fix(acquisition): bind deployment audit to exact bytes on current main

[seonghobae]

Fresh protected-main test-first successor for #207/#125, now non-destructively refreshed onto live protected base db4f444c1b1849ec615364a233469870c23407e6. No predecessor checks, reviews, scanner/model output, deployment evidence, or acquisition evidence transfer to the refreshed head.

RCA -> RED -> GREEN

Protected scripts/acquisition-deployment-evidence-audit.mjs path-read retained deployment and attestation evidence through ordinary UTF-8 decoding and calculated deployment subject identity from decoded text. Malformed retained bytes could therefore be replacement-normalized before JSON/JSONL semantics, and a path validated by metadata could be swapped to a symlink before the later content read.

Test-only RED head b8d42c372bd59e5b38f57ad470c132017648a127 added only test/acquisition-deployment-evidence-input-integrity.test.ts. Application ci 31577098644, job 94051567432, checked out the exact head and failed in release verify after exact-checkout/toolchain/install success. Source-backed annotations identify the three intended boundaries: malformed deployment JSON accepted under replacement-decoded receipt identity, malformed attestation bytes accepted, and a metadata-to-read path-to-symlink swap accepted.

GREEN head 11e8af5de95fdaa28e2e5c4be71499d239df5199 implemented bounded real O_NOFOLLOW descriptor snapshots, opened-object regular-file/device/inode/size validation, exact bounded reads, fatal UTF-8 decoding, and exact deployment-byte SHA-256 binding while preserving existing release/governance/attestation semantics. Its application ci 31577456755, reviewer-ci 31577457008, and eligible central Security Scan 31577456760 completed successfully; those results remain predecessor evidence after the base refresh.

Current exact refreshed head 49c00e73bec816f1ba51de1ff20a3992e23da3ce is a non-forced two-parent merge preserving current protected main plus the exact final two repair blobs: scripts/acquisition-deployment-evidence-audit.mjs ceb2b71c226c0e0c6d0116587a9c7c8f30fdf87a and test/acquisition-deployment-evidence-input-integrity.test.ts dc5d587c66cd0735d8fa7603ef23149aceb93c46. Fresh compare against live main is 0 behind with only those two changed paths.

Current exact-head state

Application ci 31590689704, reviewer-ci 31590689715, and protected-base eligible central Security Scan 31590689592 are queued/non-passing on exact refreshed head 49c00e73bec816f1ba51de1ff20a3992e23da3ce. Keep Draft until all applicable exact-head gates are terminal-success and current reviews/threads are re-read.

Authority boundary

This repair authenticates one buyer-side deployment-evidence input boundary. It does not prove a production deployment, cryptographic attestation verification, immutable release publication, production environment governance, KPI/revenue/legal/IP-transfer evidence, or acquisition readiness. Merge only if the unchanged exact head satisfies actual live Noema governance and every applicable gate.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d0ce4fc4-c5c4-4d4b-869d-9a9316e5cdf2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by fresh protected-main successor #223.

Fresh pre-closure proof:

• protected main: db4f444c1b1849ec615364a233469870c23407e6;
• this PR exact head: 49c00e73bec816f1ba51de1ff20a3992e23da3ce;
• successor fix(acquisition): restack deployment audit byte identity on latest main #223 exact head: 4c407b46eb91c9832ef2a9df6331172c5a319a34 on the same exact protected base;
• the complete two-file repair is preserved byte-for-byte in fix(acquisition): restack deployment audit byte identity on latest main #223:
  • scripts/acquisition-deployment-evidence-audit.mjs blob ceb2b71c226c0e0c6d0116587a9c7c8f30fdf87a;
  • test/acquisition-deployment-evidence-input-integrity.test.ts blob dc5d587c66cd0735d8fa7603ef23149aceb93c46;
• current formal reviews and inline review threads on this PR are both empty.

No check, review, scanner/model output, or merge authority transfers. #223 must independently complete exact-head gates before Ready/merge consideration.