fix(security): harden private-reporting audit evidence I/O

[seonghobae]

Scope

Harden the Noema-owned private-vulnerability-reporting operational audit without claiming live reporting, notification staffing, or end-to-end advisory exercise evidence. The lane rejects unsafe retained-report paths, malformed repository/source authority, unbounded or deceptive remote JSON, and cleanup behavior that could suppress a proven failure.

Repair lineage

• over-limit response streaming rejects at 16 KiB; cancellation is best-effort cleanup and cannot replace or delay the size-limit failure;
• retained report publication uses the existing private no-follow writer and rejects symlinked parent/leaf paths;
• repository endpoint authority accepts only canonical ContextualWisdomLab/<name> identities and rejects dot segments or deceptive invalid names;
• exact source identity accepts only a full 40-hex SHA-1 or 64-hex SHA-256 commit;
• source revision and repository authority are validated independently before collection, so each retained field is present only when its own authority is valid;
• realistic CLI regressions cover invalid repository evidence, invalid source evidence, SHA-256 source identity, stalled stream cancellation, retained-path symlink boundaries, and current operator/runbook behavior.

Historical test-first repairs remain in the branch lineage. Superseded test-only or predecessor hosted runs are not transferable.

Current exact authority

Only evidence for unchanged exact head 58776696144e6f7c48f79aaf4f5ba583d628a54c is eligible.

• live protected base: main@5aad3e410703faaf52882e2f33fadd25d217bcdd;
• ancestry: current main is the merge base; candidate is 21 ahead / 0 behind;
• effective relative-to-main delta is eight private-reporting/changelog/runbook/regression files; protected-main acquisition behavior remains inherited rather than replayed;
• lifecycle: open / Ready / mergeable;
• current review threads: 0 unresolved; the SHA-256 runbook and changelog findings are addressed on the current head;
• exact-head ci 33482425636, patch-validator-image 33482425525, reviewer-ci 33482425534, and required Security Scan 33482425568 are queued and therefore non-passing;
• no predecessor, superseded, queued/pending/cancelled, status-only, or model-only evidence transfers to this head.

Do not merge after head/base/governance movement or while any applicable exact-head gate is non-terminal. Related: #73.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: c51c7e74-1847-4076-8d07-41d06c5ade74

📥 Commits

Reviewing files that changed from the base of the PR and between 5aad3e4 and d8c84f4.

📒 Files selected for processing (6)

• scripts/lib/private-vulnerability-reporting-audit.mjs
• scripts/private-vulnerability-reporting-audit.mjs
• test/private-vulnerability-reporting-audit.test.ts
• test/private-vulnerability-reporting-invalid-repository-evidence.test.ts
• test/private-vulnerability-reporting-invalid-source-evidence.test.ts
• test/private-vulnerability-reporting-repository-authority.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

감사 스크립트가 SHA-256 커밋을 지원하고 저장소 검증을 강화한다. 보고서 경로와 응답 스트림 처리를 보호한다. 검증 실패 시 저장소 식별자와 실패 정보를 일관되게 기록한다. 통합 테스트와 파일시스템 보안 테스트를 추가했다.

Changes

비공개 취약점 보고 감사

Layer / File(s)	Summary
저장소 및 소스 리비전 검증 scripts/lib/private-vulnerability-reporting-audit.mjs, scripts/private-vulnerability-reporting-audit.mjs, test/private-vulnerability-reporting-repository-authority.test.ts, test/private-vulnerability-reporting-invalid-source-evidence.test.ts	저장소 이름에서 ContextualWisdomLab/ 접두사를 제거한다. . 및 .. 저장소 이름을 거부한다. 40자 SHA-1과 64자 SHA-256 소스 리비전을 허용한다. 관련 오류 메시지와 검증 테스트를 갱신한다.
응답 및 보고서 출력 보호 scripts/private-vulnerability-reporting-audit.mjs, test/private-vulnerability-reporting-audit.test.ts	응답 크기 초과 시 reader.cancel() 완료를 기다리지 않고 제한 초과 오류를 반환한다. 보고서 작성 전에 부모 경로를 검증한다. 디렉터리를 0o700 모드로 생성하고 writeAcquisitionPrivateFile로 기록한다. 심볼릭 링크 파일과 부모 디렉터리 테스트를 추가한다.
검증 실패 증거 생성 scripts/private-vulnerability-reporting-audit.mjs, test/private-vulnerability-reporting-audit.test.ts, test/private-vulnerability-reporting-invalid-repository-evidence.test.ts	소스 리비전과 저장소 검증을 별도 처리한다. 저장소 검증 성공 시 repository를 기록하고 실패 시 unknown을 기록한다. 실패 보고서의 상태, 저장소 값, 오류 세부 정보, RTL 오버라이드 문자 제거를 검증한다.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Merge Risk: 🟡 Moderate · up to d8c84

The change hardens private audit evidence handling, but the current head is not merge-ready because required validation checks remain queued; merge should wait until those checks complete successfully.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 6 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 private-reporting audit evidence의 보안 강화라는 변경 목적을 정확하고 간결하게 요약합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/private-vulnerability-reporting-cancel-liveness

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 0 new potential issues.