fix(observability): let the sink write to the file it read

[rldyourmnd]

The defect

OpenJSONLSink opened the destination to scan the existing history, closed it, and opened it again to append. A rename between the two left the recovered duplicate-identity and size state describing the first file while every write went to the second.

The SameFile check that looked like it covered this proved the path equalled the descriptor at the second open — not that it was the file scanned.

The fix

One descriptor for the sink's lifetime: O_RDWR|O_APPEND|O_CREATE, validated, then read from and appended to. O_APPEND puts writes at the end regardless of the read offset, so validation and extension are the same object by construction. A destination whose name no longer resolves to the object just opened is refused rather than followed.

What the test does and does not do

The window lived inside OpenJSONLSink. Reaching it from outside would need a hook that exists only to be hooked — the kind of control this repository is trying to remove — so it is closed by construction and the test says so plainly rather than implying it reproduces the defect.

I wrote a behavioural test first and then found it did not discriminate: it renamed the path after the sink was open, which the old code survives too, because by then it also held a descriptor. The comment was corrected. What it now pins is that the construction cannot be silently undone.

Scope, deliberately narrowed

You confirmed untrusted commands are not a goal. The other two check-then-use surfaces — workspace resolution and executable resolution — need an actor with concurrent write access to the machine already running the Task, which the stated trust boundary excludes: manifests and commands are trusted reviewed inputs, and someone who can rewrite a PATH directory can do so with or without a race.

So they are recorded in SECURITY.md, not closed, including the consequence that executable_path records what was inspected, what an attacker would need, and the trigger that would make them real — running commands that are not fully trusted — along with the fix that would then apply. A stated gap is worth more than a control that does not remove it.

Verification

gofmt, go vet, staticcheck v0.7.0, full suite under umask 002, -race, all six contract checkers. All green. The now-dead scanJSONL wrapper is removed.