fix(acquisition): require canonical release and data-room authority

docs/doctoring/release-publication-file-stability.md

@@ -11,30 +11,31 @@ The protected publication workflow already constrains the release bundle to a fi
 `scripts/lib/stable-file-evidence.mjs` provides the release-materialization step with a bounded no-follow descriptor reader. The isolated `scripts/release-publication-receipt.mjs` carries the same small descriptor-read contract inline so the existing one-file handoff remains self-contained rather than silently depending on repository files that are absent in the publication job. The descriptor contract:
 
 1. requires a positive reviewed byte ceiling and an available `O_NOFOLLOW`/read-only open contract;
-2. rejects a pathname that is a symlink, non-regular file, empty file, or declared oversize before opening;
-3. opens the exact pathname with `O_NOFOLLOW` and compares pathname metadata with the opened descriptor;
-4. reads only through that descriptor, with a streaming `maximum + 1` ceiling instead of trusting the initial size alone;
-5. revalidates descriptor device, inode, mode, size, modification time, change time, and observed byte count after the read;
-6. re-resolves the pathname after the read and requires it still to identify the same regular-file device/inode/mode/size; and
-7. closes the descriptor on success and failure.
+2. requires every ancestor component to remain a real non-symlink directory before open, immediately after open, and again after the bounded descriptor read;
+3. rejects a final pathname that is a symlink, non-regular file, empty file, or declared oversize before opening;
+4. opens the exact pathname with `O_NOFOLLOW` and compares pathname metadata with the opened descriptor;
+5. reads only through that descriptor, with a streaming `maximum + 1` ceiling instead of trusting the initial size alone;
+6. revalidates descriptor device, inode, mode, size, modification time, change time, and observed byte count after the read;
+7. re-resolves the final pathname after the read and requires it still to identify the same regular-file device/inode/mode/size; and
+8. closes the descriptor on success and failure.
 
-`release-evidence.mjs` now hashes the exact accepted source-archive and SBOM bytes instead of reopening their pathnames. Its manifest and `SHA256SUMS` outputs use an unpredictable owner-only temporary file followed by atomic rename. The output-directory real-directory check remains in place; this change does not claim immunity to a hostile replacement of an ancestor directory outside the reviewed GitHub-hosted-runner threat boundary.
+`release-evidence.mjs` now hashes the exact accepted source-archive and SBOM bytes instead of reopening their pathnames. Its manifest and `SHA256SUMS` outputs use an unpredictable owner-only temporary file followed by atomic rename. The output-directory real-directory check remains in place. The reader now rejects symlinked ancestor paths as well as final-component symlinks; it does not claim immunity to an adversary capable of repeatedly replacing real ancestor directories between every metadata observation and filesystem operation.
 
-The publication receipt retains one accepted snapshot of `release-evidence.json` for both semantic validation and release-asset hashing. It requires `--release-evidence` to identify the exact `release-evidence.json` inside the supplied release asset directory, preventing a separately parsed manifest from being combined with a different hashed asset. `SHA256SUMS` is parsed from the same retained bytes that were hashed into the local asset map. The receipt output likewise uses an unpredictable temporary file plus atomic rename.
+The publication receipt retains one accepted snapshot of `release-evidence.json` for both semantic validation and release-asset hashing. It requires `--release-evidence` to identify the exact `release-evidence.json` inside the supplied release asset directory, preventing a separately parsed manifest from being combined with a different hashed asset. `SHA256SUMS` is parsed from the same retained bytes that were hashed into the local asset map. The receipt output likewise uses an unpredictable temporary file plus atomic rename. Its self-contained reader applies the same non-symlink ancestor requirement so a policy, verification response, evidence manifest, or release asset cannot be accepted through a symlinked parent merely because the final component is regular.
 
 The publication workflow deliberately copies only `release-publication-receipt.mjs` into the sterile handoff. The receipt therefore contains no relative module imports; its duplicate-decoded-JSON-key scanner, stable descriptor reader, and atomic output helper are intentionally self-contained boundary code. This avoids an acquisition-path defect in which tests run the script from the repository successfully but the isolated publication job cannot resolve an unshipped sibling module.
 
