[Security] Enforce one canonical local-audio resource budget before analysis

[seonghobae]

Canonical owner

#866 remains the single BandScope source owner for local-audio Resource Admission & Decode. Current exact head: 1756759998876ad9ac77c81b9ad6dc71daecdf1c; protected base: develop@314ddeae7b775a4957594b599358c8255617eb2e.

Implemented Draft truth

The #866 stack currently provides one versioned local-audio admission boundary: exact 100 MiB encoded-file ceiling; source metadata preflight for duration/sample rate/channels; canonical 44.1 kHz mono decode with one-sample-over duration probing; exact NumPy float32 post-decode admission; 39,690,000 decoded-sample / 158,760,000-byte canonical-buffer ceilings; stable payload-free rejection reasons and policy provenance; YouTube parity/owned-artifact cleanup; and path-free project-owned publication identity with size+SHA-256 receipt verification, no-clobber publication, Unix directory synchronization / Windows write-through namespace durability, and pre-existing destination preservation.

Policy v2 (53747bd… RED → 379d4a1… fix → 6b16e3c… doctoring) bound the canonical decoded-memory ceiling to production float32 without shortening the 15-minute window. Policy v3 (e96b6f0… RED → b24a6ff… fix → 3ee3f64…/623294d… doctoring) additionally rejects noncanonical float16/float64 decoded PCM with decoded_dtype_unsupported while preserving memory-budget rejection ordering. Test-authority drift was repaired through 8adcec8… and f294100… so policy-version assertions follow the production source of truth.

Native analysis cancellation and IPC authority

An intervening ordinary descendant 370a3d5865a0a3c43ebafceef9f5cdec6b6fc1e3 added the cancellation contracts. The direct-child implementation followed through 0238c675… (typed Cancelled error), 7aa8055f… (TypeScript cancelled wire contract), 4b85582d… (job-specific cancellation registry/command, queued cancellation, direct child kill/reap, single terminal slot release), c4e2f30d… (doctoring), and 0a54d609… (CHANGELOG). No hosted RED is claimed for that implementation because the fix followed before an independent terminal RED was observed.

A later valid finding showed that invoke-handler registration alone was not enough for this application: because BandScope uses Tauri 2 AppManifest::commands, renderer authority must also exist in the generated permission/capability boundary. The ordinary repair descendants are 12cc6bda… (shared cancellation wire-value regression), 36c56053… (declare cancel_analysis_job in AppManifest::commands), a90a7ea2… (grant allow-cancel-analysis-job in the main capability), b746f60a… (generated allow/deny permission artifact), 9e5d1d52… (focused Rust contract binding manifest + permission + capability), 2dac5b60… (doctoring tied to Tauri 2 runtime-authority/permission documentation), 2f254ac5… (security source-of-truth update for narrow IPC authority and process-tree claim boundary), and 17567599… (CLAUDE architecture update covering analysis cancellation, project/score commands, and the manifest → permission → capability boundary).

The WebView can therefore request cancellation only through an explicitly authorized BandScope command and a BandScope-minted job id; no PID or generic process handle crosses IPC. Queued work terminalizes as typed cancelled before engine startup when observed. Running work polls cancellation at the native process boundary, kills and reaps the directly owned child, drains/joins its readers, emits terminal cancellation, clears request state, and releases the in-flight slot on the worker's single terminal path. Repeated cancellation of a terminal job leaves that terminal status unchanged.

Remaining resource/cancellation acceptance

The canonical-buffer ceiling is not an end-to-end peak-memory budget. decode_mono_audio(...) still calls librosa.load(...) before post-decode validation, so decoder/resampler intermediates can consume memory before policy v3 observes the canonical float32 array. Downstream NumPy/PyTorch/model allocations and accelerator memory remain outside that artifact ceiling.

The native cancellation slice is also not yet process-tree containment. Child::kill/wait proves termination/reaping of the directly owned Python child only; it does not prove platform-correct descendant termination on Windows/macOS/Linux, bounded closure of inherited pipe handles, or deletion of child-created temp artifacts. Remaining acceptance therefore includes platform-specific process-tree containment, measured cancellation latency and process/temp cleanup on rights-cleared full-length rehearsal audio, measured peak RSS/VRAM, explicit per-job CPU/GPU budgets, exact policy parity across all decoder/model paths, durable path-free resource diagnostics, and Windows/macOS buyer-performance evidence.

CI / foundation prerequisites

Exact 1756759998876ad9ac77c81b9ad6dc71daecdf1c has fresh workflows: ci 34103923858, build-baseline 34103923883, Security Scan 34103923868, SAST Semgrep 34103923872, CodeQL PR 34103923854, and sbom 34103923864. They were all queued on the first exact-head sweep and must become terminal on this same head. Predecessor GREEN does not transfer.

#1176 remains exact 8fe6b6d99c009527ef0bcba419e6f6debdb23c23, open/Draft, with repository CI/build-baseline/SBOM/Security/SAST successful and central CodeQL verdict publication failing after real shard dispatch. .github#1902 remains canonical central recovery owner at exact 4b025af481f3a4fb0bdb4d400a7e055066a496a2; it is still Draft, with a two-language exact-job wake race after valid terminal publication. Do not copy #1176's formatter delta into #866 or synthesize BandScope-local CodeQL success.

Fresh develop remains 314ddeae7b775a4957594b599358c8255617eb2e, protected, and its 14 required contexts still include retired Analyze (javascript-typescript) and Analyze (python). The branch-protection settings/documentation migration remains separate from the central verdict-publication repair.

Downstream / commercial boundaries

#970 Project Persistence and #1160 Active Player consume #866 only through ordinary protected ancestry; they must not copy mutable Resource Admission source authority. #1129 remains the commercial audio-I/O dependency blocker, #1180 owns immutable commercially admissible model-artifact Distribution/update semantics, and #1181 independently blocks upstream pretrained htdemucs commercial packaging absent explicit rights or an admissible replacement.