[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_249":250,"_251":252},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_17":18,"_38":-7,"_130":-5,"_19":131,"_132":133,"_134":135,"_136":137,"_138":139,"_21":140,"_141":-5,"_142":143,"_144":24,"_145":146,"_147":88,"_148":-5,"_149":-5,"_150":151},"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":24,"_30":-5},"handle","sebas1","name","rumbo-r2-github-observer","branchName","v1-5-broker-autopilot","path","RELEASE_V1.md","project",{"_32":76,"_13":14,"_36":77,"_67":-5,"_78":24,"_79":80,"_81":80,"_82":83,"_84":-5,"_30":72,"_85":86,"_87":88,"_89":-5,"_90":-5,"_91":26,"_40":41,"_92":93,"_94":95,"_96":97,"_98":-5,"_99":100,"_101":100,"_102":103,"_104":103,"_105":103,"_106":100,"_107":100,"_53":108,"_109":110,"_111":112,"_113":24},"file",{"_68":69,"_13":18,"_70":21,"_71":24,"_75":-5},"isDirectory",false,"page",0,"history",[31],"hasNext","userId",{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":-5,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":58,"_59":-5,"_60":-5,"_61":62},"id","0fe136d5-9deb-4b00-bb10-178ee9d562ec","branchId","e67102cd-5694-458d-ae3f-26b34b39ed1e","createdAt",["D",1787986138220],"version",1,"orgId","01a04116-f28c-754c-9173-77bf5814fcd6","parentId","incomingCommitId","f4230bd6-6226-4942-b48a-f6ce422f37de","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","mcp","clientLabel","ChatGPT","user",{"_32":72,"_40":41,"_11":12,"_73":74},{"_68":69,"_13":18,"_70":21,"_71":24},"pull","merge",{"_34":64,"_13":65,"_38":66,"_67":-5},"revert","multiple","commits",[63],{"_32":33,"_34":35,"_36":37,"_38":39,"_40":41,"_42":-5,"_43":44,"_45":-5,"_46":-5,"_47":-5,"_48":-5,"_49":50,"_51":52,"_53":54,"_21":55,"_56":-5,"_57":58,"_59":-5},"3b4d54a6-dc1b-448d-8db8-741c5fde7ed2","main",16,"deletedAt","fileId","01a04c47-5467-7544-bc62-eb08035abd60","fileType","deleted","d3788f19-13c5-4356-87e8-dce639626bb9","avatar","https://lh3.googleusercontent.com/a/ACg8ocJaC6uiXPmN9dvgA2XcSlzBSkPJO0GN5zKzPm3a8cbjmXC9HYA=s96-c","deletedAtVersion","8438d584-50f8-4401-a0e3-85e0f7aa21f4",["D",1787977337892],"legacyEnvVars","privacy","public","httpPrivacy","description","Independent fail-closed GitHub observer for RUMBO R2","imageUrl","pinnedFileId","3875e380-a361-11f1-aa59-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","8438d58450f84401a0e385e0f7aa21f4","tursoHostname","8438d58450f84401a0e385e0f7aa21f4-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789539031988],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_129":74},"org",{"_11":12,"_124":125,"_73":74,"_30":72,"_126":127,"_128":24},"branch",{"_38":114,"_13":16,"_32":35,"_115":76,"_116":64,"_117":118,"_119":80,"_120":76,"_121":41,"_122":14,"_123":12},"isOwned",15,"projectId","forkedBranchId","forkedBranchVersion",13,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","sebas","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_32":76,"_13":14,"_36":244,"_67":-5,"_78":24,"_79":80,"_81":80,"_82":83,"_84":-5,"_30":72,"_85":86,"_87":88,"_89":-5,"_90":-5,"_91":26,"_40":41,"_92":93,"_94":95,"_96":245,"_98":-5,"_99":100,"_101":100,"_102":103,"_104":103,"_105":103,"_106":100,"_107":100,"_53":246,"_109":247,"_111":248,"_113":24},"tree",[176,177,178,179,180,181,182,183],"files",[176,177,178,179,180,181,182,183],"counts",{"_164":26,"_165":166,"_167":26,"_168":169,"_170":171},"contents",[],{"_32":157,"_34":35,"_68":69,"_13":18,"_158":159,"_70":21,"_38":26,"_42":-5,"_36":160,"_161":39,"_162":-5,"_17":163},"upstreamProject","upstreamBranch",{"_32":64,"_36":152,"_153":154,"_13":65,"_115":76,"_38":66,"_116":-5,"_117":-5,"_155":156,"_67":-5,"_113":24,"_79":80,"_123":12,"_40":41,"_122":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1787977337892],"updatedAt",["D",1787988623030],"lockfileKey","1787988623350-esm.town_v_sebas1_rumbo-r2-github-observer@16-main","2f0f2b6e-38ac-4c8d-908e-d773b77c0e79","content","# RUMBO R2 GitHub Observer V1\n\nStatus: **IMPLEMENTED / SELFTEST_PASS / GITHUB_APP_CREDENTIAL_PENDING / PRODUCTION_NO_GO**\n\nRuntime:\n\n`sebas1/rumbo-r2-github-observer`\n\nImplementation:\n\n`R2_GITHUB_OBSERVER_V1`\n\n## Purpose\n\nThis observer removes the architectural requirement that a diagnostic R2 snapshot must\nexecute on a GitHub-hosted runner. Once a dedicated GitHub App installation token is\nbound, the observer can read the private repository directly through the GitHub REST API\nand independently verify the exact PR snapshot.\n\nIt does not weaken the historical GitHub Actions observer. The workflow remains pinned in\nthe candidate, but the external observer provides a second execution substrate that is not\ncoupled to the account's exhausted hosted-runner minutes.\n\n## Exact trust pins\n\nRepository:\n\n- full name: `fscfede-beep/rumbo-control-queue`\n- repository id: `1314199389`\n- owner id: `293577326`\n- default branch: `main`\n\nSealed package SHA-256:\n\n`afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f`\n\nStatic bootstrap Git blob pins:\n\n- observer workflow:\n `3d5dd465aad367cde5eabfff2ba7033865ceef8b`\n- expected package:\n `1260b3516219341c63107dca1cc1b21a1ecb9ba0`\n- snapshot guard:\n `752f12df05d0b6b1bc122cbe61a3145458fdd074`\n\n## Observation contract\n\nA live observation is bound to:\n\n- exact repository identity;\n- exact PR number;\n- exact base SHA;\n- exact head SHA;\n- open DRAFT PR state;\n- base branch `main`;\n- Git compare proof that head descends from base;\n- exact three static blob pins;\n- parseable `LIVE_STATE.json`;\n- `rumbo-continuity-live-state/v3` dynamic state invariants;\n- package SHA-256;\n- process prohibitions against direct main mutation and unreviewed merge;\n- product `NO_GO`;\n- README package and `PRODUCTION_NO_GO` markers;\n- observed native branch/ruleset enforcement.\n\nNative protection is measured independently from snapshot validity. A receipt may be\n`OBSERVATION_PASS` while `merge_ready=false` if native enforcement is not proven.\n\n## Signed receipts\n\nObserver receipts use ES256.\n\nSigning key id:\n\n`aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8`\n\nThe private signing JWK is stored only as encrypted Val Town environment state. The public\nverification JWK is exposed in `/health`.\n\nReceipts are persisted in a dedicated SQLite ledger and lifecycle creation is anchored in\na separate audit hash chain.