feat(security): gate AI-agent artifact installation

[seonghobae]

Closes #128 only when the complete Agent Artifact Admission lineage reaches protected main; child merges into this feature branch do not close protected-main work.

Boundary

wardnet-agent-artifact-admission is Wardnet's Rust-first pre-execution policy/evidence boundary for structured installer intents. It does not fetch, decrypt, install, execute, isolate, activate, route, authorize outbound transport, resolve project dependency groups, or own runtime credential/environment discovery. quarantine-sandbox-runtime owns hostile execution/isolation and effective workspace/filesystem/interpreter lifecycle; contextual-orchestrator owns Agent/LLM orchestration; EgressWeave owns executable outbound transport authorization; AppGuardrail owns static package/security analysis; Noema owns governed activation; Keyverse remains credential/identity backend. Wardnet consumes foreign capabilities only through released/versioned ports or ACLs and does not copy sibling source, query foreign application tables, or pin mutable sibling heads.

Policy remains deny-by-default and binds reviewed workspace-manifest SHA-256 plus exact artifact ecosystem/name/version/HTTPS registry/owner/SHA-256, executable family, declared operands, and bounded provenance. An allow receipt is admission authority only; it is not proof of retrieved bytes, effective runtime environment, transport enforcement, installation, isolation, or activation.

Current exact candidate — 2026-09-13 KST

Protected/default main remains exact f8260f1e03836039ff9463dd99fa982e4e270c4b. Current #129 branch head is exact e3bd77284db673e336791e9e21ea28ab8a3e89c6, produced by ordinary expected-head integration of serialized child #396 into predecessor exact 30e81ad13e49a0dc6d0e3c53affa60c51471f9bb. No force update, destructive rebase, self/model approval, gate weakening, mutable foreign dependency, or routine bypass was used. This PR remains Draft while protected integration evidence and central required-gate settlement are incomplete.

The lineage preserves deny-by-default structured-argv admission; reviewed workspace-manifest SHA-256; exact artifact ecosystem/name/version/HTTPS registry/owner/SHA-256 binding; package-manager source, destination, trust, configuration, lifecycle, mutation, dependency/build/platform/cardinality controls; audit-before-allow; bounded remote-instruction provenance; exact submitted-argv identity; and parser-phase separation between package-manager-owned authority and delegated child argv.

Latest causal slice — uv global-option bytecode authority (#395 → #396)

Fresh review of predecessor exact 30e81ad13e49a0dc6d0e3c53affa60c51471f9bb found a Wardnet-owned evidence-integrity defect: uv_bytecode_compilation_authority recognized exact --compile-bytecode / --compile for uv pip install only at fixed argv positions. Astral's documented uv [OPTIONS] <COMMAND> grammar permits reviewed global options before the active command, so uv --color never pip install ... --compile-bytecode stayed fail-closed as ForbiddenCommand but lost the separate causal ArtifactNotApproved evidence for caller-selected generated bytecode materialization.

Test-only exact 6c24a3d9d4e2f554649346fcb06222e01ff380e9 kept production source byte-identical and established semantic RED in hosted CI 34734372758, rust job 103662996596: the global-option install case omitted ArtifactNotApproved, while near-spelling/non-install controls did not fabricate bytecode authority. The minimum repair reused the existing uv_active_command_index parser, required exact active pip followed by exact install, scanned only that install argument slice for exact compile selectors, and preserved the existing uv run delegated-child boundary through uv_run_owned_argument_end. supported_install_command was not widened.

Final child exact f6e407f3d61bf2f1d0babf1b9aef8e0f9a327403 was exactly 3 commits ahead / 0 behind its unchanged parent, with that parent as merge base. CI 34734790945 / rust 103664147833 and Fuzz 34734790991 / fuzz 103664147382 were SUCCESS; CodeRabbit and Devin statuses were SUCCESS; submitted reviews and unresolved threads were 0. It merged normally with fixed expected head as e3bd77284db673e336791e9e21ea28ab8a3e89c6. Issue #395 remains open until the effective repair reaches protected main or a verified complete successor.

Wardnet still does not execute uv/pip, compile bytecode, read ambient package-manager configuration/certificate stores, discover interpreters, resolve/fetch packages, inspect or mutate runtime/filesystem state, or perform DNS/TLS/network I/O.

