[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_204":205,"_206":207},"routes/_app.x.$handle.$name",{"_97":96,"_31":42,"_106":86,"_26":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":120,"_121":24,"_122":123,"_124":56,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_40":41,"_31":42,"_35":43,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":80,"_81":82,"_83":84,"_85":24},"version",15,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":20,"_33":34,"_35":36,"_37":14,"_38":39,"_23":24},"previous","deleted",false,"deletedHere","path","RELEASE_V1_2.md","latestPath","fileId","a56c3cea-a376-11f1-9779-1607ee4eb77e","name","fileType","content","# RUMBO R2 GitHub App Custody Broker V1.2 — Post-Install Autopilot\n\nStatus: **PASS / FAIL_CLOSED / APP_CEREMONY_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT`.\n\nV1.2 adds a narrow post-install automation chain. After the owner-authenticated GitHub App creation and exact repository installation callback succeeds, the broker automatically attempts only:\n\n1. the deployer JIT draft-PR preparation endpoint;\n2. the external observer exact PR/base/head snapshot;\n3. durable storage of the preparation and signed observer receipt summary.\n\nIt never calls the authorizer, a merge endpoint, a deploy endpoint, billing, repository visibility or product-production actions.\n\nTwo independent service bearers are held only in encrypted environment state. The deployer and observer store only SHA-256 verifiers and accept those credentials only on the JIT preparation and observation endpoints respectively.\n\nAutopilot validates exact downstream implementation revisions, requires deploy disabled, validates the JIT fail-closed response contract, requires a signed ES256 observer receipt, requires `invocation_mode=BROKER_AUTOPILOT`, and preserves `merge_authorized=false`, `deploy_enabled=false`, `product_production=NO_GO`, `production_go=false`.\n\nNew admin endpoints:\n- `GET /v1/autopilot/status`\n- `POST /v1/autopilot/retry`\n\nSelftest evaluation: `01a04c4c-abe8-77af-b152-b24237c6e7b6` — PASS.\n\nThe current pre-install state correctly returns `CUSTODY_NOT_READY` before any GitHub mutation. Downstream revision readiness is intentionally false until observer V1.5 and deployer V3.6 are promoted.\n\nStatic audit confirms no service-token literals in source, no authorizer/merge call, exact one-repository custody, exact permission ceilings, durable receipt-summary audit, and global NO_GO.\n","createdAt",["D",1787986540187],"branchVersion","branchId","9b6dba0b-ae18-4da9-be55-7168f9f97dda","id","44ca72b5-d95b-4859-bf7a-071b0516aa36","rumbo-r2-github-app-broker",["D",1787978449051],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","RUMBO R2 GitHub App custody broker","imageUrl","d3788f19-13c5-4356-87e8-dce639626bb9","pinnedFileId","cec0f0e4-a363-11f1-a646-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","tursoName","44ca72b5d95b4859bf7a071b0516aa36","tursoHostname","44ca72b5d95b4859bf7a071b0516aa36-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789542098478],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_97":96,"_105":101},"org",{"_97":96,"_98":99,"_100":101,"_18":52,"_102":103,"_104":24},"branch",{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":14,"_91":47,"_92":41,"_93":62,"_94":42,"_95":96},"isOwned","v1-2-post-install-autopilot","projectId","forkedBranchId","03db65e7-d606-458c-889b-d9ce53af5170","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","sebas1","handle","displayName","sebas","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_40":41,"_31":42,"_35":199,"_44":-5,"_45":24,"_46":47,"_48":47,"_49":50,"_51":-5,"_18":52,"_53":54,"_55":56,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":64,"_65":66,"_67":200,"_69":-5,"_70":71,"_72":71,"_73":74,"_75":74,"_76":74,"_77":71,"_78":71,"_79":201,"_81":202,"_83":203,"_85":24},"tree",[182,183,184,185],"files",[182,183,184,185],"counts",{"_171":60,"_172":173,"_174":60,"_175":176,"_177":178},"contents",[136,137,138,139],"upstreamProject","upstreamBranch",{"_40":89,"_35":129,"_130":131,"_31":132,"_87":41,"_13":133,"_88":-5,"_90":-5,"_134":135,"_44":-5,"_85":24,"_46":47,"_95":96,"_61":62,"_94":42},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787978449051],"updatedAt",["D",1789027675099],"main",24,"lockfileKey","1789027675310-esm.town_v_sebas1_rumbo-r2-github-app-broker@24-main",{"_40":164,"_31":165,"_29":166,"_143":-5,"_38":39,"_37":167,"_145":56,"_35":168,"_13":60,"_32":20,"_33":169,"_23":24,"_150":-5,"_26":170},{"_40":161,"_31":27,"_29":30,"_143":-5,"_38":39,"_37":14,"_145":56,"_35":162,"_13":60,"_32":20,"_33":34,"_23":24,"_150":-5,"_26":163},{"_40":152,"_31":153,"_29":154,"_143":-5,"_38":39,"_37":155,"_145":56,"_35":156,"_13":157,"_32":158,"_33":159,"_23":24,"_150":-5,"_26":160},{"_40":140,"_31":141,"_29":142,"_143":-5,"_38":39,"_37":144,"_145":56,"_35":146,"_13":147,"_32":148,"_33":149,"_23":24,"_150":-5,"_26":151},"32570442-c4a8-44ab-8046-46b9e1fd8b44","selftest.ts","01a04c47-6298-743f-8d31-0e2dc54380a4","parentId",14,"latest",["D",1787986482232],6,"script","const base=\"https://sebas1--01a04c476298743f8d310a16c9852da3.web.val.run\";\nconst root=Deno.env.get(\"R2_BROKER_ROOT_TOKEN\");\nif(!root) throw new Error(\"ROOT_TOKEN_MISSING\");\nconst auth={Authorization:`Bearer ${root}`};\n\nconst healthRes=await fetch(base+\"/health\");\nconst health=await healthRes.json();\n\nconst unauthSetup=await fetch(base+\"/v1/setup-session\",{method:\"POST\"});\nconst unauthManifest=await fetch(base+\"/v1/manifest-preview\");\nconst unauthObserver=await fetch(base+\"/v1/token/observer\",{method:\"POST\"});\nconst unauthDeployer=await fetch(base+\"/v1/token/deployer\",{method:\"POST\"});\nconst unauthAutopilotStatus=await fetch(base+\"/v1/autopilot/status\");\nconst unauthAutopilotRetry=await fetch(base+\"/v1/autopilot/retry\",{method:\"POST\"});\n\nconst selfRes=await fetch(base+\"/v1/selftest\",{method:\"POST\",headers:auth});\nconst self=await selfRes.json();\n\nconst manifestRes=await fetch(base+\"/v1/manifest-preview\",{headers:auth});\nconst preview=await manifestRes.json();\n\nconst autopilotStatusRes=await fetch(base+\"/v1/autopilot/status\",{headers:auth});\nconst autopilotStatus:any=await autopilotStatusRes.json();\nconst autopilotRetryRes=await fetch(base+\"/v1/autopilot/retry\",{method:\"POST\",headers:auth});\nconst