 The descriptor reader fails closed when a runtime cannot provide the no-follow flag. Noema's publication workflow currently executes on Ubuntu GitHub-hosted runners; this control does not claim equivalent filesystem semantics on runtimes where Node does not expose the required flag.
 
 ## Verification strategy
 
-`test/stable-release-file-evidence.test.ts` includes a real temporary-file/symlink case plus deterministic filesystem-adapter cases for path-to-descriptor replacement, in-place descriptor mutation, same-byte pathname replacement after reading, short reads, streamed oversize, unsupported open flags, non-files, empty files, and descriptor closure after failure. `test/release-evidence-file-stability.test.ts` binds release materialization to the stable reader and atomic evidence writer. `test/release-publication-output-atomicity.test.ts` requires temporary exclusive creation plus rename for the final receipt, and `test/release-publication-runtime-handoff.test.ts` verifies that the isolated one-file executable has no relative runtime dependency while the workflow authenticates that exact file across its handoffs. Existing immutable-release publication tests continue to exercise the complete receipt CLI, exact asset set, digest checks, malformed UTF-8 handling, duplicate decoded JSON keys, immutable-policy checks, and publication evidence contract.
+`test/stable-release-file-evidence.test.ts` includes real final-component and parent-directory symlink cases plus deterministic filesystem-adapter cases for malformed/non-directory parent authority, path-to-descriptor replacement, in-place descriptor mutation, same-byte pathname replacement after reading, short reads, streamed oversize, unsupported open flags, non-files, empty files, and descriptor closure after failure. `test/release-evidence-file-stability.test.ts` binds release materialization to the stable reader and atomic evidence writer. `test/immutable-release-publication.test.ts` executes the complete self-contained publication CLI through a symlinked parent and requires it to fail closed. `test/release-publication-output-atomicity.test.ts` requires temporary exclusive creation plus rename for the final receipt, and `test/release-publication-runtime-handoff.test.ts` verifies that the isolated one-file executable has no relative runtime dependency while the workflow authenticates that exact file across its handoffs. Existing immutable-release publication tests continue to exercise the exact asset set, digest checks, malformed UTF-8 handling, duplicate decoded JSON keys, immutable-policy checks, and publication evidence contract.
 
 This change does **not** prove that a GitHub Release exists, that Cloudflare deployment succeeded, that production KPIs are healthy, or that legal/IP transfer rights are complete. It strengthens only the local evidence-consumption and publication boundary used when those external facts are eventually captured.
 
 ## Standards and implementation basis
 
-POSIX.1-2024 specifies that `open()` with `O_NOFOLLOW` fails when the final pathname component is a symbolic link. Node.js exposes the corresponding filesystem constant and documents that it causes open to fail for a symbolic-link path. Those primitives remove the final-component symlink-follow step from the open operation; the additional descriptor/path identity checks are Noema's application-level control for replacement and mutation across the full read window.
+POSIX.1-2024 specifies that `open()` with `O_NOFOLLOW` fails when the final pathname component is a symbolic link. Node.js exposes the corresponding filesystem constant and documents that it causes open to fail for a symbolic-link path. Those primitives remove the final-component symlink-follow step from the open operation; Noema separately validates ancestor components and descriptor/path identity because `O_NOFOLLOW` alone does not authenticate the parent traversal used to reach the final component.
 
