RUMBO R2 GitHub App custody setup

This creates one private GitHub App with only Contents read, Pull requests write, and Administration read.

GitHub will show the final permissions before creation. No billing or plan change is performed.

\n `);\n});\n\napp.get(\"/github/manifest/callback\",async c=>{\n const code=String(c.req.query(\"code\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!code||!state)return c.text(\"Missing code/state\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }\n if(!matched)return c.text(\"Invalid or expired setup state\",403);\n\n const existing=await sqlite.execute(\"SELECT app_id FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(existing.rows.length)return c.text(\"App custody already initialized\",409);\n\n const res=await fetch(`https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`,{\n method:\"POST\",\n headers:{Accept:\"application/vnd.github+json\",\"X-GitHub-Api-Version\":API_VERSION,\"User-Agent\":\"rumbo-r2-github-app-broker/1\"}\n });\n const text=await res.text();\n let data:any=null;try{data=text?JSON.parse(text):null;}catch{}\n if(res.status!==201||!data?.id||!data?.slug||!data?.pem){\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='FAILED',failure_reason=? WHERE session_id=?\",args:[`MANIFEST_CONVERSION_${res.status}`,matched.session_id]});\n return c.text(\"GitHub App manifest conversion failed\",502);\n }\n\n const encrypted=await encryptSecret(String(data.pem));\n const keySha=await sha256Text(String(data.pem));\n const now=new Date();\n await sqlite.execute({sql:`INSERT INTO app_custody(singleton_id,app_id,app_slug,encrypted_private_key,private_key_sha256,created_at)\n VALUES(1,?,?,?,?,?)`,args:[Number(data.id),String(data.slug),encrypted,keySha,now.toISOString()]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='APP_CREATED',app_id=?,app_slug=?,expires_at=? WHERE session_id=?\",\n args:[Number(data.id),String(data.slug),new Date(now.getTime()+MAX_INSTALL_AGE_MS).toISOString(),matched.session_id]});\n await appendAudit(\"GITHUB_APP_MANIFEST_CONVERTED\",String(data.id),keySha);\n\n const install=`https://github.com/apps/${encodeURIComponent(String(data.slug))}/installations/new?state=${encodeURIComponent(state)}`;\n return c.html(`Install RUMBO R2 App\n

GitHub App created and private key sealed

Install it on exactly ${REPO_FULL}. The broker will reject any other repository.

