RUMBO R2 GitHub App custody setup

This creates one private GitHub App with only Contents read, Pull requests write, and Administration read.

GitHub will show the final permissions before creation. No billing or plan change is performed.

\n `);\n});\n\napp.get(\"/github/manifest/callback\",async c=>{\n const code=String(c.req.query(\"code\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!code||!state)return c.text(\"Missing code/state\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }\n if(!matched)return c.text(\"Invalid or expired setup state\",403);\n\n const existing=await sqlite.execute(\"SELECT app_id FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(existing.rows.length)return c.text(\"App custody already initialized\",409);\n\n const res=await fetch(`https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`,{\n method:\"POST\",\n headers:{Accept:\"application/vnd.github+json\",\"X-GitHub-Api-Version\":API_VERSION,\"User-Agent\":\"rumbo-r2-github-app-broker/1\"}\n });\n const text=await res.text();\n let data:any=null;try{data=text?JSON.parse(text):null;}catch{}\n if(res.status!==201||!data?.id||!data?.slug||!data?.pem){\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='FAILED',failure_reason=? WHERE session_id=?\",args:[`MANIFEST_CONVERSION_${res.status}`,matched.session_id]});\n return c.text(\"GitHub App manifest conversion failed\",502);\n }\n\n const encrypted=await encryptSecret(String(data.pem));\n const keySha=await sha256Text(String(data.pem));\n const now=new Date();\n await sqlite.execute({sql:`INSERT INTO app_custody(singleton_id,app_id,app_slug,encrypted_private_key,private_key_sha256,created_at)\n VALUES(1,?,?,?,?,?)`,args:[Number(data.id),String(data.slug),encrypted,keySha,now.toISOString()]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='APP_CREATED',app_id=?,app_slug=?,expires_at=? WHERE session_id=?\",\n args:[Number(data.id),String(data.slug),new Date(now.getTime()+MAX_INSTALL_AGE_MS).toISOString(),matched.session_id]});\n await appendAudit(\"GITHUB_APP_MANIFEST_CONVERTED\",String(data.id),keySha);\n\n const install=`https://github.com/apps/${encodeURIComponent(String(data.slug))}/installations/new?state=${encodeURIComponent(state)}`;\n return c.html(`Install RUMBO R2 App\n

GitHub App created and private key sealed

Install it on exactly ${REPO_FULL}. The broker will reject any other repository.

\n Install RUMBO R2 App on the repository`);\n});\n\napp.get(\"/github/install/setup\",async c=>{\n const installationId=Number(c.req.query(\"installation_id\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!Number.isSafeInteger(installationId)||installationId<=0)return c.text(\"Missing installation_id\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='APP_CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n if(state){\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }else if(!matched){\n matched=row;\n }\n }\n if(!matched)return c.text(\"No live pending installation session\",403);\n\n const cust=await custody();\n if(!cust||cust.app_id!==Number(matched.app_id))return c.text(\"Custody/app mismatch\",409);\n\n const appValidation=await validateAppConfiguration(cust);\n if(!appValidation.ok)return c.text(`GitHub App configuration rejected: ${appValidation.error}`,403);\n\n const installValidation=await validateInstallationMetadata(cust,installationId);\n if(!installValidation.ok)return c.text(`GitHub App installation rejected: ${installValidation.error}`,403);\n\n const tokenRes=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${installationId}/access_tokens`,\"POST\",{\n repository_ids:[REPOSITORY_ID],\n permissions:{contents:\"read\",pull_requests:\"read\",administration:\"read\"}\n });\n if(tokenRes.status!==201||!tokenRes.json?.token)return c.text(\"Could not mint verification token\",502);\n\n const verificationToken=String(tokenRes.json.token);\n const scopeValidation=await validateInstallationTokenRepoScope(verificationToken);\n await revokeInstallationToken(verificationToken);\n if(!scopeValidation.ok){\n return c.text(`Installation repository scope rejected: ${scopeValidation.error}`,403);\n }\n\n const accountId=Number(installValidation.json?.account?.id||0);\n const accountLogin=String(installValidation.json?.account?.login||\"\");\n const verifiedAt=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO app_installation(singleton_id,installation_id,account_id,account_login,repository_id,verified_at)\n VALUES(1,?,?,?,?,?)\n ON CONFLICT(singleton_id) DO UPDATE SET installation_id=excluded.installation_id,account_id=excluded.account_id,\n account_login=excluded.account_login,repository_id=excluded.repository_id,verified_at=excluded.verified_at`,\n args:[installationId,accountId,accountLogin,REPOSITORY_ID,verifiedAt]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='INSTALLED',installation_id=? WHERE session_id=?\",args:[installationId,matched.session_id]});\n await appendAudit(\"GITHUB_APP_INSTALLATION_VERIFIED\",String(installationId),await sha256Text(canonical({installationId,accountId,accountLogin,repositoryId:REPOSITORY_ID})));\n\n const autopilot=await runPostInstallAutopilot(\"GITHUB_APP_INSTALL_CALLBACK\");\n const autopilotSummary=htmlEscape(JSON.stringify({\n run_id:autopilot.run_id,\n status:autopilot.status,\n pr_number:autopilot.pr_number||null,\n observer_receipt_sha256:autopilot.observer_receipt_sha256||null,\n observer_status:autopilot.observer_status||null,\n observer_blocking_count:Number.isSafeInteger(autopilot.observer_blocking_count)?autopilot.observer_blocking_count:null,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },null,2));\n\n return c.html(`RUMBO R2 Ready\n

