fix(operations): preserve runner API JSON byte integrity

[seonghobae]

Purpose

Test-first hardening for the read-only GitHub Actions runner-assignment evidence source. Protected main invoked gh with encoding: "utf8" and then passed the resulting string directly to JSON.parse, allowing malformed API bytes to be replacement-decoded and duplicate decoded member names to collapse under last-key-wins semantics before run/job identity and runner-assignment decisions.

Exact RED → GREEN identity

• protected/live base: 6bc8ed016dc07f95d4e041a3b79ac00c4086b182;
• RED head: 774a54636a82220a0a144b8b5c566a81cd94674d;
• current GREEN head: 56802e206ffb7dcc5336c62f87df54823004cc5e.

The RED requires malformed UTF-8 and id plus escape-equivalent i\u0064 to fail closed. GREEN keeps successful gh stdout as bounded raw bytes, fatal-decodes UTF-8, applies Noema's decoded-key JSON integrity scanner, and only then calls JSON.parse. Existing shell-free subprocess execution, 2 MiB maxBuffer, 20-second timeout, explicit API version, repository/path bounds, least-authority child environment, pagination, and report semantics remain unchanged.

Evidence boundary

This hardens runner-assignment evidence only; it does not establish that a runner is assigned, a required check passed, an independent review occurred, or a release/deployment happened. Keep Draft until one unchanged exact head has fresh terminal-success application CI, exact 100% owned production statement/branch/function/line coverage with realistic tests, reviewer-ci, protected-base-eligible central Security Scan, and zero valid unresolved findings. The repository-wide nanoid <3.3.18 blocker tracked by #271/#272 remains separate.

No write token, repair/self-modifying workflow, audit waiver, package-lock hand edit, reviewer/secret invention, gate weakening, release, deployment, licensing decision, or acquisition-ready claim.

Related: #30.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e5b1606d-64d7-4477-88c0-36d054eb56dc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by consolidated runner-assignment JSON-integrity successor #341. The current lane preserves bounded raw-byte parsing, fatal UTF-8, duplicate decoded-key rejection, atomic reporting, and configured production coverage. Closing this predecessor; historical evidence does not transfer.