\n Install RUMBO R2 App on the repository`);\n});\n\napp.get(\"/github/install/setup\",async c=>{\n const installationId=Number(c.req.query(\"installation_id\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!Number.isSafeInteger(installationId)||installationId<=0)return c.text(\"Missing installation_id\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='APP_CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n if(state){\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }else if(!matched){\n matched=row;\n }\n }\n if(!matched)return c.text(\"No live pending installation session\",403);\n\n const cust=await custody();\n if(!cust||cust.app_id!==Number(matched.app_id))return c.text(\"Custody/app mismatch\",409);\n\n const appValidation=await validateAppConfiguration(cust);\n if(!appValidation.ok)return c.text(`GitHub App configuration rejected: ${appValidation.error}`,403);\n\n const installValidation=await validateInstallationMetadata(cust,installationId);\n if(!installValidation.ok)return c.text(`GitHub App installation rejected: ${installValidation.error}`,403);\n\n const tokenRes=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${installationId}/access_tokens`,\"POST\",{\n repository_ids:[REPOSITORY_ID],\n permissions:{contents:\"read\",pull_requests:\"read\",administration:\"read\"}\n });\n if(tokenRes.status!==201||!tokenRes.json?.token)return c.text(\"Could not mint verification token\",502);\n\n const verificationToken=String(tokenRes.json.token);\n const scopeValidation=await validateInstallationTokenRepoScope(verificationToken);\n await revokeInstallationToken(verificationToken);\n if(!scopeValidation.ok){\n return c.text(`Installation repository scope rejected: ${scopeValidation.error}`,403);\n }\n\n const accountId=Number(installValidation.json?.account?.id||0);\n const accountLogin=String(installValidation.json?.account?.login||\"\");\n const verifiedAt=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO app_installation(singleton_id,installation_id,account_id,account_login,repository_id,verified_at)\n VALUES(1,?,?,?,?,?)\n ON CONFLICT(singleton_id) DO UPDATE SET installation_id=excluded.installation_id,account_id=excluded.account_id,\n account_login=excluded.account_login,repository_id=excluded.repository_id,verified_at=excluded.verified_at`,\n args:[installationId,accountId,accountLogin,REPOSITORY_ID,verifiedAt]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='INSTALLED',installation_id=? WHERE session_id=?\",args:[installationId,matched.session_id]});\n await appendAudit(\"GITHUB_APP_INSTALLATION_VERIFIED\",String(installationId),await sha256Text(canonical({installationId,accountId,accountLogin,repositoryId:REPOSITORY_ID})));\n\n const autopilot=await runPostInstallAutopilot(\"GITHUB_APP_INSTALL_CALLBACK\");\n const autopilotSummary=htmlEscape(JSON.stringify({\n run_id:autopilot.run_id,\n status:autopilot.status,\n pr_number:autopilot.pr_number||null,\n observer_receipt_sha256:autopilot.observer_receipt_sha256||null,\n observer_status:autopilot.observer_status||null,\n observer_blocking_count:Number.isSafeInteger(autopilot.observer_blocking_count)?autopilot.observer_blocking_count:null,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },null,2));\n\n return c.html(`RUMBO R2 Ready\n

Dedicated GitHub App custody is ready

The private key is encrypted at rest. Installation tokens are minted just-in-time and are never persisted.

Repository identity verified: ${REPO_FULL}.

Post-install fail-closed autopilot

${autopilotSummary}

No merge, deploy, billing, visibility or product-production authority is granted by this automation.