 NIST SSDF 1.1 recommends defining, implementing, and verifying software security requirements throughout the development lifecycle. Noema treats release evidence byte identity and executable handoff closure as such requirements because publication receipts are later consumed as acquisition and supply-chain evidence.
 

scripts/acquisition-data-room-integrity-audit.mjs

@@ -10,7 +10,8 @@ import {
   writeAcquisitionPrivateFile,
 } from "./lib/acquisition-private-output.mjs";
 
-const fullShaPattern = /^[0-9a-f]{40}$/i;
+const fullShaPattern = /^[0-9a-f]{40}$/;
+const releaseTagPattern = /^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*))?$/;
 const now = new Date().toISOString();
 const configuredOutputDir = process.env.NOEMA_DATA_ROOM_OUTPUT_DIR
   || process.env.NOEMA_ACQUISITION_AUDIT_OUTPUT_DIR
@@ -24,27 +25,27 @@ let auditPath = join(outputDir, "data-room-integrity-audit.json");
 
 /** Bind an optional caller expectation to the already authenticated checkout. */
 function expectedSourceCommit(authenticatedHead) {
-  const supplied = String(process.env.NOEMA_DATA_ROOM_SOURCE_COMMIT || "").trim();
+  const supplied = String(process.env.NOEMA_DATA_ROOM_SOURCE_COMMIT || "");
   if (!supplied) {
     return authenticatedHead;
   }
   if (!fullShaPattern.test(supplied)) {
-    throw new TypeError("NOEMA_DATA_ROOM_SOURCE_COMMIT must be a full commit SHA.");
+    throw new TypeError("NOEMA_DATA_ROOM_SOURCE_COMMIT must be an exact lowercase full commit SHA.");
   }
-  if (supplied.toLowerCase() !== authenticatedHead) {
+  if (supplied !== authenticatedHead) {
     throw new Error("NOEMA_DATA_ROOM_SOURCE_COMMIT does not match the exact checked-out HEAD.");
   }
   return authenticatedHead;
 }
 
 /** Resolve an optional immutable release selection through the local-only Git trust root. */
 function expectedRelease() {
-  const tag = String(process.env.NOEMA_RELEASE_UNDER_DILIGENCE_TAG || "").trim();
+  const tag = String(process.env.NOEMA_RELEASE_UNDER_DILIGENCE_TAG || "");
   if (!tag) {
     return { expectedReleaseTag: "", expectedReleaseCommitSha: "" };
   }
-  if (!/^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(tag)) {
-    throw new TypeError("NOEMA_RELEASE_UNDER_DILIGENCE_TAG must be an immutable SemVer tag.");
+  if (!releaseTagPattern.test(tag)) {
+    throw new TypeError("NOEMA_RELEASE_UNDER_DILIGENCE_TAG must use exact canonical SemVer bytes.");
   }
   return {
     expectedReleaseTag: tag,

scripts/acquisition-data-room-manifest-secure.mjs

@@ -10,7 +10,8 @@ import {
   writeAcquisitionPrivateFile,
 } from "./lib/acquisition-private-output.mjs";
 
-const fullShaPattern = /^[0-9a-f]{40}$/i;
+const fullShaPattern = /^[0-9a-f]{40}$/;
+const releaseTagPattern = /^v(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-(?:(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*))?$/;
 const now = new Date().toISOString();
 const configuredOutputDir = process.env.NOEMA_DATA_ROOM_OUTPUT_DIR
   || process.env.NOEMA_ACQUISITION_AUDIT_OUTPUT_DIR
@@ -19,27 +20,27 @@ const configuredManifestPath = process.env.NOEMA_DATA_ROOM_MANIFEST_PATH || "";
 
 /** Bind an optional caller expectation to the already authenticated checkout. */
 function resolveSourceCommit(authenticatedHead) {
-  const supplied = String(process.env.NOEMA_DATA_ROOM_SOURCE_COMMIT || "").trim();
+  const supplied = String(process.env.NOEMA_DATA_ROOM_SOURCE_COMMIT || "");
   if (!supplied) {
     return authenticatedHead;
   }
   if (!fullShaPattern.test(supplied)) {
-    throw new TypeError("NOEMA_DATA_ROOM_SOURCE_COMMIT must be a full commit SHA.");
+    throw new TypeError("NOEMA_DATA_ROOM_SOURCE_COMMIT must be an exact lowercase full commit SHA.");
   }
-  if (supplied.toLowerCase() !== authenticatedHead) {
+  if (supplied !== authenticatedHead) {
     throw new Error("NOEMA_DATA_ROOM_SOURCE_COMMIT does not match the exact checked-out HEAD.");
   }
   return authenticatedHead;
 }
 
