fix(kpi): reject compact credential-shaped source IDs

[seonghobae]

Summary

Prevent KPI provenance sourceId from accepting credential-shaped, locator-shaped, executable-scheme, percent-encoded, or display-ambiguous labels that can leak secret material or create non-canonical retained buyer evidence.

Root cause and repair lineage

The shared hasUnsafeSourceId boundary rejects credential-shaped labels, control/format/separator characters, surrounding whitespace, Unicode normalization ambiguity, hierarchical/non-hierarchical executable locators, query-bearing authority and percent-encoded identity material. Existing credential/control/space/NFKC/password-alias hardening remains intact.

Scope / evidence boundary

This hardens provenance-label validation only. It does not synthesize production KPI evidence and does not satisfy issue #3's >=30-day authenticated production-data requirement. Technical gate success is not production, deployment, legal, or acquisition evidence.

Current exact identity and evidence

• exact head: 4e2cadbb56cff3b143d70dc99a78b7f7347a8afe
• protected live main: 2c83355529447248c246805d1954f268e027d2ab
• diverged predecessor-base lane: ahead 34 / behind 1; merge base 270b66e592330c4f1c7d3b726779b1a6c599c70c
• Application CI 32667243953: terminal-success
• reviewer-ci 32667243783: terminal-success
• central Security Scan 32667243829: workflow-level terminal-success but not merge-authoritative while protected-central scanner authority remains defective
• dedicated patch-validator-image 32667243882: terminal-success
• formal reviews: 0
• unresolved review threads: 0

These results belong to this diverged exact head and must be regenerated after non-destructive convergence; they do not authorize merging the stale-base lane.

Merge / dependency boundary

#500 is the earlier open Noema dependency root at current exact head 9f739215f0e6aecb18115670b98922e3f5ba3df0, exact descendant of protected main, ahead 371 / behind 0, Draft/mergeable. Its current bounded repair rolls Noema's deployed trusted reusable-workflow SHA from historical central 17052a7... to current GitHub-verified protected central .github/main@f6c2a2702b7b7578b2d1fc5f2f9a5125a0390d33. Exact Application run 33150505816 / job 98781133257 then correctly found the canonical architecture graph still asserting the historical SHA; current #500 fixes that documentation inconsistency and explicitly records that the central workflow changed materially rather than claiming blob equivalence. Current #500 Application/reviewer/Security/image evidence is non-terminal, so this KPI lane must not overtake it.

Read-only protected central .github/main is GitHub-verified f6c2a2702b7b7578b2d1fc5f2f9a5125a0390d33. Protected security-scan.yml still has generic Dependency Review/Trivy checkout and fail-open support-probe behavior owned by .github#1222; downstream Security success cannot be reused after convergence. Existing owner PR #897 is current-base aligned at exact head 4a5f29f6ee559693b48a78667071276df6502a3e, open/Ready/mergeable, but remains owner-side non-passing pending its central review-sidecar/pin path. Existing central pin-owner #1371 is current-base aligned at exact head bc996ddcc26958aae0be3bde76f2fd60201a12dc, open/Ready/mergeable.

Existing central #834 separately owns the protected Noema stable exchange-envelope consumer correction from nonexistent top-level .token to data.token and remains a foreign-owner historical-base, non-mergeable lane. No Noema producer workaround belongs in this KPI lane.

After #500 integrates or protected main otherwise moves, refetch this exact lane; if no writer conflict exists, converge non-destructively onto the then-current protected main and regenerate every applicable exact-head gate. Do not reuse current Security success. No outbound license or production KPI claim is made here.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bae49146-8309-4e40-bea1-3bdf36c48236

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}