fix(acquisition): require canonical release and data-room authority

[seonghobae]

Summary

Test-first hardening of Noema acquisition/release evidence authority. This branch preserves fail-closed retained release/SBOM/publication identity, bounded parsing, non-reflective diagnostics, stable filesystem evidence reads, and private acquisition-output path integrity.

Current causal repair

Exact head 87899225ff559ea7241a786faa0c605634766ac8 closes a raw-path/inspection-path mismatch in scripts/lib/stable-file-evidence.mjs: ancestor validation used a resolved path while file inspection/open could still consume the raw caller path. A symlink-parent plus dot-segment input could therefore make parent inspection and file opening refer to different traversal semantics.

• RED 2f6bcfc07f64a875e1dcc4a0b7c39ba1a9c386ab adds a real symlink-parent + dot-segment reproduction.
• 8d4c1127ea9e8acc5f44da9cb479b108f4ca3ca0 fixes the intended lexical-canonical test contract.
• Production repair 87899225ff559ea7241a786faa0c605634766ac8 rejects non-normalized raw paths before parent inspection/file open while preserving canonical relative paths. Existing O_NOFOLLOW, real-parent traversal, single-link regular-file authority, bounded reads, and descriptor/path stable-version checks remain intact.

Exact current state

• Exact head: 87899225ff559ea7241a786faa0c605634766ac8.
• Protected live main: 2c83355529447248c246805d1954f268e027d2ab; this lane was created from the prior protected base and remains downstream of fix(oidc): reject non-canonical workflow source configuration #500.
• Draft/mergeable. Unresolved review threads: 0.
• Application CI 33066532873: terminal-success.
• reviewer-ci 33066532748: terminal-failure at the signed reviewer sandbox vulnerability scan after tests, exact 100% line+branch coverage, docstring coverage, dependency installation, Cosign, and Trivy setup passed. The branch still carries the signed Node distroless substrate with fixable OpenSSL/libssl3t64 findings.
• Security Scan 33066532804: workflow-level terminal-success but non-authoritative while central exact-head scanner authority is not protected truth.
• dedicated patch-validator-image 33066532764: terminal-success.

The reviewer failure is not repaired by weakening Trivy or duplicating a leaf workaround. The causal non-OpenSSL reviewer substrate (java-base-debian13 + CodeGraph bundled Node) is already owned by earlier Noema dependency-root PR #500 and must converge into this lane through dependency order.

Dependency / foreign-owner boundary

Earlier Noema root #500 is now exact head 26d2066af7500d43b4896c1211b45c1f105d9433, exact descendant of protected main@2c833555..., ahead 357 / behind 0, Draft/mergeable. Its current repair binds successful GitHub REST installation/install-token JSON authority to the reviewed JSON media type before Response.json() parsing. Adopted RED 8788bd737453d65bd65fab95ebba9b2f81a753f5 failed Application 33136111362 / job 98736346184; production repair 8bf2ec89b96008015bbddd6a75361a3c49713437 added the fail-closed media-type guard; f780dc077e858a5894b5defbf1edb82c6bd33cc7 restored source newline only. Exact CI 33136701756 then exposed a 99.97% branch-coverage gap in the absent-Content-Type path despite all 2,926 behavior tests passing. Current 26d2066... adds a real no-header byte-body regression. Application 33136876714, reviewer 33136876715, and Security 33136876724 are terminal-success; dedicated image 33136876735 remains in_progress/non-passing. #500 therefore still precedes this lane.

Read-only protected central .github/main is GitHub-verified 17052a7ca3c16db90932a4d6036b43165ddee418. .github#1222 remains the canonical owner of exact submitted-head/live-base scanner authority. Existing owner PR #897 is aligned to that central base at exact head 1f834b4d0f86abb407fa286b1f7b857889d8ec33, open/Ready/mergeable; its exact-head security/scanner workflows are terminal-success but current review history does not establish a qualifying explicit APPROVE on that exact head. Protected central Security Scan still gives OSV immutable base/head materialization while Dependency Review and Trivy use generic checkout and the support probe can convert exact-comparison HTTP 403/404 to supported=false plus success. Current Noema Security success therefore does not transfer as merge-authoritative evidence after dependency convergence.

Existing central #834 separately owns the Noema stable exchange-envelope consumer correction (.token versus stable data.token) and remains a foreign-owner historical-base, non-mergeable lane. No producer workaround belongs here.

Merge boundary

Keep Draft. Do not merge until #500 resolves in dependency order, this branch converges without losing its stronger acquisition-evidence repair, every applicable exact-head gate is regenerated and terminal-clean, central scanner/consumer repairs reach protected truth with downstream canaries, live base/governance is freshly unchanged, exact 100% owned-production coverage remains proven, and zero valid unresolved findings remain. Technical evidence does not synthesize authentic production/KPI/deployment/revenue/legal-transfer evidence.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}