fix(security): isolate saleable readiness subprocess authority

[seonghobae]

Test-first hardening of the saleable-readiness subprocess authority boundary, non-destructively refreshed onto protected main 18cac8dcab31dd53048d5d14ad01673b5b77d141. No predecessor checks, reviews, scanner/model output, production KPI/smoke evidence, release evidence, or acquisition evidence transfer after refresh.

RCA -> RED -> GREEN -> review repair

Protected scripts/saleable-readiness-audit.mjs forwarded the complete ambient environment into nested npm, security, KPI, alert, and smoke subprocesses. The RED contract required an explicit behavior-level allowlist. GREEN introduced createReadinessSubprocessEnvironment() with only platform launch/TLS/locale plus bounded KPI/alert/smoke configuration.

CodeRabbit then identified a valid functional regression: the allowlist removed an explicitly supplied NOEMA_AUDIT_REPORT_ONLY override even though runCommand() distinguishes that explicit override from ambient inheritance. RED a7edd13128642de578e928293e326ba4b895b477 pinned the override contract and GREEN c913196f51f2cf85ef33129cb1cecdc409a664ed added only that reviewed key while retaining ambient-value deletion. The sole inline finding is resolved.

Current exact source

Current head 091cb6cdec07330dc10a2eae772103ea57af2c4f is a non-forced refresh preserving OpenAPI-integrated protected main plus the exact reviewed final blobs:

• scripts/saleable-readiness-audit.mjs 0054030f6e66d2211195bfc545f14980f04e9966;
• test/saleable-readiness-subprocess-environment.test.ts 0bc3cfdc95a295605ee324db6c8e77597e7a2242.

Fresh diff contains only those two paths and is zero commits behind the observed protected base. The visible formal review remains COMMENTED on a predecessor; current unresolved inline threads are zero.

Exact-head evidence

For unchanged head 091cb6cdec07330dc10a2eae772103ea57af2c4f:

• application ci 31595905471: queued/non-passing at the latest direct run read;
• reviewer-ci 31595905416: queued/non-passing;
• protected-base eligible central Security Scan 31595905266: queued/non-passing.

The PR remains Draft until the unchanged exact head has terminal-success applicable gates and current findings remain clean. No blind rerun, clean-head churn, synthetic status, or gate weakening is used.

Authority boundary

This repair narrows local child-process authority only. It does not create real KPI/smoke evidence, prove saleability, publish a release, deploy Noema, choose an outbound license, establish revenue/legal/IP-transfer evidence, or create acquisition readiness.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 43 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f7d1475d-b11f-4723-aa8b-585b4fc6403b

📥 Commits

Reviewing files that changed from the base of the PR and between f25812c and 7b2f1b7.

📒 Files selected for processing (2)

• scripts/saleable-readiness-audit.mjs
• test/saleable-readiness-subprocess-environment.test.ts

📝 Walkthrough

Walkthrough

Readiness 하위 프로세스는 전체 process.env 대신 허용된 환경 변수만 받습니다. 호출별 override와 문자열 값만 사용합니다. 테스트는 필수 런타임 키의 전달과 비밀정보 및 권한 관련 키의 제외를 검증합니다.

Changes

Readiness 환경 변수 제한

Layer / File(s)	Summary
허용 환경 변수 구성 scripts/saleable-readiness-audit.mjs	허용 목록을 추가했습니다. override 또는 현재 프로세스 환경에서 문자열 값만 선택해 하위 프로세스 환경 객체를 구성합니다.
하위 프로세스 연결 및 검증 scripts/saleable-readiness-audit.mjs, test/saleable-readiness-subprocess-environment.test.ts	runCommand가 제한된 환경 객체를 사용합니다. 테스트는 허용된 런타임 키의 전달과 API 토큰, GitHub 토큰, 프록시, NODE_OPTIONS 등 금지된 키의 제외를 검증합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 readiness 하위 프로세스의 환경 변수 권한 격리라는 주요 변경 사항을 정확하고 간결하게 설명합니다.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/saleable-readiness-subprocess-env

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/saleable-readiness-audit.mjs`:
- Around line 16-41: Allow the explicit NOEMA_AUDIT_REPORT_ONLY override to
reach child processes by adding it to readinessSubprocessEnvironmentKeys in
scripts/saleable-readiness-audit.mjs; preserve the existing filtering that
blocks ambient inheritance. Update
test/saleable-readiness-subprocess-environment.test.ts in the required allowlist
contract to include this key.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 91d49c62-b54a-4a1a-bdce-c62f49abb032

📥 Commits

Reviewing files that changed from the base of the PR and between c85d710 and f25812c.

📒 Files selected for processing (2)

• scripts/saleable-readiness-audit.mjs
• test/saleable-readiness-subprocess-environment.test.ts