autopilotRetry:any=await autopilotRetryRes.json();\n\nconst auditRes=await fetch(base+\"/v1/audit\",{headers:auth});\nconst audit=await auditRes.json();\n\nconst m=preview.manifest||{};\nconst perms=m.default_permissions||{};\nconst installScope=preview.repository_install_scope||{};\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\"&&\n health.post_install_autopilot?.service_auth_configured===true&&\n health.post_install_autopilot?.plaintext_service_tokens_exposed===false&&\n health.post_install_autopilot?.expected_deployer_implementation===\"R2_DEPLOYER_CONTROLLER_V3_6_BROKER_AUTOPILOT\"&&\n health.post_install_autopilot?.expected_observer_implementation===\"R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT\"&&\n health.post_install_autopilot?.ready===false&&\n health.post_install_autopilot?.max_authority===\"DRAFT_PR_PLUS_SIGNED_OBSERVER_ONLY\"&&\n health.post_install_autopilot?.merge_authorized===false&&\n health.post_install_autopilot?.deploy_enabled===false&&\n health.root_token_configured===true&&\n health.custody_encryption_key_configured===true&&\n health.setup_pepper_configured===true&&\n health.observer_role_hash_configured===true&&\n health.deployer_role_hash_configured===true&&\n health.app_created===false&&\n health.installation_verified===false&&\n health.broker_ready===false&&\n health.tokens_persisted===false&&\n health.private_key_plaintext_persisted===false&&\n health.production_go===false&&\n unauthSetup.status===401&&\n unauthManifest.status===401&&\n unauthObserver.status===401&&\n unauthDeployer.status===401&&\n unauthAutopilotStatus.status===401&&\n unauthAutopilotRetry.status===401&&\n autopilotStatusRes.status===200&&\n autopilotStatus.schema===\"rumbo-r2-post-install-autopilot-status/v1\"&&\n autopilotStatus.implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\"&&\n autopilotStatus.broker_ready===false&&\n autopilotStatus.service_auth_configured===true&&\n autopilotStatus.downstream?.ready===false&&\n autopilotStatus.merge_authorized===false&&\n autopilotStatus.deploy_enabled===false&&\n autopilotStatus.production_go===false&&\n autopilotRetryRes.status===409&&\n autopilotRetry.schema===\"rumbo-r2-post-install-autopilot-run/v1\"&&\n autopilotRetry.status===\"CUSTODY_NOT_READY\"&&\n autopilotRetry.merge_authorized===false&&\n autopilotRetry.deploy_enabled===false&&\n autopilotRetry.production_go===false&&\n selfRes.status===200&&\n self.selftest===\"PASS\"&&\n self.aes_gcm_roundtrip===true&&\n self.rsa_app_jwt_shape===true&&\n self.manifest_permissions_exact===true&&\n self.exact_permission_set_accepts_expected===true&&\n self.exact_permission_set_rejects_extra===true&&\n self.exact_permission_set_rejects_upgrade===true&&\n self.manifest_private===true&&\n self.webhook_inactive===true&&\n self.tokens_persisted===false&&\n self.production_go===false&&\n manifestRes.status===200&&\n m.public===false&&\n m.hook_attributes?.active===false&&\n perms.contents===\"read\"&&\n perms.pull_requests===\"write\"&&\n perms.administration===\"read\"&&\n Array.isArray(m.default_events)&&m.default_events.length===0&&\n m.request_oauth_on_install===false&&\n m.setup_on_update===false&&\n installScope.mode===\"ONLY_SELECTED_REPOSITORY\"&&\n installScope.required_repository_id===1314199389&&\n installScope.required_full_name===\"fscfede-beep/rumbo-control-queue\"&&\n preview.production_go===false&&\n auditRes.status===200&&\n audit.audit_chain_ok===true&&\n audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n broker_ready:health.broker_ready,\n unauth_setup:unauthSetup.status,\n unauth_manifest:unauthManifest.status,\n unauth_observer_token:unauthObserver.status,\n unauth_deployer_token:unauthDeployer.status,\n unauth_autopilot_status:unauthAutopilotStatus.status,\n unauth_autopilot_retry:unauthAutopilotRetry.status,\n autopilot_status:autopilotStatusRes.status,\n autopilot_downstream_ready:autopilotStatus.downstream?.ready,\n autopilot_retry_without_custody:autopilotRetryRes.status,\n autopilot_retry_state:autopilotRetry.status,\n internal_selftest:selfRes.status,\n aes_gcm_roundtrip:self.aes_gcm_roundtrip,\n rsa_app_jwt_shape:self.rsa_app_jwt_shape,\n manifest_permissions_exact:self.manifest_permissions_exact,\n exact_permission_set_accepts_expected:self.exact_permission_set_accepts_expected,\n exact_permission_set_rejects_extra:self.exact_permission_set_rejects_extra,\n exact_permission_set_rejects_upgrade:self.exact_permission_set_rejects_upgrade,\n manifest_private:self.manifest_private,\n webhook_inactive:self.webhook_inactive,\n manifest_preview:manifestRes.status,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n app_created:health.app_created,\n installation_verified:health.installation_verified,\n tokens_persisted:health.tokens_persisted,\n private_key_plaintext_persisted:health.private_key_plaintext_persisted,\n production_go:false\n},null,2));\nif(!pass)Deno.exit(1);\n","label",[141],"cf04a113-2f87-4293-b734-acd602138773","main.tsx","01a04c47-6298-743f-8d31-0a16c9852da3",8,["D",1787986438786],7,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { createPrivateKey, sign as nodeSign, generateKeyPairSync } from \"node:crypto\";\nimport { Buffer } from \"node:buffer\";\n\nconst app=new Hono();\n\nconst IMPLEMENTATION=\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\";\nconst DEPLOYER_BASE=\"https://sebas1--862fe8baa35b11f18a2b1607ee4eb77e.web.val.run\";\nconst DEPLOYER_IMPLEMENTATION=\"R2_DEPLOYER_CONTROLLER_V3_6_BROKER_AUTOPILOT\";\nconst OBSERVER_BASE=\"https://sebas1--3875e380a36111f1aa591607ee4eb77e.web.val.run\";\nconst OBSERVER_IMPLEMENTATION=\"R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT\";\nconst BASE=\"https://sebas1--cec0f0e4a36311f1a6461607ee4eb77e.web.val.run\";\nconst API_VERSION=\"2026-03-10\";\nconst REPO_OWNER=\"fscfede-beep\";\nconst REPO_NAME=\"rumbo-control-queue\";\nconst REPO_FULL=`${REPO_OWNER}/${REPO_NAME}`;\nconst REPOSITORY_ID=1314199389;\nconst OWNER_ID=293577326;\nconst MAX_SETUP_AGE_MS=30*60*1000;\nconst MAX_INSTALL_AGE_MS=2*60*60*1000;\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS setup_sessions(\n session_id TEXT PRIMARY KEY,\n status TEXT NOT NULL CHECK(status IN ('CREATED','APP_CREATED','INSTALLED','EXPIRED','FAILED')),\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n app_id INTEGER,\n app_slug TEXT,\n installation_id INTEGER,\n failure_reason TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS