fix(security): restack validation-evidence JSON integrity on protected main

[seonghobae]

Purpose

Restack only #302's tested security-validation JSON-integrity delta onto current protected main after #298 advanced the base. The predecessor branch remains untouched and no predecessor evidence transfers.

Exact construction identity

• protected main before construction: 10f7874f309cb120bc57b8c0cb637d1292650fe0 (tree c2ceeca94a8ecabec0f03dab11d56c7b99d54d1e);
• predecessor fix(security): restack validation-evidence JSON integrity on latest main #302 unchanged head: 4c47ea7ed199e8d3397f6f5fdebd30d7cf0c09d2;
• successor head: 9aae638b2b6754ae91549dca747f1364798e5304 (tree cc86d44339afeac33d47d9bef212903a2d3e6160);
• ancestry: 1 ahead / 0 behind, merge base exactly current protected main;
• scope: exactly scripts/security-validation-evidence.mjs (+4/-0) and new test/security-validation-evidence-duplicate-json.test.ts (+49/-0);
• exact transplanted blobs: 78c524baddf230ccc622c444b2cc04a400141c2c and 75780c6a2ca10b32f41395355472955b5534bd2b.

Current protected-main source blob was independently refetched as 774cb32f870d5ee3cd5b35a30ad19798dbbf112d; the intervening #298 release-publication integration does not overlap this lane.

Security behavior

After fatal UTF-8 decoding, run Noema's bounded decoded-key scanner before JSON.parse, so contradictory literal/escape-equivalent members cannot collapse through JavaScript last-key-wins semantics before security-evidence evaluation. The focused regression requires fail-closed duplicate_keys for owner plus escape-equivalent ow\u006eer. Existing checklist, malformed-JSON, evidence-evaluation, and audit-output semantics remain unchanged.

Evidence boundary

Keep Draft until this unchanged exact head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, every other applicable live gate, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, independently refetch protected main, exact head/ref/ancestry, workflow checkout SHAs, reviews/threads/findings, live rulesets, central .github Security Scan authority, and active-writer state. Current observable ruleset requires the central Security Scan workflow and does not impose an independent approval rule; do not synthesize one.

This change validates supplied evidence only. It does not create security-validation evidence, release/deploy, weaken gates, invent authority/evidence, create a repair writer, or choose an outbound license.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 48bb4db9-f8b8-499f-a0d0-b2ee178c84f5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}