fix(acquisition): restack deployment audit byte identity on latest main

[seonghobae]

Fresh protected-main successor for #213/#124 on exact base db4f444c1b1849ec615364a233469870c23407e6. No predecessor checks, reviews, scanner/model output, deployment evidence, release evidence, or acquisition evidence transfer.

Test-first proof

Exact RED head 6463d9ffaaba3cb29b4476a9beb529d6a66d6c2d added only test/acquisition-deployment-evidence-input-integrity.test.ts. Application ci 31590227319, verify job 94093234995, checked out that exact head and failed at release verify; the intended regressions proved protected source accepted all three unsafe cases:

• malformed UTF-8 deployment evidence even when the receipt matched replacement-decoded text;
• malformed UTF-8 retained attestation bytes;
• a deployment-evidence path swapped to a symlink after metadata validation.

Each unsafe path returned status 0 where the test required fail-closed status 1. The same RED head's protected-base eligible central Security Scan completed successfully; reviewer evidence on RED is not application GREEN evidence.

Current GREEN implementation

Exact current head 4c407b46eb91c9832ef2a9df6331172c5a319a34:

• opens retained evidence with reviewed signed-32-bit-safe O_RDONLY | O_NOFOLLOW capability;
• binds path metadata, opened descriptor device/inode/size, exact read byte count, and final descriptor metadata;
• decodes semantic JSON/JSONL using fatal UTF-8;
• computes the deployment subject SHA-256 from the exact retained Buffer used for semantics rather than decoded/re-encoded text;
• preserves existing release identity, governance, attestation structure, signer/OIDC/runner-policy and report semantics.

Stale duplicate #213 was closed only after proving the exact final blobs are preserved here: scripts/acquisition-deployment-evidence-audit.mjs ceb2b71c226c0e0c6d0116587a9c7c8f30fdf87a and test/acquisition-deployment-evidence-input-integrity.test.ts dc5d587c66cd0735d8fa7603ef23149aceb93c46.

Exact-head proof

For unchanged head 4c407b46eb91c9832ef2a9df6331172c5a319a34:

• application ci 31591248220, job 94096480600: terminal success; exact checkout, package-manager identity, frozen install, and release verify succeeded;
• reviewer-ci 31591248252, job 94096480772: terminal success; exact checkout, 100% reviewer line/branch coverage, 100% docstring gate, authenticated sandbox-image scan, and real no-network CodeGraph smoke succeeded;
• eligible central Security Scan 31591248238: terminal success; dependency review, OSV, and Trivy hard-gate jobs succeeded, while Scorecard remains posture evidence;
• current formal reviews: 0;
• current inline review threads: 0;
• fresh compare is 0 behind protected main and GitHub reports mergeable.

CodeRabbit reported Review rate limited after Ready. That status/model evidence is not a source finding, formal approval, or live required gate. The current live ruleset requires the central Security Scan workflow and does not expose an approval rule.

Authority boundary

This is retained-evidence integrity hardening only. It does not prove a real production deployment, cryptographically verify an attestation by itself, establish production environment governance, publish a release, choose owner/legal rights, establish revenue/transfer evidence, or make Noema acquisition-ready.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c602d18e-9f73-480b-af42-5c73f59e46a2

📥 Commits

Reviewing files that changed from the base of the PR and between db4f444 and 4c407b4.

📒 Files selected for processing (2)

• scripts/acquisition-deployment-evidence-audit.mjs
• test/acquisition-deployment-evidence-input-integrity.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}