fix(security): prevent acquisition preflight Git filter execution

[seonghobae]

Scope

Repair issue #575 without broadening Noema authority. This lane owns only the acquisition Git conversion-boundary defect and directly affected tests/decision documentation. It does not copy quarantine/security/outbound authority, provider routing, product domain truth, or lifecycle truth into this acquisition boundary.

Reality RED → causal repair

The original test-only exact 15e5fe04c454f64aa3cfe97b2966aca3ec730ff6 changed the existing clean-filter regression to same-size base\n → evil\n; hosted application CI 34371012334 reached release tests and failed on that exact while Security Scan and reviewer-ci independently succeeded. That established the production defect without weakening any gate.

Production 33970e6da225fb8314f59a2573923bcb268821c2 removed the worktree-aware git diff-files call. The preflight still requires exact HEAD, pre/post unsafe-index checks, staged index-vs-HEAD comparison, immutable exact-tree enumeration, descriptor-bound O_NOFOLLOW raw-byte hashing, mode/size/path bounds, and final exact-HEAD stability. It does not blacklist filters, mutate repository config, or relax byte authenticity.

Hosted CI on predecessor exact 02e8bbe331b0b24cd892fee67de16afa2c959c46 then exposed a narrow convergence RED: exact checkout/base/lock/install/typecheck succeeded, but release tests failed while Security Scan, reviewer-ci, and patch-validator-image succeeded. Two stale assertions in test/acquisition-git-content-hash.test.ts still expected the superseded authenticated Git index bytes diagnostic. Commit 944379c1273ebcb8d5a20dae8e73120dcf838970 changed only those assertions.

After normal #574 integration, the lane ordinary/non-force reconverged by a two-parent merge onto protected main@fdae30f5657529b79bbbb6d24e37e8270e912ebe. Hosted application CI 34378908355 on reconverged exact 7c9a6739ceed01014bf7f9f65ebde53e953185d1 then provided the next precise RED: 4,304/4,305 tests passed; only test/acquisition-git-worktree-binding.test.ts still expected the old staged-comparison diagnostic containing the commit SHA, while raw worktree drift is now correctly rejected by the exact-tree byte authenticator with tracked checkout differs from exact HEAD tree bytes. Commit 4ac4bfcd2c0696c51954aefd14ebae4e3c7d168c updates that one hostile regression expectation. Production behavior and all authentication gates remain unchanged.

Current exact authority

Current exact is 4ac4bfcd2c0696c51954aefd14ebae4e3c7d168c and it already contains protected main@fdae30f5657529b79bbbb6d24e37e8270e912ebe through the ordinary merge parent. The previous exact had Security Scan and reviewer-ci GREEN; its application CI failure is intentionally superseded by this causal test repair, and its patch-validator-image result cannot be inherited. Keep Draft until all four gates complete on the unchanged current exact and fresh review/base remain clean.

docs/acquisition-data-room-integrity.md, docs/acquisition-git-content-authentication.md, ADR 0016, and the doctoring record describe the filter-free exact-tree + descriptor-bound local Git-blob hashing path. CHANGELOG.md already describes the protected direct Node-crypto exact-tree hashing authority and is not rewritten solely to repeat this narrower conversion-helper repair. No merge, release, deployment, or acquisition-readiness completion is claimed.

Summary by CodeRabbit

• 보안 및 안정성

  • 저장소 사전 검사가 고정된 커밋 트리와 실제 체크아웃 파일의 원시 바이트를 직접 비교하도록 개선되었습니다.
  • Git 변환 설정이나 인덱스 상태로 인해 추적 파일 변경이 숨겨지는 문제를 방지합니다.
  • 파일 경로와 실행 권한 검증이 강화되어 변조된 체크아웃을 보다 안정적으로 탐지합니다.

• 문서

  • 콘텐츠 인증 절차와 복구 안내를 최신 검증 방식에 맞게 업데이트했습니다.
  • 관련 설계 결정과 참고 자료를 추가했습니다.

• 테스트

  • 동일한 크기의 파일 변조, 커밋 이동, staged 변경 등 보안 경계 사례 검증을 보강했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: c42ff9c2-98d1-4594-84db-7f3dd76bbe56

📥 Commits

Reviewing files that changed from the base of the PR and between fdae30f and 4ac4bfc.

📒 Files selected for processing (10)

• docs/acquisition-data-room-integrity.md
• docs/acquisition-git-content-authentication.md
• docs/adr/0016-avoid-repository-git-conversion-execution-in-acquisition-preflight.md
• docs/doctoring/acquisition-git-content-authentication.md
• scripts/lib/acquisition-git-preflight.mjs
• test/acquisition-git-content-hash.test.ts
• test/acquisition-git-filter-boundary.test.ts
• test/acquisition-git-preflight.test.ts
• test/acquisition-git-worktree-binding.test.ts
• test/main-governance-source-binding.test.ts

---

📝 Walkthrough

Walkthrough

Git preflight가 git diff-files와 파일별 git hash-object를 사용하지 않도록 변경되었다. 검증은 exact HEAD tree의 blob ID와 O_NOFOLLOW descriptor에서 읽은 raw bytes를 직접 계산한 Git object ID를 비교한다. 관련 문서와 회귀 테스트도 갱신되었다.

Changes

Acquisition Git 인증

Layer / File(s)	Summary
인증 계약과 검증 절차 docs/acquisition-data-room-integrity.md, docs/acquisition-git-content-authentication.md, docs/doctoring/..., docs/adr/...	문서가 exact HEAD tree의 mode·object ID·path inventory와 descriptor-bound raw bytes를 인증 기준으로 정의한다. SHA-1과 SHA-256 blob hashing은 Node crypto로 수행한다.
Preflight 인증 경로 변경 scripts/lib/acquisition-git-preflight.mjs	git diff-files 호출을 제거한다. staged 비교와 descriptor-bound raw-byte pass를 사용한다. 오류 메시지와 인증 설명을 exact HEAD tree 기준으로 갱신한다.
인증 회귀 테스트 갱신 test/acquisition-git-content-hash.test.ts, test/acquisition-git-filter-boundary.test.ts, test/acquisition-git-preflight.test.ts, test/acquisition-git-worktree-binding.test.ts, test/main-governance-source-binding.test.ts	same-size tracked drift, 인증 전후 index 상태, HEAD 이동, exact HEAD 오류 메시지, ls-tree 기반 tracked source simulation을 검증하도록 테스트를 갱신한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant AcquisitionPreflight
  participant Git
  participant CheckoutDescriptor
  participant NodeCrypto
  AcquisitionPreflight->>Git: exact HEAD tree inventory 조회
  AcquisitionPreflight->>CheckoutDescriptor: tracked file raw bytes 읽기
  CheckoutDescriptor->>NodeCrypto: Git blob framing 적용 후 hash 계산
  NodeCrypto-->>AcquisitionPreflight: blob object ID 반환
  AcquisitionPreflight->>Git: exact HEAD tree object ID와 비교

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/acquisition-git-filter-preflight

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}