security(evidence): reject malformed UTF-8 validation bytes

[seonghobae]

Problem

Protected main c85d710804139c0697d7ef8fa47d02b1389e6d84 reads the security checklist and security-validation-evidence.json through non-fatal UTF-8 decoding. A byte-invalid retained artifact can therefore be replacement-normalized before checklist/JSON semantics are evaluated.

This is a separate retained-evidence boundary from #112/#114 release/publication hardening and from the stale acquisition-integrity stack #69.

RCA

• First failing boundary: retained security validation bytes -> decoded checklist/evidence values.
• Immediate cause: ordinary UTF-8 string decoding replaces malformed byte sequences.
• Root cause: semantic validation ran without an explicit valid-byte/text boundary.
• Systemic risk: corrupted evidence can become a different Unicode value before buyer/security acceptance logic observes it.

Active test-first repair

PR #119 (fix(security): reject malformed UTF-8 validation evidence) is the current direct-main repair.

• protected/live base: c85d710804139c0697d7ef8fa47d02b1389e6d84;
• RED head: cc599f9ee50b7f8f550c4eb03ddbe7007bd25931;
• current exact GREEN head: 64083f906171884a4b00ea90ea8e0b93ee960851;
• current compare: 2 commits ahead / 0 behind live main, merge base exactly the protected head;
• PR state: Ready, mergeable, direct main.

The GREEN reads exact bytes and applies fatal TextDecoder decoding before checklist or JSON semantics. File-read, invalid-UTF-8 and invalid-JSON failures remain distinct. Valid fixtures preserve existing behavior.

Exact current proof

For unchanged #119 head 64083f906171884a4b00ea90ea8e0b93ee960851:

• application ci 31442220383: terminal success;
• reviewer-ci 31442220598: terminal success;
• eligible central Security Scan 31442220406: terminal success;
• formal reviews: 0;
• inline review threads: 0;
• CodeRabbit review was rate-limited on this exact head and remains non-passing/non-approval evidence.

Acceptance

Repository-owned implementation on #119 current exact head

• Malformed UTF-8 in otherwise passing evidence returns non-zero and cannot emit a passing audit.
• Malformed UTF-8 checklist bytes fail closed before checklist semantics.
• Valid UTF-8 passing fixtures remain passing.
• Invalid JSON remains failing independently of UTF-8 validity.
• Focused RED -> GREEN plus exact-head application CI, reviewer-ci, eligible central Security Scan and current review/thread validation are complete.
• No workflow/gate weakening, release/deployment claim, outbound-license choice, or fabricated operational/acquisition evidence is introduced.

Remaining protected integration / operation

• Obtain live governance and qualifying independent formal-review evidence actually required by chore(governance): protect main and enforce release checks #27/chore(operations): provision and activate hourly maintainer App #29; a rate-limited model review is not a substitute.
• Merge only an unchanged exact head after all applicable gates remain satisfied.
• Re-run malformed-byte and valid-evidence contracts from protected main after integration and retain protected-source evidence separately from PR/check/model evidence.
• Continue to treat actual security validation, release/deployment, production operation, legal rights and acquisition evidence as separate facts.

Related: #5, #27, #29, #68, #112, #114, #119

[seonghobae]

Protected integration completed through successor PR #197. Exact protected-main merge is 1f662dfcb80b08ba25d8ec9bff80bd433c49b6ed; it contains the same final source/test blobs as the superseded #119 implementation (scripts/security-validation-evidence.mjs blob 774cb32f870d5ee3cd5b35a30ad19798dbbf112d, test/security-validation-evidence.test.ts blob 5ff840aa60662343c3b2bc43e624683d7cb3f1e6).

Test-first evidence on #197 was reacquired from current main lineage: RED head b0069604e777ee8d842613e58e0e06a96488a027 failed application CI at the intended release-verify boundary; GREEN head 73c2da50121d01487d05f38bb16a0acad0c16b28 then completed application ci 31552126332, reviewer-ci 31552126338, and protected-base eligible central Security Scan 31552126347 successfully. The initial RED Security Scan had a transient Trivy-action execution failure before SARIF/gate parsing; the unchanged GREEN source subsequently completed Trivy, OSV, dependency review and Scorecard jobs successfully, so that predecessor failure was not promoted to a vulnerability finding.

After merge, protected-main push ci 31552302183 and reviewer-ci 31552302182 both completed successfully on exact main 1f662df..., re-exercising the integrated tests from protected source. Old PR #119 has been closed only after its two changed final blobs were proven byte-identical to protected main.

This closes only the malformed UTF-8 retained-evidence parser defect. Real security-validation operation, immutable release/deployment, production KPI, owner/legal rights, revenue, transfer, and acquisition evidence remain separate fail-closed facts.