[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_222":223,"_224":225},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_17":18,"_38":-7,"_130":-5,"_19":131,"_132":133,"_134":135,"_136":137,"_138":139,"_21":140,"_141":-5,"_142":143,"_144":24,"_145":146,"_147":88,"_148":-5,"_149":-5,"_150":151},"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":24,"_30":-5},"handle","sebas1","name","rumbo-r2-deployer","branchName","v3-github-rest-adapter","path","RELEASE_V1.md","project",{"_32":76,"_13":14,"_36":77,"_67":-5,"_78":24,"_79":80,"_81":80,"_82":83,"_84":-5,"_30":72,"_85":86,"_87":88,"_89":-5,"_90":-5,"_91":26,"_40":41,"_92":93,"_94":95,"_96":97,"_98":-5,"_99":100,"_101":100,"_102":103,"_104":103,"_105":103,"_106":100,"_107":100,"_53":108,"_109":110,"_111":112,"_113":24},"file",{"_68":69,"_13":18,"_70":21,"_71":24,"_75":-5},"isDirectory",false,"page",0,"history",[31],"hasNext","userId",{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":-5,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":58,"_59":-5,"_60":-5,"_61":62},"id","66944a90-1998-4a7d-901b-dce6354a6496","branchId","6c9212f9-5eac-434b-a4b6-5ff976c1ef09","createdAt",["D",1787977754351],"version",1,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","parentId","incomingCommitId","0508ffed-8220-4133-95d8-f67b5d58a754","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","mcp","clientLabel","ChatGPT","user",{"_32":72,"_40":41,"_11":12,"_73":74},{"_68":69,"_13":18,"_70":21,"_71":24},"pull","merge",{"_34":64,"_13":65,"_38":66,"_67":-5},"revert","multiple","commits",[63],{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":-5,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":58,"_59":-5},"05a3146a-0d13-441a-b505-9ff526f70e96","main",20,"deletedAt","fileId","01a04bc7-66e9-71bc-a6b4-15735f2c2e5c","fileType","deleted","d3788f19-13c5-4356-87e8-dce639626bb9","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","deletedAtVersion","dc841a2e-8ac0-491d-b8e5-ee9e11dc6e2a",["D",1787974891297],"legacyEnvVars","privacy","public","httpPrivacy","description","Fail-closed RUMBO R2 deployer controller","imageUrl","pinnedFileId","862fe8ba-a35b-11f1-8a2b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","dc841a2e8ac0491db8e5ee9e11dc6e2a","tursoHostname","dc841a2e8ac0491db8e5ee9e11dc6e2a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789539031988],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_129":74},"org",{"_11":12,"_124":125,"_73":74,"_30":72,"_126":127,"_128":24},"branch",{"_38":114,"_13":16,"_32":35,"_115":76,"_116":64,"_117":118,"_119":80,"_120":76,"_121":41,"_122":14,"_123":12},"isOwned",4,"projectId","forkedBranchId","forkedBranchVersion",5,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_32":76,"_13":14,"_36":217,"_67":-5,"_78":24,"_79":80,"_81":80,"_82":83,"_84":-5,"_30":72,"_85":86,"_87":88,"_89":-5,"_90":-5,"_91":26,"_40":41,"_92":93,"_94":95,"_96":218,"_98":-5,"_99":100,"_101":100,"_102":103,"_104":103,"_105":103,"_106":100,"_107":100,"_53":219,"_109":220,"_111":221,"_113":24},"tree",[176,177,178,179,180],"files",[176,177,178,179,180],"counts",{"_164":26,"_165":166,"_167":26,"_168":169,"_170":171},"contents",[],{"_32":157,"_34":35,"_68":69,"_13":18,"_158":159,"_70":21,"_38":26,"_42":-5,"_36":160,"_161":39,"_162":-5,"_17":163},"upstreamProject","upstreamBranch",{"_32":64,"_36":152,"_153":154,"_13":65,"_115":76,"_38":66,"_116":-5,"_117":-5,"_155":156,"_67":-5,"_113":24,"_79":80,"_123":12,"_40":41,"_122":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787974891297],"updatedAt",["D",1787988946009],"lockfileKey","1787988946607-esm.town_v_sebas1_rumbo-r2-deployer@20-main","082bb563-a86d-402f-b669-31cb72e36a70","content","# RUMBO R2 Deployer Controller V1\n\nStatus: **LIVE_CANDIDATE / FAIL_CLOSED / PROVIDER_UNBOUND / PRODUCTION_NO_GO**\n\nThis service creates an independent deployment-control boundary separate from both the\ncontinuity relay and the dedicated R2 authorizer.\n\n## Current safety state\n\n- controller bearer: encrypted environment variable `R2_DEPLOY_ROOT_TOKEN`;\n- deploy enable gate `R2_ALLOW_DEPLOY`: absent / false;\n- GitHub App provider credential `R2_GITHUB_APP_TOKEN`: absent;\n- provider adapter: `NOT_BOUND`;\n- product production: false.\n\n## Binding contract\n\nEvery prepared deployment plan binds exactly to:\n\n- repository identity SHA-256;\n- PR number;\n- base SHA;\n- head SHA;\n- sealed package SHA-256;\n- evidence SHA-256;\n- dedicated-authorizer consumption receipt SHA-256.\n\nExact duplicate plans are rejected.\n\n## Execute behavior\n\n`POST /v1/execute` fails closed in this order:\n\n1. plan must exist and remain PREPARED;\n2. `R2_ALLOW_DEPLOY=true` must be explicitly present;\n3. a dedicated GitHub App credential must be configured;\n4. a provider adapter must be implemented.\n\nAt present step 2 fails with HTTP 423. No provider-side mutation can occur.\n\n## Adversarial self-test\n\nVal Town evaluation:\n\n`01a04b9c-9389-760a-be16-a819d85ebf7f`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- unauthenticated ledger → 401;\n- invalid binding → 400;\n- prepare → 201;\n- execute while disabled → 423;\n- duplicate prepare → 409;\n- cancel → 200;\n- execute cancelled plan → 409;\n- ledger → 200;\n- audit → 200;\n- audit chain valid → true.\n\nTest plan request SHA-256:\n\n`4fdc1f93766e2b457c58ae02189b6666c075dc8fadef9c6a9afd2e1ee3d4f5c4`\n\n## Claim boundary\n\nThe external deployer **controller runtime** exists and is live fail-closed.