fix(security): reject duplicate validation-evidence JSON keys

[seonghobae]

Purpose

Test-first hardening for Noema's security-validation evidence parser. Protected main fatally decodes UTF-8 before JSON.parse, but duplicate decoded object keys can still be normalized by JavaScript's last-key-wins semantics before evaluateSecurityEvidence() sees them. That allows two contradictory source documents to collapse into one apparently valid evidence object.

Exact RED identity

• protected/live base: 6bc8ed016dc07f95d4e041a3b79ac00c4086b182;
• RED head: 274634a9bf57290a89f2b6baf8406d17f2820cf0;
• branch: fix/security-evidence-duplicate-json-keys.

The RED supplies both owner and its JSON-escape-equivalent ow\u006eer so the protected parser currently resolves the later value instead of rejecting the ambiguous bytes. Acceptance requires fail-closed duplicate_keys evidence before policy evaluation.

Intended GREEN

Reuse the repository's existing decoded-key JSON scanner rather than introducing a second parser. Reject any duplicate decoded object key before JSON.parse, preserve fatal UTF-8 and malformed-JSON classifications, and keep the security checklist/evidence evaluator contract unchanged.

Evidence boundary

Keep Draft until the unchanged final exact head obtains fresh application CI, exact 100% owned production statement/branch/function/line coverage, reviewer-ci, protected-base-eligible central Security Scan, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

No repair/self-modifying workflow, package-lock hand edit, secret/reviewer invention, gate weakening, outbound-license decision, release, deployment, or acquisition-readiness claim.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d354e39c-e8ca-4f78-88cc-91da4e8d45e2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}