fix(security): bind admission config reads to regular files

[seonghobae]

Closes #254 only after this child is ordinarily integrated into #129 and its valid delta/evidence is retained.

Scope

Wardnet-owned Agent Artifact Admission local configuration and credential bootstrap only. This child does not fetch/install/execute artifacts, authorize egress, own effective runtime environment/config, or copy quarantine/EgressWeave/contextual-orchestrator/AppGuardrail behavior.

Base is exact feat/agent-artifact-admission@c4030f7fecaa5627ccec31ce58eca7e59db45334.

Hosted RED

Test-only exact dcfa3ace0b5d83bbc4fd5f5d76fbf22008a6c6e4 added hostile final-symlink cases for both protected credentials and reviewed policy configuration. CI 34453151722, rust job 102793305406, acquired a real ubuntu-24.04 runner and checked out merge candidate 909929f5b1debbfd4b6ba23f0839cc21f53d359a. cargo test --locked --workspace reached local_file_authority_contract.rs; both hostile cases failed exactly because the current File::open(path) readers followed final symlinks and accepted the safe-permission targets. The remaining pre-existing workspace tests shown before that suite were green. This is the retained semantic RED witness.

Causal repair candidate

Current exact head is df64d5f87588ba094793d5f52569b191673b9dc1. The production reader now uses one Linux read-only O_NOFOLLOW | O_NONBLOCK open for each security-sensitive local authority input, validates regular-file type plus the existing policy/credential permission invariant on that same descriptor, and only then materializes bounded bytes. Non-Linux targets fail closed until an equivalent native contract exists, matching the existing file-backed audit-sink platform boundary.

A bounded Linux FIFO child-process acceptance test now proves both readers reject a no-writer FIFO promptly rather than hanging before type validation. No pathname pre-check plus second-open TOCTOU workaround was introduced. docs/doctoring/agent-artifact-admission-configuration-integrity.md records the descriptor-bound authority model, residual scope and references.

Traceability: POSIX.1-2024 open/openat specifies final-link rejection under O_NOFOLLOW and nonblocking read-only FIFO open behavior under O_NONBLOCK; MITRE CWE-59 covers improper link resolution before file access; existing permission controls remain mapped to CWE-732 and NIST SP 800-53 Rev. 5 CM-5/AC-6.

Current-head CI 34453941622 and Fuzz 34453941689 are pending/queued. Keep Draft until exact df64d5... is terminal GREEN, review threads are clean, and the complete child delta is ordinarily integrated into #129 without force update or gate weakening. Predecessor RED is diagnostic evidence only and is not promoted as current-head GREEN.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 1cb3197c-a9cf-4ac9-bf2b-8decfd496f2e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}