\n\n## Fail-closed credential state\n\nCurrent:\n\n- observer control bearer: configured;\n- observer receipt signing key: configured;\n- dedicated GitHub App token: **not configured**;\n- `observer_can_run=false`;\n- live observe request without GitHub App token: HTTP 424;\n- `production_go=false`.\n\nNo private GitHub credential is present in source.\n\n## Self-test\n\nEvaluation:\n\n`01a04bc2-7e75-7109-b401-e5af497fbc30`\n\nResult: **PASS**.\n\nChecks:\n\n- health → 200;\n- unauthenticated ledger → 401;\n- observe without GitHub App token → 424;\n- ES256 fixture signature → valid;\n- tampered fixture under same signature → invalid;\n- audit → 200;\n- audit chain → valid;\n- production_go → false.\n\nFixture receipt SHA-256:\n\n`3adf54a665f4bfa4e7975a3bc3a0754135ee3799506bc93619487cd6c5094fa5`\n\n## Claim boundary\n\nCode-level private GitHub observation is implemented.\n\nLive independent observation remains unavailable until a dedicated GitHub App installation\ncredential is placed in `R2_GITHUB_APP_TOKEN`. This service cannot itself create that\nGitHub App, change the user's GitHub plan, or bypass GitHub private-repository plan limits.\n\nNo merge or product-production authorization is implied.\n",["D",1787986138220],"branchVersion","label",[18],"pulls","branches",5,"forks","envVars",{"_172":174,"_175":26},"connections",{"_172":26,"_173":26},"count","unfilledCount",4,"emptyCount",{"_32":157,"_13":18,"_68":69,"_42":-5,"_34":35,"_161":39,"_188":88,"_36":241,"_38":26,"_70":21,"_158":159,"_71":24,"_162":-5,"_193":242,"_17":243},{"_32":234,"_13":235,"_68":236,"_42":-5,"_34":35,"_161":39,"_188":88,"_36":237,"_38":26,"_70":21,"_158":238,"_71":24,"_162":-5,"_193":239,"_17":240},{"_32":227,"_13":228,"_68":229,"_42":-5,"_34":35,"_161":39,"_188":88,"_36":230,"_38":26,"_70":21,"_158":231,"_71":24,"_162":-5,"_193":232,"_17":233},{"_32":220,"_13":221,"_68":222,"_42":-5,"_34":35,"_161":39,"_188":88,"_36":223,"_38":26,"_70":21,"_158":224,"_71":24,"_162":-5,"_193":225,"_17":226},{"_32":213,"_13":214,"_68":215,"_42":-5,"_34":35,"_161":39,"_188":88,"_36":216,"_38":26,"_70":21,"_158":217,"_71":24,"_162":-5,"_193":218,"_17":219},{"_32":206,"_13":207,"_68":208,"_42":-5,"_34":35,"_161":114,"_188":88,"_36":209,"_38":26,"_70":21,"_158":210,"_71":24,"_162":-5,"_193":211,"_17":212},{"_32":196,"_13":197,"_68":198,"_42":-5,"_34":35,"_161":199,"_188":88,"_36":200,"_38":201,"_70":202,"_158":203,"_71":24,"_162":-5,"_193":204,"_17":205},{"_32":184,"_13":185,"_68":186,"_42":-5,"_34":35,"_161":187,"_188":88,"_36":189,"_38":190,"_70":191,"_158":192,"_71":24,"_162":-5,"_193":194,"_17":195},"6630b1a4-d609-4f72-964b-78d51ecc8c37","selftest.ts","01a04c47-5467-7544-bc63-0367e51f7531",14,"latest",["D",1787986511162],6,"script","const base=\"https://sebas1--01a04c4754677544bc62fd38df666450.web.val.run\";\nconst root=Deno.env.get(\"R2_OBSERVER_ROOT_TOKEN\");\nconst signingRaw=Deno.env.get(\"R2_OBSERVER_SIGNING_JWK_V1\");\nif(!root||!signingRaw)throw new Error(\"REQUIRED_ENV_MISSING\");\n\nfunction canonical(v:unknown):string{\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256(s:string):Promise{\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64url(bytes:Uint8Array):string{\n const raw=Array.from(bytes,b=>String.fromCharCode(b)).join(\"\");\n return btoa(raw).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\nfunction b64urlDecode(s:string):Uint8Array{\n const pad=\"=\".repeat((4-(s.length%4))%4);\n const raw=atob(s.replaceAll(\"-\",\"+\").replaceAll(\"_\",\"/\")+pad);\n return Uint8Array.from(raw,ch=>ch.charCodeAt(0));\n}\nasync function sign(s:string):Promise{\n const key=await crypto.subtle.importKey(\"jwk\",JSON.parse(signingRaw!),{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"sign\"]);\n const sig=await crypto.subtle.sign({name:\"ECDSA\",hash:\"SHA-256\"},key,new TextEncoder().encode(s));\n return b64url(new Uint8Array(sig));\n}\nasync function verify(s:string,sig:string,jwk:JsonWebKey):Promise{\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"verify\"]);\n return await crypto.subtle.verify({name:\"ECDSA\",hash:\"SHA-256\"},key,b64urlDecode(sig),new TextEncoder().encode(s));\n}\n\nconst healthRes=await fetch(base+\"/health\");\nconst health:any=await healthRes.json();\nconst unauthLedger=await fetch(base+\"/v1/ledger\");\nconst authHeaders={Authorization:`Bearer ${root}`,\"Content-Type\":\"application/json\"};\nconst blockedObserve=await fetch(base+\"/v1/observe\",{\n method:\"POST\",headers:authHeaders,\n body:JSON.stringify({\n pr_number:999,\n expected_base_sha:\"1\".repeat(40),\n expected_head_sha:\"2\".repeat(40)\n })\n});\nconst blockedBody:any=await blockedObserve.json();\n\nconst fixtureUnsigned={\n schema:\"rumbo-r2-github-observer-receipt/v1\",\n observer_implementation:\"R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT\",\n broker_implementation:\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\",\n authoritative_for:\"R2_GITHUB_PR_SNAPSHOT_ONLY\",\n production_go:false,\n repository:{full_name:\"fscfede-beep/rumbo-control-queue\",id:1314199389,owner_id:293577326},\n pr_number:999,\n base_sha:\"1\".repeat(40),\n head_sha:\"2\".repeat(40),\n head_branch:\"audit/selftest\",\n observed_at:new Date().toISOString(),\n package_sha256:\"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\",\n state_sha256:\"3\".repeat(64),\n readme_sha256:\"4\".repeat(64),\n static_file_evidence:{\n \".github/workflows/continuity-r2-observe.yml\":{status:200,git_blob_sha:\"3d5dd465aad367cde5eabfff2ba7033865ceef8b\"},\n \"tools/continuity-r2/EXPECTED_PACKAGE.json\":{status:200,git_blob_sha:\"1260b3516219341c63107dca1cc1b21a1ecb9ba0\"},\n \"tools/continuity-r2/snapshot_guard.py\":{status:200,git_blob_sha:\"752f12df05d0b6b1bc122cbe61a3145458fdd074\"}\n },\n native_enforcement:{\n proven:false,\n classic_branch_protection:false,\n active_main_ruleset:false,\n protection_api_status:403,\n rulesets_api_status:403\n },\n checks:[],\n blocking_count:0,\n observation_status:\"OBSERVATION_PASS\",\n merge_ready:false,\n invocation_mode:\"ROOT\",\n note:\"Independent GitHub snapshot observation only. Receipt cannot authorize product production.