app_custody(\n singleton_id INTEGER PRIMARY KEY CHECK(singleton_id=1),\n app_id INTEGER NOT NULL UNIQUE,\n app_slug TEXT NOT NULL,\n encrypted_private_key TEXT NOT NULL,\n private_key_sha256 TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS app_installation(\n singleton_id INTEGER PRIMARY KEY CHECK(singleton_id=1),\n installation_id INTEGER NOT NULL UNIQUE,\n account_id INTEGER NOT NULL,\n account_login TEXT NOT NULL,\n repository_id INTEGER NOT NULL,\n verified_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS broker_audit(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n object_id TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_broker_audit_prev ON broker_audit(prev_event_sha256)`,\n `CREATE TABLE IF NOT EXISTS autopilot_runs(\n run_id TEXT PRIMARY KEY,\n trigger TEXT NOT NULL,\n status TEXT NOT NULL,\n started_at TEXT NOT NULL,\n completed_at TEXT,\n pr_number INTEGER,\n base_sha TEXT,\n head_sha TEXT,\n preparation_sha256 TEXT,\n observer_receipt_sha256 TEXT,\n observer_status TEXT,\n observer_blocking_count INTEGER,\n observer_merge_ready INTEGER,\n result_json TEXT NOT NULL\n )`,\n `CREATE INDEX IF NOT EXISTS idx_autopilot_runs_started ON autopilot_runs(started_at DESC)`\n]);\n\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256Text(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64url(bytes:Uint8Array):string{\n const raw=Array.from(bytes,b=>String.fromCharCode(b)).join(\"\");\n return btoa(raw).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nfunction bearer(req:Request):string{\n const h=req.headers.get(\"authorization\")||\"\";\n return h.startsWith(\"Bearer \")?h.slice(7):\"\";\n}\nfunction ct(a:string,b:string):boolean{\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0;for(let i=0;i{\n const token=bearer(req);\n if(!token)return false;\n const observed=await sha256Text(token);\n const key=role===\"observer\"?\"R2_OBSERVER_ROLE_TOKEN_SHA256\":\"R2_DEPLOYER_ROLE_TOKEN_SHA256\";\n const expected=Deno.env.get(key)||\"\";\n return !!expected&&ct(expected,observed);\n}\nasync function aesKey():Promise{\n const raw=Deno.env.get(\"R2_CUSTODY_AES_KEY_B64URL\")||\"\";\n if(!raw)throw new Error(\"CUSTODY_AES_KEY_NOT_CONFIGURED\");\n const bytes=b64urlDecode(raw);\n if(bytes.byteLength!==32)throw new Error(\"CUSTODY_AES_KEY_INVALID\");\n return await crypto.subtle.importKey(\"raw\",bytes,{name:\"AES-GCM\"},false,[\"encrypt\",\"decrypt\"]);\n}\nasync function encryptSecret(plaintext:string):Promise{\n const key=await aesKey();\n const iv=crypto.getRandomValues(new Uint8Array(12));\n const ctbuf=await crypto.subtle.encrypt({name:\"AES-GCM\",iv},key,new TextEncoder().encode(plaintext));\n return JSON.stringify({v:1,alg:\"A256GCM\",iv:b64url(iv),ciphertext:b64url(new Uint8Array(ctbuf))});\n}\nasync function decryptSecret(envelope:string):Promise{\n const obj=JSON.parse(envelope);\n if(obj?.v!==1||obj?.alg!==\"A256GCM\")throw new Error(\"CUSTODY_ENVELOPE_INVALID\");\n const key=await aesKey();\n const plain=await crypto.subtle.decrypt({name:\"AES-GCM\",iv:b64urlDecode(String(obj.iv))},key,b64urlDecode(String(obj.ciphertext)));\n return new TextDecoder().decode(new Uint8Array(plain));\n}\nfunction appJwtFromPem(appId:number,pem:string):string{\n const now=Math.floor(Date.now()/1000);\n const header=b64url(new TextEncoder().encode(JSON.stringify({alg:\"RS256\",typ:\"JWT\"})));\n const payload=b64url(new TextEncoder().encode(JSON.stringify({iat:now-60,exp:now+540,iss:String(appId)})));\n const input=`${header}.${payload}`;\n const privateKey=createPrivateKey(pem);\n const sig=nodeSign(\"RSA-SHA256\",Buffer.from(input),privateKey);\n return `${input}.${b64url(new Uint8Array(sig))}`;\n}\nasync function appendAudit(event_type:string,object_id:string|null,object_sha256:string|null){\n for(let i=0;i<8;i++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM broker_audit ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,object_id,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256=await sha256Text(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO broker_audit(event_type,object_id,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,object_id,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n }catch(e){if(!String(e).includes(\"UNIQUE\"))throw e;}\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\nasync function setupState(sessionId:string):Promise{\n const pepper=Deno.env.get(\"R2_SETUP_PEPPER\")||\"\";\n if(!pepper)throw new Error(\"SETUP_PEPPER_NOT_CONFIGURED\");\n return await sha256Text(`${sessionId}:${pepper}`);\n}\nfunction manifestFor(sessionId:string,state:string){\n return {\n name:`RUMBO-R2-Control-Gate-${sessionId.slice(0,8)}`,\n url:BASE,\n hook_attributes:{url:`${BASE}/github/webhook`,active:false},\n redirect_url:`${BASE}/github/manifest/callback`,\n setup_url:`${BASE}/github/install/setup`,\n description:\"RUMBO R2 least-privilege private repository control gate\",\n public:false,\n default_permissions:{\n contents:\"read\",\n pull_requests:\"write\",\n administration:\"read\"\n },\n default_events:[],\n request_oauth_on_install:false,\n setup_on_update:false\n };\n}\nfunction htmlEscape(s:string):string{\n return s.replaceAll(\"&\",\"&\").replaceAll(\"<\",\"<\").replaceAll(\">\",\">\").replaceAll('\"',\""\");\n}\nasync function githubAppRequest(appId:number,pem:string,path:string,method=\"GET\",body?:unknown){\n const jwt=appJwtFromPem(appId,pem);\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${jwt}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-github-app-broker/1\",\n \"Content-Type\":\"application/json\"\n },\n body:body===undefined?undefined:JSON.stringify(body)\n });\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n}\nasync function custody(){\n const c=await sqlite.execute(\"SELECT * FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(!c.rows.length)return null;\n const row:any=c.rows[0];\n const pem=await decryptSecret(String(row.encrypted_private_key));\n return {app_id:Number(row.app_id),app_slug:String(row.app_slug),pem};\n}\nasync function installation(){\n const r=await sqlite.execute(\"SELECT * FROM app_installation WHERE singleton_id=1 LIMIT 1\");\n return r.rows.length?r.rows[0]:null;\n}\n\nfunction exactAppPermissionSet(perms:any):boolean{\n if(!perms||typeof perms!==\"object\")return false;\n if(perms.contents!==\"read\"||perms.pull_requests!