\n\nActual provider deployment remains unresolved because no dedicated GitHub App provider\ncredential or provider adapter is bound. This is intentional and must not be reported as\n`EXTERNAL_DEPLOYER_EXECUTION_LIVE`.\n",["D",1787977754351],"branchVersion","label",[18],"pulls","branches",7,"forks","envVars",{"_172":174,"_175":26},"connections",{"_172":26,"_173":26},"count","unfilledCount",3,"emptyCount",{"_32":157,"_13":18,"_68":69,"_42":-5,"_34":35,"_161":39,"_184":88,"_36":214,"_38":26,"_70":21,"_158":159,"_71":24,"_162":-5,"_188":215,"_17":216},{"_32":207,"_13":208,"_68":209,"_42":-5,"_34":35,"_161":39,"_184":88,"_36":210,"_38":26,"_70":21,"_158":211,"_71":24,"_162":-5,"_188":212,"_17":213},{"_32":200,"_13":201,"_68":202,"_42":-5,"_34":35,"_161":114,"_184":88,"_36":203,"_38":26,"_70":21,"_158":204,"_71":24,"_162":-5,"_188":205,"_17":206},{"_32":191,"_13":192,"_68":193,"_42":-5,"_34":35,"_161":194,"_184":88,"_36":195,"_38":39,"_70":196,"_158":197,"_71":24,"_162":-5,"_188":198,"_17":199},{"_32":181,"_13":182,"_68":183,"_42":-5,"_34":35,"_161":174,"_184":88,"_36":185,"_38":39,"_70":186,"_158":187,"_71":24,"_162":-5,"_188":189,"_17":190},"47ef6859-def4-4ed8-964d-6ce3a4e97751","selftest.ts","01a04bc7-66e9-71bc-a6b4-23c5c0298efb","latest",["D",1787977835465],"script","const base=\"https://sebas1--01a04bc766e971bca6b41fdf3a5321dc.web.val.run\";\nconst root=Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\");\nif(!root)throw new Error(\"ROOT_TOKEN_MISSING\");\nconst headers={Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\nconst fixture={\n \"schema\": \"rumbo-r2-dedicated-authorizer-consumption/v3\",\n \"authorization_id\": \"42a5f091-92e0-4236-8d55-1fcf3bdf9ee6\",\n \"action\": \"TEST_ONLY\",\n \"repository_identity_sha256\": \"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\",\n \"pr_number\": 412,\n \"base_sha\": \"1ad77acefc7326595c50d7b0edffa81a2188e737\",\n \"head_sha\": \"d0043f418c1b0f7d21b36dc1c5469c9ded49cfd7\",\n \"package_sha256\": \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\",\n \"evidence_sha256\": \"68c130e4d3d087456aefecc17c2b08ecba020d0a1bb5c155c56e53e0d10ddeb2\",\n \"observer_receipt_sha256\": null,\n \"request_sha256\": \"3608afc6c82ffa38d2712857ec06143142e53921f1d57e3ada57db5c661881a0\",\n \"consumed_at\": \"2026-08-29T04:29:03.087Z\",\n \"consumer\": \"deployer-v3-fixture\",\n \"merge_authorized\": false,\n \"production_go\": false,\n \"consumed\": true,\n \"receipt_sha256\": \"25d86f0213156af385df003cf8cb63a30de2ae7191b9442593d881e136ad2b53\",\n \"receipt_signature\": {\n \"alg\": \"ES256\",\n \"kid\": \"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\",\n \"signature_b64url\": \"SrLn-kMxl-r2_vJxsVppqde_6NwpXnk77usfi4piV8dibfbURzPOe-bsoED5nut9s7GyAUko5BvVdekF0zHX0A\"\n }\n};\n\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nfunction canonicalReceipt(v:any){\n return {\n schema:v.schema,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nasync function localVerify(v:any,jwk:JsonWebKey):Promise{\n const canon=canonical(canonicalReceipt(v));\n if(await sha256(canon)!==v.receipt_sha256)return false;\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n return await crypto.subtle.verify(\n {name:\"ECDSA\",hash:\"SHA-256\"},key,b64urlDecode(v.receipt_signature.signature_b64url),new TextEncoder().encode(canon)\n );\n}\n\nconst healthRes=await fetch(base+\"/health\");\nconst health:any=await healthRes.json();\nconst localValid=healthRes.status===200?await localVerify(fixture,health.authorizer?.verify_jwk):false;\nconst localTamper=healthRes.status===200?await localVerify({...fixture,head_sha:\"f\".repeat(40)},health.authorizer?.verify_jwk):true;\n\nconst unauthLedger=await fetch(base+\"/v3/ledger\");\nconst retiredV2=await fetch(base+\"/v2/prepare\",{method:\"POST\",headers,body:\"{}\"});\nconst retiredV1=await fetch(base+\"/v1/prepare\",{method:\"POST\",headers,body:\"{}\"});\n\nconst tampered={...fixture,evidence_sha256:\"f\".repeat(64)};\nconst tamperedRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:tampered})});\nconst forgedMerge={...fixture,action:\"MERGE_PR\",merge_authorized:true,observer_receipt_sha256:\"a\".repeat(64),evidence_sha256:\"a\".repeat(64)};\nconst forgedMergeRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:forgedMerge})});\n\nconst prepareRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:fixture})});\nconst prepared:any=await prepareRes.json();\nif(prepareRes.status!==201&&prepareRes.status!==409)throw new Error(`PREPARE_${prepareRes.status}_${prepared.error||\"UNKNOWN\"}`);\nif(prepareRes.status===409&&prepared.status!==\"PREPARED\")throw new Error(\"EXISTING_PLAN_NOT_PREPARED\");\nconst planId=String(prepared.plan_id||\"\");\nif(!planId)throw new Error(\"PLAN_ID_MISSING\");\n\nconst preflightRes=await fetch(base+\"/v3/preflight\",{method:\"POST\",headers,body:JSON.stringify({plan_id:planId})});\nconst preflight:any=await preflightRes.json();\nconst executeRes=await fetch(base+\"/v3/execute\",{method:\"POST\",headers,body:JSON.stringify({plan_id:planId})});\nconst execute:any=await executeRes.json();\nconst duplicateRes=await fetch(base+\"/v3/prepare\",{method:\"POST\",headers,body:JSON.stringify({authorizer_receipt:fixture})});\n\nconst ledgerRes=await fetch(base+\"/v3/ledger\",{headers});\nconst ledger:any=await ledgerRes.json();\nconst plan=Array.isArray(ledger.records)?ledger.records.find((x:any)=>String(x.plan_id)===planId):null;\nconst secretLeak=Array.isArray(ledger.records)&&ledger.records.some((x:any)=>Object.prototype.hasOwnProperty.call(x,\"authorizer_signature_b64url\"));\n\nconst auditRes=await fetch(base+\"/v3/audit\",{headers});\nconst