Dedicated GitHub App custody is ready

The private key is encrypted at rest. Installation tokens are minted just-in-time and are never persisted.

Repository identity verified: ${REPO_FULL}.

Post-install fail-closed autopilot

${autopilotSummary}

No merge, deploy, billing, visibility or product-production authority is granted by this automation.

\n `);\n});\n\napp.post(\"/v1/token/observer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"observer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"observer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"observer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/token/deployer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"deployer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"deployer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"deployer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/manifest-preview\",c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n return c.json({\n schema:\"rumbo-r2-github-app-manifest-preview/v1\",\n manifest:manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\"),\n repository_install_scope:{mode:\"ONLY_SELECTED_REPOSITORY\",required_repository_id:REPOSITORY_ID,required_full_name:REPO_FULL},\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/autopilot/status\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT run_id,trigger,status,started_at,completed_at,pr_number,base_sha,head_sha,\n preparation_sha256,observer_receipt_sha256,observer_status,observer_blocking_count,observer_merge_ready,result_json\n FROM autopilot_runs ORDER BY started_at DESC LIMIT 20`);\n const records=(rs.rows as any[]).map(r=>({\n ...r,\n observer_merge_ready:r.observer_merge_ready===null?null:Number(r.observer_merge_ready)===1,\n result:(()=>{try{return JSON.parse(String(r.result_json||\"{}\"));}catch{return {parse_error:true};}})()\n })).map(({result_json,...r})=>r);\n const downstream=await downstreamHealth();\n return c.json({\n schema:\"rumbo-r2-post-install-autopilot-status/v1\",\n implementation:IMPLEMENTATION,\n broker_ready:!!(await installation())&&!!(await custody()),\n service_auth_configured:!!Deno.env.get(\"R2_DEPLOYER_JIT_AUTOPILOT_TOKEN\")&&!!Deno.env.get(\"R2_OBSERVER_AUTOPILOT_TOKEN\"),\n downstream,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false,\n records\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/autopilot/retry\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const result=await runPostInstallAutopilot(\"ROOT_RETRY\");\n return c.json({\n schema:\"rumbo-r2-post-install-autopilot-run/v1\",\n implementation:IMPLEMENTATION,\n ...result,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },result.status===\"SIGNED_OBSERVER_PASS\"||result.status===\"SIGNED_OBSERVER_NO_GO\"?200:409,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/selftest\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const sample=\"rumbo-r2-custody-selftest:\"+crypto.randomUUID();\n const enc=await encryptSecret(sample);\n const dec=await decryptSecret(enc);\n const {privateKey}=generateKeyPairSync(\"rsa\",{modulusLength:2048});\n const pem=privateKey.export({type:\"pkcs8\",format:\"pem\"}).toString();\n const jwt=appJwtFromPem(123456,pem);\n const jwtShape=jwt.split(\".