fix(security): isolate saleable readiness subprocess authority

scripts/saleable-readiness-audit.mjs

@@ -13,8 +13,48 @@ const securityChecklist = process.env.NOEMA_SECURITY_CHECKLIST_PATH || "docs/sec
 const securityEvidencePath = process.env.NOEMA_SECURITY_EVIDENCE_PATH || "artifacts/security/security-validation-evidence.json";
 const checks = [];
 
+const readinessSubprocessEnvironmentKeys = Object.freeze([
+  "PATH",
+  "PATHEXT",
+  "SystemRoot",
+  "ComSpec",
+  "CI",
+  "NO_COLOR",
+  "TZ",
+  "LANG",
+  "LC_ALL",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+  "NOEMA_KPI_FAILURE_THRESHOLD",
+  "NOEMA_KPI_P95_THRESHOLD_MS",
+  "NOEMA_KPI_REQUIRE_WINDOW_DAYS",
+  "NOEMA_KPI_LOG_PATH",
+  "NOEMA_KPI_PROVENANCE_PATH",
+  "NOEMA_KPI_EVIDENCE_PATH",
+  "NOEMA_ALERT_5M_FAILURE_RATE",
+  "NOEMA_ALERT_5M_P95_MS",
+  "NOEMA_ALERT_RATE_LIMIT_MINUTES",
+  "NOEMA_ALERT_WORKFLOW_SPIKE_MULTIPLIER",
+  "NOEMA_EXCHANGE_URL",
+  "NOEMA_SMOKE_EVIDENCE_PATH",
+]);
+
+function createReadinessSubprocessEnvironment(overrides = {}) {
+  const env = {};
+  for (const key of readinessSubprocessEnvironmentKeys) {
+    const value = Object.prototype.hasOwnProperty.call(overrides, key)
+      ? overrides[key]
+      : process.env[key];
+    if (typeof value === "string") {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+
 function runCommand(command, args, options = {}) {
-  const env = { ...process.env, ...options.env };
+  const env = createReadinessSubprocessEnvironment(options.env);
   if (!Object.prototype.hasOwnProperty.call(options.env ?? {}, "NOEMA_AUDIT_REPORT_ONLY")) {
     delete env.NOEMA_AUDIT_REPORT_ONLY;
   }

test/saleable-readiness-subprocess-environment.test.ts

@@ -0,0 +1,54 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+describe("saleable readiness subprocess authority", () => {
+  it("passes only the explicit non-secret runtime contract to child commands", () => {
+    const script = readFileSync("scripts/saleable-readiness-audit.mjs", "utf8");
+
+    expect(script).toContain("readinessSubprocessEnvironmentKeys");
+    expect(script).toContain("createReadinessSubprocessEnvironment");
+    expect(script).toContain("const env = createReadinessSubprocessEnvironment(options.env)");
+    expect(script).not.toContain("...process.env");
+
+    for (const requiredRuntimeKey of [
+      "PATH",
+      "PATHEXT",
+      "SystemRoot",
+      "ComSpec",
+      "CI",
+      "NO_COLOR",
+      "TZ",
+      "LANG",
+      "LC_ALL",
+      "NODE_EXTRA_CA_CERTS",
+      "SSL_CERT_FILE",
+      "SSL_CERT_DIR",
+      "NOEMA_KPI_FAILURE_THRESHOLD",
+      "NOEMA_KPI_P95_THRESHOLD_MS",
+      "NOEMA_KPI_REQUIRE_WINDOW_DAYS",
+      "NOEMA_KPI_LOG_PATH",
+      "NOEMA_KPI_PROVENANCE_PATH",
+      "NOEMA_KPI_EVIDENCE_PATH",
+      "NOEMA_ALERT_5M_FAILURE_RATE",
+      "NOEMA_ALERT_5M_P95_MS",
+      "NOEMA_ALERT_RATE_LIMIT_MINUTES",
+      "NOEMA_ALERT_WORKFLOW_SPIKE_MULTIPLIER",
+    ]) {
+      expect(script).toContain(`\"${requiredRuntimeKey}\"`);
+    }
+
+    for (const forbiddenAmbientAuthority of [
+      "NVIDIA_NIM_API_KEY",
+      "GH_TOKEN",
+      "GITHUB_TOKEN",
+      "NOEMA_MAINTAINER_APP_PRIVATE_KEY",
+      "NOEMA_REVIEWER_APP_PRIVATE_KEY",
+      "CLOUDFLARE_API_TOKEN",
+      "NODE_OPTIONS",
+      "HTTPS_PROXY",
+      "HTTP_PROXY",
+    ]) {
+      expect(script).not.toContain(`\"${forbiddenAmbientAuthority}\"`);
+    }
+  });
+});