fix(security): enforce admission credential file permissions

[seonghobae]

Refs #246. Stacked Draft on feat/agent-artifact-admission; do not merge before #129's current security lineage is stable/integrated.

Boundary

This change belongs to Wardnet's Agent Artifact Admission credential-loading boundary. It does not introduce identity brokerage, secret distribution, hostile execution/isolation, outbound transport policy, LLM orchestration, or static package analysis; Keyverse, quarantine-sandbox-runtime, EgressWeave, contextual-orchestrator and AppGuardrail remain canonical owners for those capabilities.

Hosted semantic RED

Test-only head d9126dba9fad4332eec16cb441d3fb7a569452b4 made the documented local credential-file access boundary executable. On Unix, owner-only 0600/0400 are positive controls; representative group/other read/write/execute modes must fail closed.

CI 34434716330, rust job 102737284371, acquired a real GitHub-hosted Ubuntu 24.04 runner, completed checkout/toolchain/rustfmt and passed the existing workspace suite until crates/agent-artifact-admission/tests/cli_contract.rs. credential_loader_rejects_group_or_other_permissions then failed exactly at mode 0640: load_admin_token accepted credential authority exposed outside the owner boundary. This is the semantic RED; it is not a runner, formatter or unrelated-test failure.

Minimum causal repair

Exact source successor 2efe188cd94b77d039c749368cfeee977dbb51e4 changes only the local credential reader. It opens the credential path once, checks access metadata on that same open file handle before materializing secret bytes, and on Unix rejects any group/other permission bit (mode & 0o077 != 0) with the existing non-secret InvalidCredential error. The ordinary non-secret configuration reader remains unchanged. This avoids a check-then-open path race and does not broaden the change into symlink/ownership policy without a separate hostile finding.

A platform without this POSIX permission predicate fails the local-file credential boundary closed rather than pretending Unix mode bits provide Windows ACL parity. A native ACL contract can replace that conservative boundary when separately specified and tested.

Fresh exact-head CI 34436046500 and Fuzz 34436046509 are current non-terminal evidence; predecessor receipts do not transfer.

Traceability: MITRE CWE-732 and NIST SP 800-53 Rev. 5 AC-6/AC-6(1), as recorded in #246. Keep Draft and stacked. No self/model approval, routine bypass, force update, mutable dependency, or foreign-owner source copy may be promoted as release authority.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 5c2208a7-acb6-43fe-93d7-7d92a33706d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}