\"\n};\nconst canon=canonical(fixtureUnsigned);\nconst fixtureSha=await sha256(canon);\nconst signature=await sign(canon);\nconst signatureValid=await verify(canon,signature,health.receipt_signature?.verify_jwk);\nconst tamperedValid=await verify(canonical({...fixtureUnsigned,head_sha:\"f\".repeat(40)}),signature,health.receipt_signature?.verify_jwk);\n\nconst auditRes=await fetch(base+\"/v1/audit\",{headers:{Authorization:`Bearer ${root}`}});\nconst audit:any=await auditRes.json();\n\nconst expectedPins={\n \".github/workflows/continuity-r2-observe.yml\":\"3d5dd465aad367cde5eabfff2ba7033865ceef8b\",\n \"tools/continuity-r2/EXPECTED_PACKAGE.json\":\"1260b3516219341c63107dca1cc1b21a1ecb9ba0\",\n \"tools/continuity-r2/snapshot_guard.py\":\"752f12df05d0b6b1bc122cbe61a3145458fdd074\"\n};\n\nconst pass=\n healthRes.status===200&&\n health.implementation===\"R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT\"&&\n health.broker_autopilot_token_hash_configured===true&&\n health.broker_autopilot_plaintext_token_persisted_here===false&&\n health.broker_autopilot_scope===\"OBSERVE_ONLY\"&&\n health.state_authority_policy?.accepted_bootstrap_schema===\"rumbo-continuity-live-state/v2\"&&\n health.state_authority_policy?.snapshot_coordinates_authoritative===false&&\n health.state_authority_policy?.runtime_pr_coordinates_source===\"GITHUB_API\"&&\n health.state_authority_policy?.runtime_coordinates_signed_in_receipt===true&&\n health.state_authority_policy?.sealed_payload_can_be_jit_refreshed_without_content_rewrite===true&&\n health.native_enforcement_policy?.minimum_approving_reviews===1&&\n health.native_enforcement_policy?.classic_requires_force_push_disabled===true&&\n health.native_enforcement_policy?.classic_requires_deletion_disabled===true&&\n JSON.stringify(health.native_enforcement_policy?.ruleset_required_rules)===JSON.stringify([\"pull_request\",\"non_fast_forward\",\"deletion\"])&&\n health.root_token_configured===true&&\n health.signing_key_configured===true&&\n health.direct_github_token_path_retired===true&&\n health.github_broker?.expected_implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\"&&\n health.github_broker?.observed_implementation===\"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\"&&\n health.github_broker?.role===\"observer\"&&\n health.github_broker?.role_token_configured===true&&\n health.github_broker?.health_status===200&&\n health.github_broker?.broker_ready===false&&\n health.observer_can_run===false&&\n health.production_go===false&&\n health.receipt_signature?.alg===\"ES256\"&&\n health.receipt_signature?.kid===\"aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8\"&&\n JSON.stringify(health.static_git_blob_pins)===JSON.stringify(expectedPins)&&\n unauthLedger.status===401&&\n blockedObserve.status===424&&\n blockedBody.error===\"GITHUB_BROKER_NOT_READY\"&&\n blockedBody.reason===\"CUSTODY_NOT_READY\"&&\n signatureValid===true&&\n tamperedValid===false&&\n auditRes.status===200&&\n audit.audit_chain_ok===true&&\n audit.production_go===false;\n\nconsole.log(JSON.stringify({\n selftest:pass?\"PASS\":\"FAIL\",\n implementation:health.implementation,\n checks:{\n health:healthRes.status,\n direct_github_token_path_retired:health.direct_github_token_path_retired,\n broker_role_token_configured:health.github_broker?.role_token_configured,\n broker_ready:health.github_broker?.broker_ready,\n unauthenticated_ledger:unauthLedger.status,\n observe_without_broker_custody:blockedObserve.status,\n fixture_signature_valid:signatureValid,\n tampered_fixture_valid:tamperedValid,\n audit:auditRes.status,\n audit_chain_ok:audit.audit_chain_ok\n },\n fixture_receipt_sha256:fixtureSha,\n signing_kid:health.receipt_signature?.kid,\n observer_can_run:false,\n production_go:false\n},null,2));\nif(!pass)Deno.exit(1);\n","children",[],[185],"cb68caad-5265-4186-b50c-53186437f10d","main.tsx","01a04c47-5467-7544-bc62-fd38df666450",12,["D",1787986502895],7,"http","import { Hono } from \"npm:hono\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst app = new Hono();\n\nconst IMPLEMENTATION = \"R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT\";\nconst GITHUB_BROKER_BASE = \"https://sebas1--cec0f0e4a36311f1a6461607ee4eb77e.web.val.run\";\nconst GITHUB_BROKER_IMPLEMENTATION = \"R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT\";\nconst REPO_OWNER = \"fscfede-beep\";\nconst REPO_NAME = \"rumbo-control-queue\";\nconst REPO_FULL = `${REPO_OWNER}/${REPO_NAME}`;\nconst REPOSITORY_ID = 1314199389;\nconst OWNER_ID = 293577326;\nconst DEFAULT_BRANCH = \"main\";\nconst PACKAGE_SHA256 = \"afbdc77510286adc5721ada5a0ddfa75e10305cb5200d6fd37cd8438c9c6119f\";\nconst SIGNING_KID = \"aaZsAh07RChcec-P6l_R-aGrMglZjIZP0xA0jZMClx8\";\nconst VERIFY_JWK: JsonWebKey = {\n kty:\"EC\",crv:\"P-256\",\n x:\"lYPzwJFKYb5YZsikYx57Wr6TfkwwNyog15s0BN_p8fA\",\n y:\"9bVfI4jPqeN-yt2KQjz9MgmsDjLpbqzs1pw1DcgPwHQ\",\n key_ops:[\"verify\"],ext:true\n};\nconst API_VERSION = \"2026-03-10\";\nconst MAX_BODY = 64 * 1024;\n\nconst STATIC_PINS: Record = {\n \".github/workflows/continuity-r2-observe.yml\":\n \"3d5dd465aad367cde5eabfff2ba7033865ceef8b\",\n \"tools/continuity-r2/EXPECTED_PACKAGE.json\":\n \"1260b3516219341c63107dca1cc1b21a1ecb9ba0\",\n \"tools/continuity-r2/snapshot_guard.py\":\n \"752f12df05d0b6b1bc122cbe61a3145458fdd074\"\n};\n\nawait sqlite.batch([\n `CREATE TABLE IF NOT EXISTS observer_receipts(\n receipt_sha256 TEXT PRIMARY KEY,\n pr_number INTEGER NOT NULL,\n base_sha TEXT NOT NULL,\n head_sha TEXT NOT NULL,\n observed_at TEXT NOT NULL,\n observation_status TEXT NOT NULL,\n blocking_count INTEGER NOT NULL,\n native_enforcement_proven INTEGER NOT NULL CHECK(native_enforcement_proven IN (0,1)),\n merge_ready INTEGER NOT NULL CHECK(merge_ready IN (0,1)),\n state_sha256 TEXT,\n readme_sha256 TEXT,\n signature_kid TEXT NOT NULL,\n signature_b64url TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_observer_pr_head\n ON observer_receipts(pr_number,head_sha)`,\n `CREATE TABLE IF NOT EXISTS observer_audit(\n seq INTEGER PRIMARY KEY AUTOINCREMENT,\n event_type TEXT NOT NULL,\n receipt_sha256 TEXT,\n object_sha256 TEXT,\n prev_event_sha256 TEXT NOT NULL,\n event_sha256 TEXT NOT NULL UNIQUE,\n created_at TEXT NOT NULL\n )`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_observer_audit_prev\n ON observer_audit(prev_event_sha256)`,\n `CREATE UNIQUE INDEX IF NOT EXISTS idx_observer_audit_event_receipt\n ON observer_audit(event_type,receipt_sha256)\n WHERE receipt_sha256 IS NOT NULL`\n]);\n\nfunction bearer(req: Request): string {\n const h = req.headers.get(\"authorization\") || \"\";\n return h.startsWith(\"Bearer \") ? h.slice(7) : \"\";\n}\nfunction ct(a:string,b:string):boolean {\n const aa=new TextEncoder().encode(a),bb=new TextEncoder().encode(b);\n if(aa.length!