[Security] Gate AI-agent package installs from untrusted llms.txt and web instructions

Threat and owned outcome

AI coding agents can turn untrusted llms.txt, README fragments, issue/PR comments, retrieved documents or tool output into package-install/execution requests. Wardnet owns the Rust-first Agent Artifact Admission policy and security-evidence boundary before installation or execution. Source text never establishes artifact identity, registry trust, install/materialization authority, network authority or execution authority.

Wardnet owns structured admission policy/evidence only. quarantine-sandbox-runtime owns hostile execution, effective interpreter/runtime environment, filesystem/session isolation and cleanup; contextual-orchestrator owns Agent/LLM/tool orchestration; EgressWeave owns executable outbound transport authorization; AppGuardrail owns static package/security analysis; Noema owns governed activation; Keyverse remains credential/identity backend. Wardnet consumes foreign capabilities only through released/versioned ports or ACLs and does not copy sibling source, query sibling application state or pin mutable sibling heads as production authority.

Protected/default Wardnet truth remains main@f8260f1e03836039ff9463dd99fa982e4e270c4b. Wardnet still has no immutable GitHub Release.

Current canonical candidate

PR #129 remains the sole canonical Draft integration candidate at exact 9efc804006057f099190d8ffcaa7096c955abe0d, based exactly on protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b and mechanically mergeable. This head was produced by ordinary expected-head integration of serialized child #439. No force update, destructive rebase, self/model approval, gate weakening or bypass was used.

The candidate preserves deny-by-default structured-argv admission; reviewed workspace-manifest SHA-256; exact artifact ecosystem/name/version/HTTPS registry/owner/SHA-256 binding; package-manager source, destination, trust, configuration, lifecycle, mutation, dependency/build/platform/cardinality controls; audit-before-allow; bounded remote-instruction provenance; exact submitted-argv identity; and parser-phase attribution that stops foreign/delegated child argv from fabricating package-manager authority.

An allow receipt is admission authority only. It is not proof of retrieved-byte integrity, effective runtime configuration, transport enforcement, installation, isolation or activation.

On the unchanged canonical root, repository-owned CI, Fuzz, SAST and Security evidence is terminal SUCCESS. Required CodeQL remains terminal FAILURE only at the delegated current-head settlement boundary owned by central .github#1929: exact-head checkout/classification and current-head verdict read succeeded, and the required compatibility job failed at the central release/enforcement step; a later dispatch cannot retroactively replace that already-failed required workflow. This is not a Wardnet source/test/SARIF RED and does not justify source/no-op churn, copied central workflow logic or routine bypass.

PR #129 is the canonical exact-head implementation/evidence lane and #130 is the sole detailed cross-lane current-state ledger. This issue intentionally does not duplicate per-run workflow IDs/review/thread snapshots; integration decisions must re-read the live PR and ledger.

Latest integrated serialized repairs

#270 / #431 — pip General Options log-output authority

Parser-valid pre-command --log, --log-file, and --local-log previously failed closed generically but lost causal alternate_install_root evidence and could let the consumed log path contaminate artifact evidence. Test-only exact ea5e4994d7bee013178c04c7b9d6bfb0a0d3f9f6 established semantic RED. Minimum repair exact eedaa3fb46e89ce740c28269654235ba99c51912 reused the existing direct-pip General Options normalization seam. Exact repair CI 35046405436 and Fuzz 35046405418 completed SUCCESS; #431 then normally merged into #129 as 71451ce3a70d4b64b380dd0566c03c0a37465d65.

#432 / #433 — pip `--cache-dir` causal evidence

Test-only exact f6adbc349353de80c55411ba08ae9ca977467073 established hosted semantic RED for parser-valid pip/pip3 pre-command --cache-dir: the request remained blocked but lacked causal alternate_install_root, and the consumed cache path could contaminate artifact evidence.