 /** Resolve the selected immutable release tag from the same local-only Git trust root. */
 function resolveRelease() {
-  const tag = String(process.env.NOEMA_RELEASE_UNDER_DILIGENCE_TAG || "").trim();
+  const tag = String(process.env.NOEMA_RELEASE_UNDER_DILIGENCE_TAG || "");
   if (!tag) {
     return { releaseTag: "", releaseCommitSha: "" };
   }
-  if (!/^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(tag)) {
-    throw new TypeError("NOEMA_RELEASE_UNDER_DILIGENCE_TAG must be an immutable SemVer tag.");
+  if (!releaseTagPattern.test(tag)) {
+    throw new TypeError("NOEMA_RELEASE_UNDER_DILIGENCE_TAG must use exact canonical SemVer bytes.");
   }
   return {
     releaseTag: tag,

scripts/acquisition-readiness-audit.mjs

@@ -29,7 +29,7 @@ const transferEvidencePath = process.env.NOEMA_TRANSFER_EVIDENCE_PATH
   || "artifacts/acquisition/transfer-evidence.json";
 const releasePublicationReceiptPath = process.env.NOEMA_RELEASE_PUBLICATION_RECEIPT_PATH
   || "artifacts/acquisition/release-publication-receipt.json";
-const releaseUnderDiligenceTag = String(process.env.NOEMA_RELEASE_UNDER_DILIGENCE_TAG || "").trim();
+const releaseUnderDiligenceTag = String(process.env.NOEMA_RELEASE_UNDER_DILIGENCE_TAG || "");
 const pilotLogPath = process.env.NOEMA_PILOT_LOG_PATH
   || "docs/pilot-readiness-log.md";
 const saleableEvidencePath = process.env.NOEMA_SALEABLE_AUDIT_PATH

scripts/lib/acquisition-private-output.mjs

@@ -56,14 +56,29 @@ function sameOutputIdentity(left, right) {
   );
 }
 
+function cleanupIdentityMatchedPath(path, expectedMetadata, fileSystem) {
+  if (!expectedMetadata || typeof fileSystem.unlinkSync !== "function") {
+    return;
+  }
+  try {
+    const cleanupCandidate = fileSystem.lstatSync(path, { throwIfNoEntry: false }) ?? null;
+    if (sameOutputIdentity(expectedMetadata, cleanupCandidate)) {
+      fileSystem.unlinkSync(path);
+    }
+  } catch {
+    // Preserve the original write/validation error. Cleanup authority is
+    // limited to the same inode; a replaced pathname is never unlinked.
+  }
+}
+
 /**
  * Refuse an acquisition output path when any existing parent component is a
  * symbolic link or a non-directory filesystem object.
  *
  * The walk starts at the output leaf's parent and continues to the filesystem
  * root, so a missing intermediate directory does not hide an unsafe higher
  * ancestor. This boundary is intentionally checked before directory creation
- * and again by the private writer immediately before opening the leaf.
+ * and again around the private writer's no-follow leaf opens.
  */
 export function assertAcquisitionPrivatePathParents(
   path,
@@ -89,16 +104,20 @@ export function assertAcquisitionPrivatePathParents(
 
 function writeNewPrivateFile(path, contents, fileSystem, flags) {
   const descriptor = fileSystem.openSync(path, flags, 0o600);
+  let createdMetadata = null;
+  let accepted = false;
   try {
-    const opened = fileSystem.fstatSync(descriptor);
-    if (!safeOutputMetadata(opened)) {
+    createdMetadata = fileSystem.fstatSync(descriptor);
+    if (!safeOutputMetadata(createdMetadata)) {
       throw new Error("acquisition output path changed before writing");
     }
+    assertAcquisitionPrivatePathParents(path, fileSystem);
     fileSystem.fchmodSync(descriptor, 0o600);
     fileSystem.ftruncateSync(descriptor, 0);
     fileSystem.writeFileSync(descriptor, contents, { encoding: "utf8" });
 
