fix(security): restack validation-evidence JSON integrity on latest main

[seonghobae]

Purpose

Create a clean successor for #294 on the current protected-main lineage after #292 advanced main. The predecessor exact head had fresh successful application CI, reviewer CI, and central Security Scan against its then-live base, but that evidence cannot be promoted across the protected-base movement. This successor carries only the tested security-validation JSON-integrity hardening and focused regression.

Exact construction identity

• protected main immediately before construction and PR creation: 7a62f6ddfc2b435ceab84a954714b97a9534161c;
• predecessor fix(security): restack validation-evidence JSON integrity on current main #294 exact unchanged head: a8f0b6c78a8f067070bceee64362bd5e65ed4f63;
• predecessor application ci 31793091235, reviewer-ci 31793091204, and central Security Scan 31793091183: terminal success on the predecessor lineage only;
• predecessor formal reviews: 0; inline review threads: 0 at the latest pre-restack refetch;
• successor exact head: 4c47ea7ed199e8d3397f6f5fdebd30d7cf0c09d2;
• successor ancestry: exactly one commit on current protected main, 1 ahead / 0 behind, merge base exactly 7a62f6ddfc2b435ceab84a954714b97a9534161c;
• successor scope: exactly two paths: scripts/security-validation-evidence.mjs (+4/-0) and new test/security-validation-evidence-duplicate-json.test.ts (+49/-0).

Both successor blobs are byte-identical to the reviewed #294 blobs; all unrelated bytes come from current protected main.

Security behavior

The security-validation evidence reader already fatal-decodes UTF-8. This change additionally runs Noema's bounded decoded-key scanner before JSON.parse, so contradictory literal/escape-equivalent member names cannot collapse through JavaScript last-key-wins behavior before evaluateSecurityEvidence() makes a security-readiness decision.

The focused regression supplies both owner and escape-equivalent ow\u006eer and requires fail-closed duplicate_keys evidence. Checklist evaluation, malformed-JSON classification, evidence evaluation, and audit-output semantics remain unchanged.

Evidence boundary

No predecessor CI, coverage, scanner, review, model, release, deployment, or acquisition evidence transfers. Keep this successor Draft until this unchanged exact head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, all other applicable checks/statuses, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, independently re-resolve protected main, exact head/ref/ancestry, workflow checkout SHAs, live rulesets, the exact central .github Security Scan revision/triggers/base filters/thresholds, formal reviews, unresolved threads, statuses, and active-writer state. Current observable live Noema policy enforces the central Security Scan workflow and does not currently impose an independent formal-approval rule; no synthetic approval requirement is introduced.

This change validates supplied evidence; it does not create security-validation evidence, publish a release, deploy production, manufacture operational/acquisition proof, weaken gates, create a self-modifying repair workflow, invent secrets/reviewers, or choose an outbound license.

Supersedes #294 only after fresh exact-head verification and protected integration.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9273ccb2-951f-4755-91c3-d2c0b9c69a58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}