Repair exact abc7a4f5aac60d028e218a6b9d8fb8347c01a189 reused the existing direct-pip General Options normalization seam. CI 35089942188 failed only at cargo fmt --check; exact 35de5dc66992c72c3d634969d72ac0de403be1a2 applied only rustfmt's canonical formatting. Fresh exact-child CI 35133704088 and Fuzz 35133704131 then reached terminal SUCCESS; fresh reviews/threads were clean. #433 was marked Ready and normally merged with fixed expected head into #129 as merge commit fdd3e3dbd73a2838ffdabad41134a9c156cddca6.

#438 / #439 — uv global-option value boundary

Hostile test-only exact ea9c817a8d0edd0e78052d18493a1f1f0954e91f proved semantic RED for parser-valid uv --project run pip install ... --managed-python: the global option value run was mistaken for the active uv command boundary, so the request retained ForbiddenCommand but lost causal AlternateInstallRoot provider evidence. Ordinary global values and actual uv run controls behaved as expected.

Minimum causal repair exact 1dfcdcb38b5ef9bc2bee25e48dc63a15e65117a5 removed the duplicate raw run/pip position heuristic and reused the existing parser-aware policy::uv_active_command_index() authority. It did not introduce a second uv parser, widen executable grammar, or add runtime/interpreter/filesystem/transport authority. Subsequent child commits only finished rustfmt's canonical formatting for the regression fixture.

On unchanged exact child #439@f84787e5b6bb4148be417a98957b24e102dd1137, CI 35460113884 and Fuzz 35460113893 completed SUCCESS; fresh reviews and review threads were empty; parent compatibility remained exact with then-root #129@fdd3e3dbd73a2838ffdabad41134a9c156cddca6. #439 was marked Ready and normally merged with fixed expected-head protection as merge commit 9efc804006057f099190d8ffcaa7096c955abe0d.

The integrated behavior remains fail-closed Block with stable causal evidence and exact submitted-argv command_sha256 identity. No package-manager execution, filesystem authorization, runtime cache behavior, foreign-owner logic or mutable dependency was added. Issue #438 remains open until this effective delta reaches protected main or a verified complete successor preserves every valid code/test/fixture/contract/evidence item.

Context Fabric / EA and release boundary

Wardnet treats context-graph-contracts, enterprise-architecture-core, quarantine-sandbox-runtime, EgressWeave, contextual-orchestrator and AppGuardrail mutable protected/default heads as read-only inventory/compatibility evidence only. It writes neither CGC nor EA while the Context Fabric writer owns them, and production use of foreign-owner capabilities requires compatible immutable released contracts rather than mutable repository heads. Current exact foreign refs and Release inventories belong in #130's sole detailed cross-lane ledger rather than this issue.

Protected AGENTS.md, CLAUDE.md and docs/architecture.md remain protected ownership authority. Draft #111 is the accepted-ADR consolidation lane; Draft #361 is the canonical PRD/TRD/UML lane; #130 is the sole docs/product-technical-gap-baseline.md writer; #333 is the CodeGraph-guidance writer.

Completion gate

Keep this issue and still-unprotected child findings open. Close only after #129 or a verified complete successor preserving every unique implementation/test/fixture/contract/traceability/evidence delta reaches protected main; retrieved bytes or equivalent immutable provenance are independently verified before execution; required foreign ports are released/versioned and compatible; and one unchanged integration head has terminal-valid repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence with fresh protected-base compatibility.

Central hosted-runner/OpenCode defects remain .github#712/#1234 or verified successors, delegated CodeQL settlement remains .github#1929 or verified successor, and generic solo-maintainer approval remains .github#772. No predecessor-evidence transfer, self/model approval, routine administrator bypass, force push, destructive rebase, gate weakening, mutable foreign dependency, source copy, cross-service SQL, ambient-runtime inference or foreign-owner logic duplication.

