fix(security): bind release publication inputs to stable descriptors

[seonghobae]

Purpose

Harden the immutable release-publication receipt against pathname replacement, in-place mutation, and partial/non-atomic retained output across filesystem validation, JSON parsing, SHA-256 hashing, and receipt publication.

Protected base at branch creation and current comparison: 2db716d7252603689b2cc18b700bac25e872b28f. Current exact head: 66e67332369eadfd6e752abae537bb11ecb9b0a2. The branch remains directly based on that protected commit with no destructive history rewrite.

Test-first lineage

• cff6c72e8120639687818e0edfaa465c85b9eb88 — RED: imports the not-yet-existing stable reader and specifies real symlink plus deterministic replacement/mutation/short-read/oversize contracts.
• 81297cc6b94a9d3ea3d81270c86abbcba99645df — GREEN helper: bounded O_NOFOLLOW descriptor reads with pre/post descriptor and pathname identity checks.
• 7d3417ef984a94cd2f29075ada730ff5662a42c7 — integrates exact retained bytes into release JSON parsing, asset hashing, and SHA256SUMS validation; also requires --release-evidence to be the exact manifest in the asset directory.
• b0c115cb6ec9d43df3814dcef4011e0c2516303a — records POSIX.1-2024, Node.js, and NIST SSDF 1.1 rationale.
• fabf23e0e1d8ac99b8671d1e9a98bfb94d139093 — second RED: requires publication receipt output to use the repository's reviewed atomic evidence writer instead of pathname check plus direct write.
• 66e67332369eadfd6e752abae537bb11ecb9b0a2 — second GREEN: reuses the existing writeAtomically implementation for receipt publication and removes the split output check/use boundary.

Security boundary

The receipt no longer validates a pathname and later reopens that pathname to consume potentially different bytes. Each input is opened once with no-follow semantics, bounded while reading, checked for descriptor identity/timestamp drift, and re-resolved after the read. release-evidence.json is retained once and the same bytes drive both semantic validation and release-asset hashing. SHA256SUMS is parsed from the same retained bytes hashed into the local asset map. The final receipt is published through a temporary file plus atomic rename rather than a direct overwrite.

Existing publication workflow/tests use release/release-evidence.json as the manifest inside the same release asset directory, so the exact manifest-path binding preserves the production invocation rather than creating an alternate evidence source.

This does not prove a GitHub Release exists, establish deployment/production truth, choose an outbound license, or manufacture acquisition evidence.

Current merge blocker

This remains Draft because the new production helper is not yet in the single configured owned-production coverage inventory. Two active Noema PR lanes, #336 and #341, both own vitest.config.ts; their live heads remain distinct from this lane. Single-writer policy therefore forbids racing that file in this invocation. Direct realistic tests are present, but the exact 100% owned-production requirement is not yet satisfied and no coverage evidence will be promoted to passing until the coverage-config lane is free and this helper is included with terminal 100% statements/branches/functions/lines.

Exact-head application ci, reviewer-ci, and eligible protected-base central Security Scan are currently queued and therefore non-passing. There are currently zero formal reviews and zero inline review threads; absence is not approval.

Do not merge unless the unchanged final exact head has fresh terminal-success application ci, reviewer-ci, eligible protected-base central Security Scan, exact configured 100% owned-production statement/branch/function/line coverage, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b1d38eb3-730a-4cda-82ea-ea54b1b4a9eb

📥 Commits

Reviewing files that changed from the base of the PR and between d5b0efe and c91d04b.

📒 Files selected for processing (9)

• docs/doctoring/release-publication-file-stability.md
• scripts/lib/stable-file-evidence.mjs
• scripts/release-evidence.mjs
• scripts/release-publication-receipt.mjs
• test/release-evidence-file-stability.test.ts
• test/release-publication-output-atomicity.test.ts
• test/release-publication-runtime-handoff.test.ts
• test/stable-release-file-evidence.test.ts
• vitest.config.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}