==bb.length)return false;\n let d=0; for(let i=0;i {\n const expectedHash=Deno.env.get(\"R2_BROKER_OBSERVER_AUTOPILOT_TOKEN_SHA256\")||\"\";\n const observed=bearer(req);\n if(!expectedHash||!observed)return false;\n const observedHash=await sha256Text(observed);\n return ct(expectedHash,observedHash);\n}\nasync function observeAuthorized(req:Request):Promise<\"ROOT\"|\"BROKER_AUTOPILOT\"|null> {\n if(authorized(req))return \"ROOT\";\n if(await brokerAutopilotAuthorized(req))return \"BROKER_AUTOPILOT\";\n return null;\n}\nfunction canonical(v:unknown):string {\n if(v===null||typeof v!==\"object\")return JSON.stringify(v);\n if(Array.isArray(v))return \"[\"+v.map(canonical).join(\",\")+\"]\";\n const o=v as Record;\n return \"{\"+Object.keys(o).sort().map(k=>JSON.stringify(k)+\":\"+canonical(o[k])).join(\",\")+\"}\";\n}\nasync function sha256Text(s:string):Promise {\n const d=await crypto.subtle.digest(\"SHA-256\",new TextEncoder().encode(s));\n return [...new Uint8Array(d)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\n}\nfunction b64url(bytes:Uint8Array):string {\n const raw=Array.from(bytes,b=>String.fromCharCode(b)).join(\"\");\n return btoa(raw).replaceAll(\"+\",\"-\").replaceAll(\"/\",\"_\").replace(/=+$/g,\"\");\n}\nasync function signCanonical(s:string):Promise {\n const raw=Deno.env.get(\"R2_OBSERVER_SIGNING_JWK_V1\")||\"\";\n if(!raw)throw new Error(\"OBSERVER_SIGNING_KEY_NOT_CONFIGURED\");\n const jwk=JSON.parse(raw);\n const key=await crypto.subtle.importKey(\"jwk\",jwk,{name:\"ECDSA\",namedCurve:\"P-256\"},false,[\"sign\"]);\n const sig=await crypto.subtle.sign({name:\"ECDSA\",hash:\"SHA-256\"},key,new TextEncoder().encode(s));\n return b64url(new Uint8Array(sig));\n}\nfunction decodeBase64(s:string):string {\n const compact=s.replace(/\\s+/g,\"\");\n const raw=atob(compact);\n return new TextDecoder().decode(Uint8Array.from(raw,ch=>ch.charCodeAt(0)));\n}\nasync function bodyJson(c:any):Promise {\n const len=Number(c.req.header(\"content-length\")||\"0\");\n if(Number.isFinite(len)&&len>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n const txt=await c.req.text();\n if(new TextEncoder().encode(txt).length>MAX_BODY)throw new Error(\"PAYLOAD_TOO_LARGE\");\n return JSON.parse(txt||\"{}\");\n}\nfunction add(checks:any[],name:string,ok:boolean,detail:any,blocking=true){\n checks.push({name,status:ok?\"PASS\":\"FAIL\",detail,blocking});\n}\nlet brokerTokenCache:{token:string;expires_at_ms:number}|null=null;\n\nasync function brokerHealth(){\n try{\n const res=await fetch(GITHUB_BROKER_BASE+\"/health\",{headers:{\"User-Agent\":\"rumbo-r2-github-observer/1.2\"}});\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,json,text};\n }catch(e){\n return {status:0,json:null,text:String(e)};\n }\n}\n\nasync function getGithubToken():Promise<{ok:true;token:string;expires_at:string}|{ok:false;error:string}>{\n if(brokerTokenCache&&brokerTokenCache.expires_at_ms>Date.now()+60_000){\n return {ok:true,token:brokerTokenCache.token,expires_at:new Date(brokerTokenCache.expires_at_ms).toISOString()};\n }\n const roleToken=Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\")||\"\";\n if(!roleToken)return {ok:false,error:\"GITHUB_BROKER_ROLE_TOKEN_NOT_CONFIGURED\"};\n let res:Response;\n try{\n res=await fetch(GITHUB_BROKER_BASE+\"/v1/token/observer\",{\n method:\"POST\",\n headers:{Authorization:`Bearer ${roleToken}`,\"User-Agent\":\"rumbo-r2-github-observer/1.2\"}\n });\n }catch{\n return {ok:false,error:\"GITHUB_BROKER_UNREACHABLE\"};\n }\n const text=await res.text();\n let json:any=null;try{json=text?JSON.parse(text):null;}catch{}\n if(res.status!==200||!json){\n return {ok:false,error:String(json?.error||`GITHUB_BROKER_HTTP_${res.status}`)};\n }\n const expiresAt=Date.parse(String(json.expires_at||\"\"));\n const perms=json.permissions||{};\n const valid=\n typeof json.token===\"string\"&&json.token.length>20&&\n Number(json.repository_id)===REPOSITORY_ID&&\n json.broker_implementation===GITHUB_BROKER_IMPLEMENTATION&&\n json.role===\"observer\"&&\n perms.contents===\"read\"&&\n perms.pull_requests===\"read\"&&\n perms.administration===\"read\"&&\n json.production_go===false&&\n Number.isFinite(expiresAt)&&expiresAt>Date.now()+60_000;\n if(!valid)return {ok:false,error:\"GITHUB_BROKER_TOKEN_CONTRACT_INVALID\"};\n brokerTokenCache={token:String(json.token),expires_at_ms:expiresAt};\n return {ok:true,token:String(json.token),expires_at:String(json.expires_at)};\n}\n\nasync function github(path:string,method=\"GET\",body?:unknown){\n const tokenResult=await getGithubToken();\n if(!tokenResult.ok)return {status:0,headers:new Headers(),json:null,text:tokenResult.error};\n const res=await fetch(\"https://api.github.com\"+path,{\n method,\n headers:{\n Accept:\"application/vnd.github+json\",\n Authorization:`Bearer ${tokenResult.token}`,\n \"X-GitHub-Api-Version\":API_VERSION,\n \"User-Agent\":\"rumbo-r2-github-observer/1.2\"\n },\n body:body===undefined?undefined:JSON.stringify(body)\n });\n const text=await res.text();\n let json:any=null;\n try{json=text?JSON.parse(text):null;}catch{}\n return {status:res.status,headers:res.headers,json,text};\n}\nasync function fetchContent(path:string,ref:string){\n const encoded=path.split(\"/\").map(encodeURIComponent).join(\"/\");\n const r=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/contents/${encoded}?ref=${encodeURIComponent(ref)}`);\n if(r.status!==200||!r.json||typeof r.json.content!==\"string\"){\n return {ok:false,status:r.status,sha:null,text:null,error:r.json?.message||r.text};\n }\n return {\n ok:true,status:r.status,sha:String(r.json.sha||\"\"),\n text:decodeBase64(r.json.content),error:null\n };\n}\nfunction validateState(state:any,ctx:{pr:number;base:string;head:string;branch:string}){\n const checks:any[]=[];\n\n /*\n * LIVE_STATE.json is a sealed bootstrap snapshot, not a source of current PR\n * coordinates. Current PR/base/head/branch authority comes from GitHub API\n * reads performed in this observation and is signed into the observer receipt.\n * This distinction is required for JIT refresh of the dormant bootstrap branch:\n * the sealed payload can remain byte-stable while GitHub main advances.