fix(kpi): reject compact credential-shaped source IDs

[seonghobae]

Summary

Prevent KPI provenance sourceId from accepting credential-shaped, locator-shaped, executable-scheme, percent-encoded, or display-ambiguous labels that can leak secret material or create non-canonical retained buyer evidence.

Root cause and repair lineage

The shared hasUnsafeSourceId boundary rejects credential-shaped labels, control/format/separator characters, surrounding whitespace, Unicode normalization ambiguity, hierarchical/non-hierarchical executable locators, query-bearing authority and percent-encoded identity material. Existing credential/control/space/NFKC/password-alias hardening remains intact.

Scope / evidence boundary

This hardens provenance-label validation only. It does not synthesize production KPI evidence and does not satisfy issue #3's >=30-day authenticated production-data requirement. Technical gate success is not production, deployment, legal, or acquisition evidence.

Current exact identity and evidence

• exact head: 4e2cadbb56cff3b143d70dc99a78b7f7347a8afe;
• independently resolved protected main: 2c83355529447248c246805d1954f268e027d2ab;
• diverged predecessor-base lane: ahead 34 / behind 1; merge base 270b66e592330c4f1c7d3b726779b1a6c599c70c;
• Application CI 32667243953: terminal-success;
• reviewer-ci 32667243783: terminal-success;
• dedicated patch-validator-image 32667243882: terminal-success;
• Security Scan 32667243829: workflow-level terminal-success but not merge-authoritative while protected-central scanner authority remains defective;
• formal reviews: 0;
• review threads: 0.

These results belong to this diverged exact head and must be regenerated after non-destructive convergence; they do not authorize merging the stale-base lane.

Dependency / owner boundary

Earlier Noema dependency root #500 is current exact head 91e72951c739a40d17f8474fd43318837b30c5b2, Draft/mergeable and an exact descendant of protected main. Application 33231140202, reviewer 33231140178, and workflow-level Security 33231140205 are terminal-success; dedicated image 33231140223 remains pending/non-passing. This KPI lane must not overtake it.

Protected central .github/main is GitHub-verified e1b03eebc6dc5c85aed393e5928927c96376cf46. Protected security-scan.yml still has generic Dependency Review/Trivy checkout and a Dependency Review support probe that can map exact-comparison HTTP 403/404 to supported=false plus successful completion. Downstream Security success cannot be promoted to submitted-head-authoritative evidence.

Canonical central scanner owner #897 remains open / Ready / mergeable at exact head 74eb5d1753cba1a48e47e9bc05940373181d7b23 on the current protected central base, but required Strix provider-unavailable evidence, exact-current OpenCode CHANGES_REQUESTED, and absence of a qualifying independent approval remain non-passing. Central #834 separately owns the protected Noema stable exchange-envelope consumer correction from nonexistent top-level .token to data.token and remains exact head 1a202f9745e90280e3b1bbdead4f78320ba413fc on a historical non-mergeable base. No Noema producer workaround belongs here.

Merge boundary

Keep Draft. After #500 integrates or protected main otherwise moves, refetch this exact lane; if no writer conflict exists, converge non-destructively onto the then-current protected main and regenerate every applicable exact-head CI/security/coverage/package/SBOM/provenance gate. Do not reuse current Security success after convergence. No outbound license or production KPI claim is made here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-base exact merge-result promotion is now active as #507 at 34d37b0f02ab52e5982884df1defc50f068e1cea (parents: protected main 9fd64b184a7df52922efe0b6c121d714f6f6217d and this source tree head f1357b02cb457d9a0d606c6207f84267526f3a93). Closing this Draft as superseded-in-progress to avoid duplicate workflow queue load. #507 must pass its own current-base CI, reviewer-ci, and required Security Scan before merge; this PR can be reopened if that promotion exposes a valid defect.