fix(kpi): restack provenance JSON byte integrity on 2d9d4e main

[seonghobae]

Purpose

Restack only PR #323's strict production-KPI provenance byte-integrity hardening onto the current protected main after #324 advanced the base. No predecessor CI, review, scanner, coverage, model/status, production-KPI, release, deployment, legal-rights, or acquisition authority transfers.

Exact lineage

• protected/live base at construction: 2d9d4e26a81d043a1985fc2244efb2a311fcf1d0;
• predecessor fix(kpi): restack provenance JSON byte integrity on 4b45ca main #323 exact head at the final pre-write refetch: 5a200e80cbf77fbb0f6dbd33242f56e869008f88;
• this successor exact head: 46485f3024885746e58beff0ff559b426f06186a;
• merge base: exact protected main;
• ancestry: exactly 1 commit ahead / 0 behind protected main;
• net scope: exactly two paths: scripts/kpi-gate.mjs and test/kpi-provenance-json-integrity.test.ts;
• protected source blob before overlay remained byte-identical to fix(kpi): restack provenance JSON byte integrity on 4b45ca main #323's old base (12363af16b4168efef2fd0e45bae6086d968bdf2), while successor production/test blobs are exact predecessor-head blobs (2ce57ef368f36a196645c94948dad3f2476ca5a0, c8a072efd12f86c826c0b6d98b506ecee9817c76).

KPI provenance integrity contract

Strict provenance remains raw bytes until fatal UTF-8 decoding and rejects escape-equivalent duplicate decoded JSON object names before JSON.parse or production-source identity, collection timestamp, record count, SHA-256/byte-size, verified snapshot, final identity, and least-authority KPI child-process decisions. Existing production-source/provenance binding remains unchanged.

This hardens evidence parsing only. It does not synthesize, substitute for, or claim a real 30-day production KPI window.

Evidence boundary

Keep this PR Draft until this unchanged exact head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact configured 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Immediately before Ready or merge, independently re-resolve protected main, exact head/base/ancestry, workflow checkout SHAs, reviews/threads, live rulesets, exact central Security Scan authority/triggers/base filters/thresholds, releases, and active-writer state.

No gate weakening, force update, synthetic KPI/release/deployment/legal evidence, reviewer/secret invention, outbound-license choice, or acquisition-ready claim is introduced.

Related: #323, #321, #315, #284, #3.

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4ae0bb18-10da-4533-800c-62257bf744e3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by consolidated current lineage PR #348, which carries the same strict KPI provenance byte-integrity work plus the current production coverage contract. Closing this predecessor to keep one active writer; predecessor evidence does not transfer.