\n */\n add(checks,\"state_schema\",state?.schema===\"rumbo-continuity-live-state/v2\",state?.schema);\n add(checks,\"state_repo_full\",state?.repository?.full_name===REPO_FULL,state?.repository?.full_name);\n add(checks,\"state_repo_id\",Number(state?.repository?.repository_id)===REPOSITORY_ID,state?.repository?.repository_id);\n add(checks,\"state_owner_login\",state?.repository?.owner_login===REPO_OWNER,state?.repository?.owner_login);\n add(checks,\"state_owner_id\",Number(state?.repository?.owner_id)===OWNER_ID,state?.repository?.owner_id);\n add(checks,\"state_owner_type\",state?.repository?.owner_type===\"User\",state?.repository?.owner_type);\n add(checks,\"state_visibility\",state?.repository?.visibility===\"private\",state?.repository?.visibility);\n add(checks,\"state_default_branch\",state?.repository?.default_branch===DEFAULT_BRANCH,state?.repository?.default_branch);\n add(checks,\"state_control_package\",state?.control_package?.sha256===PACKAGE_SHA256,state?.control_package?.sha256);\n add(checks,\"state_local_artifact_seal\",state?.control_package?.local_artifact_seal===\"PASS\",state?.control_package?.local_artifact_seal);\n add(checks,\"state_direct_main_forbidden\",state?.safety?.direct_main_mutation===\"FORBIDDEN_BY_PROCESS\",state?.safety?.direct_main_mutation);\n add(checks,\"state_merge_without_review_forbidden\",state?.safety?.merge_without_reviewed_pr===\"FORBIDDEN_BY_PROCESS\",state?.safety?.merge_without_reviewed_pr);\n add(checks,\"state_runtime_merge_gate_disabled\",state?.safety?.merge_authorization_runtime_gate===\"DISABLED\",state?.safety?.merge_authorization_runtime_gate);\n add(checks,\"state_production_false\",state?.safety?.production_go_from_this_file===false,state?.safety?.production_go_from_this_file);\n add(checks,\"state_product_no_go\",state?.authority?.product_production===\"NO_GO\",state?.authority?.product_production);\n add(checks,\"state_control_plane_not_operational_go\",state?.canonical_state?.control_plane_operational_go===false,state?.canonical_state?.control_plane_operational_go);\n\n add(checks,\"state_lineage_snapshot_non_authoritative\",true,{\n snapshot_successor_pr:state?.lineage?.successor_pr??null,\n snapshot_successor_branch:state?.lineage?.successor_branch??null,\n snapshot_successor_base_sha:state?.repository?.successor_branch_base_sha??null,\n runtime_pr:ctx.pr,\n runtime_branch:ctx.branch,\n runtime_base_sha:ctx.base,\n runtime_head_sha:ctx.head,\n authority:\"RUNTIME_GITHUB_API_AND_SIGNED_OBSERVER_RECEIPT\"\n },false);\n\n return checks;\n}\nasync function nativeEnforcement(){\n const checks:any[]=[];\n const protection=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/branches/${DEFAULT_BRANCH}/protection`);\n let classic=false;\n if(protection.status===200&&protection.json){\n const j=protection.json;\n const reviews=j.required_pull_request_reviews;\n const requiredApprovals=Number(reviews?.required_approving_review_count||0);\n const pr=!!reviews&&requiredApprovals>=1;\n const force=j.allow_force_pushes?.enabled===false;\n const del=j.allow_deletions?.enabled===false;\n classic=pr&&force&&del;\n }\n add(checks,\"classic_branch_protection\",classic,{status:protection.status},false);\n\n const list=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets`);\n let ruleset=false;\n const inspected:any[]=[];\n if(list.status===200&&Array.isArray(list.json)){\n for(const item of list.json){\n if(item?.enforcement!==\"active\"||item?.target!==\"branch\"||!item?.id)continue;\n const detail=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/rulesets/${item.id}`);\n if(detail.status!==200||!detail.json)continue;\n const types=new Set((detail.json.rules||[]).map((r:any)=>String(r.type)));\n const include=(detail.json.conditions?.ref_name?.include||[]).map(String);\n const targetsMain=include.includes(\"~DEFAULT_BRANCH\")||include.includes(\"refs/heads/main\")||include.includes(\"main\");\n const pullRule=(detail.json.rules||[]).find((r:any)=>String(r.type)===\"pull_request\");\n const requiredApprovals=Number(pullRule?.parameters?.required_approving_review_count||0);\n const protects=types.has(\"pull_request\")&&types.has(\"non_fast_forward\")&&types.has(\"deletion\")&&targetsMain&&requiredApprovals>=1;\n inspected.push({id:item.id,types:[...types],include,required_approvals:requiredApprovals,protects});\n if(protects)ruleset=true;\n }\n }\n add(checks,\"active_main_ruleset\",ruleset,{status:list.status,inspected},false);\n return {\n proven:classic||ruleset,\n classic,\n ruleset,\n protection_status:protection.status,\n rulesets_status:list.status,\n checks\n };\n}\nasync function appendAudit(event_type:string,receipt_sha256:string|null,object_sha256:string|null){\n if(receipt_sha256){\n const ex=await sqlite.execute({sql:\"SELECT event_sha256 FROM observer_audit WHERE event_type=? AND receipt_sha256=? LIMIT 1\",args:[event_type,receipt_sha256]});\n if(ex.rows.length)return String(ex.rows[0].event_sha256);\n }\n for(let attempt=0;attempt<8;attempt++){\n const last=await sqlite.execute(\"SELECT event_sha256 FROM observer_audit ORDER BY seq DESC LIMIT 1\");\n const prev=String(last.rows[0]?.event_sha256||\"0\".repeat(64));\n const created_at=new Date().toISOString();\n const ev={event_type,receipt_sha256,object_sha256,prev_event_sha256:prev,created_at};\n const event_sha256=await sha256Text(canonical(ev));\n try{\n await sqlite.execute({sql:`INSERT INTO observer_audit(event_type,receipt_sha256,object_sha256,prev_event_sha256,event_sha256,created_at)\n VALUES(?,?,?,?,?,?)`,args:[event_type,receipt_sha256,object_sha256,prev,event_sha256,created_at]});\n return event_sha256;\n }catch(e){\n if(!String(e).includes(\"UNIQUE\"))throw e;\n }\n }\n throw new Error(\"AUDIT_APPEND_CONTENTION\");\n}\n\napp.get(\"/\",c=>c.json({service:\"rumbo-r2-github-observer\",implementation:IMPLEMENTATION,status:\"ok\",production_go:false}));\napp.get(\"/health\",async c=>{\n const broker=await brokerHealth();\n const brokerReady=broker.status===200&&broker.json?.implementation===GITHUB_BROKER_IMPLEMENTATION&&broker.json?.broker_ready===true;\n const roleTokenConfigured=!!Deno.env.get(\"R2_GITHUB_BROKER_ROLE_TOKEN\");\n return c.json({\n ok:true,\n implementation:IMPLEMENTATION,\n root_token_configured:!!Deno.env.get(\"R2_OBSERVER_ROOT_TOKEN\"),\n signing_key_configured:!!Deno.env.get(\"R2_OBSERVER_SIGNING_JWK_V1\"),\n broker_autopilot_token_hash_configured:!!Deno.env.get(\"R2_BROKER_OBSERVER_AUTOPILOT_TOKEN_SHA256\"),\n broker_autopilot_plaintext_token_persisted_here:false,\n broker_autopilot_scope:\"OBSERVE_ONLY\",\n direct_github_token_path_retired:true,\n github_broker:{\n base:GITHUB_BROKER_BASE,\n expected_implementation:GITHUB_BROKER_IMPLEMENTATION,\n