audit:any=await auditRes.json();\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"R2_DEPLOYER_CONTROLLER_V3_GITHUB_REST_ADAPTER\"&&\n health.root_token_configured===true&&\n health.deploy_enabled===false&&\n health.provider_credential_configured===false&&\n health.provider_adapter===\"GITHUB_REST_2026_03_10_IMPLEMENTED\"&&\n health.production_go===false&&\n health.authorizer?.implementation===\"DEDICATED_R2_AUTHORIZER_V3_OBSERVER_GATED\"&&\n health.authorizer?.receipt_schema===\"rumbo-r2-dedicated-authorizer-consumption/v3\"&&\n health.authorizer?.observer_receipt_required_for_merge===true&&\n health.execution_policy?.native_enforcement_required===true&&\n health.execution_policy?.current_main_must_equal_bound_base===true&&\n health.execution_policy?.exact_head_sha_merge===true&&\n health.execution_policy?.post_merge_main_readback_required===true&&\n localValid===true&&\n localTamper===false&&\n unauthLedger.status===401&&\n retiredV2.status===410&&\n retiredV1.status===410&&\n tamperedRes.status===400&&\n forgedMergeRes.status===400&&\n (prepareRes.status===201||prepareRes.status===409)&&\n preflightRes.status===424&&preflight.error===\"PROVIDER_CREDENTIAL_NOT_CONFIGURED\"&&\n executeRes.status===403&&execute.error===\"AUTHORIZER_ACTION_NOT_MERGE_PR\"&&\n duplicateRes.status===409&&\n ledgerRes.status===200&&ledger.production_go===false&&\n plan?.authorizer_action===\"TEST_ONLY\"&&plan?.observer_receipt_sha256===null&&\n secretLeak===false&&\n auditRes.status===200&&audit.audit_chain_ok===true&&audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n local_authorizer_v3_fixture_verified:localValid,\n local_tamper_verified:localTamper,\n unauthenticated_ledger:unauthLedger.status,\n v2_retired:retiredV2.status,\n v1_retired:retiredV1.status,\n tampered_receipt_prepare:tamperedRes.status,\n forged_merge_prepare:forgedMergeRes.status,\n prepare:prepareRes.status,\n provider_preflight_without_credential:preflightRes.status,\n execute_test_only:executeRes.status,\n duplicate_prepare:duplicateRes.status,\n ledger:ledgerRes.status,\n signature_bytes_leaked_in_ledger:secretLeak,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n plan_id:planId,\n authorizer_receipt_sha256:fixture.receipt_sha256,\n provider_adapter:health.provider_adapter,\n deploy_enabled:false,\n production_go:false\n},null,2));\nif(!pass)Deno.exit(1);\n","children",[],[182],"1feec071-05c6-4f21-ab10-5bc9ab59c915","main.tsx","01a04bc7-66e9-71bc-a6b4-1fdf3a5321dc",2,["D",1787977805800],"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app=new Hono();\n\nconst IMPLEMENTATION=\"R2_DEPLOYER_CONTROLLER_V3_GITHUB_REST_ADAPTER\";\nconst REPO_OWNER=\"fscfede-beep\";\nconst REPO_NAME=\"rumbo-control-queue\";\nconst REPO_FULL=`${REPO_OWNER}/${REPO_NAME}`;\nconst REPOSITORY_ID=1314199389;\nconst OWNER_ID=293577326;\nconst DEFAULT_BRANCH=\"main\";\nconst REPO_IDENTITY_SHA256=\"59e28afe0dd67d61cdaaaa5d470a6470b6c1540f025d172f094fe3321857fc23\";\nconst PACKAGE_SHA256=\"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst AUTHORIZER_IMPLEMENTATION=\"DEDICATED_R2_AUTHORIZER_V3_OBSERVER_GATED\";\nconst AUTHORIZER_SIGNING_KID=\"bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY\";\nconst AUTHORIZER_VERIFY_JWK:JsonWebKey={\n kty:\"EC\",crv:\"P-256\",\n x:\"TV0M-YRfRzqMB6dTZIhLOu7w21Tkgul-lUns7HwpHy4\",\n y:\"mRWAIOykqSBgsAXqC9t3OOmk3KLljPH935lilXma-W4\",\n key_ops:[\"verify\"],ext:true\n};\nconst API_VERSION=\"2026-03-10\";\nconst MAX_BODY=64*1024;\nconst MAX_EXEC_RECEIPT_AGE_SECONDS=900;\nconst MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS=300;\nconst SHA256_RE=/^[a-f0-9]{64}$/;\nconst GIT_SHA_RE=/^[a-f0-9]{40}$/;\nconst B64URL_RE=/^[A-Za-z0-9_-]{80,128}$/;\n\ntype AuthorizerAction=\"TEST_ONLY\"|\"MERGE_PR\";\ntype VerifiedReceipt={\n schema:\"rumbo-r2-dedicated-authorizer-consumption/v3\";\n authorization_id:string;\n action:AuthorizerAction;\n repository_identity_sha256:string;\n pr_number:number;\n base_sha:string;\n head_sha:string;\n package_sha256:string;\n evidence_sha256:string;\n observer_receipt_sha256:string|null;\n request_sha256:string;\n consumed_at:string;\n consumer:string;\n merge_authorized:boolean;\n production_go:false;\n consumed:true;\n receipt_sha256:string;\n receipt_signature:{alg:\"ES256\";kid:string;signature_b64url:string};\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS deploy_plans_v3(\n plan_id TEXT PRIMARY KEY,\n authorizer_action TEXT NOT NULL CHECK(authorizer_action IN ('TEST_ONLY','MERGE_PR')),\n authorizer_authorization_id TEXT NOT NULL UNIQUE,\n repository_identity_sha256 TEXT NOT NULL,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n package_sha256 TEXT NOT NULL,\n evidence_sha256 TEXT NOT NULL,\n observer_receipt_sha256 TEXT,\n authorizer_request_sha256 TEXT NOT NULL,\n authorizer_receipt_sha256 TEXT NOT NULL UNIQUE,\n authorizer_signature_kid TEXT NOT NULL,\n authorizer_consumed_at TEXT NOT NULL,\n authorizer_merge_authorized INTEGER NOT NULL CHECK(authorizer_merge_authorized IN (0,1)),\n request_sha256 TEXT NOT NULL UNIQUE,\n status TEXT NOT NULL CHECK(status IN ('PREPARED','CANCELLED','EXECUTED')),\n created_at TEXT NOT NULL,\n executed_at TEXT,\n provider_merge_sha TEXT,\n provider_main_readback_sha TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_deploy_plans_v3_status ON deploy_plans_v3(status,created_at)`,\n `CREATE TABLE IF NOT EXISTS deploy_audit_v3(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n plan_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v3_prev ON deploy_audit_v3(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_deploy_audit_v3_event_plan\n