fix(acquisition): restack exact deployment evidence bytes on current main

[seonghobae]

Fresh protected-main successor for #125 on exact base 1a8a77d67f61a2c61e88974be9206a91d19acdf4. No predecessor checks, reviews, scanner output, model judgment, deployment evidence, or acquisition evidence transfers.

Current test-first RED head 4b4c4d7ba150e98f1d86e6ed47ac50a2ba5680d9 adds only the retained-byte integrity regression. Protected scripts/acquisition-deployment-evidence-audit.mjs still reads evidence with readFileSync(path, "utf8") and hashes decoded text, so malformed UTF-8 can be replacement-normalized before JSON/JSONL semantics and receipt digest binding.

Selected bounded GREEN after exact RED proof: read bounded exact bytes, decode parsed evidence with fatal UTF-8, and compute the deployment subject SHA-256 over the same exact retained Buffer, preserving release/governance/attestation semantics.

Historical #125 remains open until this current-main successor proves and integrates the complete two-file contract.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a121c64-288c-4911-8031-848ec2dafc82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by fresh protected-main successor #213 after exact byte/scope comparison.

Fresh identities immediately before this closure decision:

• protected main: 0b515c11670f26f888ccdf66707f34b946f505ef;
• fix(acquisition): restack exact deployment evidence bytes on current main #207 unchanged head: 09ef73b8f07b5b7d37796cf0127aa38b55e38b62;
• fix(acquisition): bind deployment audit to exact bytes on current main #213 current head: 11e8af5de95fdaa28e2e5c4be71499d239df5199 on exact current main base.

Preservation proof:

• fix(acquisition): restack exact deployment evidence bytes on current main #207 scripts/acquisition-deployment-evidence-audit.mjs and fix(acquisition): bind deployment audit to exact bytes on current main #213 current source are byte-identical (ceb2b71c226c0e0c6d0116587a9c7c8f30fdf87a);
• fix(acquisition): restack exact deployment evidence bytes on current main #207 test/acquisition-deployment-evidence-input-integrity.test.ts and fix(acquisition): bind deployment audit to exact bytes on current main #213 current test are byte-identical (dc5d587c66cd0735d8fa7603ef23149aceb93c46);
• fix(acquisition): restack exact deployment evidence bytes on current main #207's only extra changed path, scripts/check-kpi.mjs, is already byte-identical to current protected main (10ba8c0a8a03f95aae5df88ab01bc05e10b17b4f) and is therefore base-drift rather than unique acquisition work;
• fix(acquisition): restack exact deployment evidence bytes on current main #207 and fix(acquisition): bind deployment audit to exact bytes on current main #213 have no current inline review threads to preserve;
• fix(acquisition): bind deployment audit to exact bytes on current main #213 current exact head has fresh terminal-success application ci 31577456755, reviewer-ci 31577457008, and eligible central Security Scan 31577456760. Those results belong only to fix(acquisition): bind deployment audit to exact bytes on current main #213 and do not transfer to fix(acquisition): restack exact deployment evidence bytes on current main #207.

Closing #207 unmerged removes the stale parallel acquisition writer without discarding unique behavior or regression coverage. #213 remains the sole current-main owner; its branch is otherwise left untouched in this invocation because its head moved during the fresh writer-state sweep.