observed_implementation:broker.json?.implementation||null,\n role:\"observer\",\n role_token_configured:roleTokenConfigured,\n health_status:broker.status,\n broker_ready:brokerReady\n },\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID,default_branch:DEFAULT_BRANCH},\n package_sha256:PACKAGE_SHA256,\n static_git_blob_pins:STATIC_PINS,\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KID,verify_jwk:VERIFY_JWK},\n state_authority_policy:{\n accepted_bootstrap_schema:\"rumbo-continuity-live-state/v2\",\n snapshot_coordinates_authoritative:false,\n runtime_pr_coordinates_source:\"GITHUB_API\",\n runtime_coordinates_signed_in_receipt:true,\n sealed_payload_can_be_jit_refreshed_without_content_rewrite:true\n },\n native_enforcement_policy:{\n minimum_approving_reviews:1,\n classic_requires_force_push_disabled:true,\n classic_requires_deletion_disabled:true,\n ruleset_required_rules:[\"pull_request\",\"non_fast_forward\",\"deletion\"]\n },\n capabilities:[\n \"private-github-independent-observation\",\n \"broker-post-install-autopilot-observe-only\",\n \"hashed-service-token-auth\",\n \"github-app-broker-jit-token\",\n \"no-durable-github-installation-token\",\n \"exact-repository-identity\",\n \"exact-pr-base-head-binding\",\n \"git-lineage-compare\",\n \"static-bootstrap-blob-pinning\",\n \"stable-state-invariant-validation\",\n \"runtime-github-coordinate-authority\",\n \"jit-dormant-branch-refresh-compatible\",\n \"native-enforcement-observation\",\n \"minimum-one-approval-enforcement\",\n \"force-push-and-deletion-enforcement\",\n \"implementation-bound-signed-receipts\",\n \"signed-observer-receipts\",\n \"durable-observer-ledger\",\n \"audit-hash-chain\"\n ],\n observer_can_run:roleTokenConfigured&&brokerReady,\n production_go:false\n },200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.post(\"/v1/observe\",async c=>{\n const authMode=await observeAuthorized(c.req.raw);\n if(!authMode)return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const tokenCheck=await getGithubToken();\n if(!tokenCheck.ok){\n return c.json({\n error:\"GITHUB_BROKER_NOT_READY\",\n reason:tokenCheck.error,\n observer_can_run:false,\n production_go:false\n },424,{\"Cache-Control\":\"no-store\"});\n }\n try{\n const b=await bodyJson(c);\n const prNumber=Number(b?.pr_number);\n const expectedBase=String(b?.expected_base_sha||\"\");\n const expectedHead=String(b?.expected_head_sha||\"\");\n if(!Number.isSafeInteger(prNumber)||prNumber<=0||!/^[a-f0-9]{40}$/.test(expectedBase)||!/^[a-f0-9]{40}$/.test(expectedHead)){\n return c.json({error:\"INVALID_EXACT_BINDING\"},400,{\"Cache-Control\":\"no-store\"});\n }\n\n const checks:any[]=[];\n const repo=await github(`/repos/${REPO_OWNER}/${REPO_NAME}`);\n add(checks,\"repo_api_read\",repo.status===200,repo.status);\n add(checks,\"repo_id\",Number(repo.json?.id)===REPOSITORY_ID,repo.json?.id);\n add(checks,\"owner_id\",Number(repo.json?.owner?.id)===OWNER_ID,repo.json?.owner?.id);\n add(checks,\"private_repo\",repo.json?.private===true,repo.json?.private);\n add(checks,\"default_branch\",repo.json?.default_branch===DEFAULT_BRANCH,repo.json?.default_branch);\n\n const pr=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/pulls/${prNumber}`);\n add(checks,\"pr_api_read\",pr.status===200,pr.status);\n add(checks,\"pr_open\",pr.json?.state===\"open\",pr.json?.state);\n add(checks,\"pr_draft\",pr.json?.draft===true,pr.json?.draft);\n add(checks,\"pr_base_ref\",pr.json?.base?.ref===DEFAULT_BRANCH,pr.json?.base?.ref);\n add(checks,\"pr_base_sha_exact\",pr.json?.base?.sha===expectedBase,pr.json?.base?.sha);\n add(checks,\"pr_head_sha_exact\",pr.json?.head?.sha===expectedHead,pr.json?.head?.sha);\n const branch=String(pr.json?.head?.ref||\"\");\n add(checks,\"pr_branch_present\",!!branch,branch);\n\n const cmp=await github(`/repos/${REPO_OWNER}/${REPO_NAME}/compare/${expectedBase}...${expectedHead}`);\n add(checks,\"compare_api_read\",cmp.status===200,cmp.status);\n add(checks,\"head_descends_from_base\",cmp.json?.behind_by===0&&Number(cmp.json?.ahead_by)>=1,{status:cmp.json?.status,ahead_by:cmp.json?.ahead_by,behind_by:cmp.json?.behind_by});\n\n const fileEvidence:any={};\n for(const [path,pin] of Object.entries(STATIC_PINS)){\n const f=await fetchContent(path,expectedHead);\n fileEvidence[path]={status:f.status,git_blob_sha:f.sha};\n add(checks,`static_pin:${path}`,f.ok&&f.sha===pin,{observed:f.sha,expected:pin,status:f.status});\n }\n\n const liveFile=await fetchContent(\"tools/continuity-r2/LIVE_STATE.json\",expectedHead);\n add(checks,\"live_state_read\",liveFile.ok,{status:liveFile.status,error:liveFile.error});\n let state:any=null;\n if(liveFile.ok){\n try{state=JSON.parse(liveFile.text!);}catch{}\n }\n add(checks,\"live_state_json\",!!state,state?\"parsed\":\"invalid\");\n if(state){\n checks.push(...validateState(state,{pr:prNumber,base:expectedBase,head:expectedHead,branch}));\n }\n\n const readmeFile=await fetchContent(\"tools/continuity-r2/README.md\",expectedHead);\n add(checks,\"readme_read\",readmeFile.ok,{status:readmeFile.status,error:readmeFile.error});\n if(readmeFile.ok){\n add(checks,\"readme_package_pin\",readmeFile.text!.includes(PACKAGE_SHA256),PACKAGE_SHA256);\n add(checks,\"readme_production_no_go\",readmeFile.text!.includes(\"PRODUCTION_NO_GO\"),\"required marker\");\n }\n\n const native=await nativeEnforcement();\n checks.push(...native.checks);\n\n const blocking=checks.filter(x=>x.blocking&&x.status!==\"PASS\");\n const observationStatus=blocking.length===0?\"OBSERVATION_PASS\":\"NO_GO\";\n const stateSha=liveFile.ok?await sha256Text(liveFile.text!):null;\n const readmeSha=readmeFile.ok?await sha256Text(readmeFile.text!):null;\n const observedAt=new Date().toISOString();\n const unsigned={\n schema:\"rumbo-r2-github-observer-receipt/v1\",\n observer_implementation:IMPLEMENTATION,\n broker_implementation:GITHUB_BROKER_IMPLEMENTATION,\n authoritative_for:\"R2_GITHUB_PR_SNAPSHOT_ONLY\",\n production_go:false,\n repository:{full_name:REPO_FULL,id:REPOSITORY_ID,owner_id:OWNER_ID},\n pr_number:prNumber,\n base_sha:expectedBase,\n head_sha:expectedHead,\n head_branch:branch||null,\n observed_at:observedAt,\n package_sha256:PACKAGE_SHA256,\n state_sha256:stateSha,\n readme_sha256:readmeSha,\n static_file_evidence:fileEvidence,\n native_enforcement:{\n proven:native.proven,\n classic_branch_protection:native.classic,\n active_main_ruleset:native.ruleset,\n protection_api_status:native.protection_status,\n rulesets_api_status:native.rulesets_status\n },\n checks,\n blocking_count:blocking.length,\n observation_status:observationStatus,\n merge_ready:observationStatus===\"OBSERVATION_PASS\"&&native.proven,\n invocation_mode:authMode,\n note:\"Independent GitHub snapshot observation only. Receipt cannot authorize product production.