fix(kpi): restack fatal UTF-8 direct KPI input on latest main

[seonghobae]

Fresh protected-main successor to #188/#123 on exact base 0c4e8929d3ecad80fd930b5ddde0e3b8db3016ff. No predecessor checks, reviews, scanner output, model judgment, production KPI, or release evidence transfers.

Test-first head ff474843ba8733a58c95296eb98d17b7f070dae5 contains only the deterministic direct-KPI input-integrity regression while protected scripts/compute-kpi.mjs still uses non-fatal UTF-8 decoding. The regression injects malformed retained UTF-8 into an otherwise valid /exchange record and requires failure before metric output while separately pinning valid metrics and the existing non-JSON-line policy.

The narrow GREEN remedy reads exact bytes and decodes with fatal UTF-8 before line/JSON/metric semantics. Exact-head application CI, reviewer-ci, protected-base eligible central Security Scan, reviews/threads, and live-base identity must be reacquired. Pending/absent/skipped/predecessor evidence remains non-passing.

Supersedes #188/#123 only after this successor proves and integrates the complete contract.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 29a6043f-5b82-4f40-a068-626f90b11ecf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}