test(security): prove audit special-file open is nonblocking

[seonghobae]

Refs #252. Draft child of exact feat/agent-artifact-admission@bf5a48b8a095359b28a067e019b93b8c0e26104f.

Wardnet-local scope only: audit-evidence file persistence for Agent Artifact Admission. No quarantine execution, EgressWeave transport policy, contextual-orchestrator behavior, AppGuardrail analysis, foreign-owner source, cross-service SQL, product-gap-ledger edit, force update, self/model approval or gate weakening.

Hosted hostile RED

The first test commit required formatting repair and therefore was not accepted as RED. Test-only exact 187aabd1ada11b5a5c9bbf3c07df143d645b492d is the valid hostile reproduction: production source remained byte-identical to parent #129@bf5a48b...; CI 34448606974, rust job 102778872900, acquired real ubuntu-24.04, completed checkout/toolchain and cargo fmt --check, then executed the workspace suite. Existing tests passed through the audit-path controls. In audit_special_file_safety_contract, the helper control passed, while file_sink_rejects_fifo_without_blocking_on_open remained blocked for the bounded 3.11 s interval and failed with audit append blocked while opening a FIFO; special audit files must fail closed promptly. The child was killed/reaped, so the regression is semantic RED rather than a hung runner.

Root cause is the existing Linux single-open boundary: O_NOFOLLOW and post-open metadata().is_file() protect against final-link redirection and reject non-regular descriptors after open, but a write-only FIFO can block inside open before that type check. Linux man-pages 6.18 fifo(7) and open(2) specify that normal FIFO open waits for the other endpoint; O_NONBLOCK | O_WRONLY instead fails promptly with ENXIO when no reader exists.

Minimum causal repair

Exact successor 1e2efdc9580328709b3d3bdde3682979abf46a2a changes only the hostile fixture and crates/agent-artifact-admission/src/audit.rs. The production delta adds Linux O_NONBLOCK to the same OpenOptions custom flags that already contain O_NOFOLLOW; mode 0600, append/create behavior, the post-open regular-file check, stable AuditError::StorageUnavailable, process-local serialization, bounded encoding, flush and sync_data remain unchanged. Linux open(2) documents that O_NONBLOCK has no relevant effect on regular-file semantics, while it prevents this FIFO open from waiting indefinitely. No pre-open pathname type check or TOCTOU-prone split path was introduced.

Exact-current GREEN

On unchanged exact 1e2efdc9580328709b3d3bdde3682979abf46a2a, repository CI 34449016775 is terminal SUCCESS: rust job 102780179969 completed hosted checkout/toolchain, formatting, the full locked workspace test step, and Clippy successfully. Fuzz 34449016761 is also terminal SUCCESS. Fresh submitted-review inventory is empty and inline review-thread inventory is empty. The live base remains unchanged exact feat/agent-artifact-admission@bf5a48b8a095359b28a067e019b93b8c0e26104f, and the PR is mechanically mergeable.

This child is ready for normal integration into #129. After integration, #129 must reacquire its own exact-head repository/security/coverage/package/SBOM/provenance/review/thread evidence; child receipts do not transfer.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9b45b8d4-cf85-401d-9db9-b3e3decfed27

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}