Fresh state correction — 2026-09-03: owning Draft PR #129 is now exact 85f0f6542a13bfdcc05024b51423851b33ae2ed8, not the older 2545b759… snapshot in this issue body. The later lineage preserves the Cargo build-variant restrictions and adds the pnpmfile-hook admission requirement; current exact-head remote gates remain non-terminal, so predecessor evidence does not transfer. Keep this issue open until the unchanged owning candidate reaches protected main with then-live security/coverage/review/governance evidence.

Fresh canonical-owner integration boundary (2026-09-04 KST): do not widen #129 or duplicate the new external-extension owner stack while those contracts are still mutable. context-graph-contracts#27 now owns the future provider-neutral external-capability-artifact / scan / isolation / activation / invocation-receipt grammar, but explicitly waits behind the existing CGC protected-source release stack and has no immutable release. appguardrail#1099 owns exact external-plugin package static scan/SARIF receipt and is still an open issue. quarantine-sandbox-runtime#14@899b02014a7de990d1aba66f52d42fc2fc14c9c3 remains Draft/unreleased; its artifact-analysis follow-on is only planned in QSR issue #17 and current #14 still carries an unexecuted P0 command-resource identity RED. Noema #545 owns external extension admission/activation/expiry/rollback; that is distinct from Wardnet's generic pre-execution package-install admission decision.

Wardnet #129 should therefore keep its present bounded-context contract: structured install intent + Wardnet-owned policy decision/audit, with external provenance behind an ACL and no direct foreign source/schema dependency. A later integration slice may consume only an immutable released CGC contract and independently authenticated AppGuardrail/QSR evidence references, mapping them into Wardnet policy/artifact identity without copying scanner, sandbox, activation, or provider-specific plugin fields.

Future adapter RED/GREEN acceptance: RED must prove a mutable PR/head URL, self-asserted pass, mismatched artifact/policy digest, expired/foreign evidence, or Noema activation alone cannot make an otherwise unapproved Wardnet install admissible. GREEN must bind one exact artifact digest + Wardnet policy revision + released CGC contract identity + independently verified evidence references, remain replay/idempotency-safe, and preserve the existing rule that the execution broker/quarantine re-verifies retrieved bytes before execution. No source churn is justified on #129 until those foreign owner releases exist; keep current fail-closed local contract and exact-head gates authoritative.

Fresh owning-candidate state supersedes the older 85f0f654... snapshot in this issue body. PR #129 remains Draft/mergeable on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; exact current head is de69e7151913d246f4f1dffec08428aa32b2dc60. The candidate now additionally fails closed on unrepresented Docker/Podman platform selectors and Podman registry-trust weakening: accepted --tls-verify=false spellings and caller-selected --cert-dir are denied as alternate trust authority while explicit TLS verification remains compatible. These are Wardnet admission decisions only; registry transport and hostile execution remain canonical downstream-owner responsibilities.

Fresh exact-head runs remain non-passing/pre-execution: CI 33816557436, Fuzz 33816557351, Security Scan 33816557337, SAST 33816557347, Scorecard PR 33816557380, OSV 33816557766. No predecessor result transfers. Keep #128 open until this full admission delta is protected-main truth and then-live exact-head/security/review/governance evidence is terminal-valid.

Current implementation override (2026-09-04): owning Draft PR #129 is now exact 3a63247e412d17b7bbee2a1d1668dfc84adf1280 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128, not the older 85f0f654... snapshot in the issue body. The intervening delta was read and adopted non-force.

New hostile artifact-set slice: RED d7f429c37a3bd26ea746254defc5d65f33ef71f2 proves Docker/Podman pull -a/--all-tags can expand one reviewed digest request into every mutable tag in the repository; causal GREEN 7f06137453dc2296e4c4ac8c439777bf19ba7244 rejects that caller capability as artifact_not_approved; 37751afc97dd318ae1dd2be48faf54e60069163a records the CHANGELOG invariant and current head 3a63247... adds primary Docker/Podman/NIST traceability. This remains Wardnet pre-execution security admission; it does not fetch/execute workloads or duplicate quarantine/OCI transport authority.