ON deploy_audit_v3(event_type,plan_id)\n WHERE plan_id IS NOT NULL`\n]);\n\nfunction bearer(req:Request):string{\n const h=req.headers.get(\"authorization\")||\"\";\n return h.startsWith(\"Bearer \")?h.slice(7):\"\";\n}\nfunction ct(a:string,b:string):boolean{\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0;for(let i=0;i;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nasync function bodyJson(c:any):Promise{\n const len=Number(c.req.header(\"content-length\")||\"0\");\n if(Number.isFinite(len)&&len>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt=await c.req.text();\n if(new TextEncoder().encode(txt).length>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt||\"{}\");\n}\nfunction canonicalReceipt(v:any){\n return {\n schema:v.schema,\n authorization_id:v.authorization_id,\n action:v.action,\n repository_identity_sha256:v.repository_identity_sha256,\n pr_number:v.pr_number,\n base_sha:v.base_sha,\n head_sha:v.head_sha,\n package_sha256:v.package_sha256,\n evidence_sha256:v.evidence_sha256,\n observer_receipt_sha256:v.observer_receipt_sha256,\n request_sha256:v.request_sha256,\n consumed_at:v.consumed_at,\n consumer:v.consumer,\n merge_authorized:v.merge_authorized,\n production_go:v.production_go\n };\n}\nfunction structuralReceiptCheck(v:any):v is VerifiedReceipt{\n if(!v||typeof v!==\"object\")return false;\n if(v.schema!==\"rumbo-r2-dedicated-authorizer-consumption/v3\")return false;\n if(typeof v.authorization_id!==\"string\"||v.authorization_id.length<16||v.authorization_id.length>128)return false;\n if(v.action!==\"TEST_ONLY\"&&v.action!==\"MERGE_PR\")return false;\n if(v.repository_identity_sha256!==REPO_IDENTITY_SHA256)return false;\n if(!Number.isSafeInteger(v.pr_number)||v.pr_number<=0)return false;\n if(!GIT_SHA_RE.test(String(v.base_sha||\"\"))||!GIT_SHA_RE.test(String(v.head_sha||\"\")))return false;\n if(v.package_sha256!==PACKAGE_SHA256)return false;\n if(!SHA256_RE.test(String(v.evidence_sha256||\"\"))||!SHA256_RE.test(String(v.request_sha256||\"\")))return false;\n if(v.observer_receipt_sha256!==null&&!SHA256_RE.test(String(v.observer_receipt_sha256||\"\")))return false;\n if(!Number.isFinite(Date.parse(String(v.consumed_at||\"\"))))return false;\n if(typeof v.consumer!==\"string\"||!/^[A-Za-z0-9_.:-]{1,128}$/.test(v.consumer))return false;\n if(v.consumed!==true||v.production_go!==false)return false;\n if(typeof v.merge_authorized!==\"boolean\"||v.merge_authorized!==(v.action===\"MERGE_PR\"))return false;\n if(v.action===\"MERGE_PR\"&&(!v.observer_receipt_sha256||v.evidence_sha256!==v.observer_receipt_sha256))return false;\n if(v.action===\"TEST_ONLY\"&&v.observer_receipt_sha256!==null)return false;\n if(!SHA256_RE.test(String(v.receipt_sha256||\"\")))return false;\n if(v.receipt_signature?.alg!==\"ES256\"||v.receipt_signature?.kid!==AUTHORIZER_SIGNING_KID)return false;\n if(!B64URL_RE.test(String(v.receipt_signature?.signature_b64url||\"\")))return false;\n return true;\n}\nasync function verifyAuthorizerReceipt(v:any):Promise<{ok:true;receipt:VerifiedReceipt}|{ok:false;error:string}>{\n if(!structuralReceiptCheck(v))return {ok:false,error:\"INVALID_AUTHORIZER_V3_RECEIPT_STRUCTURE\"};\n const canon=canonical(canonicalReceipt(v));\n const computed=await sha256(canon);\n if(!ct(computed,String(v.receipt_sha256)))return {ok:false,error:\"AUTHORIZER_RECEIPT_HASH_MISMATCH\"};\n let key:CryptoKey;\n try{key=await crypto.subtle.importKey(\"jwk\",AUTHORIZER_VERIFY_JWK,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);}\n catch{return {ok:false,error:\"AUTHORIZER_VERIFY_KEY_IMPORT_FAILED\"};}\n let sig:Uint8Array;\n try{sig=b64urlDecode(String(v.receipt_signature.signature_b64url));}\n catch{return {ok:false,error:\"AUTHORIZER_SIGNATURE_ENCODING_INVALID\"};}\n const valid=await crypto.subtle.verify({name:\"ECDSA\",hash:\"SHA-256\"},key,sig,new TextEncoder().encode(canon));\n if(!valid)return {ok:false,error:\"AUTHORIZER_RECEIPT_SIGNATURE_INVALID\"};\n return {ok:true,receipt:v};\n}\nasync function github(path:string,method=\"GET\",body?:unknown){\n const token=Deno.env.get(\"R2_GITHUB_APP_TOKEN\")||\"\";\n if(!token)return {status:0,json:null,text:\"GITHUB_APP_TOKEN_NOT_CONFIGURED\"};\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${token}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-deployer/3\",\n \"Content-Type\":\"application/json\"\n },\n body:body===undefined?undefined:JSON.stringify(body)\n });\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n}\nasync function nativeEnforcement(){\n const protection=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/branches/${DEFAULT_BRANCH}/protection`);\n let classic=false;\n if(protection.status===200&&protection.json){\n const j=protection.json;\n classic=!!j.required_pull_request_reviews &&\n (j.allow_force_pushes?.enabled===false||j.allow_force_pushes===null) &&\n (j.allow_deletions?.enabled===false||j.allow_deletions===null);\n }\n const list=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets`);\n let ruleset=false;\n if(list.status===200&&Array.isArray(list.json)){\n for(const item of list.json){\n if(item?.enforcement!==\"active\"||item?.target!==\"branch\"||!item?.id)continue;\n const detail=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets/${item.id}`);\n if(detail.status!