==\"write\"||perms.administration!==\"read\")return false;\n for(const [key,value] of Object.entries(perms)){\n if(key===\"metadata\"){\n if(value!==\"read\")return false;\n continue;\n }\n if(key===\"contents\"&&value===\"read\")continue;\n if(key===\"pull_requests\"&&value===\"write\")continue;\n if(key===\"administration\"&&value===\"read\")continue;\n return false;\n }\n return true;\n}\n\nasync function validateAppConfiguration(cust:{app_id:number;app_slug:string;pem:string}){\n const r=await githubAppRequest(cust.app_id,cust.pem,\"/app\");\n if(r.status!==200||!r.json)return {ok:false,error:`APP_METADATA_${r.status}`};\n const j=r.json;\n if(Number(j.id)!==cust.app_id)return {ok:false,error:\"APP_ID_MISMATCH\"};\n if(String(j.slug||\"\")!==cust.app_slug)return {ok:false,error:\"APP_SLUG_MISMATCH\"};\n if(Number(j.owner?.id)!==OWNER_ID||String(j.owner?.login||\"\")!==REPO_OWNER)return {ok:false,error:\"APP_OWNER_MISMATCH\"};\n if(!exactAppPermissionSet(j.permissions))return {ok:false,error:\"APP_PERMISSION_DRIFT\"};\n if(!Array.isArray(j.events)||j.events.length!==0)return {ok:false,error:\"APP_EVENT_DRIFT\"};\n return {ok:true};\n}\n\nasync function validateInstallationMetadata(cust:{app_id:number;app_slug:string;pem:string},installationId:number){\n const r=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${installationId}`);\n if(r.status!==200||!r.json)return {ok:false,error:`INSTALLATION_METADATA_${r.status}`,json:r.json};\n const j=r.json;\n if(Number(j.id)!==installationId||Number(j.app_id)!==cust.app_id)return {ok:false,error:\"INSTALLATION_APP_MISMATCH\",json:j};\n if(Number(j.account?.id)!==OWNER_ID||String(j.account?.login||\"\")!==REPO_OWNER||String(j.target_type||\"\")!==\"User\"){\n return {ok:false,error:\"INSTALLATION_OWNER_MISMATCH\",json:j};\n }\n if(String(j.repository_selection||\"\")!==\"selected\")return {ok:false,error:\"INSTALLATION_NOT_SELECTED_REPOS_ONLY\",json:j};\n if(j.suspended_at!==null&&j.suspended_at!==undefined)return {ok:false,error:\"INSTALLATION_SUSPENDED\",json:j};\n if(!exactAppPermissionSet(j.permissions))return {ok:false,error:\"INSTALLATION_PERMISSION_DRIFT\",json:j};\n if(!Array.isArray(j.events)||j.events.length!==0)return {ok:false,error:\"INSTALLATION_EVENT_DRIFT\",json:j};\n return {ok:true,json:j};\n}\n\nasync function installationTokenRequest(token:string,path:string,method=\"GET\"){\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${token}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-github-app-broker/1\"\n }\n });\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n}\n\nasync function validateInstallationTokenRepoScope(token:string){\n const r=await installationTokenRequest(token,\"/installation/repositories?per_page=100\");\n if(r.status!==200||!r.json)return {ok:false,error:`INSTALLATION_REPOSITORIES_${r.status}`};\n const repos=Array.isArray(r.json.repositories)?r.json.repositories:[];\n const exact=\n Number(r.json.total_count)===1&&repos.length===1&&\n Number(repos[0]?.id)===REPOSITORY_ID&&\n String(repos[0]?.full_name||\"\")===REPO_FULL&&\n Number(repos[0]?.owner?.id)===OWNER_ID&&\n repos[0]?.private===true;\n return exact?{ok:true}:{ok:false,error:\"INSTALLATION_REPOSITORY_SCOPE_DRIFT\"};\n}\n\nasync function revokeInstallationToken(token:string){\n try{await installationTokenRequest(token,\"/installation/token\",\"DELETE\");}catch{}\n}\n\nasync function createInstallationToken(role:\"observer\"|\"deployer\"){\n const cust=await custody();\n const inst:any=await installation();\n if(!cust||!inst)throw new Error(\"CUSTODY_NOT_READY\");\n\n const appValidation=await validateAppConfiguration(cust);\n if(!appValidation.ok)throw new Error(appValidation.error);\n\n const installValidation=await validateInstallationMetadata(cust,Number(inst.installation_id));\n if(!installValidation.ok)throw new Error(installValidation.error);\n\n const permissions=role===\"observer\"\n ? {contents:\"read\",pull_requests:\"read\",administration:\"read\"}\n : {contents:\"read\",pull_requests:\"write\",administration:\"read\"};\n const r=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${inst.installation_id}/access_tokens`,\"POST\",{\n repository_ids:[REPOSITORY_ID],\n permissions\n });\n if(r.status!==201||!r.json?.token||!r.json?.expires_at){\n throw new Error(`INSTALLATION_TOKEN_FAILED_${r.status}_${r.json?.message||\"UNKNOWN\"}`);\n }\n\n const token=String(r.json.token);\n const scopeValidation=await validateInstallationTokenRepoScope(token);\n if(!scopeValidation.ok){\n await revokeInstallationToken(token);\n throw new Error(scopeValidation.error);\n }\n\n await appendAudit(\"INSTALLATION_TOKEN_ISSUED\",role,await sha256Text(canonical({\n role,expires_at:r.json.expires_at,repository_id:REPOSITORY_ID,permissions,\n app_id:cust.app_id,installation_id:Number(inst.installation_id)\n })));\n return {token,expires_at:String(r.json.expires_at),permissions,repository_id:REPOSITORY_ID};\n}\n\nasync function fetchJson(url:string,init:RequestInit={}){\n try{\n const res=await fetch(url,{...init,signal:AbortSignal.timeout(30000)});\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n }catch(e){\n return {status:0,json:null,text:String(e)};\n }\n}\n\nasync function downstreamHealth(){\n const [deployer,observer]=await Promise.all([\n fetchJson(DEPLOYER_BASE+\"/health\",{headers:{\"User-Agent\":\"rumbo-r2-github-app-broker/1.2\"}}),\n fetchJson(OBSERVER_BASE+\"/health\",{headers:{\"User-Agent\":\"rumbo-r2-github-app-broker/1.2\"}})\n ]);\n const deployerReady=\n deployer.status===200&&\n deployer.json?.implementation===DEPLOYER_IMPLEMENTATION&&\n deployer.json?.broker_autopilot_token_hash_configured===true&&\n deployer.json?.deploy_enabled===false&&\n deployer.json?.production_go===false;\n const observerReady=\n observer.status===200&&\n observer.json?.implementation===OBSERVER_IMPLEMENTATION&&\n observer.json?.broker_autopilot_token_hash_configured===true&&\n observer.json?.production_go===false;\n return {\n ready:deployerReady&&observerReady,\n deployer:{\n status:deployer.status,\n implementation:deployer.json?.implementation||null,\n service_auth_ready:deployer.json?.broker_autopilot_token_hash_configured===true,\n deploy_enabled:deployer.json?.deploy_enabled??null,\n production_go:deployer.json?.production_go??null,\n exact:deployerReady\n },\n observer:{\n status:observer.status,\n implementation:observer.json?.implementation||null,\n service_auth_ready:observer.json?.broker_autopilot_token_hash_configured===true,\n production_go:observer.json?.production_go??null,\n exact:observerReady\n }\n };\n}\n\nasync function persistAutopilotRun(v:any){\n await sqlite.execute({\n sql:`INSERT INTO autopilot_runs(\n run_id,trigger,status,started_at,completed_at,pr_number,base_sha,head_sha,preparation_sha256,\n observer_receipt_sha256,observer_status,observer_blocking_count,observer_merge_ready,result_json\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,\n args:[\n v.run_id,v.trigger,v.status,v.started_at,v.completed_at||null,v.pr_number||null,v.base_sha||null,v.head_sha||null,\n v.preparation_sha256||null,v.observer_receipt_sha256||null,v.observer_status||null,\n Number.isSafeInteger(v.observer_blocking_count)?v.observer_blocking_count:null,\n typeof v.observer_merge_ready===\"boolean\"?