fix(acquisition): restack deployment audit byte identity on latest main - #223

Fresh protected-main successor for #213/#124 on exact base db4f444c1b1849ec615364a233469870c23407e6. No predecessor checks, reviews, scanner/model output, deployment evidence, release evidence, or acquisition evidence transfer.

Test-first proof

Exact RED head 6463d9ffaaba3cb29b4476a9beb529d6a66d6c2d added only test/acquisition-deployment-evidence-input-integrity.test.ts. Application ci 31590227319, verify job 94093234995, checked out that exact head and failed at release verify; the intended regressions proved protected source accepted all three unsafe cases:

• malformed UTF-8 deployment evidence even when the receipt matched replacement-decoded text;
• malformed UTF-8 retained attestation bytes;
• a deployment-evidence path swapped to a symlink after metadata validation.

Each unsafe path returned status 0 where the test required fail-closed status 1. The same RED head's protected-base eligible central Security Scan completed successfully; reviewer evidence on RED is not application GREEN evidence.

Current GREEN implementation

Exact current head 4c407b46eb91c9832ef2a9df6331172c5a319a34:

• opens retained evidence with reviewed signed-32-bit-safe O_RDONLY | O_NOFOLLOW capability;
• binds path metadata, opened descriptor device/inode/size, exact read byte count, and final descriptor metadata;
• decodes semantic JSON/JSONL using fatal UTF-8;
• computes the deployment subject SHA-256 from the exact retained Buffer used for semantics rather than decoded/re-encoded text;
• preserves existing release identity, governance, attestation structure, signer/OIDC/runner-policy and report semantics.

Stale duplicate #213 was closed only after proving the exact final blobs are preserved here: scripts/acquisition-deployment-evidence-audit.mjs ceb2b71c226c0e0c6d0116587a9c7c8f30fdf87a and test/acquisition-deployment-evidence-input-integrity.test.ts dc5d587c66cd0735d8fa7603ef23149aceb93c46.

Exact-head proof

For unchanged head 4c407b46eb91c9832ef2a9df6331172c5a319a34:

• application ci 31591248220, job 94096480600: terminal success; exact checkout, package-manager identity, frozen install, and release verify succeeded;
• reviewer-ci 31591248252, job 94096480772: terminal success; exact checkout, 100% reviewer line/branch coverage, 100% docstring gate, authenticated sandbox-image scan, and real no-network CodeGraph smoke succeeded;
• eligible central Security Scan 31591248238: terminal success; dependency review, OSV, and Trivy hard-gate jobs succeeded, while Scorecard remains posture evidence;
• current formal reviews: 0;
• current inline review threads: 0;
• fresh compare is 0 behind protected main and GitHub reports mergeable.

CodeRabbit reported Review rate limited after Ready. That status/model evidence is not a source finding, formal approval, or live required gate. The current live ruleset requires the central Security Scan workflow and does not expose an approval rule.

Authority boundary

This is retained-evidence integrity hardening only. It does not prove a real production deployment, cryptographically verify an attestation by itself, establish production environment governance, publish a release, choose owner/legal rights, establish revenue/transfer evidence, or make Noema acquisition-ready.