fix(agent-admission): reject unsafe uv index strategies

[seonghobae]

Child of #129 for #399, serialized from exact parent 38844f847e97c76cbe549f0b6cda0a4f05e28f44.

Hosted semantic RED

Initial test-only exact head 53a9c437a3c81621167216924d67891e5d7f13c9 kept production source byte-identical to the parent. CI run 34743380738, rust job 103686767497, failed only in the new uv index-strategy contract after the pre-existing workspace tests passed. The causal failures were:

• --index-strategy=unsafe-best-match returned Allow instead of Block;
• separate --index-strategy unsafe-best-match blocked only as ArtifactNotApproved and omitted AlternateTrustRoot;
• unsafe-first-match likewise lacked the required trust-boundary classification.

Controls stayed GREEN: the default strategy and explicit first-index remained admissible; near-spelling and delegated uv run child argv did not fabricate uv trust authority.

Fresh review of the first repair then found a second parser-phase evidence defect. The repair's private fixed-position uv pip install matcher duplicated older grammar and did not adopt the parent lineage's shared uv_active_command_index parser. Astral permits reviewed top-level uv options before the active command, so uv --color never pip install ... --index-strategy=unsafe-best-match remained fail-closed as ForbiddenCommand but lost its separate causal AlternateTrustRoot evidence.

Second test-only exact 98b8043378a8de7d08a030db8c783674564403e6 kept production source unchanged from the preceding repair. Hosted CI 34744340082, rust job 103689338735, reached the new hostile contract after formatting and failed exactly because the global-option case returned [ForbiddenCommand] without AlternateTrustRoot. Seven sibling index-strategy controls passed.

Minimum causal repair

Final exact head 3b0e82e7d0c812ab8fb192e9cdc600cbff753752 keeps the normalizer bounded to the already-supported direct uv pip install grammar, but makes causal unsafe-strategy attribution reuse policy::uv_active_command_index. It requires exact active pip followed by exact install and inspects only that install argument slice. This preserves evidence through reviewed top-level uv options without widening supported_install_command, while uv run delegated child argv and non-install commands remain outside this authority.

The Wardnet-owned uv_index_strategy_authority recognizes only Astral's documented first-index, unsafe-first-match, and unsafe-best-match values; normalizes documented separate-value grammar so the value is not misclassified as a package operand; and classifies only the two unsafe-* strategies as AlternateTrustRoot. It does not inspect ambient uv config/environment, resolve/fetch packages, perform DNS/TLS/network I/O, or copy runtime/egress/static-analysis owner behavior.

docs/doctoring/uv-index-strategy-authority.md records the parser-phase boundary and Astral references retrieved 2026-09-13.

Exact-head GREEN

On unchanged exact 3b0e82e7d0c812ab8fb192e9cdc600cbff753752:

• CI 34744514640 — SUCCESS;
• Fuzz 34744514655 — SUCCESS;
• submitted reviews — 0;
• unresolved inline review threads — 0.

Fresh parent remains exact 38844f847e97c76cbe549f0b6cda0a4f05e28f44, so no restack is required before normal expected-head integration.

Authoritative vendor basis:

• https://docs.astral.sh/uv/pip/compatibility/#package-priority
• https://docs.astral.sh/uv/reference/settings/#index-strategy
• https://docs.astral.sh/uv/reference/cli/#uv-pip-install

No force update, destructive rebase, self/model approval, gate weakening, mutable foreign dependency, or bypass.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: b7c84911-5502-453a-9e91-525de36a5079

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}