds exactly to:\n\n- repository identity SHA-256;\n- PR number;\n- base SHA;\n- head SHA;\n- sealed package SHA-256;\n- evidence SHA-256;\n- dedicated-authorizer consumption receipt SHA-256.\n\nExact duplicate plans are rejected.\n\n## Execute behavior\n\n`POST /v1/execute` fails closed in this order:\n\n1. plan must exist and remain PREPARED;\n2. `R2_ALLOW_DEPLOY=true` must be explicitly present;\n3. a dedicated GitHub App credential must be configured;\n4. a provider adapter must be implemented.\n\nAt present step 2 fails with HTTP 423. No provider-side mutation can occur.\n\n## Adversarial self-test\n\nVal Town evaluation:\n\n`01a04b9c-9389-760a-be16-a819d85ebf7f`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- unauthenticated ledger → 401;\n- invalid binding → 400;\n- prepare → 201;\n- execute while disabled → 423;\n- duplicate prepare → 409;\n- cancel → 200;\n- execute cancelled plan → 409;\n- ledger → 200;\n- audit → 200;\n- audit chain valid → true.\n\nTest plan request SHA-256:\n\n`4fdc1f93766e2b457c58ae02189b6666c075dc8fadef9c6a9afd2e1ee3d4f5c4`\n\n## Claim boundary\n\nThe external deployer **controller runtime** exists and is live fail-closed.\n\nActual provider deployment remains unresolved because no dedicated GitHub App provider\ncredential or provider adapter is bound. This is intentional and must not be reported as\n`EXTERNAL_DEPLOYER_EXECUTION_LIVE`.\n",[215],"pulls","branches",7,"forks","envVars",{"_228":230,"_231":60},"connections",{"_228":60,"_229":60},"count","unfilledCount",3,"emptyCount",{"_40":214,"_31":215,"_29":216,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":274,"_13":60,"_32":20,"_33":218,"_23":24,"_158":-5,"_244":275,"_26":276},{"_40":208,"_31":209,"_29":210,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":271,"_13":60,"_32":20,"_33":212,"_23":24,"_158":-5,"_244":272,"_26":273},{"_40":202,"_31":203,"_29":204,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":268,"_13":60,"_32":20,"_33":206,"_23":24,"_158":-5,"_244":269,"_26":270},{"_40":196,"_31":197,"_29":198,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":265,"_13":60,"_32":20,"_33":200,"_23":24,"_158":-5,"_244":266,"_26":267},{"_40":190,"_31":191,"_29":192,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":262,"_13":60,"_32":20,"_33":194,"_23":24,"_158":-5,"_244":263,"_26":264},{"_40":184,"_31":185,"_29":186,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":259,"_13":60,"_32":20,"_33":188,"_23":24,"_158":-5,"_244":260,"_26":261},{"_40":178,"_31":179,"_29":180,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":256,"_13":60,"_32":20,"_33":182,"_23":24,"_158":-5,"_244":257,"_26":258},{"_40":172,"_31":173,"_29":174,"_151":-5,"_38":39,"_37":155,"_153":56,"_35":253,"_13":60,"_32":20,"_33":176,"_23":24,"_158":-5,"_244":254,"_26":255},{"_40":169,"_31":27,"_29":30,"_151":-5,"_38":39,"_37":14,"_153":56,"_35":250,"_13":60,"_32":20,"_33":34,"_23":24,"_158":-5,"_244":251,"_26":252},{"_40":160,"_31":161,"_29":162,"_151":-5,"_38":39,"_37":163,"_153":56,"_35":247,"_13":165,"_32":166,"_33":167,"_23":24,"_158":-5,"_244":248,"_26":249},{"_40":148,"_31":149,"_29":150,"_151":-5,"_38":39,"_37":152,"_153":56,"_35":243,"_13":155,"_32":156,"_33":157,"_23":24,"_158":-5,"_244":245,"_26":246},["D",1787986865359],"children",[],[149],["D",1787986829029],[],[161],["D",1787986936544],[],[27],["D",1787986135362],[],[173],["D",1787986135362],[],[179],["D",1787986135362],[],[185],["D",1787986135362],[],[191],["D",1787986135362],[],[197],["D",1787986135362],[],[203],["D",1787986135362],[],[209],["D",1787986135362],[],[215],["D",1787974891297],["D",1789539031988],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":52,"_103":104,"_105":24},{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":91,"_92":47,"_93":41,"_94":62,"_95":42,"_96":97},"ctx",{"_79":-5,"_127":315,"_316":317,"_318":319,"_320":24,"_321":24,"_322":24,"_323":56,"_324":-5,"_325":-7,"_326":-7,"_327":60,"_328":24,"_329":24,"_330":-5,"_331":24,"_332":24,"_333":24,"_334":-5},"ENV",{"_286":287,"_288":289,"_290":133,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300,"_301":302,"_303":304,"_305":306,"_307":308,"_309":310,"_311":312,"_313":314},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v13