security: bind Homebrew execution to approved script bytes

[seonghobae]

Purpose

Bind Homebrew planning, model judgment, human approval, and execution to the exact script bytes that were verified, rather than only to pathname plus device/inode identity, while preserving the fixed command, local-model gate, exact confirmation phrase, single-use judgment, audit publication, and macOS-only runtime authority.

Root cause

A same-user actor could rewrite the approved Homebrew executable in place without changing device/inode identity. Re-planning narrowed the race but did not bind the script bytes actually sourced by Bash to the bytes approved by the plan and judgment.

The predecessor exact head 3de1191e5f4f6562e1710dd41ffc709743ce196b was 57 commits behind its moved #205 parent and inherited the same release artifact namespace failure. That release contract is owned by #264 and is now carried through #187 and #205; this PR retains only its content-binding product delta.

Exact current state — 2026-09-07

• stacked base: fix: support standard Intel Homebrew executable target #205 exact head b01fb34124f573a0c7b31f8e1a239558c16573e7
• exact current head: ce005cb8888a1cb24ec0754ae0b7f7723239a1f7
• non-force two-parent refresh commit: ce005cb8888a1cb24ec0754ae0b7f7723239a1f7
• exact base-to-head comparison: ahead 11 / behind 0, merge base b01fb34124f573a0c7b31f8e1a239558c16573e7
• semantic delta remains exactly two files: src-tauri/src/brew_cleanup.rs and src-tauri/tests/brew_cleanup_snapshot_testability_contract.rs
• local integrated verification: npm test passed 40 Vitest files / 164 tests plus 2 Node concurrency tests; git diff --cached --check passed before commit construction
• local Rust verification was not claimed because this runner has no cargo; hosted exact-head Rust evidence remains required
• fresh exact-head workflows are authoritative; predecessor successes and failures are historical only
• PR remains Draft

Test-first repair

The implementation rejects empty or over-8-MiB script objects, reads the already-open verified source into a private anonymous tempfile snapshot, hashes captured bytes with BLAKE3 while copying, fsyncs and rewinds that snapshot, revalidates opened-object and current-path identity/executable admission after capture, binds device:inode:digest into the existing opaque brew_identity, and passes only the captured snapshot descriptor to the fixed privileged Bash launcher.

The Unix regression opens an approved executable, mutates the same inode in place, proves device/inode remains unchanged, then proves the retained verified snapshot still contains only the approved bytes. The macOS runtime command remains unavailable on non-macOS platforms.

Stack / ownership

Dependency order is #264 release artifact contract → #187 durable audit authority → #205 Intel compatibility → this content-bound execution slice. The branch was refreshed with ordinary two-parent history, preserving every valid predecessor commit and canonical owner delta.

Required before merge

Keep Draft until parent dependencies are integrated or deliberately preserved; every applicable exact-head native and central workflow passes; every valid current-head finding is addressed and threads are resolved; repository-wide exact 100% owned-production coverage is satisfied without weakening; package/SBOM/provenance/release requirements are complete where applicable; and fresh dependency/base ancestry remains current. Pending, queued, absent-required, skipped-required, neutral-required, failed, stale, predecessor, synthetic, diagnostic-only, status-only, model-only, or author-only evidence is non-passing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 18 minutes and 57 seconds before sending another message.

[seonghobae]

The content-bound Homebrew execution slice is ready for review at exact head 2e7b845b7610a871ec5981d964bcab5cb99df41d; hosted Test/Release/build checks are green and GitHub reports clean. Protected independent approvals are still required; no merge bypass is used.

[devin-ai-integration]

Devin Review found 2 potential issues.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2e7b845b7610a871ec5981d964bcab5cb99df41d.

• Head SHA: 2e7b845b7610a871ec5981d964bcab5cb99df41d

• Workflow run: 32702646057

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 2e7b845b7610a871ec5981d964bcab5cb99df41d
• Workflow run: 32702646057
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 2e7b845b7610a871ec5981d964bcab5cb99df41d.

• Head SHA: 2e7b845b7610a871ec5981d964bcab5cb99df41d

• Workflow run: 32702646057

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (2 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (2 files)"]
  R1 --> V1["required checks"]

Loading

[seonghobae]

Reviewed the two remaining informational threads on exact head 2e7b845b7610a871ec5981d964bcab5cb99df41d: /dev/fd/3 is the deliberate byte-verified execution source and preserves the existing BASH_SOURCE behavior; the dev:ino:hash identity is recomputed and compared consistently across plan/dry-run/execute. No code change is warranted. Both threads are resolved; hosted checks are already green, but the stale changes-requested review state still requires a fresh qualifying approval.