fix(operations): restack runner API JSON byte integrity on current main

[seonghobae]

Purpose

Restack only PR #287's runner-assignment API byte-integrity hardening onto the current protected-main lineage without transferring predecessor CI, review, scanner, coverage, model, release, deployment, or operational authority.

Exact construction

• protected main immediately before construction and publication: 1f4964fb3102cc1b0a9bcf19acae461904ecc672;
• predecessor fix(operations): preserve runner API JSON byte integrity #287 exact head at the final pre-write refetch: 44569526696e3bbf3e36eafa6d0bf7112832e9b8;
• successor exact head: 24a322f2cc99414d3fcbb3e2bcb853d3b6a09dd3;
• ancestry: exactly 1 commit ahead / 0 behind protected main, merge base exactly protected main;
• net scope: exactly two paths: scripts/actions-runner-assignment-audit.mjs and test/actions-runner-assignment-cli.test.ts.

Both target paths were absent from the 24-commit protected-main delta since #287's current merge base 933471b954512710bb9635f18f45fe8f323adcff; the successor therefore transplants the predecessor's exact current head blobs without overwriting intervening protected-main bytes.

Fail-closed behavior retained

Successful gh stdout remains bounded raw bytes until fatal UTF-8 decoding, then Noema's decoded-key integrity scanner runs before JSON.parse. Malformed UTF-8 and escape-equivalent duplicate object names fail closed before run/job identity and runner-assignment decisions. Existing shell-free subprocess execution, 2 MiB output bound, 20-second timeout, explicit GitHub API version, repository/path bounds, least-authority child environment, pagination, and report semantics remain unchanged.

This hardens read-only runner-assignment evidence only. It does not prove that a runner is assigned, a required check passed, an independent review occurred, or a release/deployment happened.

Evidence boundary

Keep Draft until the unchanged exact head receives fresh terminal-success application ci, reviewer-ci, and protected-base-eligible central Security Scan, with exact 100% owned production statement/branch/function/line coverage using realistic tests and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, independently re-resolve protected main, exact head/base/ancestry, reviews/threads, checks/workflow checkout SHAs, live rulesets, exact central Security Scan revision/triggers/base filters/thresholds, releases, and active-writer state. No force update, gate weakening, repair/self-modifying workflow, secret/reviewer invention, release, deployment, outbound-license decision, or acquisition-ready claim is introduced.

Supersedes #287 only after fresh exact-head verification and protected integration. Related: #30.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4f8abaab-91b0-476b-9243-efc7c75cdf14

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by consolidated runner-assignment JSON-integrity successor #341. Closing this stale current-main predecessor so one authoritative writer remains; no prior CI, scanner, review, or coverage evidence is reused.