fix(operations): restack runner API JSON byte integrity on 2d9d4e main

[seonghobae]

Purpose

Rebuild only PR #312's current runner-assignment GitHub API byte-integrity hardening onto the current protected-main lineage. No predecessor CI, review, scanner, coverage, model, runner-assignment, release, deployment, or acquisition authority transfers.

Exact construction

• protected main at the final pre-write refetch: 2d9d4e26a81d043a1985fc2244efb2a311fcf1d0;
• source PR fix(operations): restack runner API JSON byte integrity on current main #312 exact unchanged head at the final pre-write refetch: e08556d5f35b086bfcf9f90dcff03cd0bf2c2183;
• successor exact head: 60a0b8d6a19b56da6e10bfd79799ea544b165cd1;
• parent is exactly the protected-main SHA above;
• net scope is exactly three paths: scripts/actions-runner-assignment-audit.mjs, test/actions-runner-assignment-cli.test.ts, and vitest.config.ts.

A fresh compare from #312's live base 1f4964fb3102cc1b0a9bcf19acae461904ecc672 to current protected main showed 13 protected commits with no overlap on these three paths. The successor therefore overlays only #312's exact current-head blobs without overwriting intervening protected bytes.

Fail-closed behavior retained

Successful gh api stdout remains bounded raw bytes until fatal UTF-8 decoding, then decoded-key integrity validation runs before JSON.parse. Malformed UTF-8 and escape-equivalent duplicate object names fail closed before run/job identity and runner-assignment decisions. Existing shell-free subprocess execution, 2 MiB output bound, 20-second timeout, explicit GitHub API version, repository/path bounds, least-authority child environment, pagination, and report semantics remain unchanged.

This hardens read-only runner-assignment evidence only. It does not prove runner assignment, required-check success, formal review, release, deployment, production KPI, or acquisition readiness.

Evidence boundary

Keep Draft until this unchanged exact head receives fresh terminal-success application ci, reviewer-ci, and protected-base-eligible central Security Scan, configured exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Live Noema governance currently requires the central .github/workflows/security-scan.yml@refs/heads/main workflow and does not currently impose an independent formal-approval rule. No model review or predecessor evidence is merge authority.

Supersedes #312 only after fresh exact-head verification and protected integration. Related: #30.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 71bc2638-5724-4cdc-9e4c-16a8cf455dea

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by consolidated runner-assignment JSON-integrity successor #341, which preserves this implementation and current coverage configuration. Closing the stale predecessor; its earlier check results do not transfer.