(v.observer_merge_ready?1:0):null,\n JSON.stringify(v.result||{})\n ]\n });\n}\n\nasync function runPostInstallAutopilot(trigger:string){\n const run_id=crypto.randomUUID();\n const started_at=new Date().toISOString();\n const base:any={run_id,trigger,started_at};\n\n const cust=await custody();\n const inst:any=await installation();\n if(!cust||!inst){\n const out={...base,status:\"CUSTODY_NOT_READY\",completed_at:new Date().toISOString(),result:{production_go:false}};\n await persistAutopilotRun(out);\n return out;\n }\n\n const deployerToken=Deno.env.get(\"R2_DEPLOYER_JIT_AUTOPILOT_TOKEN\")||\"\";\n const observerToken=Deno.env.get(\"R2_OBSERVER_AUTOPILOT_TOKEN\")||\"\";\n if(!deployerToken||!observerToken){\n const out={...base,status:\"SERVICE_AUTH_NOT_CONFIGURED\",completed_at:new Date().toISOString(),result:{\n deployer_token_configured:!!deployerToken,observer_token_configured:!!observerToken,production_go:false\n }};\n await persistAutopilotRun(out);\n return out;\n }\n\n const dh=await downstreamHealth();\n if(!dh.ready){\n const out={...base,status:\"DOWNSTREAM_NOT_READY\",completed_at:new Date().toISOString(),result:{downstream:dh,production_go:false}};\n await persistAutopilotRun(out);\n return out;\n }\n\n const jit=await fetchJson(DEPLOYER_BASE+\"/v3/jit/prepare-activation\",{\n method:\"POST\",\n headers:{Authorization:`Bearer ${deployerToken}`,\"Content-Type\":\"application/json\",\"User-Agent\":\"rumbo-r2-github-app-broker/1.2\"},\n body:\"{}\"\n });\n const jp=jit.json||{};\n const jitContract=\n jit.status===200&&\n jp.schema===\"rumbo-r2-jit-activation-preparation/v1\"&&\n jp.implementation===DEPLOYER_IMPLEMENTATION&&\n jp.jit_activation_prepared===true&&\n Number.isSafeInteger(jp.pr_number)&&Number(jp.pr_number)>0&&\n /^[a-f0-9]{40}$/.test(String(jp.base_sha||\"\"))&&\n /^[a-f0-9]{40}$/.test(String(jp.head_sha||\"\"))&&\n jp.pr_draft===true&&\n jp.merge_authorized===false&&\n jp.deploy_enabled===false&&\n jp.product_production===\"NO_GO\"&&\n jp.production_go===false;\n if(!jitContract){\n const out={...base,status:\"JIT_PREPARATION_BLOCKED\",completed_at:new Date().toISOString(),result:{\n jit_status:jit.status,\n jit_error:jp.error||null,\n jit_reason:jp.reason||null,\n production_go:false\n }};\n await persistAutopilotRun(out);\n await appendAudit(\"AUTOPILOT_JIT_BLOCKED\",run_id,await sha256Text(canonical(out.result)));\n return out;\n }\n\n const observer=await fetchJson(OBSERVER_BASE+\"/v1/observe\",{\n method:\"POST\",\n headers:{Authorization:`Bearer ${observerToken}`,\"Content-Type\":\"application/json\",\"User-Agent\":\"rumbo-r2-github-app-broker/1.2\"},\n body:JSON.stringify({\n pr_number:Number(jp.pr_number),\n expected_base_sha:String(jp.base_sha),\n expected_head_sha:String(jp.head_sha)\n })\n });\n const or=observer.json||{};\n const signedObserverContract=\n (observer.status===200||observer.status===409)&&\n or.schema===\"rumbo-r2-github-observer-receipt/v1\"&&\n or.observer_implementation===OBSERVER_IMPLEMENTATION&&\n or.broker_implementation===IMPLEMENTATION&&\n or.invocation_mode===\"BROKER_AUTOPILOT\"&&\n Number(or.pr_number)===Number(jp.pr_number)&&\n String(or.base_sha)===String(jp.base_sha)&&\n String(or.head_sha)===String(jp.head_sha)&&\n /^[a-f0-9]{64}$/.test(String(or.receipt_sha256||\"\"))&&\n or.receipt_signature?.alg===\"ES256\"&&\n or.production_go===false;\n if(!signedObserverContract){\n const out={...base,status:\"OBSERVER_CONTRACT_FAILED\",completed_at:new Date().toISOString(),\n pr_number:Number(jp.pr_number),base_sha:String(jp.base_sha),head_sha:String(jp.head_sha),\n preparation_sha256:String(jp.preparation_sha256||\"\"),result:{\n observer_http_status:observer.status,\n observer_error:or.error||null,\n production_go:false\n }};\n await persistAutopilotRun(out);\n await appendAudit(\"AUTOPILOT_OBSERVER_CONTRACT_FAILED\",run_id,await sha256Text(canonical(out.result)));\n return out;\n }\n\n const pass=observer.status===200&&or.observation_status===\"OBSERVATION_PASS\"&&Number(or.blocking_count)===0&&or.merge_ready===true;\n const out={\n ...base,\n status:pass?\"SIGNED_OBSERVER_PASS\":\"SIGNED_OBSERVER_NO_GO\",\n completed_at:new Date().toISOString(),\n pr_number:Number(jp.pr_number),\n base_sha:String(jp.base_sha),\n head_sha:String(jp.head_sha),\n preparation_sha256:String(jp.preparation_sha256||\"\"),\n observer_receipt_sha256:String(or.receipt_sha256),\n observer_status:String(or.observation_status||\"\"),\n observer_blocking_count:Number(or.blocking_count||0),\n observer_merge_ready:or.merge_ready===true,\n result:{\n pr_created:jp.pr_created===true,\n branch_refresh_performed:jp.branch_refresh_performed===true,\n static_pins_verified:jp.static_pins_verified===true,\n dynamic_files_present:jp.dynamic_files_present===true,\n observer_http_status:observer.status,\n observer_native_enforcement_proven:or.native_enforcement?.proven===true,\n next_gate:pass?\"AUTHORITATIVE_REVIEW_AND_SEPARATE_PROMOTION_CONTROLS\":\"RESOLVE_OBSERVER_BLOCKING_CHECKS\",\n merge_authorized:false,\n deploy_enabled:false,\n product_production:\"NO_GO\",\n production_go:false\n }\n };\n await persistAutopilotRun(out);\n await appendAudit(pass?