fix(operations): preserve external scheduler evidence source

[seonghobae]

Scope

Prevent the external scheduler evidence audit from destroying, redirecting, ambiguously sharing, replacing, or visually misrepresenting retained operational evidence at Noema-owned authority boundaries. Source evidence and audit output remain separate filesystem objects; retained input must not traverse symlinked parents, accept multiply-linked aliases, or cease naming the exact descriptor-validated inode before the audit proceeds; report publication must not follow unsafe parent/leaf authority; retained diagnostics must not preserve Unicode formatting controls that can alter buyer/operator-visible meaning.

Test-first repair lineage

Earlier commits establish path-collision, parent/leaf symlink, same-inode hardlink, single-link source, private report publication, diagnostic-sanitization, and post-read retained-source identity boundaries.

• 081f90145b332f77a037c6fc4574218326698ae7 added a regression where stable descriptor metadata is insufficient because the configured pathname resolves to a different inode after bytes are accepted. Superseded hosted runs are not claimed as terminal RED evidence.
• 8077fa1bec8fc8df077d7ad8d157afb79be51210 withholds parsed evidence until descriptor close succeeds, then re-lstats the retained pathname and requires the same regular, single-link dev/ino/size/mtime/ctime identity with parent authority rechecked.
• 6c7eb459b85f5d36cc75b3b3d1a2203d889a0a32 and compatible focused tests cover post-read pathname drift branches.
• Current head 1ed38b6a321ef085bc9c5e123c8e821ae4c83efc also closes the publication race: scheduler reports use the shared private writer with exclusive one-shot creation, so an accepted source inode concurrently moved onto reportPath is rejected rather than replaced. It retains the required Unreleased changelog entry.

Current exact authority

Only evidence for unchanged exact head 1ed38b6a321ef085bc9c5e123c8e821ae4c83efc is eligible.

• protected base: main@f0ce457111f961f8627c7eece439d80b749a768d;
• lifecycle: open / Ready / mergeable;
• candidate delta: CHANGELOG.md, scripts/external-scheduler-evidence-audit.mjs, scripts/lib/acquisition-private-output.mjs, and six focused external-scheduler test files;
• unresolved inline review threads: 0 at the latest refetch;
• exact-head workflows remain non-passing until terminal: Application 33446724867 queued; reviewer-ci 33446724840 queued; required Security Scan 33446724821 queued; dedicated patch-validator-image 33446724854 pending.

Focused validation recorded on the exact pushed tree: 19 files / 153 tests passed; the two touched production modules contributed to combined 100% statements, branches, functions, and lines; direct tsc --noEmit and git diff --check passed. Hosted exact-head checks remain authoritative and predecessor/queued/pending/stale/model-only evidence is not merge evidence.

Related: #96

[coderabbitai]

Warning

Review limit reached

Next included review available in 36 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: ad9fc4ea-c706-49c9-852c-6524c7481076

📥 Commits

Reviewing files that changed from the base of the PR and between f0ce457 and 1ed38b6.

📒 Files selected for processing (9)

• CHANGELOG.md
• scripts/external-scheduler-evidence-audit.mjs
• scripts/lib/acquisition-private-output.mjs
• test/external-scheduler-evidence-cli-defaults.test.ts
• test/external-scheduler-evidence-cli.test.ts
• test/external-scheduler-evidence-path-collision.test.ts
• test/external-scheduler-evidence-post-read-stability.test.ts
• test/external-scheduler-evidence-sanitization.test.ts
• test/external-scheduler-evidence-source-hardlink.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}