     const afterDescriptor = fileSystem.fstatSync(descriptor);
+    assertAcquisitionPrivatePathParents(path, fileSystem);
     const afterPath = fileSystem.lstatSync(path);
     if (
       !safeOutputMetadata(afterDescriptor)
@@ -107,8 +126,12 @@ function writeNewPrivateFile(path, contents, fileSystem, flags) {
     ) {
       throw new Error("acquisition output path changed while writing");
     }
+    accepted = true;
   } finally {
     fileSystem.closeSync(descriptor);
+    if (!accepted) {
+      cleanupIdentityMatchedPath(path, createdMetadata, fileSystem);
+    }
   }
 }
 
@@ -120,9 +143,12 @@ function writeNewPrivateFile(path, contents, fileSystem, flags) {
  * written completely to an owner-only, exclusive sibling file and atomically
  * renamed over the verified target only after the write succeeds, so a failed
  * replacement cannot truncate or partially overwrite trusted prior evidence.
- * Newly created targets use O_EXCL directly. Existing parent components are
- * required to be real directories, never symbolic links or non-directory
- * objects, both before staging and immediately before replacement.
+ * Newly created targets use O_EXCL directly and remove their identity-matched
+ * leaf when a synchronous validation/write failure occurs. Existing parent
+ * components are required to be real directories, never symbolic links or
+ * non-directory objects, before and immediately after each leaf/staging open
+ * and again before a new file is accepted or an existing target is atomically
+ * replaced.
  */
 export function writeAcquisitionPrivateFile(
   path,
@@ -162,6 +188,7 @@ export function writeAcquisitionPrivateFile(
 
   const existingDescriptor = fileSystem.openSync(path, writeOnly | noFollow, 0o600);
   try {
+    assertAcquisitionPrivatePathParents(path, fileSystem);
     const opened = fileSystem.fstatSync(existingDescriptor);
     if (!safeOutputMetadata(opened) || !sameOutputIdentity(before, opened)) {
       throw new Error("acquisition output path changed before writing");
@@ -182,6 +209,7 @@ export function writeAcquisitionPrivateFile(
     );
     staged = true;
     try {
+      assertAcquisitionPrivatePathParents(tempPath, fileSystem);
       stagedMetadata = fileSystem.fstatSync(stagedDescriptor);
       if (!safeOutputMetadata(stagedMetadata)) {
         throw new Error("acquisition staged output must remain a single-link regular file");
@@ -229,15 +257,7 @@ export function writeAcquisitionPrivateFile(
     }
   } finally {
     if (staged && stagedMetadata) {
-      try {
-        const cleanupCandidate = fileSystem.lstatSync(tempPath, { throwIfNoEntry: false }) ?? null;
-        if (sameOutputIdentity(stagedMetadata, cleanupCandidate)) {
-          fileSystem.unlinkSync(tempPath);
-        }
-      } catch {
-        // Preserve the original write/validation error. Cleanup authority is
-        // limited to the same staged inode; a replaced pathname is never unlinked.
-      }
+      cleanupIdentityMatchedPath(tempPath, stagedMetadata, fileSystem);
     }
   }
 }

scripts/lib/release-sbom-authority.mjs

@@ -0,0 +1,17 @@
+const unsafeBomRefCharacterPattern = /[\p{Cc}\p{Cf}\p{Cs}\p{Zl}\p{Zp}\u00a0\u1680\u2000-\u200a\u202f\u205f\u3000]/u;
+
+export function requireCanonicalReleaseBomRef(value, label) {
+  if (
+    typeof value !== "string"
+    || value.length === 0
+    || value !== value.trim()
+    || value !== value.normalize("NFC")
+    || unsafeBomRefCharacterPattern.test(value)
+    || value.startsWith("urn:cdx:")
+  ) {
+    throw new Error(
+      `${label} must be a canonical non-empty bom-ref identity in NFC without control, format, surrogate, non-ASCII Unicode separator, or BOM-Link prefix ambiguity`,
+    );
+  }
+  return value;
+}