\"AUTOPILOT_SIGNED_OBSERVER_PASS\":\"AUTOPILOT_SIGNED_OBSERVER_NO_GO\",run_id,await sha256Text(canonical({\n pr_number:out.pr_number,base_sha:out.base_sha,head_sha:out.head_sha,\n preparation_sha256:out.preparation_sha256,observer_receipt_sha256:out.observer_receipt_sha256,\n observer_status:out.observer_status,observer_blocking_count:out.observer_blocking_count\n })));\n return out;\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-github-app-broker\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\n\napp.get(\"/health\",async c=>{\n const cust=await sqlite.execute(\"SELECT app_id,app_slug,created_at FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n const inst=await sqlite.execute(\"SELECT installation_id,account_id,account_login,repository_id,verified_at FROM app_installation WHERE singleton_id=1 LIMIT 1\");\n const appCreated=cust.rows.length===1;\n const installationVerified=inst.rows.length===1&&Number(inst.rows[0].repository_id)===REPOSITORY_ID;\n const downstream=await downstreamHealth();\n const serviceAuthConfigured=!!Deno.env.get(\"R2_DEPLOYER_JIT_AUTOPILOT_TOKEN\")&&!!Deno.env.get(\"R2_OBSERVER_AUTOPILOT_TOKEN\");\n return c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_BROKER_ROOT_TOKEN\"),\n custody_encryption_key_configured:!!Deno.env.get(\"R2_CUSTODY_AES_KEY_B64URL\"),\n setup_pepper_configured:!!Deno.env.get(\"R2_SETUP_PEPPER\"),\n observer_role_hash_configured:!!Deno.env.get(\"R2_OBSERVER_ROLE_TOKEN_SHA256\"),\n deployer_role_hash_configured:!!Deno.env.get(\"R2_DEPLOYER_ROLE_TOKEN_SHA256\"),\n post_install_autopilot:{\n service_auth_configured:serviceAuthConfigured,\n plaintext_service_tokens_exposed:false,\n expected_deployer_implementation:DEPLOYER_IMPLEMENTATION,\n expected_observer_implementation:OBSERVER_IMPLEMENTATION,\n downstream,\n ready:serviceAuthConfigured&&downstream.ready,\n trigger:\"GITHUB_APP_INSTALL_CALLBACK_AND_ROOT_RETRY\",\n max_authority:\"DRAFT_PR_PLUS_SIGNED_OBSERVER_ONLY\",\n merge_authorized:false,\n deploy_enabled:false\n },\n app_created:appCreated,\n app_slug:appCreated?cust.rows[0].app_slug:null,\n installation_verified:installationVerified,\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID},\n broker_ready:appCreated&&installationVerified,\n app_max_permissions:{contents:\"read\",pull_requests:\"write\",administration:\"read\"},\n observer_token_permissions:{contents:\"read\",pull_requests:\"read\",administration:\"read\"},\n deployer_token_permissions:{contents:\"read\",pull_requests:\"write\",administration:\"read\"},\n tokens_persisted:false,\n private_key_plaintext_persisted:false,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/setup-session\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const existing=await sqlite.execute(\"SELECT app_id FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(existing.rows.length)return c.json({error:\"APP_CUSTODY_ALREADY_EXISTS\",production_go:false},409,{\"Cache-Control\":\"no-store\"});\n const session_id=crypto.randomUUID();\n const created=new Date();\n const expires=new Date(created.getTime()+MAX_SETUP_AGE_MS);\n await sqlite.execute({sql:\"INSERT INTO setup_sessions(session_id,status,created_at,expires_at) VALUES(?,'CREATED',?,?)\",args:[session_id,created.toISOString(),expires.toISOString()]});\n await appendAudit(\"SETUP_SESSION_CREATED\",session_id,await sha256Text(session_id));\n return c.json({\n created:true,\n session_id,\n browser_url:`${BASE}/setup/${session_id}`,\n expires_at:expires.toISOString(),\n human_github_confirmation_required:true,\n production_go:false\n },201,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/setup/:session\",async c=>{\n const sessionId=String(c.req.param(\"session\")||\"\");\n const rs=await sqlite.execute({sql:\"SELECT * FROM setup_sessions WHERE session_id=? LIMIT 1\",args:[sessionId]});\n if(!rs.rows.length)return c.text(\"Unknown setup session\",404);\n const row:any=rs.rows[0];\n if(String(row.status)!==\"CREATED\"||Date.parse(String(row.expires_at))<=Date.now())return c.text(\"Setup session expired or already used\",410);\n const state=await setupState(sessionId);\n const manifest=JSON.stringify(manifestFor(sessionId,state));\n const action=`https://github.com/settings/apps/new?state=${encodeURIComponent(state)}`;\n return c.html(`RUMBO R2 GitHub App\n

RUMBO R2 GitHub App custody setup

This creates one private GitHub App with only Contents read, Pull requests write, and Administration read.

GitHub will show the final permissions before creation. No billing or plan change is performed.

\n `);\n});\n\napp.get(\"/github/manifest/callback\",async c=>{\n const code=String(c.req.query(\"code\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!code||!state)return c.text(\"Missing code/state\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }\n if(!matched)return c.text(\"Invalid or expired setup state\",403);\n\n const existing=await sqlite.execute(\"SELECT app_id FROM app_custody WHERE singleton_id=1 LIMIT 1\");\n if(existing.rows.length)return c.text(\"App custody already initialized\",409);\n\n const res=await fetch(`https://api.github.com/app-manifests/${encodeURIComponent(code)}/conversions`,{\n method:\"POST\",\n headers:{Accept:\"application/vnd.github+json\",\"X-GitHub-Api-Version\":API_VERSION,\"User-Agent\":\"rumbo-r2-github-app-broker/1\"}\n });\n const text=await res.text();\n let data:any=null;try{data=text?JSON.parse(text):null;}catch{}\n if(res.status!==201||!data?.id||!data?.slug||!data?.pem){\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='FAILED',failure_reason=? WHERE session_id=?\",args:[`MANIFEST_CONVERSION_${res.status}`,matched.session_id]});\n return c.text(\"GitHub App manifest conversion failed\",502);\n }\n\n const encrypted=await encryptSecret(String(data.pem));\n const keySha=await sha256Text(String(data.pem));\n const now=new Date();\n await sqlite.execute({sql:`INSERT INTO app_custody(singleton_id,app_id,app_slug,encrypted_private_key,private_key_sha256,created_at)\n VALUES(1,?,?,?,?,?)`,args:[Number(data.id),String(data.slug),encrypted,keySha,now.toISOString()]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='APP_CREATED',app_id=?,app_slug=?,expires_at=? WHERE session_id=?\",\n args:[Number(data.id),String(data.slug),new Date(now.getTime()+MAX_INSTALL_AGE_MS).toISOString(),matched.session_id]});\n await appendAudit(\"GITHUB_APP_MANIFEST_CONVERTED\",String(data.id),keySha);\n\n const install=`https://github.com/apps/${encodeURIComponent(String(data.slug))}/installations/new?state=${encodeURIComponent(state)}`;\n return c.html(`Install RUMBO R2 App\n

GitHub App created and private key sealed

Install it on exactly ${REPO_FULL}. The broker will reject any other repository.

