security(attestation): bound signer receipt file intake before semantic validation #2315

Finding

The scientific-validation verifier in #2300 now emits a versioned predicate plus completion manifest and validate_receipt_manifest() strictly validates their semantics. The remaining signer-handoff intake is still a raw-bytes API: a future credentialed signer that reads manifest / predicate files without an owner-provided bounded regular-file boundary can allocate or hash attacker-controlled receipt files before the semantic validator gets a chance to reject them.

This is distinct from the 16 MiB sealed scientific evidence limit. The signer receipt pair is a different trust boundary and #2299 explicitly requires bounded inert-data intake before credentialed attestation authority is used.

RED / acceptance

Add an owner signer-facing receipt reader that:

• pins every parent-directory path component without following symlinks;
• opens each receipt leaf once with O_NOFOLLOW and O_NONBLOCK, requires a regular inode by descriptor, and reads at most a fixed receipt limit + 1 byte;
• rejects oversized manifest or predicate bytes before JSON parsing or digest validation;
• rejects the same manifest/predicate path and preserves exact bytes for validate_receipt_manifest() rather than reparsing/re-serializing them;
• exposes a stable nonzero CLI result for missing, symlinked, non-regular, oversized, or semantically invalid receipt pairs;
• remains uncredentialed and performs no signing, OIDC, psychometric arithmetic, or caller code execution.

Use a documented fixed limit with a quantitative rationale. A 4 MiB per-file ceiling still leaves room for more than 60k 64-hex execution-artifact identities plus JSON overhead while bounding signer memory. Put the new production module and tests under the existing Scientific Validation Evidence Quality 100% owned line/branch/docstring gate.

Do not weaken validate_receipt_manifest(), do not copy product-performance predicate semantics, and do not claim #2299 or TEPP#637 is authenticated until #2164 and the credentialed owner workflow land through normal protected review.

Refs #2299 #2300 #2164 ContextualWisdomLab/TEPP#637.