Exact-current evidence

On unchanged exact e3bd77284db673e336791e9e21ea28ab8a3e89c6:

• CI 34737248139 — SUCCESS;
• Fuzz 34737248183 — SUCCESS;
• Security Scan 34737248205 — SUCCESS;
• SAST Semgrep 34737248165 — SUCCESS;
• Devin Review and CodeRabbit commit statuses — SUCCESS;
• current valid unresolved inline review threads — 0;
• submitted reviews remain non-approving records; independent approving review — none;
• required CodeQL PR 34737248162 — FAILURE at the delegated central terminal-settlement boundary. Detect job 103670729682 succeeded. Compatibility job 103670906653 successfully read the current-head dispatch verdict and then failed only at Release runner or enforce current-head CodeQL verdict at 04:19:47Z. Downstream Dispatch current-head CodeQL scan job 103671708226 did not start until 04:21:02Z and then completed SUCCESS at 04:21:09Z on the same unchanged head, too late to repair the already-terminal required workflow.

Exact current consumer evidence and RED→GREEN acceptance are on central .github#1929 comment 5651110280. This is central owner work, not authorization for Wardnet source churn or a routine bypass. Runner/materialization/OpenCode remains .github#712 / .github#1234 or verified successors; solo-maintainer generic approval remains .github#772. Wardnet does not copy those central workflows, synthesize statuses, promote predecessor GREEN, or bypass ordinary queued/failed gates.

Documentation / architecture alignment

Fresh live guidance remains aligned with this bounded context. AGENTS.md and CLAUDE.md keep Wardnet Rust-first and central-workflow ownership. PR #361 is the canonical PRD/TRD/UML writer; PR #111 remains the accepted-ADR consolidation lane; PR #130 remains the sole writer for docs/product-technical-gap-baseline.md. This Agent Artifact Admission PR does not compete with those writers.

Context / release boundary

Fresh read-only owner truth remains context-graph-contracts protected/default develop@99cb5468ba3c15c5e79688f53dee74724fae2d13 and enterprise-architecture-core protected/default develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece; both release inventories are empty. Wardnet writes neither repository while the Context Fabric writer owns them and consumes only released compatible contracts/provenance. Current release inventories for contextual-orchestrator, EgressWeave, quarantine-sandbox-runtime, AppGuardrail, and Wardnet are also empty, so mutable sibling heads are development evidence only and not production dependencies.

Wardnet has no immutable protected release. Release readiness remains false until one protected exact head binds version/CHANGELOG/tag/package or image identity, SBOM/provenance/signature, reproducibility, deployment promotion, rollback/roll-forward and recovery evidence. Stale, predecessor, queued, skipped, cancelled, synthetic, or model-only evidence is non-passing.

Keep #129 Draft. Protected promotion requires one unchanged exact head with terminal-valid repository/security/coverage/package/SBOM/provenance/review/thread evidence, fresh protected-base compatibility, any actually required released foreign contracts, and satisfiable live governance. Admission issues remain open until their effective deltas reach protected main or a verified complete successor carries every valid code/test/fixture/contract/evidence delta.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Live exact-head override — 2026-09-03

A concurrent non-force writer advanced this Draft after the body snapshot. Current GitHub head is 43837309a042a4016b5497bcda25d8e80193f0ef, not 86abdb91e43d154e1e194780c58b29a63bfb0c82. Fresh comparison proves a one-commit linear advance (ahead_by=1, behind_by=0) whose only delta is crates/agent-artifact-admission/tests/bun_scope_escape_contract.rs: test(admission): keep Bun argv construction explicit replaces the two map(str::to_string) expressions with explicit closures. The intervening delta is adopted; no restack/force update is warranted.

All predecessor check evidence is historical after that move. Exact-current-head workflow state is non-passing: CI 33663428878 queued; Fuzz 33663429017 pending; Security Scan 33663429034 queued; SAST Semgrep 33663429149 pending; OSV 33663429986 queued; Scorecard 33663428806 queued; CodeQL PR 33663431222 completed startup_failure. The current review-thread inventory contains only one historical/outdated Scorecard thread and it is resolved; there is no current unresolved review finding in the returned thread set.

Keep Draft and do not churn the clean source merely to retrigger. .github#712 remains the causal owner for pre-checkout acquisition/startup-failure evidence and .github#1644/#772 for the live solo-maintainer ruleset defect. No predecessor evidence, self/model approval, routine bypass or gate weakening applies.

[seonghobae]

Exact-current-head update — 2026-09-04

Current head is 3a63247e412d17b7bbee2a1d1668dfc84adf1280 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; keep Draft. This lineage adds one bounded OCI artifact-identity repair without taking over registry transport or quarantine execution:

• RED d7f429c37a3bd26ea746254defc5d65f33ef71f2: Docker and Podman pull with an otherwise approved digest plus -a / --all-tags must block rather than widen one approved artifact into the repository's mutable tag set.
• Causal GREEN 7f06137453dc2296e4c4ac8c439777bf19ba7244: the existing artifact-variant predicate now rejects repository-wide pull expansion and preserves the public artifact_not_approved reason domain.
• Doctoring 37751afc97dd318ae1dd2be48faf54e60069163a -> 3a63247e412d17b7bbee2a1d1668dfc84adf1280 records the exact-set invariant and current Docker/Podman primary command semantics. Wardnet still does not fetch images, validate downloaded bytes, or own runtime isolation.

