security: bind cloud copy receipts to private storage

[seonghobae]

Purpose

Harden the cloud-copy receipt publication boundary so immutable copy receipts are not created under Unix directories writable by group/other principals and are private from creation, without changing cloud-copy planning, human approval, source preservation, rollback, provider/filesystem authority, or receipt semantics.

Exact current state

• Exact source head: 6ed7994b413ca6bb6fe03603334e68504f5d1a1d.
• Independently resolved live protected main: be418bac9bfbdc8aa41b1a698713833e3dbccfdc.
• Fresh main -> head comparison is diverged, ahead_by = 7, behind_by = 15, with merge base 309eaaa5c6d9d7826f23f2718ea454267e2882a9.
• Semantic delta remains exactly src-tauri/src/cloud_transfer.rs plus src-tauri/tests/cloud_receipt_private_authority.rs; historical temporary/self-modifying workflow material and unrelated local-eviction work are no longer present in the current delta.
• Exact-head native workflows are green: Test 31626017882, Release 31626017871, Security Scan 31626017872, and SAST Semgrep 31626017929 all completed success.
• The only observed formal review is GHAS COMMENTED; its workflow-permission thread targets an obsolete predecessor repair workflow and is resolved/outdated. It is not approval and does not transfer semantic evidence to this head.
• The PR remains Draft and is not integration-ready while stale against protected main.

Test-first hardening currently preserved

The focused production-path regression requires group-write and other-user-write receipt directories to fail closed, preserve the source, roll back a newly copied destination, and create no receipt. Current production code:

• rejects Unix receipt directories whose mode contains 0o022 with stable receipt-directory-writable-by-others;
• creates new receipt files with Unix mode 0o400 at create_new time; and
• performs post-write permission hardening through the already-open receipt file rather than pathname set_permissions.

Cloud-copy planning, explicit approval, receipt payload/integrity, destination rollback, source preservation, and copy authority remain otherwise unchanged.

Residual directory-identity security boundary

This head does not satisfy issue #194's stronger same-user directory-replacement contract. It still authorizes a receipt directory by pathname metadata and later creates/cleans the record through a re-resolved pathname. #187 is the proving owner for descriptor/handle-relative immutable publication and must be integrated or otherwise establish the accepted primitive first. #186 must then be deliberately reconstructed/converged on the then-current protected main and adopt/prove the object-bound primitive before integration. Existing checks cannot transfer to that changed head.

Scope / dependency order

#179 owns provider-sync evidence, #181 cloud-review decisions, #182 cloud-eviction authority records, #187 the current object-bound publication primitive, #174 generic cleanup, #156 repository-wide exact coverage, and #149 canonical documentation. This line does not race those owners.

Required before merge

Keep Draft until the unique receipt hardening is deliberately converged onto current protected main; the #194 directory-identity boundary is resolved for this receipt family; unchanged exact-head native and every live required central workflow pass; every valid current-head finding is addressed; repository-wide exact 100% owned-production statement/branch/function/line coverage is satisfied without exclusions or threshold weakening; and fresh live-base ancestry remains current. Pending, queued, skipped-required, failed, stale, predecessor, status-only, model-only, diagnostic-only, or synthetic evidence is not passing.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4625d299-a235-4983-8aeb-27acc230401a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}