security: bind Homebrew execution to approved script bytes

[seonghobae]

Purpose

Bind Homebrew planning, model judgment, human approval, and execution to the exact script bytes that were verified, rather than only to pathname plus device/inode identity, while preserving the fixed command, local-model gate, exact confirmation phrase, single-use judgment, audit publication, and macOS-only runtime authority.

Root cause

A same-user actor could rewrite the approved Homebrew executable in place without changing device/inode identity. Re-planning narrowed the race but did not bind the script bytes actually sourced by Bash to the bytes approved by the plan and judgment.

Exact current state

• stacked base fix: support standard Intel Homebrew executable target #205 exact head: 4432ea1aa12ccafd4774828f135898cd333f2d97
• exact current head: fe13b27404af46f64960b5f46ae2b806e17830ae
• fresh base-to-head comparison is ahead-only and preserves exactly two semantic files: src-tauri/src/brew_cleanup.rs and src-tauri/tests/brew_cleanup_snapshot_testability_contract.rs
• exact Test 32320000010 and Release 32319999991 are queued; predecessor successes do not transfer
• PR remains Draft

Test-first repair

The implementation rejects empty or over-8-MiB script objects, reads the already-open verified source into a private anonymous tempfile snapshot, hashes the captured bytes with BLAKE3 while copying, fsyncs and rewinds that snapshot, revalidates opened object and current pathname identity/executable admission after capture, binds device:inode:digest into the existing opaque brew_identity, and passes only the captured snapshot descriptor to the fixed privileged Bash launcher. Later same-inode writes to the source pathname therefore cannot change the bytes sourced for the approved invocation.

The real Unix regression opens an approved executable, mutates the same inode in place, proves device/inode remains unchanged, then proves the retained verified snapshot still contains only the approved bytes. The macOS runtime command remains unavailable on non-macOS platforms.

The branch was advanced non-destructively onto current #205. Current base-to-head comparison proves only the intended content-binding delta remains.

Required before merge

Keep Draft until parent dependencies are integrated or deliberately preserved; every applicable exact-head native and central workflow passes; every valid current-head finding is addressed and threads are resolved; repository-wide exact 100% owned-production coverage is satisfied without weakening; package/SBOM/provenance/release requirements are complete where applicable; and fresh dependency/base ancestry remains current. Pending, queued, absent-required, skipped-required, neutral-required, failed, stale, predecessor, synthetic, diagnostic-only, status-only, model-only, or author-only evidence is non-passing.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 132a9ce7-d4bb-49b4-a848-7eb83b4f29ba

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 18 minutes and 57 seconds before sending another message.

[seonghobae]

The content-bound Homebrew execution slice is ready for review at exact head 2e7b845b7610a871ec5981d964bcab5cb99df41d; hosted Test/Release/build checks are green and GitHub reports clean. Protected independent approvals are still required; no merge bypass is used.

[devin-ai-integration]

Devin Review found 2 potential issues.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2e7b845b7610a871ec5981d964bcab5cb99df41d.

• Head SHA: 2e7b845b7610a871ec5981d964bcab5cb99df41d

• Workflow run: 32702646057

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 2e7b845b7610a871ec5981d964bcab5cb99df41d
• Workflow run: 32702646057
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2e7b845b7610a871ec5981d964bcab5cb99df41d.

• Head SHA: 2e7b845b7610a871ec5981d964bcab5cb99df41d

• Workflow run: 32702646057

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

Reviewed the two remaining informational threads on exact head 2e7b845b7610a871ec5981d964bcab5cb99df41d: /dev/fd/3 is the deliberate byte-verified execution source and preserves the existing BASH_SOURCE behavior; the dev:ino:hash identity is recomputed and compared consistently across plan/dry-run/execute. No code change is warranted. Both threads are resolved; hosted checks are already green, but the stale changes-requested review state still requires a fresh qualifying approval.