==200||!detail.json)continue;\n const types=new Set((detail.json.rules||[]).map((r:any)=>String(r.type)));\n const include=(detail.json.conditions?.ref_name?.include||[]).map(String);\n const targetsMain=include.includes(\"~DEFAULT_BRANCH\")||include.includes(\"refs/heads/main\")||include.includes(\"main\");\n if(targetsMain&&types.has(\"pull_request\")&&types.has(\"non_fast_forward\"))ruleset=true;\n }\n }\n return {proven:classic||ruleset,classic,ruleset,protection_status:protection.status,rulesets_status:list.status};\n}\nasync function providerPreflight(row:any){\n const checks:any[]=[];\n const add=(name:string,ok:boolean,detail:any)=>checks.push({name,status:ok?\"PASS\":\"FAIL\",detail});\n\n const repo=await github(`/repos/${REPO_OWNER}/${REPO_NAME}`);\n add(\"repo_api\",repo.status===200,repo.status);\n add(\"repo_id\",Number(repo.json?.id)===REPOSITORY_ID,repo.json?.id);\n add(\"owner_id\",Number(repo.json?.owner?.id)===OWNER_ID,repo.json?.owner?.id);\n add(\"private_repo\",repo.json?.private===true,repo.json?.private);\n add(\"default_branch\",repo.json?.default_branch===DEFAULT_BRANCH,repo.json?.default_branch);\n\n const pr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}`);\n add(\"pr_api\",pr.status===200,pr.status);\n add(\"pr_open\",pr.json?.state===\"open\",pr.json?.state);\n add(\"pr_ready\",pr.json?.draft===false,pr.json?.draft);\n add(\"base_main\",pr.json?.base?.ref===DEFAULT_BRANCH,pr.json?.base?.ref);\n add(\"base_sha_exact\",pr.json?.base?.sha===row.base_sha,pr.json?.base?.sha);\n add(\"head_sha_exact\",pr.json?.head?.sha===row.head_sha,pr.json?.head?.sha);\n\n const cmp=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/compare/${row.base_sha}...${row.head_sha}`);\n add(\"compare_api\",cmp.status===200,cmp.status);\n add(\"head_descends_from_base\",cmp.json?.behind_by===0&&Number(cmp.json?.ahead_by)>=1,{ahead_by:cmp.json?.ahead_by,behind_by:cmp.json?.behind_by});\n\n const main=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n add(\"main_ref_api\",main.status===200,main.status);\n add(\"current_main_equals_bound_base\",main.json?.object?.sha===row.base_sha,main.json?.object?.sha);\n\n const native=await nativeEnforcement();\n add(\"native_enforcement\",native.proven,native);\n\n return {ok:checks.every(x=>x.status===\"PASS\"),checks,native,current_main_sha:main.json?.object?.sha||null};\n}\nasync function audit(event_type:string,plan_id:string|null,object_sha256:string|null){\n if(plan_id){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM deploy_audit_v3 WHERE event_type=? AND plan_id=? LIMIT 1\",args:[event_type,plan_id]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n for(let i=0;i<8;i++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM deploy_audit_v3 ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,plan_id,object_sha256,prev_event_sha256:prev,created_at};\n const h=await sha256(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO deploy_audit_v3(event_type,plan_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,plan_id,object_sha256,prev,h,created_at]});\n return h;\n }catch(e){if(!String(e).includes(\"UNIQUE\"))throw e;}\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-deployer\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\napp.get(\"/health\",c=>c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_DEPLOY_ROOT_TOKEN\"),\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n provider_credential_configured:!!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"),\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID,default_branch:DEFAULT_BRANCH},\n package_sha256:PACKAGE_SHA256,\n authorizer:{\n implementation:AUTHORIZER_IMPLEMENTATION,\n receipt_schema:\"rumbo-r2-dedicated-authorizer-consumption/v3\",\n signature_alg:\"ES256\",\n signing_kid:AUTHORIZER_SIGNING_KID,\n verify_jwk:AUTHORIZER_VERIFY_JWK,\n observer_receipt_required_for_merge:true\n },\n execution_policy:{\n required_authorizer_action:\"MERGE_PR\",\n observer_receipt_required:true,\n max_prepare_merge_receipt_age_seconds:MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS,\n max_execute_receipt_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,\n current_main_must_equal_bound_base:true,\n pr_must_be_ready_not_draft:true,\n native_enforcement_required:true,\n exact_head_sha_merge:true,\n post_merge_main_readback_required:true,\n test_only_never_executable:true\n },\n capabilities:[\n \"signed-authorizer-v3-verification\",\n \"observer-linked-merge-authority\",\n \"github-rest-provider-preflight\",\n \"exact-live-main-base-revalidation\",\n \"native-enforcement-revalidation\",\n \"exact-head-sha-merge\",\n \"post-merge-main-readback\",\n \"fail-closed-provider-credential\",\n \"audit-hash-chain\"\n ],\n production_go:false\n}),200,{\"Cache-Control\":\"no-store\"});\n\napp.post(\"/v3/prepare\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c);\n const verified=await verifyAuthorizerReceipt(b?.authorizer_receipt);\n if(!verified.ok)return c.json({error:verified.error,production_go:false},400,{\"Cache-Control\":\"no-store\"});\n const r=verified.receipt;\n\n if(r.action===\"MERGE_PR\"){\n const age=(Date.now()-Date.parse(r.consumed_at))/1000;\n if(!Number.isFinite(age)||age< -60||age>MAX_PREPARE_MERGE_RECEIPT_AGE_SECONDS){\n return c.json({error:\"MERGE_AUTHORIZER_RECEIPT_STALE\",production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n if(!r.observer_receipt_sha256||r.evidence_sha256!