\"\n };\n const canon=canonical(unsigned);\n const receiptSha=await sha256Text(canon);\n const signature=await signCanonical(canon);\n const receipt={\n ...unsigned,\n receipt_sha256:receiptSha,\n receipt_signature:{alg:\"ES256\",kid:SIGNING_KID,signature_b64url:signature}\n };\n\n const prior=await sqlite.execute({sql:\"SELECT receipt_sha256 FROM observer_receipts WHERE pr_number=? AND head_sha=? LIMIT 1\",args:[prNumber,expectedHead]});\n if(!prior.rows.length){\n await sqlite.execute({sql:`INSERT INTO observer_receipts(\n receipt_sha256,pr_number,base_sha,head_sha,observed_at,observation_status,blocking_count,\n native_enforcement_proven,merge_ready,state_sha256,readme_sha256,signature_kid,signature_b64url\n ) VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)`,args:[\n receiptSha,prNumber,expectedBase,expectedHead,observedAt,observationStatus,blocking.length,\n native.proven?1:0,receipt.merge_ready?1:0,stateSha,readmeSha,SIGNING_KID,signature\n ]});\n await appendAudit(\"OBSERVER_RECEIPT_CREATED\",receiptSha,receiptSha);\n }\n\n return c.json(receipt,observationStatus===\"OBSERVATION_PASS\"?200:409,{\"Cache-Control\":\"no-store\"});\n }catch(e){\n return c.json({error:String(e?.message||e),production_go:false},400,{\"Cache-Control\":\"no-store\"});\n }\n});\n\napp.get(\"/v1/ledger\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(`SELECT receipt_sha256,pr_number,base_sha,head_sha,observed_at,\n observation_status,blocking_count,native_enforcement_proven,merge_ready,state_sha256,readme_sha256,\n signature_kid FROM observer_receipts ORDER BY observed_at DESC LIMIT 100`);\n return c.json({schema:\"rumbo-r2-github-observer-ledger/v1\",implementation:IMPLEMENTATION,production_go:false,records:rs.rows},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.get(\"/v1/audit\",async c=>{\n if(!authorized(c.req.raw))return c.json({error:\"UNAUTHORIZED\"},401,{\"Cache-Control\":\"no-store\"});\n const rs=await sqlite.execute(\"SELECT * FROM observer_audit ORDER BY seq ASC\");\n let prev=\"0\".repeat(64),ok=true;\n for(const r of rs.rows as any[]){\n const ev={event_type:r.event_type,receipt_sha256:r.receipt_sha256,object_sha256:r.object_sha256,prev_event_sha256:r.prev_event_sha256,created_at:r.created_at};\n const h=await sha256Text(canonical(ev));\n if(String(r.prev_event_sha256)!==prev||String(r.event_sha256)!==h)ok=false;\n prev=String(r.event_sha256);\n }\n return c.json({schema:\"rumbo-r2-github-observer-audit/v1\",audit_chain_ok:ok,count:rs.rows.length,tail_sha256:prev,production_go:false},200,{\"Cache-Control\":\"no-store\"});\n});\n\napp.onError((err,c)=>{\n console.error(err);\n return c.json({error:\"INTERNAL_ERROR\",production_go:false},500,{\"Cache-Control\":\"no-store\"});\n});\nexport default app.fetch;\n",[],[197],"69c0660a-a61e-4734-82f1-cb240dd09e23","RELEASE_V1_5.md","ee01d6f4-a376-11f1-a86a-1607ee4eb77e",["D",1787986661969],"# RUMBO R2 GitHub Observer V1.5 — Broker Autopilot\n\nStatus: **PASS / FAIL_CLOSED / BROKER_CUSTODY_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_OBSERVER_V1_5_BROKER_AUTOPILOT`.\n\nV1.5 adds one narrow service-auth path for the GitHub App broker's post-install autopilot. The observer stores only SHA-256 of that service bearer and accepts it only on `POST /v1/observe`; ledger, audit and all other administrative endpoints remain root-authenticated.\n\nEvery signed observer receipt now records `invocation_mode` as either `ROOT` or `BROKER_AUTOPILOT`. The broker implementation is pinned to `R2_GITHUB_APP_CUSTODY_BROKER_V1_2_POST_INSTALL_AUTOPILOT`.\n\nAll V1.4 controls remain: exact repository/PR/base/head binding, Git ancestry, sealed static blob pins, stable-state invariants, GitHub runtime coordinate authority, strict native enforcement, ES256 signed receipts, and `production_go=false`.\n\nSelftest evaluation: `01a04c4d-ce1b-70f9-981b-f9d5222a2501` — PASS.\n\nIndependent static audit: **18/18 PASS**, including hashed service-token auth, observe-only service scope, no plaintext service token, direct GitHub-token path retired, strict native enforcement and no merge authority.\n\nThe observer remains unable to run a live private-repository observation until dedicated GitHub App custody is installed.\n",[],[207],"867f6136-84f7-4efc-925e-dc6ae9a609c3","RELEASE_V1_4.md","01a04c47-5467-7544-bc62-fab09eaf00ee",["D",1787986138220],"# RUMBO R2 GitHub Observer V1.4 — JIT Derived GitHub Authority\n\nStatus: **PASS / JIT_AUTHORITY_FIXED / BROKER_CUSTODY_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_OBSERVER_V1_4_JIT_DERIVED_GITHUB_AUTHORITY`.\n\nV1.4 fixes a JIT activation defect found during reconciliation. The sealed bootstrap `LIVE_STATE.json` is schema `rumbo-continuity-live-state/v2` and contains historical successor coordinates. Those coordinates are now explicitly non-authoritative for a fresh activation. Runtime PR/base/head/branch authority is read directly from GitHub and signed into the observer receipt.\n\nStable invariants from the sealed state remain blocking: exact repository identity, private visibility, exact package SHA-256, local artifact seal PASS, direct-main mutation forbidden, reviewed-PR requirement, runtime merge gate disabled, product production NO_GO, control-plane operational GO false, and production_go false.\n\nBranch-only adversarial evaluation `01a04bf1-7dbb-75d6-9148-4a3f95890696` — PASS:\n- stale historical PR/base/branch coordinates accepted only as non-authoritative metadata;\n- wrong repository id rejected;\n- product GO rejected;\n- wrong state schema rejected.\n\nPermanent selftest after removing the diagnostic route/file: `01a04bf1-c709-708d-802a-63f5dad4c8e3` — PASS.\n\nStatic audit: PASS. Direct GitHub token custody remains retired, broker implementation remains pinned to `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE`, native enforcement remains mandatory for merge readiness, and `production_go=false`.\n",[],[214],"3c283a40-e057-4522-bdec-04d594deaf24","RELEASE_V1_3.md","01a04c47-5467-7544-bc62-f5f927579377",["D",1787986138220],"# RUMBO R2 GitHub Observer V1.3 — Broker Implementation Pin\n\nStatus: **PASS / BROKER_IMPLEMENTATION_PINNED / APP_CUSTODY_PENDING / PRODUCTION_NO_GO**\n\nImplementation: `R2_GITHUB_OBSERVER_V1_3_BROKER_IMPLEMENTATION_PINNED`.