fix(acquisition): authenticate exact deployment evidence bytes

[seonghobae]

Purpose

Test-first repair for #124. The acquisition deployment-evidence verifier must validate semantics from exact retained bytes and bind the verification-receipt subject digest to those exact bytes rather than replacement-decoded text.

Exact current identity

• protected/live base: main c85d710804139c0697d7ef8fa47d02b1389e6d84;
• branch: fix/acquisition-deployment-exact-bytes;
• RED head: 4d3df316751da0e63ea5466f158587e7a08b5905;
• GREEN/current head: 10e6636a2e72cc7bfcbc840257fc7eaa3d34d9e4;
• current compare: 2 commits ahead / 0 behind main, merge base exactly the live protected head;
• changed paths: scripts/acquisition-deployment-evidence-audit.mjs, test/acquisition-deployment-evidence-input-integrity.test.ts.

RCA -> RED -> GREEN

Protected source read acquisition deployment inputs through readFileSync(path, "utf8"). That can replacement-decode malformed bytes before JSON/JSONL semantics, while deploymentEvidenceSha256 was calculated from normalized text. The verifier could therefore bind a receipt to bytes different from the retained subject.

The RED regressions keep a valid passing fixture, inject malformed UTF-8 into otherwise valid deployment JSON while deliberately matching the receipt to replacement-decoded text, and separately corrupt the retained attestation bundle. Both malformed retained-byte cases must fail closed.

GREEN separates bounded regular-file byte reads from fatal UTF-8 decoding. JSON/JSONL parsing occurs only after strict decoding, and deployment subject SHA-256 is computed over the exact retained Buffer. Existing release identity, governance, attestation, signer/OIDC/runner-policy and report semantics remain unchanged.

Exact current-head proof

For unchanged current head 10e6636a2e72cc7bfcbc840257fc7eaa3d34d9e4:

• application ci 31443312371: terminal success;
• reviewer-ci 31443312390: terminal success;
• eligible central Security Scan 31443312357: terminal success;
• formal reviews: 0;
• inline review threads: 0;
• GitHub reports the PR Ready and mergeable.

Authority boundary

This is verifier-integrity evidence, not production or acquisition acceptance. It does not create deployment evidence, prove the production environment, cryptographically verify an attestation by itself, choose owner/legal rights, establish revenue, or make Noema acquisition-ready. #120/#121 remain the separate deployment-receipt construction boundary; stale #69 remains the broader acquisition-manifest lineage. Technical GREEN cannot replace live #27 governance or qualifying independent non-author approval under #29.

Related: #5, #27, #29, #40, #68, #120, #121, #124

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 44c2a649-f34b-4316-ab3c-97f5096a1eb4

📥 Commits

Reviewing files that changed from the base of the PR and between c85d710 and 10e6636.

📒 Files selected for processing (2)

• scripts/acquisition-deployment-evidence-audit.mjs
• test/acquisition-deployment-evidence-input-integrity.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}