security: fail cache-trash permanent deletion closed

[seonghobae]

Scope

Canonical cache-Trash security repair for issue #170. This line owns the fail-closed irreversible-deletion boundary plus directly required cache/provider identity contracts and operator/ADR evidence. Release/Test foundation remains owned by parent #264; canonical product/public documentation remains downstream in #315.

Current exact state — 2026-09-05 KST

• protected main: 0e90f9cebadbd7f59606baaec4ca1d2f178c899a;
• parent/base fix: verify Windows release artifact namespace #264 exact head: 3e33229b4157a084a1985a1c7e952f98a64f25e3;
• exact security: fail cache-trash permanent deletion closed #263 head: d9b7fcf83bc0799fc9d53d0b739d87dfa42a54b6;
• security: fail cache-trash permanent deletion closed #263 was advanced non-force with predecessor security: fail cache-trash permanent deletion closed #263 as first parent and exact current fix: verify Windows release artifact namespace #264 as second parent. The new fix: verify Windows release artifact namespace #264 delta was inspected before adoption and consists only of scripts/ci/workflow-concurrency-contract.test.mjs and src/lib/releaseSbomPublicationContract.test.ts contract-test repairs; no cache-security production owner blob was overwritten;
• net semantic delta remains exactly 13 cache-cleanup/security files. Release/Test source is inherited rather than reimplemented;
• open, Draft, mechanically mergeable. Fresh exact-head gates are required; predecessor checks do not transfer.

Security behavior

• --purge-proven-cache-trash remains read-only review evidence.
• --execute --purge-proven-cache-trash fails closed with cache-trash-identity-bound-permanent-delete-unavailable before journal or filesystem mutation.
• duplicate singleton authority options fail closed instead of using last-one-wins semantics.
• the library-side irreversible boundary refuses deletion rather than calling pathname-recursive removal.
• browser/profile/provider aliases are not promoted into proven cache-Trash deletion authority.
• untrusted option payloads are not reflected into terminal/automation diagnostics.

ADR-0002 is superseded by Proposed ADR-0012 only for permanent cache-Trash deletion. Reversible per-item cleanup remains historical design context. A future irreversible implementation requires full descendant identity, approval freshness, stable object/directory-bound mutation authority, replacement-race proof, durable pending/terminal recovery without repeated deletion, strict candidate scope, and platform-specific evidence.

Fresh review of historical #303 found a separate provider-cache PermanentPurge path that still stages via pathname fs::rename before irreversible removal. That older line is not an exception to this safety contract and remains Draft pending owner repair; it must not be merged around #263.

Required before merge

#264 exact-head Release 33937972244 is terminal success, while Test 33937972239, Security Scan 33937972188, SAST 33937972193, and CodeQL 33937972182 remain queued. Keep Draft until #264 is integrated or equivalently present on protected lineage and one unchanged #263 exact head satisfies every applicable native/central Test/Release/Security/SAST/coverage/package/SBOM/provenance/review/ruleset gate with zero valid current findings. Pending, queued, skipped-required, failed, stale, predecessor, synthetic, status-only, model-only, or infrastructure-only evidence is non-passing. No self-approval, force-push, destructive rebase, gate weakening, or predecessor-evidence transfer.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b34e8ca3-7079-4eda-80b8-6cbe89a7f1b9

📥 Commits

Reviewing files that changed from the base of the PR and between 09e1fd7 and a40429e.

📒 Files selected for processing (5)

• .github/scripts/verify-release-artifacts.sh
• .github/workflows/release.yml
• src-tauri/src/cache_cleanup.rs
• src-tauri/src/commands.rs
• src-tauri/tests/cache_cleanup_cli_purge_fail_closed.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

캐시 Trash 영구 삭제 경로를 제거하고 읽기 전용 증거 수집과 fail-closed 오류 반환으로 전환했습니다. 비 macOS Unix에서는 유효한 XDG_DATA_HOME을 사용합니다. 릴리스 workflow에는 플랫폼별 아티팩트 검증 단계가 추가되었습니다.

Changes

캐시 Trash fail-closed 전환

Layer / File(s)	Summary
캐시 Trash 증거 수집과 purge 차단 src-tauri/src/cache_cleanup.rs	CacheTrashSnapshot을 읽기 전용 증거로 유지합니다. 브라우저 Default 프로필을 제외합니다. 비 macOS Unix의 Trash 경로에 XDG_DATA_HOME을 적용합니다. 승인된 purge도 전용 영구 삭제 불가 오류를 반환하며 파일과 저널을 변경하지 않습니다.
CLI 읽기 전용 출력과 오류 계약 src-tauri/src/bin/disksage-cache-cleanup.rs, src-tauri/tests/cache_cleanup_cli_purge_fail_closed.rs	CLI가 proven_cache_trash_snapshot과 후보 목록을 출력합니다. --execute --purge-proven-cache-trash는 종료 코드 2와 전용 오류를 반환합니다. XDG Trash 선택과 파일·저널 보존을 검증합니다.
계측 빌드 계약 유지 src-tauri/src/commands.rs, src-tauri/tests/cache_cleanup_coverage_runtime_contract.rs	coverage 구성에서 AppHandle, journal_file_path, 캐시 정리 핸들러를 사용할 수 있도록 조건부 선언을 조정합니다.

릴리스 아티팩트 검증

Layer / File(s)	Summary
플랫폼별 릴리스 아티팩트 검증 .github/scripts/verify-release-artifacts.sh, .github/workflows/release.yml	검증 스크립트가 플랫폼별 디렉터리에서 번들, CLI 파일 및 SHA-256 파일을 정확히 하나씩 확인합니다. Windows 디렉터리 기준을 windows-2022로 변경합니다. attest-release가 검증 스크립트를 실행합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: 🟡 Moderate · up to a4042

The change makes permanent cache-Trash deletion fail closed and avoids treating browser profile roots as disposable cache, preventing unintended filesystem mutation. The current head is not merge-ready because required validation checks are still queued or pending and must reach terminal success before merge progression.

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant CacheCleanup
  participant FileSystem
  CLI->>CacheCleanup: 읽기 전용 purge 조회 요청
  CacheCleanup->>FileSystem: XDG Trash 또는 기본 Trash에서 후보 수집
  FileSystem-->>CacheCleanup: 후보 목록과 스냅샷 반환
  CacheCleanup-->>CLI: proven_cache_trash_snapshot과 proven_cache_trash 출력
  CLI->>CacheCleanup: 실행 purge 요청
  CacheCleanup-->>CLI: cache-trash-identity-bound-permanent-delete-unavailable 오류 반환

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 62.90% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 62 functions across 34 files. (1 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 캐시 Trash 영구 삭제를 fail-closed로 차단하는 핵심 변경을 정확히 나타냅니다. 표현은 다소 비문이지만 주요 변경을 이해할 수 있습니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 62.90% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 62 functions across 34 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/physical-cache-reclaim-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Fresh stack repair: canonical parent #264 is now 76e2d59f5c3cc7750bca574b40855c59bd3a240e, which added only the two inherited release binary-isolation contract tests relative to this PR's prior base. #263 was advanced without force to 96c38af83b5fba6f23e2763ae7bf6a71bfe7f5d6 using a two-parent merge that preserves the exact cache-safety tree and inherits those parent contracts. Fresh compare 76e2d59... -> 96c38af... is ahead-only with behind_by=0 and merge base exactly 76e2d59.... Predecessor checks do not transfer; keep Draft until new exact-head evidence is terminal-valid.