fix(acquisition): authenticate data-room manifest evidence

[seonghobae]

Problem

The acquisition data-room boundary must not trust persisted green booleans, mutable paths, ambiguous JSON, bare URLs, or artifact metadata as buyer/release authority. Generated manifests and exact-release rights receipts are untrusted inputs to the final audit and must be independently recomputed from authenticated bytes and repository/release identity.

This remains distinct from missing real-world KPI/revenue/transfer evidence tracked by #3/#5: those gates must stay intentionally RED until real evidence exists.

Current protected / implementation lineage

Protected main is now c85d710804139c0697d7ef8fa47d02b1389e6d84 after #76 integrated; the repository-wide nanoid blocker is therefore no longer the current protected-base prerequisite.

PR #69 remains the canonical acquisition-integrity implementation line at exact head 0689fa6933dfc8db89abd053427a78a45455c86c, but it is Draft because its direct-main CI/package snapshot predates the post-#76 deterministic package-manager control plane.

The former #89 line is superseded. Clean protected-main successor PR #91 is now the active Node/npm/lockfile/install-script baseline at exact head ebde3720ee27292be0ce3315986e0438dd66af9f, with fresh terminal-success ci, reviewer-ci, and central Security Scan evidence.

Acquisition integrity implemented on #69

• recompute passed, finalGatePassed, missingRequired, and missingFinalGate rather than trusting stored values;
• bind schema/objective/repository/exact commit and selected release identity;
• require unique reviewed catalog identity and reject duplicate/unknown/contradictory entries;
• descriptor-safe/no-follow/bounded stable reads with SHA-256 and byte-size recomputation;
• reject symlink/non-regular/path-to-descriptor/pre/post-read identity drift;
• explicit repository-relative path allowlisting plus Git content/tree/worktree authentication;
• bare https:// declarations remain non-verifying for final-gate material;
• external evidence requires immutable retained artifact + bounded verification receipt;
• offline/reproducible final audit; remote collection remains a separate evidence-collection step;
• digest-bound exact-release artifact_rights_metadata tied to repository, SemVer tag, full release commit and immutable artifact identity;
• OCI license annotation may only match an already authorized owner/legal SPDX expression; custom/unlicensed decisions cannot invent LicenseRef-Proprietary or another artifact-side legal posture;
• fatal UTF-8 and duplicate decoded JSON member-name rejection before acquisition values become evidence, including top-level revenue/transfer/release/saleable/data-room/package JSON paths;
• acquisition evidence remains separate from checks, scanners, review, model judgement, merge, release and deployment authority.

Current #69 exact-head evidence remains useful implementation proof: its application lane reached 82 test files / 873 tests with configured owned statements/branches/functions/lines at 100% before the then-inherited nanoid audit; reviewer-ci and central Security Scan were terminal success. That predecessor evidence does not transfer to a future refreshed head.

Current source-control dependency: #91

#69 overlaps the package-manager control plane in:

• .github/workflows/ci.yml;
• package.json;
• vitest.config.ts;
• test/workflow-readiness.test.ts;
• CHANGELOG.md.

#91 now owns exact Node 24.19.0 / npm 11.17.0, strict-allow-scripts=true, schema-v2 live-base lockfile change control, reviewed install-script identities and frozen install semantics on the clean post-#76 lineage. Replaying #69 without preserving that baseline could improve acquisition integrity while regressing supply-chain authority.

Safe integration order is therefore:

#91 protected integration
→ rebuild/refresh only #69's unique acquisition-integrity delta on the then-current protected lineage
→ preserve #91 CI/package/vitest/workflow-readiness/CHANGELOG controls
→ fresh full acquisition CI/reviewer/Security/review evidence
→ protected-main acquisition fail-closed acceptance

Do not copy #91 wholesale into the current stale #69 head or transfer predecessor checks/reviews.

Acceptance criteria

Repository-owned integrity control

• Forged all-green manifest cannot satisfy acquisition audit.
• Modification/hash/size/symlink/non-regular/path identity regressions fail closed.
• Duplicate IDs, wrong schema/objective/repository/commit/release, malformed gaps and unknown entries fail closed.
• Arbitrary HTTPS cannot satisfy final-gate evidence.
• Trusted recomputation + bounded stable-file verification.
• Real KPI/deployment/governance/revenue/transfer evidence remains absent/RED unless independently real.
• Configured 100% owned production statement/branch/function/line coverage on the active implementation head.
• Buyer/data-room documentation and ## Unreleased CHANGELOG on the implementation line.
• APA 7 primary-source doctoring for integrity/provenance boundaries.
• Duplicate decoded JSON keys and malformed UTF-8 rejected before parsing.
• Exact-release artifact rights bound to authenticated artifact/release identity without creating legal authority.
• Integrate fix(security): update transitive nanoid for CVE-2026-67213 #76 so protected main is no longer blocked by the inherited nanoid advisory.

Integration / protected acceptance

• Integrate build(reproducibility): restack deterministic npm toolchain #91 or an equivalent reviewed deterministic package-manager/install-script baseline.
• Rebuild/refresh only fix(acquisition): authenticate data-room manifest evidence #69's unique acquisition work onto that exact protected lineage while preserving build(reproducibility): restack deterministic npm toolchain #91 controls.
• Require fresh exact-source/current-base CI, reviewer, Security Scan and all applicable package/provenance gates.
• Resolve new valid current findings/threads and satisfy live governance/review requirements.
• Merge under protected policy without waiver/synthetic approval.
• Verify protected-main acquisition audit still fails closed while real KPI/deployment/environment/revenue/transfer/legal-rights evidence is absent.
• Do not version/release until repository-wide release, provenance, rights and operational gates independently pass.

Guardrails

No repair/self-modifying Actions, contents:write branch patching, status substitutes, network-dependent final-audit shortcuts, parser ambiguity, audit waivers, invented outbound rights, or bypass for #27/#29/#40. Deterministic acquisition evidence remains separate from model/reviewer judgement.

Related: #3, #5, #27, #29, #40, #69, #77, #79, #91

[seonghobae]

2026-08-09 fresh implementation mapping: PR #69 exact head bf41d7df5263a399caa5a802f299eb9fe26ea81a is the current source implementation for this issue. It independently recomputes retained evidence instead of trusting persisted passed/finalGatePassed fields, binds repository/objective/source and optional immutable release identity, rejects duplicate/malformed evidence and path aliases, uses descriptor-safe bounded no-follow reads with identity/stability checks, treats external URLs as declaration-only without a local authenticated receipt, and keeps real production/KPI/revenue/transfer gaps intentionally NOT_READY. Exact-head reviewer-ci 31165322055 and Security Scan 31165321936 are terminal-success; application CI 31165322059 still fails only at the separate inherited nanoid@3.3.16 audit blocker. Thus #68 should remain open for integration acceptance, not new evidence-integrity source work: integrate #76, refresh/revalidate #69 against the live base, satisfy exact-head CI/review/#27 governance, protected-merge #69, then close #68. No persisted Boolean, external URL syntax, model verdict, or documentation claim is being promoted to acquisition authority.