fix(kpi): reject ambiguous provenance JSON bytes

[seonghobae]

Purpose

Test-first hardening for strict production KPI provenance. Protected main at 6bc8ed016dc07f95d4e041a3b79ac00c4086b182 replacement-decoded provenance bytes with readFile(..., "utf8") and passed the result directly to JSON.parse, permitting malformed UTF-8 normalization and duplicate decoded-key last-key-wins semantics before production-source and exact-log-identity validation.

RED → GREEN

• protected/live base: 6bc8ed016dc07f95d4e041a3b79ac00c4086b182;
• observed RED head: f225a5136fba11500719d3756e542325ae5e9ef4;
• current GREEN implementation head: 9d02e98db22784273d8afdc6628ece08fc937ca3.

The RED produced exact GitHub Actions failures for both regressions: escape-equivalent duplicate sourceKind keys and malformed UTF-8 in otherwise valid strict provenance were both accepted with exit 0. The implementation now reads raw provenance bytes, uses fatal UTF-8 decoding, runs Noema's bounded decoded-key JSON scanner before JSON.parse, and preserves existing source-kind/source-id/timestamp/record-count/SHA-256+byte-size binding, permission-restricted verified snapshot, final identity recheck and least-authority KPI child environment.

On the current head, those test annotations are gone. Fresh current-head reviewer-ci and protected-base-eligible central Security Scan are terminal success. Application ci remains terminal failure in release verify; therefore this PR remains Draft and is not merge-ready. No predecessor or scanner success is used to override the application failure.

Evidence boundary

Keep Draft until one unchanged final exact head has fresh terminal-success application CI, exact 100% owned production statement/branch/function/line coverage with realistic tests, reviewer-ci, protected-base-eligible central Security Scan, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only or rate-limited evidence is non-passing.

No synthetic production data, audit waiver, hand-edited package lock, repair/self-modifying workflow, invented secret/reviewer/authority, gate weakening, release, deployment, outbound-license choice or acquisition-ready claim.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d1ddca26-8828-4452-90a1-c33f04a80535

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by consolidated current lineage PR #348, which retains the production-KPI provenance byte-integrity and realistic entrypoint coverage work while preserving later protected-main changes. Closing this stale predecessor; no historical evidence transfers.