\n\nThe observer now requires broker implementation `R2_GITHUB_APP_CUSTODY_BROKER_V1_1_EXACT_SCOPE` both in broker health and in every JIT token response. The broker implementation id is also included inside the signed observer receipt, so downstream authority can reject receipts produced through an older broker implementation.\n\nDirect GitHub token custody remains retired. JIT tokens are exact-repository, exact-permission, ephemeral only.\n\nValidation evaluation: `01a04be5-d236-75df-997b-cd6a4f6e9619` — PASS.\n\nFixture receipt SHA-256: `9a0af791daeb4b92bfd664bdfd65995381d6f6f5edfdc97bd7f4fb5d3101ce83`.\n\nStatic audit: PASS. `observer_can_run=false` until the dedicated GitHub App is created and installed; `production_go=false`.\n",[],[221],"9889ddac-9693-4c94-9660-d7f517d6ab4e","RELEASE_V1_2.md","01a04c47-5467-7544-bc62-f16244ef91a6",["D",1787986138220],"# RUMBO R2 GitHub Observer V1.2 — Broker JIT\n\nStatus: **PASS / BROKER_WIRED / APP_CUSTODY_PENDING / PRODUCTION_NO_GO**\n\nImplementation:\n\n`R2_GITHUB_OBSERVER_V1_2_BROKER_JIT`\n\n## Change\n\nThe observer no longer accepts or reads a directly provisioned `R2_GITHUB_APP_TOKEN`.\n\nThe only private-repository access path is now the dedicated GitHub App custody broker:\n\n`R2_GITHUB_APP_CUSTODY_BROKER_V1`\n\nThe observer holds only a role-specific broker bearer in encrypted environment state.\nFor each execution it requests a short-lived installation token scoped to:\n\n- exact repository id `1314199389`;\n- `contents: read`;\n- `pull_requests: read`;\n- `administration: read`.\n\nThe returned broker contract, repository id, role and permissions are validated before the\ntoken is accepted.\n\nThe installation token is cached only in process memory until shortly before expiry.\nIt is never inserted into the observer SQLite ledger and is never emitted in receipts,\nhealth or audit views.\n\n## Fail-closed state\n\nThe broker role bearer is configured, but the broker has not yet completed GitHub App\ncreation and installation.\n\nTherefore:\n\n- broker health is reachable;\n- `broker_ready=false`;\n- observer live execution returns HTTP 424;\n- no shared/direct GitHub credential fallback exists;\n- `observer_can_run=false`;\n- `production_go=false`.\n\n## Validation\n\nEvaluation:\n\n`01a04bdc-94db-7113-934f-9945f4e697cb`\n\nResult: **PASS**.\n\nValidated:\n\n- health → 200;\n- direct GitHub token path retired;\n- broker role bearer configured;\n- broker reports not ready;\n- unauthenticated ledger → 401;\n- observe without completed broker custody → 424;\n- signed receipt fixture verifies;\n- tampered receipt fails verification;\n- audit chain passes;\n- production_go remains false.\n\nFixture receipt SHA-256:\n\n`b7808664e5a4874c3c81ac76474cfbaa84765863ac95b4b735b2b95c2e4a0628`\n\n## Static audit\n\nPASS:\n\n- broker endpoint pinned;\n- direct GitHub token environment path absent;\n- broker role secret not embedded in source;\n- exact observer token permissions checked;\n- repository id checked;\n- no SQL token persistence path;\n- installation token cache is ephemeral;\n- observer implementation remains signed into every receipt;\n- strict native enforcement proof remains unchanged;\n- production_go remains false.\n\n## Boundary\n\nThis removes the direct/shared credential architecture from the observer. Live GitHub\nobservation still requires the human-authenticated GitHub App Manifest installation step\nto complete in the broker.\n",[],[228],"8056ca40-dc49-43f0-b23a-ccc7bc7e966f","RELEASE_V1_1.md","01a04c47-5467-7544-bc62-eff573794352",["D",1787986138220],"# RUMBO R2 GitHub Observer V1.1 — Native Review Hardening\n\nStatus: **PASS / CREDENTIAL_PENDING / PRODUCTION_NO_GO**\n\nImplementation:\n\n`R2_GITHUB_OBSERVER_V1_1_NATIVE_REVIEW_HARDENING`\n\nV1.1 tightens the native-enforcement proof required for a future merge-capable observer\nreceipt and binds the implementation revision into the signed receipt itself.\n\n## Rollback resistance\n\nEvery new observer receipt now signs:\n\n`observer_implementation=R2_GITHUB_OBSERVER_V1_1_NATIVE_REVIEW_HARDENING`\n\nA downstream authorizer can therefore reject receipts from older implementations even if\nthey share the same receipt schema and signing key.\n\n## Classic branch protection proof\n\nClassic protection counts as proven only when all are explicit:\n\n- required pull-request reviews are configured;\n- required approving-review count is at least 1;\n- force pushes are explicitly disabled;\n- branch deletion is explicitly disabled.\n\nMissing/null fields no longer count as safe.\n\n## Ruleset proof\n\nA ruleset counts as proven only when it:\n\n- is active;\n- targets branches;\n- targets `main` or the default branch;\n- contains a `pull_request` rule;\n- requires at least 1 approving review;\n- contains `non_fast_forward`;\n- contains `deletion`.\n\nThis closes the earlier weakness where a pull-request + non-fast-forward ruleset could be\ntreated as sufficient while branch deletion or zero required approvals remained possible.\n\n## Self-test\n\nEvaluation:\n\n`01a04bca-f946-77ca-a820-0e18424ce7ac`\n\nResult: **PASS**.\n\n- health → 200;\n- dedicated GitHub App credential absent → fail-closed;\n- unauthenticated ledger → 401;\n- live observe without credential → 424;\n- signed V1.1 fixture → valid;\n- tampered fixture → invalid;\n- audit chain → PASS;\n- production_go → false.\n\nFixture SHA-256:\n\n`69a2adace45f11c6520507b238d68b0ba748607b0a661f2d1a99cbf0cc0542f6`\n\n## Boundary\n\nThe stricter native-enforcement verifier is implemented. Live private-repository\nobservation still requires a dedicated read credential. No merge or production authority\nis created by this service.\n",[],[235],["D",1787986138220],[],[18],["D",1787977337892],["D",1789539031988],{"_11":12,"_129":74},{"_11":12,"_124":125,"_73":74,"_30":72,"_126":127,"_128":24},{"_38":114,"_13":16,"_32":35,"_115":76,"_116":64,"_117":118,"_119":80,"_120":76,"_121":41,"_122":14,"_123":12},"ctx",{"_53":-5,"_149":282,"_283":284,"_285":286,"_287":24,"_288":24,"_289":24,"_290":88,"_291":-5,"_292":-7,"_293":-7,"_294":26,"_295":24,"_296":24,"_297":-5,"_298":24,"_299":24,"_300":24,"_301":-5},"ENV",{"_253":254,"_255":256,"_257":65,"_258":259,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · RELEASE_V1.md