Harden source-bound evidence writes

[omar07ibrahim]

Outcome

Harden every source-bound evidence writer flagged on main by creating temporary files as owner-only (0600) and publishing the completed synthetic documentation artifacts as reviewed 0644 files only after the full payload has been written.

This closed all 11 py/overly-permissive-file findings through the default-branch CodeQL analysis without dismissing or suppressing any alert.

Security boundary

• Five production evidence writers now create temporaries with 0600.
• The complete payload is written before fchmod(..., 0644), fsync, and atomic replacement.
• Three adversarial race replacements are private at creation.
• Three os.open test spies no longer introduce permissive fallback modes.
• Regression coverage observes both sides of the contract: every in-progress write is 0600; every installed public evidence artifact is 0644.
• The evidence is synthetic and public. No production notes, credentials, personal data, host paths, performance claims, authentication claims, or retrieval-quality claims are involved.

Source-bound evidence

The six adopted files were generated on GitHub-hosted Actions from source commit b2c39608c2dc6180008d2b2533aebb6ed0a8f20b (tree bbefc2958919bc5c84180c76e7d47dd325bbbf17) and reviewed as one atomic bundle:

• staging run: 31317811446
• artifact: private-evidence-bundle-31317811446 / 9039266614
• artifact SHA-256: d9546fb6ea90853983a13afd1db693ab91962ead5621091d4bbe41390f8caa69
• exact inventory: one canonical evidence JSON, one canonical manifest, PNG, GIF, and two accessible SVGs
• all six paths are flat regular files with reviewed 0644 modes
• all 16 unique generator/input hashes and the aggregate capture-input digest were independently checked against the pinned Git tree

The normalized ten-step CLI transcript is semantically identical to the previous evidence. PNG pixel changes are confined to the source/wheel provenance line; GIF phases, full-canvas frames, timing, disposal, and loop semantics are unchanged. The private temporary mode is proved by code and tests, not claimed from pixels.

The temporary staging workflow used to produce the review bundle was removed before the final head.

Final verification

Verified at ed4e3df677c8fa85a39812a1d3b7a529c9371d34:

• CI run 31318250419: success
  • Python 3.11: 624 passed, 100% statement/branch coverage
  • Python 3.12: 624 passed, 100% statement/branch coverage
  • installed-wheel media replay: success
• final replay artifact 9039407682: 523,349 bytes, digest sha256:34c05a349a1336a0fdd1a005506c33c9257b1ea687821b3c1478b92aa3d08e75
• the hosted replay rendered the exact six-file bundle twice, proved both renders byte-identical, and matched the adopted media
• CodeQL run 31318250403: success, 0 results across 50 Python rules on the PR merge ref
• canonical formatting, Ruff, strict mypy, packaging, lexical evaluation, evidence freshness, clean generated-artifact boundary, and extracted/installed distribution checks all pass

Reviewable history

Five linear commits, each authored and committed only by Omar Ibrahim:

1. 76df9a7 — create evidence temporaries privately
2. e91c2c8 — prove the private evidence write boundary
3. b2c3960 — stage private evidence regeneration
4. f271d8a — adopt reviewed private-write evidence
5. ed4e3df — remove temporary private evidence staging

Integration is intentionally limited to a fast-forward of the already-reviewed head; no squash, rebase, force-push, or merge commit.

Post-integration verification

• main fast-forwarded from 3049a2dc1b2c0de1a5e2935944048a02feb18531 to the exact reviewed head ed4e3df677c8fa85a39812a1d3b7a529c9371d34 with force:false.
• GitHub records PR Harden source-bound evidence writes #3 as merged at that same SHA; no merge, squash, or rebase commit was introduced.
• main CI 31318439716: success; 624/624 tests and 100% statement/branch coverage on Python 3.11 and 3.12, plus successful installed-wheel media replay.
• main replay artifact 9039465662: 523,349 bytes, digest sha256:3475637a86798854d6c8a26ed6557ab0176561fa142f7c255b1e0b752aae81b7.
• main CodeQL 31318439718: success; default-branch analysis 1592046120 reports 0 results across 50 Python rules.
• Open code-scanning alerts: 0 (all 11 automatically closed as fixed).
• Open Dependabot alerts: 0.
• Open secret-scanning alerts: 0.
• main protection remains strict and app-bound to Python 3.11, Python 3.12, Installed-wheel media, and Analyze (python), with admin enforcement, linear history, resolved conversations, and force-push/deletion disabled.
• The merged feature branch was automatically deleted.