security(release): reject malformed UTF-8 in publication receipt inputs

[seonghobae]

Problem

Protected main c85d710804139c0697d7ef8fa47d02b1389e6d84 feeds several retained JSON inputs into immutable-release publication verification. Ordinary Node UTF-8 string decoding can replacement-normalize malformed bytes before JSON and release-identity semantics, allowing byte-invalid retained evidence to become a different Unicode document.

This is distinct from #112: #112 owns CycloneDX SBOM ingestion during release-evidence construction; this issue owns the later publication-receipt consumer across release evidence, immutable policy, release view/API and verification response JSON.

RCA

• First failing boundary: retained publication JSON bytes -> Unicode/JSON semantics in shared readJson().
• Immediate cause: non-fatal UTF-8 decoding through readFileSync(path, "utf8").
• Root cause: release/publication identity checks did not first establish a strict valid-byte/text boundary.
• Systemic risk: corrupted retained evidence can normalize before immutable-release policy and asset-identity checks observe it.

Active test-first repair

PR #115 (fix(release): reject malformed publication JSON bytes) is the current direct-main repair.

• protected/live base: c85d710804139c0697d7ef8fa47d02b1389e6d84;
• RED head: 865e1d1de927b823f7cdf15c0a20fa73003e7d62;
• current exact GREEN head: c08adafe30fc21c1e2d6ae36418c0d3f63a4afc7;
• PR state: Ready, mergeable, direct main.

RED replaces an otherwise valid immutable-policy JSON document with byte-invalid UTF-8 and requires failure before publication receipt creation. GREEN reads exact bytes for every shared readJson() input and decodes with TextDecoder("utf-8", { fatal: true }) before existing JSON object/identity validation.

Exact current proof

For unchanged #115 head c08adafe30fc21c1e2d6ae36418c0d3f63a4afc7:

• application ci 31439576448: terminal success;
• reviewer-ci 31439576475: terminal success;
• eligible central Security Scan 31439576419: terminal success;
• formal reviews: 0;
• inline review threads: 0;
• the exact-head CodeRabbit attempt was rate-limited and remains non-passing/non-approval evidence.

Acceptance

Repository-owned implementation on #115 current exact head

• Deterministic RED proves malformed UTF-8 in an otherwise structurally valid publication-policy document fails closed.
• Every current shared readJson() input is decoded with fatal UTF-8 before JSON semantics are trusted.
• Existing immutable-release, tag/commit, asset digest, attestation, exact asset-set and fail-closed semantic checks are preserved.
• Malformed-byte failure does not produce release-publication-receipt.json.
• Focused RED -> GREEN plus exact-head application CI, reviewer-ci, eligible central Security Scan and current review/thread validation are complete.
• Parser hardening does not claim release publication, deployment, owner/legal/IP rights, or acquisition readiness.

Remaining protected integration / release acceptance

• Obtain live chore(governance): protect main and enforce release checks #27 governance and qualifying independent non-author formal approval required by chore(operations): provision and activate hourly maintainer App #29 where applicable; checks/mergeability/model output are not substitutes.
• Merge only an unchanged exact head after all applicable gates remain satisfied.
• Re-run malformed-byte and valid publication-receipt contracts from protected main after integration.
• Separately retain actual immutable release publication, deployment, provenance/SBOM/NOTICE/IP consistency and buyer acceptance evidence.

Related: #5, #27, #29, #112, #115

[seonghobae]

Protected-main acceptance is now complete on the surviving current lineage. Current protected main is c67ec43c4ffecc0560d5952350b700e5bdb67953; its scripts/release-publication-receipt.mjs reads exact retained bytes, separates file-read failure from fatal UTF-8 decoding, and only then parses JSON for the publication-policy/release-view/release-API/verification/release-evidence inputs. The current implementation arrived through protected-main successor #204, exact premerge head 2688cdb4587778cca90b20a692dd7bdee4637174, which passed application ci 31559657472, reviewer-ci 31559657478, and protected-base eligible central Security Scan 31559657507 with both current CodeRabbit threads resolved before merge. Historical #115 was then closed unmerged only after its unique two-path behavior was proven preserved and strengthened by #204. The later #199 protected merge advanced main to c67ec43...; post-merge protected-main ci 31560917640, reviewer-ci 31560917639, and both dynamic code-quality runs all completed success on that exact head. This closes only the malformed publication JSON byte-decoding boundary. It does not claim an immutable public release, deployment, provenance/NOTICE/IP consistency, production KPI, revenue, owner/legal rights, transfer evidence, or acquisition readiness.