==r.observer_receipt_sha256){\n return c.json({error:\"OBSERVER_LINK_REQUIRED_FOR_MERGE\",production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n }\n\n const planBinding={\n authorizer_action:r.action,\n authorizer_authorization_id:r.authorization_id,\n repository_identity_sha256:r.repository_identity_sha256,\n pr_number:r.pr_number,\n base_sha:r.base_sha,\n head_sha:r.head_sha,\n package_sha256:r.package_sha256,\n evidence_sha256:r.evidence_sha256,\n observer_receipt_sha256:r.observer_receipt_sha256,\n authorizer_request_sha256:r.request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n authorizer_signature_kid:r.receipt_signature.kid,\n authorizer_consumed_at:r.consumed_at,\n authorizer_merge_authorized:r.merge_authorized\n };\n const request_sha256=await sha256(canonical(planBinding));\n const prior=await sqlite.execute({sql:\"SELECT plan_id,status FROM deploy_plans_v3 WHERE request_sha256=? LIMIT 1\",args:[request_sha256]});\n if(prior.rows.length)return c.json({error:\"PLAN_ALREADY_EXISTS\",plan_id:prior.rows[0].plan_id,status:prior.rows[0].status,request_sha256,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n\n const plan_id=crypto.randomUUID(),created_at=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO deploy_plans_v3(\n plan_id,authorizer_action,authorizer_authorization_id,repository_identity_sha256,\n pr_number,base_sha,head_sha,package_sha256,evidence_sha256,observer_receipt_sha256,\n authorizer_request_sha256,authorizer_receipt_sha256,authorizer_signature_kid,\n authorizer_consumed_at,authorizer_merge_authorized,request_sha256,status,created_at\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,'PREPARED',?)`,args:[\n plan_id,r.action,r.authorization_id,r.repository_identity_sha256,r.pr_number,r.base_sha,r.head_sha,\n r.package_sha256,r.evidence_sha256,r.observer_receipt_sha256,r.request_sha256,r.receipt_sha256,\n r.receipt_signature.kid,r.consumed_at,r.merge_authorized?1:0,request_sha256,created_at\n ]});\n await audit(\"V3_PLAN_PREPARED\",plan_id,request_sha256);\n\n const blocked_by:string[]=[];\n if(r.action!==\"MERGE_PR\"||!r.merge_authorized)blocked_by.push(\"AUTHORIZER_ACTION_NOT_MERGE_PR\");\n if(r.action===\"MERGE_PR\"&&!r.observer_receipt_sha256)blocked_by.push(\"OBSERVER_RECEIPT_MISSING\");\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\")blocked_by.push(\"R2_ALLOW_DEPLOY_FALSE\");\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"))blocked_by.push(\"GITHUB_APP_CREDENTIAL_NOT_CONFIGURED\");\n\n return c.json({\n prepared:true,plan_id,request_sha256,\n authorizer_receipt_sha256:r.receipt_sha256,\n observer_receipt_sha256:r.observer_receipt_sha256,\n authorizer_signature_verified:true,\n authorizer_action:r.action,\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n executable:blocked_by.length===0,\n blocked_by,\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/preflight\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v3 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"))return c.json({error:\"PROVIDER_CREDENTIAL_NOT_CONFIGURED\",plan_id,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n const result=await providerPreflight(rs.rows[0]);\n return c.json({plan_id,...result,production_go:false},result.ok?200:409,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/execute\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute({sql:\"SELECT * FROM deploy_plans_v3 WHERE plan_id=? LIMIT 1\",args:[plan_id]});\n if(!rs.rows.length)return c.json({error:\"PLAN_NOT_FOUND\"},404,{\"Cache-Control\":\"no-store\"});\n const row:any=rs.rows[0];\n if(String(row.status)!==\"PREPARED\")return c.json({error:\"PLAN_NOT_PREPARED\",status:row.status,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n if(String(row.authorizer_action)!==\"MERGE_PR\"||Number(row.authorizer_merge_authorized)!==1){\n return c.json({error:\"AUTHORIZER_ACTION_NOT_MERGE_PR\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n if(!row.observer_receipt_sha256||String(row.evidence_sha256)!==String(row.observer_receipt_sha256)){\n return c.json({error:\"OBSERVER_LINK_REQUIRED_FOR_MERGE\",plan_id,production_go:false},403,{\"Cache-Control\":\"no-store\"});\n }\n\n const age=(Date.now()-Date.parse(String(row.authorizer_consumed_at||\"\")))/1000;\n if(!Number.isFinite(age)||age< -60||age>MAX_EXEC_RECEIPT_AGE_SECONDS){\n return c.json({error:\"AUTHORIZER_RECEIPT_STALE\",plan_id,max_age_seconds:MAX_EXEC_RECEIPT_AGE_SECONDS,production_go:false},410,{\"Cache-Control\":\"no-store\"});\n }\n if(Deno.env.get(\"R2_ALLOW_DEPLOY\")!==\"true\"){\n return c.json({error:\"DEPLOY_DISABLED\",plan_id,production_go:false},423,{\"Cache-Control\":\"no-store\"});\n }\n if(!Deno.env.get(\"R2_GITHUB_APP_TOKEN\")){\n return c.json({error:\"PROVIDER_CREDENTIAL_NOT_CONFIGURED\",plan_id,production_go:false},424,{\"Cache-Control\":\"no-store\"});\n }\n\n const pre=await providerPreflight(row);\n if(!pre.ok){\n await audit(\"V3_PROVIDER_PREFLIGHT_NO_GO\",plan_id,await sha256(canonical(pre.checks)));\n return c.json({error:\"PROVIDER_PREFLIGHT_NO_GO\",plan_id,checks:pre.checks,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const merge=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${row.pr_number}/merge`,\"PUT\",{\n sha:String(row.head_sha),\n merge_method:\"merge\"\n });\n if(merge.status!==200||merge.json?.merged!==true||!GIT_SHA_RE.test(String(merge.json?.sha||\"\"))){\n await audit(\"V3_PROVIDER_MERGE_FAILED\",plan_id,await sha256(merge.text||\"\"));\n return c.json({error:\"PROVIDER_MERGE_FAILED\",plan_id,status:merge.status,message:merge.json?.message||null,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n const mergeSha=String(merge.json.sha);\n\n const main=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/git/ref/heads/${DEFAULT_BRANCH}`);\n const mainSha=String(main.json?.object?.sha||\"\");\n if(main.status!==200||mainSha!