Reject shared-writable directories for atomic JSON publication #487

Classification

• Category: correctness / filesystem integrity
• Micro-category: temporary-name swap before publication
• Severity: P2

Source

• Pull request: Persist lifecycle JSON atomically #477
• Review comment:
  Persist lifecycle JSON atomically #477 (comment)
• Affected SHA: 84ddd0d11fd5a39d56d84b50ed24c56b9b9961ad

Expected

Successful atomic_write_json publication must install the inode populated by
this writer, not a different regular file that reused its temporary basename.

Observed

The temp inode is validated before writing, but os.replace resolves the
basename later. In a group/world-writable destination directory, another OS
principal can replace that entry after flush and cause unrelated bytes to be
published as lifecycle evidence.

Acceptance

• Define the same-OS-principal directory ownership boundary explicitly.
• Reject destination directories writable by group or other principals before
  creating a temporary file.
• Preserve support for owner-private/owner-written run directories on macOS and
  Linux.
• Add a deterministic rejection regression with no destination mutation.

Primary sources

• os.fstat:
  https://docs.python.org/3/library/os.html#os.fstat
• stat mode bits:
  https://docs.python.org/3/library/stat.html
• os.replace:
  https://docs.python.org/3/library/os.html#os.replace