\").length===3;\n const manifest=manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\");\n const permissionsExact=canonical(manifest.default_permissions)===canonical({contents:\"read\",pull_requests:\"write\",administration:\"read\"});\n const expectedPermissionSet=exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const extraPermissionRejected=!exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\",issues:\"read\"});\n const upgradedPermissionRejected=!exactAppPermissionSet({contents:\"write\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const pass=dec===sample&&jwtShape&&permissionsExact&&expectedPermissionSet&&extraPermissionRejected&&upgradedPermissionRejected&&manifest.public===false&&manifest.hook_attributes.active===false;\n return c.json({\n selftest:pass?\"PASS\":\"FAIL\",\n aes_gcm_roundtrip:dec===sample,\n rsa_app_jwt_shape:jwtShape,\n manifest_permissions_exact:permissionsExact,\n exact_permission_set_accepts_expected:expectedPermissionSet,\n exact_permission_set_rejects_extra:extraPermissionRejected,\n exact_permission_set_rejects_upgrade:upgradedPermissionRejected,\n manifest_private:manifest.public===false,\n webhook_inactive:manifest.hook_attributes.active===false,\n tokens_persisted:false,\n production_go:false\n },pass?200:500,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM broker_audit ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256Text(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-github-app-broker-audit/v1\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/github/webhook\",c=>c.body(null,204));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n",[154],"ad1d4626-d292-49b7-b5b2-0a953cbe9941",["D",1787987560314],[27],"2711b30d-c3b8-4ba6-9ca6-b13bf63e02c7","RELEASE_V1_2.md","01a04c5c-fa06-70d5-987d-389d92d2d2f0",["D",1787987556873],"# RUMBO R2 GitHub App Custody Broker V1.2 — Post-Install Autopilot\n\nStatus: **PASS / FAIL_CLOSED / APP_CEREMONY_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT`.\n\nV1.2 adds a narrow post-install automation chain. After the owner-authenticated GitHub App creation and exact repository installation callback succeeds, the broker automatically attempts only:\n\n1. the deployer JIT draft-PR preparation endpoint;\n2. the external observer exact PR/base/head snapshot;\n3. durable storage of the preparation and signed observer receipt summary.\n\nIt never calls the authorizer, a merge endpoint, a deploy endpoint, billing, repository visibility or product-production actions.\n\nTwo independent service bearers are held only in encrypted environment state. The deployer and observer store only SHA-256 verifiers and accept those credentials only on the JIT preparation and observation endpoints respectively.\n\nAutopilot validates exact downstream implementation revisions, requires deploy disabled, validates the JIT fail-closed response contract, requires a signed ES256 observer receipt, requires `invocation_mode=BROKER_AUTOPILOT`, and preserves `merge_authorized=false`, `deploy_enabled=false`, `product_production=NO_GO`, `production_go=false`.\n\nNew admin endpoints:\n- `GET /v1/autopilot/status`\n- `POST /v1/autopilot/retry`\n\nSelftest evaluation: `01a04c4c-abe8-77af-b152-b24237c6e7b6` — PASS.\n\nThe current pre-install state correctly returns `CUSTODY_NOT_READY` before any GitHub mutation. Downstream revision readiness is intentionally false until observer V1.5 and deployer V3.6 are promoted.\n\nStatic audit confirms no service-token literals in source, no authorizer/merge call, exact one-repository custody, exact permission ceilings, durable receipt-summary audit, and global NO_GO.\n",[164],"7b50dc86-f542-47b1-a17d-e6964d1cc85d","RELEASE_V1_1.md","01a04c5c-fa06-70d5-987d-35671c98a5a2",["D",1787987556873],"# RUMBO R2 GitHub App Custody Broker V1.1 — Exact Scope\n\nStatus: **PASS / CUSTODY_CODE_READY / APP_INSTALLATION_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\n\nThe broker implements the GitHub App Manifest flow, AES-256-GCM private-key custody, app-JWT authentication, role-specific JIT installation tokens, exact one-repository scope verification, and a durable audit hash chain.