test(security): prove KPI child environment is least-authority

[seonghobae]

Purpose

Start issue #110 test-first from the surviving protected KPI lineage after #250 integrated and superseded moving predecessor #105. This Draft is intentionally RED: it proves the current KPI gate still forwards excessive ambient authority to its child scoring processes and defines the smallest reviewed environment contract before implementation.

Exact source identity

• protected base immediately before publication: 82d884d0415a83423d56fba9bac5262c3470a646;
• branch: fix/kpi-child-env-isolation-current-main;
• exact RED head: e7faa4c98ce24149087e01cf8dacb25d8167c12f;
• lineage: direct child of the protected base; predecessor check/review evidence does not transfer.

Current defect / RCA

Protected scripts/kpi-gate.mjs first builds const kpiChildEnvironment = { ...process.env }, removes only six selected keys, then overlays per-step values. That still forwards HOME, proxy configuration, provider/Cloudflare variables, Maintainer/Reviewer App material, unrelated NOEMA_* state, and any future ambient variable unless someone remembers to denylist it.

The two child contracts are narrower:

• kpi-check requires only the explicitly reviewed NOEMA_KPI_REQUIRE_WINDOW_DAYS step input;
• kpi-alert supports only NOEMA_ALERT_5M_FAILURE_RATE, NOEMA_ALERT_5M_P95_MS, NOEMA_ALERT_RATE_LIMIT_MINUTES, and NOEMA_ALERT_WORKFLOW_SPIKE_MULTIPLIER from ambient configuration.

process.execPath is already the exact Node executable, so this child boundary does not require ambient PATH to preserve executable resolution.

RED contract

The new regression uses only synthetic hostile values for GitHub/GH/Copilot tokens, NVIDIA/model credentials, Maintainer/Reviewer App material, Cloudflare/provider credentials, proxy values, HOME, NODE_OPTIONS, NODE_PATH, unrelated NOEMA_*, and supported KPI/alert inputs. It requires:

1. every child spawn to route through a declared createKpiChildEnvironment contract instead of copying process.env;
2. kpi-check to receive only its explicit strict-window input;
3. kpi-alert to receive only the four reviewed alert-threshold inputs;
4. unknown future child names to fail closed rather than silently inheriting authority.

The helper and source integration deliberately do not exist on this RED head. Fresh CI is expected to fail specifically at this contract. A failure elsewhere is not accepted as RED proof.

Authority boundary

No production provenance/snapshot/evidence-retention logic is changed on this head. No workflow, gate, secret, reviewer, model, release, deployment, licensing, IP, or acquisition authority is altered or invented. COPILOT_GITHUB_TOKEN is not used.

Before any GREEN write, refetch protected base, exact head/blobs, issue/writer state, reviews and current workflow evidence; then implement the smallest allowlist-based child environment and reacquire focused/full exact-head validation plus protected-base Security Scan.

Related: #3, #27, #29, #104, #105, #107, #109, #110

Summary by CodeRabbit

• 개선 사항

  • KPI 하위 작업 실행 시 단계별로 허용된 환경 설정만 전달하도록 변경했습니다.
  • kpi-check와 kpi-alert에 필요한 설정만 선별해 전달하며, 민감하거나 불필요한 환경 정보의 전달을 방지합니다.
  • 지원되지 않는 KPI 단계는 오류로 처리해 잘못된 실행을 사전에 차단합니다.

• 테스트

  • 환경 설정 전달 범위, 누락된 값 처리, 잘못된 단계 거부 동작을 검증하는 테스트를 추가했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9ced0f08-2e31-4be1-9bc9-cc0a777208e0

📥 Commits

Reviewing files that changed from the base of the PR and between 382c78f and 0697568.

📒 Files selected for processing (3)

• scripts/kpi-gate.mjs
• scripts/lib/kpi-child-environment.mjs
• test/kpi-child-environment.test.ts

---

📝 Walkthrough

Walkthrough

KPI 자식 프로세스 환경 생성을 createKpiChildEnvironment로 중앙화했습니다. kpi-check와 kpi-alert에 단계별 허용 환경 변수만 전달합니다. kpi-gate.mjs는 헬퍼 결과를 사용하며, 관련 동작을 테스트로 검증합니다.

Changes

KPI 자식 프로세스 환경 격리

Layer / File(s)	Summary
단계별 환경 생성 규칙 scripts/lib/kpi-child-environment.mjs, test/kpi-child-environment.test.ts	createKpiChildEnvironment가 kpi-check와 kpi-alert의 허용 환경 변수만 선택합니다. undefined 값은 제외하며, 알 수 없는 단계는 Unknown KPI child step 오류를 발생시킵니다.
KPI 게이트 실행 통합 scripts/kpi-gate.mjs, test/kpi-child-environment.test.ts	kpi-gate.mjs가 전체 부모 환경을 복사하지 않고 헬퍼가 생성한 환경으로 자식 프로세스를 실행합니다. 테스트가 해당 import와 실행 경로를 검증합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Mergeability Score: ⚪ Minimal · up to 06975

The PR’s child-environment behavior change has no identified actionable merge-blocking risk in the supplied evidence and is merge-ready after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant KpiGate as kpi-gate.mjs
  participant EnvironmentHelper as createKpiChildEnvironment
  participant ChildProcess as KPI child process
  KpiGate->>EnvironmentHelper: 단계 이름과 환경 전달
  EnvironmentHelper-->>KpiGate: 허용된 단계별 환경 반환
  KpiGate->>ChildProcess: 제한된 환경으로 자식 프로세스 실행

Loading

Possibly related issues

• ContextualWisdomLab/noema 이슈 110: kpi-gate.mjs의 전체 부모 환경 상속을 단계별 허용 목록 계약으로 대체하는 변경과 직접 연결됩니다.

Possibly related PRs

• ContextualWisdomLab/noema#105: kpi-gate.mjs의 자식 프로세스 실행과 환경 격리를 다룹니다.
• ContextualWisdomLab/noema#107: 자식 프로세스 환경을 명시적 허용 목록으로 구성하는 변경과 직접 연결됩니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 KPI 자식 환경의 최소 권한 격리와 보안 회귀 테스트라는 변경 목적을 명확하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/kpi-child-env-isolation-current-main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Please review the current exact head only. Prior draft-skip status and predecessor evidence are non-passing and must not be reused.

[coderabbitai]

@seonghobae I will review the current exact head of #253 only. I will not use prior draft-skip status or predecessor evidence.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.