fix(ci): secure and bound sandbox evidence streams

[seonghobae]

Purpose

Rebuild the reviewed sandbox confidentiality and availability controls from broad predecessor #767 directly on the current protected main baseline, without carrying stale dependency, scanner, or scheduled-security snapshots.

Intended focused scope

• bounded stdout, stderr, and long-running service evidence with process-group termination on overflow;
• complete credential redaction for commands, timeouts, nested JSON, service tails, and evidence notes;
• structured argv and shell=False execution;
• finite reader finalization, bounded service-tail reads, cleanup-failure evidence, and deterministic exit codes;
• hostile Unicode, JSON, timeout, flood, stuck-reader, and readiness regressions;
• permanent Python 3.14 integrated quality workflow enforcing 100% production statement, branch, and public-docstring coverage;
• APA 7 doctoring, design/plan evidence, and CHANGELOG entries.

The branch currently contains a self-removing materialization workflow that imports only the reviewed feature files from immutable predecessor head 45e4929e1fc473211168b2d6360c9da2516e5341, validates them against current main, and publishes a focused commit. Keep Draft until the materializer removes itself and exact-head checks complete. Close #767 as superseded only after this replacement is materialized and reviewed.

No predecessor-head checks or approvals are reused.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 19 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9ac06cc7-6be0-43d5-8d53-9a55ac5ca4bf

📥 Commits

Reviewing files that changed from the base of the PR and between e6fc914 and fa91574.

📒 Files selected for processing (1)

• .github/workflows/materialize-sandboxed-evidence-receipt.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Release blocker: exact current scope is only two PR-controlled materialization workflows. This branch must not rewrite, import, commit, or push its own production security code.

@opencode-agent address

Delete both materialization workflows and publish the sandbox confidentiality/availability repair as ordinary reviewed source, tests, doctoring, and changelog commits directly on this branch. Preserve structured argv with shell=False; process-group termination on output or time bounds; complete redaction across argv, stdout, stderr, JSON, timeout, service tails, cleanup notes, and evidence; bounded readers and service-tail reads; deterministic exit classifications; and hostile Unicode/JSON/flood/stuck-reader/readiness tests. The final tree must contain no materializer, receipt trigger, self-removing workflow, source snapshot, or branch writer. Require exact-head Python 3.14 integrated quality CI, Python 3.10 compatibility where applicable, 100% production statement/branch/docstring coverage, compilation, every security/supply-chain gate, current-head review, zero valid threads, and independent approval before Ready. Do not reuse predecessor #767 evidence.

[seonghobae]

@jules Replace the two-workflow materializer-only scope on exact live head 89426081514565963f969f91475545b4afef802e with ordinary reviewed production source, tests, permanent quality workflow, APA 7 doctoring, design/plan evidence, and changelog commits directly on this branch. Keep Draft and do not reuse predecessor checks or approvals.

Use immutable predecessor 45e4929e1fc473211168b2d6360c9da2516e5341 only as reviewed source reference; independently validate every imported file against current protected main. Preserve the intended bounded sandbox contract:

• structured argv and shell=False only;
• bounded stdout/stderr and service evidence;
• process-group termination on timeout or byte overflow;
• finite reader finalization and bounded service-tail reads;
• complete credential redaction in argv, stdout, stderr, nested JSON, timeout, service tails, cleanup notes, and evidence;
• deterministic exit/failure classifications and explicit cleanup-failure evidence;
• hostile Unicode, JSON, timeout, flood, stuck-reader, readiness, and partial-cleanup regressions;
• exact-head Python 3.14 integrated quality CI, Python 3.10 compatibility where supported, 100% production statement/branch/public-docstring coverage, compileall, and complete central/security/supply-chain tests.

Delete .github/workflows/materialize-sandboxed-evidence-bounds.yml and .github/workflows/materialize-sandboxed-evidence-receipt.yml; the final diff must contain no materializer, source snapshot, receipt trigger, self-removing workflow, encoded patch, branch writer, or transient agent journal. Commit normally; do not amend, force-push, mark Ready, merge, release, alter protections, or change reviewer credentials. Stop without mutation if the live head differs before writing.

[github-actions]

자동 정리: base 대비 실제 변경(diff)이 0건이라 이 PR을 닫습니다. 변경을 추가한 뒤 reopen하세요.

[seonghobae]

@opencode-agent

Finish the focused current-main reconstruction using only the reviewed sandbox feature files from immutable predecessor head 45e4929e1fc473211168b2d6360c9da2516e5341. Preserve structured argv and shell=False execution; bounded stdout/stderr/service evidence; process-group termination on overflow; complete credential redaction in commands/timeouts/nested JSON/service tails/notes; finite reader finalization; bounded service-tail reads; cleanup-failure evidence; deterministic exit codes; hostile Unicode/JSON/timeout/flood/stuck-reader/readiness regressions; Python 3.14 and exact 100% production statement/branch/public-docstring coverage. Remove the materializer and every temporary writer from the final diff; update design/ADR/CHANGELOG and APA 7 doctoring. Do not approve, merge, release, use COPILOT_GITHUB_TOKEN, or alter protections.

[seonghobae]

The PR now has an empty permanent diff after removing the unsafe PR-controlled materialization workflows. Closing the no-op branch; any sandbox confidentiality repair must be reintroduced as ordinary reviewed source, tests, doctoring, and changelog changes without a branch writer.