\n\nHardening added in V1.1:\n\n- exact GitHub App owner/id/slug verification through `GET /app`;\n- exact app permission set: `contents:read`, `pull_requests:write`, `administration:read` (plus implicit `metadata:read` only);\n- zero webhook events;\n- installation must belong to the exact owner, be unsuspended, and use `repository_selection=selected`;\n- installation permissions/events must remain exact;\n- every minted token is independently checked via `GET /installation/repositories` and must expose exactly one private repository: `fscfede-beep/rumbo-control-queue`, repository id `1314199389`, owner id `293577326`;\n- verification tokens are revoked immediately after setup validation;\n- role tokens are revoked before returning an error if exact repository scope validation fails;\n- role responses carry the broker implementation id for downstream anti-downgrade pinning;\n- installation/access tokens are never persisted;\n- plaintext PEM is never returned by an HTTP response; only AES-GCM ciphertext is stored.\n\nSelftest evaluation: `01a04be4-8d9f-75ed-925d-5c285c05a08f` — PASS.\n\nSelftest covers AES-GCM roundtrip, GitHub App RS256 JWT construction, exact manifest permission set, rejection of extra/upgraded permissions, private app manifest, inactive webhook, endpoint authentication and audit-chain integrity.\n\nIndependent static source audit after hardening: PASS across exact app/install/repository scope, revocation behavior, encrypted custody, absence of raw secret literals, no token persistence, implementation-bound token responses and `production_go=false`.\n\nThe broker is intentionally not ready until GitHub completes the authenticated App creation and exact repository installation. No billing or product-production action is performed by this release.\n",[170],"pulls","branches",3,"forks","envVars",{"_183":185,"_186":61},"connections",{"_183":61,"_184":61},"count","unfilledCount",7,"emptyCount",{"_41":169,"_31":170,"_29":171,"_146":-5,"_39":40,"_38":147,"_148":57,"_36":205,"_13":61,"_32":20,"_34":173,"_23":24,"_151":-5,"_193":206,"_26":207},{"_41":163,"_31":164,"_29":165,"_146":-5,"_39":40,"_38":147,"_148":57,"_36":202,"_13":61,"_32":20,"_34":167,"_23":24,"_151":-5,"_193":203,"_26":204},{"_41":160,"_31":27,"_29":30,"_146":-5,"_39":40,"_38":14,"_148":57,"_36":199,"_13":61,"_32":33,"_34":35,"_23":24,"_151":-5,"_193":200,"_26":201},{"_41":153,"_31":154,"_29":155,"_146":-5,"_39":40,"_38":147,"_148":57,"_36":196,"_13":61,"_32":157,"_34":158,"_23":24,"_151":-5,"_193":197,"_26":198},{"_41":143,"_31":144,"_29":145,"_146":-5,"_39":40,"_38":147,"_148":57,"_36":192,"_13":61,"_32":33,"_34":150,"_23":24,"_151":-5,"_193":194,"_26":195},["D",1787987556873],"children",[],[144],["D",1787987556873],[],[154],["D",1787987560314],[],[27],["D",1787987556873],[],[164],["D",1787987556873],[],[170],["D",1787978449051],["D",1789542098478],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":53,"_104":105,"_106":24},{"_13":14,"_31":87,"_41":40,"_88":42,"_89":90,"_91":92,"_93":48,"_94":42,"_95":63,"_96":43,"_97":98},"ctx",{"_80":-5,"_128":246,"_247":248,"_249":250,"_251":24,"_252":24,"_253":24,"_254":57,"_255":-5,"_256":-7,"_257":-7,"_258":61,"_259":24,"_260":24,"_261":-5,"_262":24,"_263":24,"_264":24,"_265":-5},"ENV",{"_217":218,"_219":220,"_221":134,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v2