\n Install RUMBO R2 App on the repository`);\n});\n\napp.get(\"/github/install/setup\",async c=>{\n const installationId=Number(c.req.query(\"installation_id\")||\"\");\n const state=String(c.req.query(\"state\")||\"\");\n if(!Number.isSafeInteger(installationId)||installationId<=0)return c.text(\"Missing installation_id\",400);\n\n const rs=await sqlite.execute(\"SELECT * FROM setup_sessions WHERE status='APP_CREATED' ORDER BY created_at DESC LIMIT 20\");\n let matched:any=null;\n for(const row of rs.rows as any[]){\n if(Date.parse(String(row.expires_at))<=Date.now())continue;\n if(state){\n const expected=await setupState(String(row.session_id));\n if(ct(expected,state)){matched=row;break;}\n }else if(!matched){\n matched=row;\n }\n }\n if(!matched)return c.text(\"No live pending installation session\",403);\n\n const cust=await custody();\n if(!cust||cust.app_id!==Number(matched.app_id))return c.text(\"Custody/app mismatch\",409);\n\n const appValidation=await validateAppConfiguration(cust);\n if(!appValidation.ok)return c.text(`GitHub App configuration rejected: ${appValidation.error}`,403);\n\n const installValidation=await validateInstallationMetadata(cust,installationId);\n if(!installValidation.ok)return c.text(`GitHub App installation rejected: ${installValidation.error}`,403);\n\n const tokenRes=await githubAppRequest(cust.app_id,cust.pem,`/app/installations/${installationId}/access_tokens`,\"POST\",{\n repository_ids:[REPOSITORY_ID],\n permissions:{contents:\"read\",pull_requests:\"read\",administration:\"read\"}\n });\n if(tokenRes.status!==201||!tokenRes.json?.token)return c.text(\"Could not mint verification token\",502);\n\n const verificationToken=String(tokenRes.json.token);\n const scopeValidation=await validateInstallationTokenRepoScope(verificationToken);\n await revokeInstallationToken(verificationToken);\n if(!scopeValidation.ok){\n return c.text(`Installation repository scope rejected: ${scopeValidation.error}`,403);\n }\n\n const accountId=Number(installValidation.json?.account?.id||0);\n const accountLogin=String(installValidation.json?.account?.login||\"\");\n const verifiedAt=new Date().toISOString();\n await sqlite.execute({sql:`INSERT INTO app_installation(singleton_id,installation_id,account_id,account_login,repository_id,verified_at)\n VALUES(1,?,?,?,?,?)\n ON CONFLICT(singleton_id) DO UPDATE SET installation_id=excluded.installation_id,account_id=excluded.account_id,\n account_login=excluded.account_login,repository_id=excluded.repository_id,verified_at=excluded.verified_at`,\n args:[installationId,accountId,accountLogin,REPOSITORY_ID,verifiedAt]});\n await sqlite.execute({sql:\"UPDATE setup_sessions SET status='INSTALLED',installation_id=? WHERE session_id=?\",args:[installationId,matched.session_id]});\n await appendAudit(\"GITHUB_APP_INSTALLATION_VERIFIED\",String(installationId),await sha256Text(canonical({installationId,accountId,accountLogin,repositoryId:REPOSITORY_ID})));\n\n const autopilot=await runPostInstallAutopilot(\"GITHUB_APP_INSTALL_CALLBACK\");\n const autopilotSummary=htmlEscape(JSON.stringify({\n run_id:autopilot.run_id,\n status:autopilot.status,\n pr_number:autopilot.pr_number||null,\n observer_receipt_sha256:autopilot.observer_receipt_sha256||null,\n observer_status:autopilot.observer_status||null,\n observer_blocking_count:Number.isSafeInteger(autopilot.observer_blocking_count)?autopilot.observer_blocking_count:null,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },null,2));\n\n return c.html(`RUMBO R2 Ready\n

Dedicated GitHub App custody is ready

The private key is encrypted at rest. Installation tokens are minted just-in-time and are never persisted.

Repository identity verified: ${REPO_FULL}.

Post-install fail-closed autopilot

${autopilotSummary}

No merge, deploy, billing, visibility or product-production authority is granted by this automation.