==mergeSha){\n await audit(\"V3_POST_MERGE_READBACK_FAILED\",plan_id,await sha256(canonical({mergeSha,mainSha,status:main.status})));\n return c.json({error:\"POST_MERGE_MAIN_READBACK_MISMATCH\",plan_id,merge_sha:mergeSha,main_sha:mainSha,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n\n const executed_at=new Date().toISOString();\n const updated:any=await sqlite.execute({\n sql:\"UPDATE deploy_plans_v3 SET status='EXECUTED',executed_at=?,provider_merge_sha=?,provider_main_readback_sha=? WHERE plan_id=? AND status='PREPARED'\",\n args:[executed_at,mergeSha,mainSha,plan_id]\n });\n if(Number(updated?.rowsAffected??0)!==1){\n return c.json({error:\"EXECUTION_LEDGER_RACE\",plan_id,production_go:false},409,{\"Cache-Control\":\"no-store\"});\n }\n await audit(\"V3_PROVIDER_MERGE_EXECUTED\",plan_id,mergeSha);\n\n return c.json({\n executed:true,\n plan_id,\n provider:\"GITHUB_REST\",\n merged_pr:Number(row.pr_number),\n merge_sha:mergeSha,\n main_readback_sha:mainSha,\n observer_receipt_sha256:String(row.observer_receipt_sha256),\n authorizer_receipt_sha256:String(row.authorizer_receipt_sha256),\n product_production_go:false,\n production_go:false,\n note:\"This executes only the gated R2 observer-installation PR merge. It is not product production authorization.\"\n },200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v3/cancel\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const b=await bodyJson(c),plan_id=String(b?.plan_id||\"\");\n if(!plan_id)return c.json({error:\"INVALID_PLAN_ID\"},400,{\"Cache-Control\":\"no-store\"});\n const updated:any=await sqlite.execute({sql:\"UPDATE deploy_plans_v3 SET status='CANCELLED' WHERE plan_id=? AND status='PREPARED'\",args:[plan_id]});\n if(Number(updated?.rowsAffected??0)!==1)return c.json({error:\"PLAN_NOT_CANCELLABLE\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n await audit(\"V3_PLAN_CANCELLED\",plan_id,null);\n return c.json({cancelled:true,plan_id,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v3/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT plan_id,authorizer_action,authorizer_authorization_id,\n repository_identity_sha256,pr_number,base_sha,head_sha,package_sha256,evidence_sha256,\n observer_receipt_sha256,authorizer_request_sha256,authorizer_receipt_sha256,\n authorizer_signature_kid,authorizer_consumed_at,authorizer_merge_authorized,\n request_sha256,status,created_at,executed_at,provider_merge_sha,provider_main_readback_sha\n FROM deploy_plans_v3 ORDER BY created_at DESC LIMIT 100`);\n return c.json({\n schema:\"rumbo-r2-deployer-ledger/v3\",\n implementation:IMPLEMENTATION,\n deploy_enabled:Deno.env.get(\"R2_ALLOW_DEPLOY\")===\"true\",\n provider_credential_configured:!!Deno.env.get(\"R2_GITHUB_APP_TOKEN\"),\n provider_adapter:\"GITHUB_REST_2026_03_10_IMPLEMENTED\",\n production_go:false,\n records:rs.rows\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v3/audit\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM deploy_audit_v3 ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,plan_id:r.plan_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-deployer-audit/v3\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.all(\"/v2/*\",c=>c.json({error:\"V2_RETIRED_USE_V3_OBSERVER_LINKED_AUTHORIZATION\",replacement_prepare:\"/v3/prepare\",production_go:false},410,{\"Cache-Control\":\"no-store\"}));\napp.all(\"/v1/*\",c=>c.json({error:\"V1_RETIRED_USE_V3_OBSERVER_LINKED_AUTHORIZATION\",replacement_prepare:\"/v3/prepare\",production_go:false},410,{\"Cache-Control\":\"no-store\"}));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\nexport default app.fetch;\n",[],[192],"e6cc01a5-ad5e-4ab4-8648-09b30a486de3","RELEASE_V3.md","784b9cc4-a362-11f1-823d-1607ee4eb77e",["D",1787977874548],"# RUMBO R2 Deployer Controller V3 — GitHub REST Adapter\n\nStatus: **PASS / LIVE_CANDIDATE / DEPLOY_DISABLED / CREDENTIAL_PENDING / PRODUCTION_NO_GO**\n\nV3 implements the provider adapter that V2 intentionally left unbound.\n\nImplementation:\n\n`R2_DEPLOYER_CONTROLLER_V3_GITHUB_REST_ADAPTER`\n\nProvider adapter:\n\n`GITHUB_REST_2026_03_10_IMPLEMENTED`\n\n## Trusted authorizer\n\nRequired authorizer:\n\n`DEDICATED_R2_AUTHORIZER_V3_OBSERVER_GATED`\n\nRequired receipt:\n\n`rumbo-r2-dedicated-authorizer-consumption/v3`\n\nThe deployer pins the authorizer ES256 public key and independently verifies the full\nreceipt before plan admission.\n\nFor `MERGE_PR`, the signed receipt must contain a non-null observer receipt SHA-256 and\nthat SHA must equal `evidence_sha256`.\n\n## Provider preflight\n\nBefore any provider mutation, the adapter re-reads GitHub and requires:\n\n- exact repository id `1314199389`;\n- exact owner id `293577326`;\n- private repository;\n- default branch `main`;\n- exact PR number from signed authorization;\n- PR still open;\n- PR no longer draft;\n- PR base still `main`;\n- PR base SHA exactly equals the signed base;\n- PR head SHA exactly equals the signed head;\n- compare API proves head descends from base;\n- current live `main` equals the signed base SHA;\n- native branch/ruleset enforcement is proven live.\n\nAny mismatch fails closed before merge.\n\n## Merge operation\n\nIf all gates are satisfied, the adapter uses GitHub's merge endpoint with the exact\nauthorized head SHA and then requires `main` readback to equal the returned merge SHA.\n\nThe execution ledger is marked EXECUTED only after that exact post-merge readback.\n\nThis merge is scoped only to installation of the R2 observer bootstrap. The response\nretains `product_production_go=false` and `production_go=false`.