fix(acquisition): refresh manifest before integrity audit

[seonghobae]

Scope

Repair Noema acquisition-readiness evidence sequencing so deterministic dependency-license evidence, buyer manifest generation, integrity verification, readiness/deployment evaluation, and retained buyer evidence remain bound to one exact source/output authority.

The canonical audit owns one ordered path: dependency-license inventory -> manifest -> integrity -> readiness -> deployment evidence. The branch preserves cross-platform execution, exact tracked-checkout authentication, SHA-1/SHA-256 Git object formats, immutable audit-executable inventory, and fail-closed tree/content verification.

Repair lineage

• db1a73052cf6a9a0c2c33e846b4a2f0ac59b0acc added a direct CLI regression where a failing stage mutates tracked source; post-stage authentication must win over child-status propagation.
• 3541bed0a1b7834969a2240693d7819f5d294171 and 6d84683c3a1dc1d1906e792dbce61bb90ad33468 repaired that boundary while retaining SHA-1/SHA-256 identity and exact package-lock byte authentication.
• 6fe5dbba440eb24216c780b4353c1563e4b99442 added a real Git-backed empty-file regression and closed the earlier 99.97% branch-coverage gap without excluding production code.
• Protected Noema main then moved by fix(operations): preserve external scheduler evidence source #525 to dd6ff2aa46f8daa8aa9a4e19e0d6825f4a98f383, causing Application 33454068355 to fail correctly at the live-base guard before product tests.
• bffb5ba5a416650c6f5876a27e29dfc6649d8318 is a non-destructive two-parent convergence of the unchanged acquisition head with current protected main. Its tree was verified from both parents before the branch ref moved: relative to current main it preserves the acquisition delta and both acquisition CHANGELOG lines; relative to predecessor head it preserves all nine fix(operations): preserve external scheduler evidence source #525 changes, including the scheduler evidence source/test hardening and scheduler CHANGELOG line. The branch ref moved with force=false only after both comparisons passed.

Current exact authority

Only evidence for unchanged exact head bffb5ba5a416650c6f5876a27e29dfc6649d8318 on protected main@dd6ff2aa46f8daa8aa9a4e19e0d6825f4a98f383 is eligible.

• ancestry: 51 ahead / 0 behind; merge base is current protected main;
• open / Ready / mergeable;
• exact-head Application 33461927255, reviewer-ci 33461927279, and required Security Scan 33461927313 are terminal-success;
• exact-head patch-validator-image 33461927548 remains in progress and is non-passing until its image/runtime/SBOM/vulnerability/provenance checks finish terminal-success;
• current review threads are resolved; predecessor base-drift failure and any predecessor evidence are not transferable;
• the latest CodeRabbit pass produced no actionable source finding; its docstring-coverage advisory is an external quality advisory rather than current merge authority and does not override exact functional/security gates.

Guardrails

• Keep dependency-license bytes, buyer manifest hashes/byte sizes, integrity verification, readiness, deployment evidence, and retention under one canonical source/output authority.
• Preserve cross-platform execution and exact SHA-1/SHA-256 Git support without weakening tree/content verification.
• Keep exact 100% owned production statement/branch/function/line coverage; add realistic regressions rather than exclusions.
• Do not special-case generated evidence to make integrity green.
• Do not merge after head/base/governance movement or while any applicable current-head gate is non-terminal.
• Do not mutate central .github, naruon, contextual-orchestrator, or another dedicated-writer repository from this lane.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 47c22389-78e3-454e-a4aa-c72165a4612f

📥 Commits

Reviewing files that changed from the base of the PR and between 7858a26 and 8ff8a65.

📒 Files selected for processing (7)

• CHANGELOG.md
• scripts/acquisition-audit.mjs
• scripts/lib/acquisition-git-preflight.mjs
• scripts/release-publication-receipt.mjs
• test/acquisition-git-exact-tree-binding.test.ts
• test/acquisition-readiness-scan-toolchain-integrity.test.ts
• test/dependency-license-inventory-release-wiring.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• CHANGELOG.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

인수 감사 실행을 단일 Node 오케스트레이터로 통합했습니다. 워크플로에서 별도 manifest 생성을 제거했습니다. tracked-byte 검증은 로컬 Git blob 해시를 사용합니다. SHA-1과 SHA-256 commit 식별자를 지원합니다.

Changes

인수 감사 파이프라인

Layer / File(s)	Summary
로컬 Git blob 해시 계산 scripts/lib/acquisition-git-preflight.mjs, test/acquisition-git-content-hash.test.ts, test/acquisition-git-descriptor-bound.test.ts, test/acquisition-git-exact-tree-binding.test.ts	tracked bytes를 Node crypto와 Git blob framing으로 해시합니다. SHA-1 및 SHA-256 object ID와 exact-tree 검증을 지원합니다.
SHA-1 및 SHA-256 식별자 검증 scripts/acquisition-data-room-integrity-audit.mjs, scripts/acquisition-data-room-manifest-secure.mjs, scripts/acquisition-readiness-audit.mjs, scripts/deployment-evidence.mjs, scripts/lib/acquisition-data-room-integrity.mjs, scripts/lib/acquisition-deployment-evidence.mjs, scripts/release-evidence.mjs, scripts/release-publication-receipt.mjs, test/*	commit SHA 검증이 40자와 64자 hexadecimal 식별자를 허용합니다. 관련 오류 메시지와 SHA-256 검증 테스트를 갱신했습니다.
단일 감사 오케스트레이터와 워크플로 연결 package.json, scripts/acquisition-audit.mjs, scripts/lib/acquisition-data-room-catalog.mjs, .github/workflows/*, docs/hourly-commercial-readiness-loop.md, CHANGELOG.md, test/*	acquisition:audit가 Node 오케스트레이터를 실행합니다. 감사 단계는 동일한 revision과 output directory를 사용합니다. 워크플로의 별도 manifest 실행을 제거하고 감사 스크립트를 카탈로그에 추가했습니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: 🔵 Low · up to 8ff8a

The PR now binds acquisition evidence to one revision and verifies source stability, but a later failure can still leave earlier artifacts retained without a completion marker, allowing incomplete evidence to be mistaken for valid buyer evidence. The change is mergeable with explicit owner awareness or follow-up to gate retention or clearly mark failed outputs.

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant AcquisitionAudit as acquisition-audit.mjs
  participant Npm
  participant AuditSteps as 감사 단계
  Workflow->>AcquisitionAudit: npm run acquisition:audit
  AcquisitionAudit->>Npm: 의존성 라이선스 인벤토리 실행
  Npm->>AuditSteps: manifest, integrity, readiness, deployment 실행
  AuditSteps-->>AcquisitionAudit: 단계별 종료 상태
  AcquisitionAudit-->>Workflow: 감사 결과와 종료 코드

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 8.70% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 23 functions across 24 files. (1 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 매니페스트 갱신과 무결성 감사의 순서 변경을 설명하며 변경 사항과 관련됩니다. 다만 실제 구현은 별도 매니페스트 단계를 제거하고 acquisition:audit로 통합합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 8.70% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 23 functions across 24 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch fix/acquisition-audit-manifest-refresh

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/acquisition-audit-manifest-refresh

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.