fix(kpi): restack ambiguous provenance JSON bytes on current main

[seonghobae]

Purpose

Restack only PR #284's strict production-KPI provenance byte-integrity hardening onto the current protected-main lineage without transferring predecessor CI, review, scanner, coverage, production, release, deployment, or acquisition authority.

Exact construction

• protected main immediately before construction and publication: 1f4964fb3102cc1b0a9bcf19acae461904ecc672;
• predecessor fix(kpi): reject ambiguous provenance JSON bytes #284 exact head at the final pre-write refetch: a769c63324dd2e8abd224009fb9dd09dafb99fce;
• successor exact head: cfc5dd4a2e7fc40459f3b415d22be3e2e53217ca;
• ancestry: exactly 1 commit ahead / 0 behind protected main, merge base exactly protected main;
• net scope: exactly two paths: scripts/kpi-gate.mjs and test/kpi-provenance-json-integrity.test.ts.

Both target paths were absent from the 24-commit protected-main delta since #284's current merge base 933471b954512710bb9635f18f45fe8f323adcff, so the successor carries the predecessor's exact current head blobs without overwriting intervening protected-main bytes.

Fail-closed behavior retained

Strict KPI provenance is read as raw bytes, fatal UTF-8 decoded, and passed through Noema's bounded decoded-key JSON integrity scanner before JSON.parse. Malformed UTF-8 and escape-equivalent duplicate keys therefore fail closed before source-kind/source-id, timestamp, record-count, SHA-256/byte-size, verified-snapshot, final identity, or least-authority child-process decisions. Existing strict production-source identity and provenance binding remain intact.

This hardens the provenance evidence boundary only. It does not synthesize production KPI data, establish 30-day production evidence, prove a release/deployment, or authorize an acquisition-readiness claim.

Evidence boundary

Keep Draft until the unchanged exact head receives fresh terminal-success application ci, reviewer-ci, and protected-base-eligible central Security Scan, with exact 100% owned production statement/branch/function/line coverage using realistic tests and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, independently re-resolve protected main, exact head/base/ancestry, reviews/threads, checks/workflow checkout SHAs, live rulesets, exact central Security Scan revision/triggers/base filters/thresholds, releases, and active-writer state. No synthetic production evidence, force update, audit waiver, gate weakening, repair/self-modifying workflow, secret/reviewer invention, release, deployment, outbound-license decision, or acquisition-ready claim is introduced.

Supersedes #284 only after fresh exact-head verification and protected integration. Related: #3.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7ce66fbf-81c7-4769-a9d8-b04c7f3d4d41

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by consolidated current lineage PR #348, which preserves this provenance-integrity slice together with later protected-main and coverage changes. Closing the stale predecessor; its prior CI/review/scanner evidence is not merge authority.