Fresh exact-head execution is not GREEN. CI 33825032608, Fuzz 33825032507, Security Scan 33825032518, SAST Semgrep 33825032753, Scorecard PR 33825032564, and OSV-Scanner PR 33825033384 are queued. CI job 100875751793 targets exact 3a63247e... with runner_id=0, empty runner/group identity and steps=[]; the specimen is handed to central .github#712. Predecessor workflow evidence does not transfer and no leaf no-op retrigger or bypass is justified.

[seonghobae]

Fresh security-review continuation on current lineage (2026-09-04): Docker's CLI Boolean option grammar permits explicit assignment forms, and Podman pull exposes the same repository-wide all-tags Boolean capability. The prior exact-token guard therefore left a realistic semantic bypass: docker|podman pull --all-tags=true <approved@sha256:...> (and short assigned forms) could retain admission while widening one reviewed digest into the repository's mutable tag set.

RED 883d1d37e05b0ccd9d30b2c1b25fd7d53c6fc8d8 adds assigned-true hostile cases. Causal source fix e9e07e696c013dab88df6a5a6dc1be8306b9b688 recognizes true Boolean assignments in the existing artifact-variant boundary and keeps the public reason domain artifact_not_approved. Coverage 2207a6f79522dc8b6cb95e817be648bb6ef9a7f3 exercises Docker/Podman long/short true spellings plus explicit-false non-regression. Doctoring/primary-reference traceability is current at exact head 6dfd777e1e9ce8b42c87c3311911a35f64f97190.

Fresh exact-head hosted evidence is non-passing, not failed source evidence: CI 33848015533, SAST 33848015479, Security Scan 33848015485, and Fuzz 33848015550 are queued; CI job 100944222630 is pre-checkout. Central runner owner .github#712 has the exact specimen in comment 5537096153. No rerun storm, predecessor evidence transfer, self-approval, or bypass is valid here.

Context Fabric/EA handoffs were refreshed on context-graph-contracts#27 and enterprise-architecture-core#45 without mutating either owner repository's source/PR state. They continue to require Wardnet security-artifact admission to remain distinct from Noema governed activation/orchestration and to consume only released provider-neutral evidence contracts.

[seonghobae]

@jules Exact-head repair request for feat/agent-artifact-admission only.

Expected head: f6889079ce49b6f08865180dd6a1ffd8145a8192; protected base observed: main@5829a0f08d78de464dd24393ce5d0f25fba9d126.

CI 33904242427, job 101230630469, reached checkout and failed deterministically at cargo fmt --check under Rust/rustfmt 1.98.1. This is a mechanical formatting defect, not a runner wait. Please re-read the branch head before writing; if it is no longer the expected SHA, do not overwrite intervening work. On the unchanged head, run repository cargo fmt with the effective toolchain and commit only the resulting rustfmt changes on the existing PR branch. Do not change semantics, dependencies, workflows, PR base/state, gates, or history; no force push/rebase. Then run cargo fmt --check locally if available and leave remote CI/security evidence to the new exact head. The PR must remain Draft until exact-head deterministic/security gates are terminal and valid review threads are clear.

[seonghobae]

Wardnet writer coordination, 2026-09-10: the test-only d8430278eae6c2a70f09540a58af1ffa70927542 is retained. I fetched CI 34424781388 / job 102707573166 logs: hosted compute did acquire at 01:36:15Z, checked out e5cebde78c61b3a09b340239af3bd036d0dc2c0a (merge d843 into a52), and failed only rustfmt at the two reason_codes.contains chains. The assertion suite was skipped, so this is not the required semantic RED.

The intervening 61ce5d9f3d67ddf0b9dbf8bfc7234a6034cc4f0b was inspected and adopted: exactly +6/-2 formatting lines in the new test, no production change, ordinary descendant preserving all prior work. I will not duplicate that repair or rerun its superseded failing head. Fresh CI 34426475175 is the appropriate next assertion attempt. Fuzz 34424781399 succeeded on d843 but does not execute this integration regression.

Production scope remains the existing policy.rs::requests_alternate_trust_root classifier after observed assertion RED, with unchanged positive admission and stable AlternateTrustRoot deduplication. Please preserve this single lane; any concurrent repair should continue from the fresh head and attach the actual failing assertion plus successor verification rather than create another PR or force-update. The issue's queued d843 snapshot is historical after the formatting successor. No merge, release, transport enforcement, installation or current-head GREEN is claimed.