\n `);\n});\n\napp.post(\"/v1/token/observer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"observer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"observer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"observer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/token/deployer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"deployer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"deployer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"deployer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/manifest-preview\",c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n return c.json({\n schema:\"rumbo-r2-github-app-manifest-preview/v1\",\n manifest:manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\"),\n repository_install_scope:{mode:\"ONLY_SELECTED_REPOSITORY\",required_repository_id:REPOSITORY_ID,required_full_name:REPO_FULL},\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/autopilot/status\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT run_id,trigger,status,started_at,completed_at,pr_number,base_sha,head_sha,\n preparation_sha256,observer_receipt_sha256,observer_status,observer_blocking_count,observer_merge_ready,result_json\n FROM autopilot_runs ORDER BY started_at DESC LIMIT 20`);\n const records=(rs.rows as any[]).map(r=>({\n ...r,\n observer_merge_ready:r.observer_merge_ready===null?null:Number(r.observer_merge_ready)===1,\n result:(()=>{try{return JSON.parse(String(r.result_json||\"{}\"));}catch{return {parse_error:true};}})()\n })).map(({result_json,...r})=>r);\n const downstream=await downstreamHealth();\n return c.json({\n schema:\"rumbo-r2-post-install-autopilot-status/v1\",\n implementation:IMPLEMENTATION,\n broker_ready:!!(await installation())&&!!(await custody()),\n service_auth_configured:!!Deno.env.get(\"R2_DEPLOYER_JIT_AUTOPILOT_TOKEN\")&&!!Deno.env.get(\"R2_OBSERVER_AUTOPILOT_TOKEN\"),\n downstream,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false,\n records\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/autopilot/retry\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const result=await runPostInstallAutopilot(\"ROOT_RETRY\");\n return c.json({\n schema:\"rumbo-r2-post-install-autopilot-run/v1\",\n implementation:IMPLEMENTATION,\n ...result,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },result.status===\"SIGNED_OBSERVER_PASS\"||result.status===\"SIGNED_OBSERVER_NO_GO\"?200:409,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/selftest\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const sample=\"rumbo-r2-custody-selftest:\"+crypto.randomUUID();\n const enc=await encryptSecret(sample);\n const dec=await decryptSecret(enc);\n const {privateKey}=generateKeyPairSync(\"rsa\",{modulusLength:2048});\n const pem=privateKey.export({type:\"pkcs8\",format:\"pem\"}).toString();\n const jwt=appJwtFromPem(123456,pem);\n const jwtShape=jwt.split(\".\").length===3;\n const manifest=manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\");\n const permissionsExact=canonical(manifest.default_permissions)===canonical({contents:\"read\",pull_requests:\"write\",administration:\"read\"});\n const expectedPermissionSet=exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const extraPermissionRejected=!exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\",issues:\"read\"});\n const upgradedPermissionRejected=!exactAppPermissionSet({contents:\"write\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const pass=dec===sample&&jwtShape&&permissionsExact&&expectedPermissionSet&&extraPermissionRejected&&upgradedPermissionRejected&&manifest.public===false&&manifest.hook_attributes.active===false;\n return c.json({\n selftest:pass?\"PASS\":\"FAIL\",\n aes_gcm_roundtrip:dec===sample,\n rsa_app_jwt_shape:jwtShape,\n manifest_permissions_exact:permissionsExact,\n exact_permission_set_accepts_expected:expectedPermissionSet,\n exact_permission_set_rejects_extra:extraPermissionRejected,\n exact_permission_set_rejects_upgrade:upgradedPermissionRejected,\n manifest_private:manifest.public===false,\n webhook_inactive:manifest.hook_attributes.active===false,\n tokens_persisted:false,\n production_go:false\n },pass?200:500,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM broker_audit ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256Text(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-github-app-broker-audit/v1\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/github/webhook\",c=>c.body(null,204));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n",[],[92],["D",1787986540187],[],[19],"44f6253d-0eff-4b7d-b395-30d29f5ef45f","RELEASE_V1_1.md","01a04c47-6298-743f-8d31-06c620baf149",1,["D",1787986141848],"# RUMBO R2 GitHub App Custody Broker V1.1 — Exact Scope\n\nStatus: **PASS / CUSTODY_CODE_READY / APP_INSTALLATION_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\n\nThe broker implements the GitHub App Manifest flow, AES-256-GCM private-key custody, app-JWT authentication, role-specific JIT installation tokens, exact one-repository scope verification, and a durable audit hash chain.