\n `);\n});\n\napp.post(\"/v1/token/observer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"observer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"observer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"observer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.post(\"/v1/token/deployer\",async c=>{\n if(!await roleAuthorized(c.req.raw,\"deployer\"))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n try{\n const token=await createInstallationToken(\"deployer\");\n return c.json({...token,broker_implementation:IMPLEMENTATION,role:\"deployer\",production_go:false},200,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n const msg=String(e?.message||e);\n return c.json({error:msg,production_go:false},msg===\"CUSTODY_NOT_READY\"?424:502,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/manifest-preview\",c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n return c.json({\n schema:\"rumbo-r2-github-app-manifest-preview/v1\",\n manifest:manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\"),\n repository_install_scope:{mode:\"ONLY_SELECTED_REPOSITORY\",required_repository_id:REPOSITORY_ID,required_full_name:REPO_FULL},\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/autopilot/status\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT run_id,trigger,status,started_at,completed_at,pr_number,base_sha,head_sha,\n preparation_sha256,observer_receipt_sha256,observer_status,observer_blocking_count,observer_merge_ready,result_json\n FROM autopilot_runs ORDER BY started_at DESC LIMIT 20`);\n const records=(rs.rows as any[]).map(r=>({\n ...r,\n observer_merge_ready:r.observer_merge_ready===null?null:Number(r.observer_merge_ready)===1,\n result:(()=>{try{return JSON.parse(String(r.result_json||\"{}\"));}catch{return {parse_error:true};}})()\n })).map(({result_json,...r})=>r);\n const downstream=await downstreamHealth();\n return c.json({\n schema:\"rumbo-r2-post-install-autopilot-status/v1\",\n implementation:IMPLEMENTATION,\n broker_ready:!!(await installation())&&!!(await custody()),\n service_auth_configured:!!Deno.env.get(\"R2_DEPLOYER_JIT_AUTOPILOT_TOKEN\")&&!!Deno.env.get(\"R2_OBSERVER_AUTOPILOT_TOKEN\"),\n downstream,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false,\n records\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/autopilot/retry\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const result=await runPostInstallAutopilot(\"ROOT_RETRY\");\n return c.json({\n schema:\"rumbo-r2-post-install-autopilot-run/v1\",\n implementation:IMPLEMENTATION,\n ...result,\n merge_authorized:false,\n deploy_enabled:false,\n production_go:false\n },result.status===\"SIGNED_OBSERVER_PASS\"||result.status===\"SIGNED_OBSERVER_NO_GO\"?200:409,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/selftest\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const sample=\"rumbo-r2-custody-selftest:\"+crypto.randomUUID();\n const enc=await encryptSecret(sample);\n const dec=await decryptSecret(enc);\n const {privateKey}=generateKeyPairSync(\"rsa\",{modulusLength:2048});\n const pem=privateKey.export({type:\"pkcs8\",format:\"pem\"}).toString();\n const jwt=appJwtFromPem(123456,pem);\n const jwtShape=jwt.split(\".\").length===3;\n const manifest=manifestFor(\"PREVIEW00000000\",\"STATE_PREVIEW\");\n const permissionsExact=canonical(manifest.default_permissions)===canonical({contents:\"read\",pull_requests:\"write\",administration:\"read\"});\n const expectedPermissionSet=exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const extraPermissionRejected=!exactAppPermissionSet({contents:\"read\",pull_requests:\"write\",administration:\"read\",metadata:\"read\",issues:\"read\"});\n const upgradedPermissionRejected=!exactAppPermissionSet({contents:\"write\",pull_requests:\"write\",administration:\"read\",metadata:\"read\"});\n const pass=dec===sample&&jwtShape&&permissionsExact&&expectedPermissionSet&&extraPermissionRejected&&upgradedPermissionRejected&&manifest.public===false&&manifest.hook_attributes.active===false;\n return c.json({\n selftest:pass?\"PASS\":\"FAIL\",\n aes_gcm_roundtrip:dec===sample,\n rsa_app_jwt_shape:jwtShape,\n manifest_permissions_exact:permissionsExact,\n exact_permission_set_accepts_expected:expectedPermissionSet,\n exact_permission_set_rejects_extra:extraPermissionRejected,\n exact_permission_set_rejects_upgrade:upgradedPermissionRejected,\n manifest_private:manifest.public===false,\n webhook_inactive:manifest.hook_attributes.active===false,\n tokens_persisted:false,\n production_go:false\n },pass?200:500,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\",async c=>{\n if(!rootAuthorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM broker_audit ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,object_id:r.object_id,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256Text(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-github-app-broker-audit/v1\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/github/webhook\",c=>c.body(null,204));\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\n\nexport default app.fetch;\n",[153],"bcf6e30d-db60-4c67-be9d-9e248094f325",["D",1787986540187],[27],"44f6253d-0eff-4b7d-b395-30d29f5ef45f","RELEASE_V1_1.md","01a04c47-6298-743f-8d31-06c620baf149",1,["D",1787986141848],"# RUMBO R2 GitHub App Custody Broker V1.1 — Exact Scope\n\nStatus: **PASS / CUSTODY_CODE_READY / APP_INSTALLATION_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`.\n\nThe broker implements the GitHub App Manifest flow, AES-256-GCM private-key custody, app-JWT authentication, role-specific JIT installation tokens, exact one-repository scope verification, and a durable audit hash chain.\n\nHardening added in V1.1:\n\n- exact GitHub App owner/id/slug verification through `GET /app`;\n- exact app permission set: `contents:read`, `pull_requests:write`, `administration:read` (plus implicit `metadata:read` only);\n- zero webhook events;\n- installation must belong to the exact owner, be unsuspended, and use `repository_selection=selected`;\n- installation permissions/events must remain exact;\n- every minted token is independently checked via `GET /installation/repositories` and must expose exactly one private repository: `fscfede-beep/rumbo-control-queue`, repository id `1314199389`, owner id `293577326`;\n- verification tokens are revoked immediately after setup validation;\n- role tokens are revoked before returning an error if exact repository scope validation fails;\n- role responses carry the broker implementation id for downstream anti-downgrade pinning;\n- installation/access tokens are never persisted;\n- plaintext PEM is never returned by an HTTP response; only AES-GCM ciphertext is stored.\n\nSelftest evaluation: `01a04be4-8d9f-75ed-925d-5c285c05a08f` — PASS.\n\nSelftest covers AES-GCM roundtrip, GitHub App RS256 JWT construction, exact manifest permission set, rejection of extra/upgraded permissions, private app manifest, inactive webhook, endpoint authentication and audit-chain integrity.\n\nIndependent static source audit after hardening: PASS across exact app/install/repository scope, revocation behavior, encrypted custody, absence of raw secret literals, no token persistence, implementation-bound token responses and `production_go=false`.\n\nThe broker is intentionally not ready until GitHub completes the authenticated App creation and exact repository installation. No billing or product-production action is performed by this release.\n",[165],"pulls","branches",3,"forks","envVars",{"_179":157,"_181":60},"connections",{"_179":60,"_180":60},"count","unfilledCount","emptyCount",{"_40":164,"_31":165,"_29":166,"_143":-5,"_38":39,"_37":167,"_145":56,"_35":196,"_13":60,"_32":20,"_33":169,"_23":24,"_150":-5,"_187":197,"_26":198},{"_40":161,"_31":27,"_29":30,"_143":-5,"_38":39,"_37":14,"_145":56,"_35":193,"_13":60,"_32":20,"_33":34,"_23":24,"_150":-5,"_187":194,"_26":195},{"_40":152,"_31":153,"_29":154,"_143":-5,"_38":39,"_37":155,"_145":56,"_35":190,"_13":157,"_32":158,"_33":159,"_23":24,"_150":-5,"_187":191,"_26":192},{"_40":140,"_31":141,"_29":142,"_143":-5,"_38":39,"_37":144,"_145":56,"_35":186,"_13":147,"_32":148,"_33":149,"_23":24,"_150":-5,"_187":188,"_26":189},["D",1787986482232],"children",[],[141],["D",1787986438786],[],[153],["D",1787986540187],[],[27],["D",1787986141848],[],[165],["D",1787978449051],["D",1789542098478],{"_97":96,"_105":101},{"_97":96,"_98":99,"_100":101,"_18":52,"_102":103,"_104":24},{"_13":14,"_31":86,"_40":39,"_87":41,"_88":89,"_90":14,"_91":47,"_92":41,"_93":62,"_94":42,"_95":96},"ctx",{"_79":-5,"_126":237,"_238":239,"_240":241,"_242":24,"_243":24,"_244":24,"_245":56,"_246":-5,"_247":-7,"_248":-7,"_249":60,"_250":24,"_251":24,"_252":-5,"_253":24,"_254":24,"_255":24,"_256":-5},"ENV",{"_208":209,"_210":211,"_212":132,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230,"_231":232,"_233":234,"_235":236},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v15