\n\n## Current fail-closed state\n\n- `R2_ALLOW_DEPLOY`: false/absent;\n- dedicated GitHub App credential: absent;\n- provider adapter code: implemented;\n- provider mutation: impossible under current gates;\n- production_go: false.\n\n## Validation\n\nBranch evaluation:\n\n`01a04bc8-ae80-7681-bb0b-711eb437cef1`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- signed authorizer V3 fixture verifies → true;\n- modified signed fixture verifies → false;\n- unauthenticated V3 ledger → 401;\n- V2 endpoint retired → 410;\n- V1 endpoint retired → 410;\n- tampered receipt admission → 400;\n- forged TEST_ONLY→MERGE_PR receipt → 400;\n- valid signed TEST_ONLY plan → 201;\n- provider preflight without dedicated credential → 424;\n- TEST_ONLY execute → 403;\n- duplicate plan → 409;\n- signature bytes projected by ledger → false;\n- audit chain → PASS;\n- production_go → false.\n\nFixture authorizer receipt SHA-256:\n\n`25d86f0213156af385df003cf8cb63a30de2ae7191b9442593d881e136ad2b53`\n\n## Static source audit\n\nPASS:\n\n- authorizer private signing material absent;\n- exact repository identity pinned;\n- observer-link invariant present for MERGE_PR;\n- current-main/base equality revalidated;\n- native enforcement revalidated;\n- exact authorized head SHA supplied to merge endpoint;\n- post-merge main readback required;\n- V2 provider path retired;\n- signature bytes omitted from ledger projection;\n- production-go remains false.\n\n## Claim boundary\n\nThe provider adapter is now implemented. Provider execution is **not live** because the\ndedicated GitHub App credential and deploy enable flag remain absent.\n\nNo product production authorization is created by this controller.\n",[],[201],"2b24cfac-590d-47af-8023-ca4985c4ee44","RELEASE_V2.md","01a04bc7-66e9-71bc-a6b4-1823f0115200",["D",1787977754351],"# RUMBO R2 Deployer Controller V2 — Signed Authorization\n\nStatus: **PASS / LIVE_CANDIDATE / PROVIDER_UNBOUND / PRODUCTION_NO_GO**\n\nV2 closes the trust gap in V1 where a caller could supply an arbitrary\n`authorizer_receipt_sha256`. Deployment planning now accepts only a complete signed\nconsumption receipt from the dedicated R2 authorizer V2 and verifies it offline.\n\n## Pinned authorizer trust root\n\nRequired authorizer:\n\n`DEDICATED_R2_AUTHORIZER_V2_SIGNED_RECEIPTS`\n\nReceipt schema:\n\n`rumbo-r2-dedicated-authorizer-consumption/v2`\n\nAlgorithm:\n\n`ES256 / ECDSA P-256 + SHA-256`\n\nPinned signing key id:\n\n`bQgIMRdRTyvdHBTMuEdc7T4hTH8zwJA_gkVEcR2TcJY`\n\nOnly the public verification JWK is embedded in the deployer.\n\n## Plan admission\n\n`POST /v2/prepare` verifies:\n\n- exact receipt schema;\n- repository identity;\n- PR number;\n- Git base/head SHA syntax;\n- sealed control-package SHA-256;\n- evidence and request SHA-256;\n- consumed timestamp;\n- exact production-go false;\n- exact action/merge-authorized consistency;\n- receipt SHA-256 recomputation;\n- signing algorithm and key id;\n- ES256 signature under the pinned public key.\n\nThe plan is derived from the verified receipt rather than duplicate caller-supplied\nbinding fields.\n\nV1 unsigned endpoints are retired with HTTP 410.\n\n## Execution policy\n\nA cryptographically valid `TEST_ONLY` receipt may be stored as a non-executable\nevidence plan, but `POST /v2/execute` rejects it with:\n\n`AUTHORIZER_ACTION_NOT_MERGE_PR`\n\nbefore checking the deployment enable flag.\n\nFor an executable path, all of the following would be required:\n\n1. signed authorizer action `MERGE_PR`;\n2. signed `merge_authorized=true`;\n3. receipt age <= 900 seconds;\n4. `R2_ALLOW_DEPLOY=true`;\n5. a dedicated GitHub App provider credential;\n6. a provider adapter.\n\nThe current runtime fails closed before those conditions:\n\n- deploy enabled: false;\n- GitHub App credential: absent;\n- provider adapter: `NOT_BOUND`;\n- production_go: false.\n\n## Adversarial validation\n\nBranch evaluation:\n\n`01a04ba9-dcc8-767a-9cae-18783c6e0100`\n\nResult: **PASS**.\n\nMatrix:\n\n- health → 200;\n- pinned signed fixture verifies → true;\n- tampered local fixture verifies → false;\n- unauthenticated ledger → 401;\n- V1 unsigned endpoint → 410;\n- tampered signed receipt admission → 400;\n- forged TEST_ONLY→MERGE_PR elevation → 400;\n- unsigned V1 receipt admission → 400;\n- valid signed TEST_ONLY prepare → 201;\n- execute TEST_ONLY plan → 403;\n- duplicate prepare → 409;\n- ledger → 200;\n- signature bytes exposed by ledger → false;\n- audit → 200;\n- audit chain valid → true.\n\nFixture authorizer receipt SHA-256:\n\n`e493623c38a1028e7263311300cb558cc8b69665a718ae9c0845a78e9b03602b`\n\n## Claim boundary\n\nThe deployer controller now independently authenticates authorizer receipts. This closes\nreceipt authenticity and action-escalation gaps between authorization custody and\ndeployment planning.\n\nActual provider execution is still not live and remains impossible under current gates.\nNo merge, deployment or product-production authorization is implied.\n",[],[208],["D",1787977754351],[],[18],["D",1787974891297],["D",1789539031988],{"_11":12,"_129":74},{"_11":12,"_124":125,"_73":74,"_30":72,"_126":127,"_128":24},{"_38":114,"_13":16,"_32":35,"_115":76,"_116":64,"_117":118,"_119":80,"_120":76,"_121":41,"_122":14,"_123":12},"ctx",{"_53":-5,"_149":255,"_256":257,"_258":259,"_260":24,"_261":24,"_262":24,"_263":88,"_264":-5,"_265":-7,"_266":-7,"_267":26,"_268":24,"_269":24,"_270":-5,"_271":24,"_272":24,"_273":24,"_274":-5},"ENV",{"_226":227,"_228":229,"_230":65,"_231":232,"_233":234,"_235":236,"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · RELEASE_V1.md