fix(security): restack validation-evidence JSON integrity on current main

[seonghobae]

Purpose

Create a clean protected-current successor for stale Draft #280 without force-pushing, rebasing, or mutating its predecessor branch. This Draft carries only the tested security-validation evidence JSON-integrity fix and its focused regression onto current protected main.

Exact construction identity

• protected main immediately before creation: e60eff4c71dc4997b9990a79daa5069d6f5e2037
• predecessor Draft fix(security): reject duplicate validation-evidence JSON keys #280 exact unchanged head: b5aa1257cc4f06d92687310a7ffa048f6eb7b7af
• successor head: a8f0b6c78a8f067070bceee64362bd5e65ed4f63
• successor tree: 329bf9e7812c309ae3c0f929b918cf644cecd120
• ancestry: one commit directly on current protected main
• scope: exactly two paths: scripts/security-validation-evidence.mjs and test/security-validation-evidence-duplicate-json.test.ts
• current protected-main production blob 774cb32f870d5ee3cd5b35a30ad19798dbbf112d is byte-identical to the predecessor's later protected-base production blob, so the transplant does not overwrite intervening protected-main changes

Test-first behavior

The predecessor RED supplies contradictory owner and escape-equivalent ow\u006eer member names. JavaScript's ordinary last-key-wins parsing can otherwise collapse those bytes before evaluateSecurityEvidence() makes a security-readiness decision.

The GREEN reuses Noema's existing bounded decoded-key scanner and rejects duplicate decoded object keys before JSON.parse. Fatal UTF-8 decoding, malformed-JSON classification, checklist evaluation, evidence evaluation, and audit output semantics remain unchanged.

Evidence boundary

No predecessor CI, review, scanner, model, release, deployment, or acquisition evidence transfers. Keep Draft until this unchanged exact successor head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings.

Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing. Re-resolve protected main, exact head/ref/ancestry, workflow checkout SHAs, live rulesets, central Security Scan authority, reviews, and threads immediately before any Ready or merge action.

This Draft does not create security-validation evidence, publish a release, deploy production, choose an outbound license, or claim commercial/acquisition readiness.

Related: #280

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7eab6496-a589-47b0-bb08-4ee8ff11c4b3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}