security: create cloud review decisions private atomically

[seonghobae]

Purpose

Close a crash/race window in the durable cloud-review authority file writer. Protected main already rejects shared-writable review directories, but write_immutable_decision created the decision file with process-default mode and only later re-resolved the pathname to make it read-only. A crash before that chmod could leave a broader authority file, and a pathname replacement between create and chmod could make the hardening act on a different object.

Test-first repair

• RED 1436fc87e2e27fbc866279db5fe7ee3eb9972bdf adds the Unix regression contract requiring owner-read-only mode at file creation, post-write permission hardening through the already-opened File, and no path-based chmod.
• Fix c0557537922a429cf3dec5fe68cf8b13c599f60e builds OpenOptions explicitly, applies Unix OpenOptionsExt::mode(0o400) before open, and uses file.set_permissions(...) after the fsynced write instead of std::fs::set_permissions(&path, ...).
• Follow-up runtime coverage on the current branch exercises the real immutable-decision publication boundary without broadening cloud-review authority.

Exact current state

• Exact head: b645b5af8a3ae113bc4710ae1f2227023f43a581.
• Independently resolved protected main: be418bac9bfbdc8aa41b1a698713833e3dbccfdc.
• PR is open, Draft, and GitHub reports it mergeable. Draft/mergeable is not merge authorization.
• Current semantic delta is exactly:
  • src-tauri/src/cloud_review.rs;
  • src-tauri/tests/cloud_review_atomic_private_create.rs;
  • src-tauri/tests/cloud_review_atomic_private_runtime.rs.
• Exact-head Test 31584801544, Release 31584801573, Security Scan 31584801584, and SAST Semgrep 31584801525 all completed successfully.
• There are currently no inline review threads. No qualifying independent approval is claimed.

Scope / ownership

This does not broaden cloud-review authority or mutation behavior. It only makes the existing append-only decision publication fail safer under crash/path-replacement conditions. Provider evidence and other provider/cloud production surfaces remain owned by their existing canonical lanes; this PR does not duplicate them. Repository-wide exact production coverage remains owned by #156.

Required before merge

Keep Draft until the unchanged exact head satisfies every live repository and organization gate together: all applicable exact-head native/central workflows, every still-valid current-head finding, repository-wide exact non-vacuous 100% owned-production region/statement-equivalent, branch, function, and line coverage without exclusions or threshold weakening, fresh protected-main ancestry, and qualifying independent approval where the live ruleset requires it. Pending, queued, skipped-required, failed, stale, predecessor, synthetic, diagnostic-only, status-only, model-only, author-only, no-source-scanner, or infrastructure-only evidence is non-passing.

[coderabbitai]

Warning

Review limit reached

Next included review available in 59 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ec42aeef-584d-457f-914a-b8143f93b35e

📥 Commits

Reviewing files that changed from the base of the PR and between 198fea8 and 94117f6.

📒 Files selected for processing (3)

• src-tauri/src/cloud_review.rs
• src-tauri/tests/cloud_review_atomic_private_create.rs
• src-tauri/tests/cloud_review_atomic_private_runtime.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head ea192535bd467dc1a0121ca2886fcdecd04da502.

• Head SHA: ea192535bd467dc1a0121ca2886fcdecd04da502

• Workflow run: 31576614667

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: b645b5af8a3ae113bc4710ae1f2227023f43a581
• Workflow run: 31928510828
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head b645b5af8a3ae113bc4710ae1f2227023f43a581.

• Head SHA: b645b5af8a3ae113bc4710ae1f2227023f43a581

• Workflow run: 31928510828

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

@coderabbitai review

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 6 minutes and 29 seconds before sending another message.

This review is anchored to predecessor SHA ea19253. Current unchanged head b645b5a has replacement same-head coverage-evidence and OpenCode checks completing successfully. This dismissal is not an approval and does not remove current quality, coverage, release/provenance, or merge gates.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head b645b5af8a3ae113bc4710ae1f2227023f43a581.

• Head SHA: b645b5af8a3ae113bc4710ae1f2227023f43a581

• Workflow run: 31928510828

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (3 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (3 files)"]
  R1 --> V1["required checks"]

Loading

Dismissing: this REQUEST_CHANGES referenced workflow run 31928510828 where coverage-evidence failed at the same head SHA. coverage-evidence has since been re-run and now reports pass (verified via gh pr checks). No unresolved review threads remain. Re-request review to re-validate.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.