\n\nHardening added in V1.1:\n\n- exact GitHub App owner/id/slug verification through `GET /app`;\n- exact app permission set: `contents:read`, `pull_requests:write`, `administration:read` (plus implicit `metadata:read` only);\n- zero webhook events;\n- installation must belong to the exact owner, be unsuspended, and use `repository_selection=selected`;\n- installation permissions/events must remain exact;\n- every minted token is independently checked via `GET /installation/repositories` and must expose exactly one private repository: `fscfede-beep/rumbo-control-queue`, repository id `1314199389`, owner id `293577326`;\n- verification tokens are revoked immediately after setup validation;\n- role tokens are revoked before returning an error if exact repository scope validation fails;\n- role responses carry the broker implementation id for downstream anti-downgrade pinning;\n- installation/access tokens are never persisted;\n- plaintext PEM is never returned by an HTTP response; only AES-GCM ciphertext is stored.\n\nSelftest evaluation: `01a04be4-8d9f-75ed-925d-5c285c05a08f` — PASS.\n\nSelftest covers AES-GCM roundtrip, GitHub App RS256 JWT construction, exact manifest permission set, rejection of extra/upgraded permissions, private app manifest, inactive webhook, endpoint authentication and audit-chain integrity.\n\nIndependent static source audit after hardening: PASS across exact app/install/repository scope, revocation behavior, encrypted custody, absence of raw secret literals, no token persistence, implementation-bound token responses and `production_go=false`.\n\nThe broker is intentionally not ready until GitHub completes the authenticated App creation and exact repository installation. No billing or product-production action is performed by this release.\n",[],[105],["D",1787978449051],"legacyEnvVars","httpPrivacy","description","RUMBO R2 GitHub App custody broker","imageUrl","userId","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","cec0f0e4-a363-11f1-a646-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount","tursoName","44ca72b5d95b4859bf7a071b0516aa36","tursoHostname","44ca72b5d95b4859bf7a071b0516aa36-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789542098478],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_158":154},"org",{"_11":12,"_151":152,"_153":154,"_118":119,"_155":156,"_157":52},"branch",{"_17":66,"_13":16,"_36":64,"_43":44,"_46":37,"_47":66,"_148":54,"_149":44,"_150":57,"_58":14,"_55":12},"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":44,"_13":14,"_38":204,"_50":-5,"_113":52,"_53":54,"_114":54,"_115":116,"_117":-5,"_118":119,"_120":121,"_122":68,"_123":-5,"_124":-5,"_125":32,"_56":57,"_126":127,"_128":129,"_130":205,"_132":-5,"_133":134,"_135":134,"_136":137,"_138":137,"_139":137,"_140":134,"_141":134,"_142":206,"_144":207,"_146":208,"_51":52},[192,193,194,195],"files",[192,193,194,195],"counts",{"_182":32,"_183":184,"_185":32,"_35":186,"_187":188},[],{"_36":59,"_13":19,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":68,"_38":69,"_17":32,"_70":24,"_71":72,"_73":52,"_74":-5,"_18":181},"upstreamProject","upstreamBranch",{"_36":37,"_38":179,"_40":180,"_13":42,"_43":44,"_17":45,"_46":-5,"_47":-5,"_48":49,"_50":-5,"_51":52,"_53":54,"_55":12,"_56":57,"_58":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787978449051],["D",1789027675099],[19],"pulls","branches",3,"forks",{"_189":96,"_191":32},"connections",{"_189":32,"_190":32},"count","unfilledCount","emptyCount",{"_36":104,"_13":105,"_60":106,"_62":-5,"_63":64,"_65":107,"_67":68,"_38":108,"_17":32,"_70":24,"_71":109,"_73":52,"_74":-5,"_88":202,"_18":203},{"_36":59,"_13":19,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":68,"_38":101,"_17":32,"_70":24,"_71":72,"_73":52,"_74":-5,"_88":200,"_18":201},{"_36":91,"_13":92,"_60":93,"_62":-5,"_63":64,"_65":94,"_67":68,"_38":95,"_17":96,"_70":97,"_71":98,"_73":52,"_74":-5,"_88":198,"_18":199},{"_36":80,"_13":81,"_60":82,"_62":-5,"_63":64,"_65":83,"_67":68,"_38":84,"_17":85,"_70":86,"_71":87,"_73":52,"_74":-5,"_88":196,"_18":197},[],[81],[],[92],[],[19],[],[105],["D",1787978449051],["D",1789542098478],{"_11":12,"_158":154},{"_11":12,"_151":152,"_153":154,"_118":119,"_155":156,"_157":52},{"_17":66,"_13":16,"_36":64,"_43":44,"_46":37,"_47":66,"_148":54,"_149":44,"_150":57,"_58":14,"_55":12},"ctx",{"_142":-5,"_176":242,"_243":244,"_245":246,"_247":52,"_248":52,"_249":52,"_250":68,"_251":-5,"_252":-7,"_253":-7,"_254":32,"_255":52,"_256":52,"_257":-5,"_258":52,"_259":52,"_260":52,"_261":-5},"ENV",{"_213":214,"_215":216,"_217":42,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]