Fresh exact-head runs are materialized but still queued/non-passing: CI 33825032608, Fuzz 33825032507, Security Scan 33825032518, SAST 33825032753, Scorecard 33825032564, OSV 33825033384; CI job 100875751793 is pre-checkout. Exact control-plane RED/GREEN is on .github#712.

A cross-owner contract defect was also handed read-only to Context Fabric: CGC #27 currently names generic external-capability Admission as Noema-owned, which must not collapse Wardnet artifact security admission with Noema governed activation/orchestration. The CGC handoff requires separate provider-neutral authority/evidence grammar and hostile fixtures for Wardnet block/missing/stale/foreign admission vs Noema active, plus the inverse Wardnet allow + Noema missing/expired; EA #45 has matching projection acceptance. Keep this issue open until the Wardnet slice is protected truth and a released CGC contract preserves that authority separation.

Current owner-candidate advance — 2026-09-04

PR #129 is now exact 6fe642f454b912fb618f30849d8fb410b8b7b5a3 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; all f25e20... and earlier workflow evidence is predecessor-only.

New hostile-case finding closes Cargo artifact-version selection authority. RED 4484acd2f7c9609ab16ddc68a748cac6cd49b51d proves that a reviewed Cargo version could otherwise coexist with caller-selected --version / --vers or a mismatched crate@version operand. Production a19326641bcf23fe0fd04b44df568785fd77c582 plus d26890854c5dc6f8c76c859655cc1fd861405fe8 fail closed on separate selectors and require the operand to encode the reviewed name@version; exact 6fe642f... isolates the selector regression using a canonical approved operand. Doctoring aa24fb90bec30866f7d09f89cff88c493627d380 records current Cargo primary-source/APA traceability. Fetch/build/install and retrieved-byte/provenance verification remain outside Wardnet.

Current remote evidence is non-passing: CI 33873894749, Fuzz 33873894792, SAST 33873894721, Security 33873894763, and required CodeQL 33873894850 are queued. CodeQL job 101026130083 is pre-checkout with runner_id=0, empty runner/group identity and steps=[]; .github#712 comment 5540583456 owns the exact current-head control-plane acceptance. The organization ruleset now includes CodeQL but still retains the structurally impossible generic one-approval requirement; .github#772 comment 5540538992 owns that central repair.

CGC #27 comment 5540525764 and EA #45 comment 5540528275 carry the provider-neutral artifact-version/projection acceptance criteria. Keep this issue open until the protected integration/release completion gate is actually satisfied.

Owning-candidate refresh, 2026-09-05 KST. PR #129 has advanced non-force to exact 66e31739a0b20935cc3a93401d07fc827c59ab4c on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; all 4cfdaf90... check conclusions are predecessor evidence only.

The current TDD slice closes an artifact-source identity gap not covered by the earlier alternate-source flags. npm and pip both accept direct operands whose material source may differ from a registry/index package coordinate. Hostile REDs 7caadbb13b30ddbaf1890603cb473a4b431639c5 (npm tarball/Git/alias/local folder) and 551101f24973751a59e173717d3460ae633e84c4 (pip direct URL/VCS/local source) prove that an opaque artifact_argument must not inherit approval merely because policy and intent repeat it. The current repair through 66e31739... binds npm-family registry operands to exact <name>@<version> and PyPI index operands to exact <name>==<version>, rejects conflicting policy during config admission, documents npm Package Spec and pip Requirement Specifiers/install semantics, and places the new domain helper under the existing DDD architecture fitness gate.

Exact-current-head workflows are CI 33894187971, Fuzz 33894187933, Security 33894188047, SAST 33894187861, CodeQL 33894187936, currently queued/non-passing. CI job 101092814074 is still pre-checkout/no-step; .github#712 comment 5543377488 owns current acquisition RCA. Current reviews are advisory COMMENTED only and the sole inline review thread is resolved/outdated.

Context Fabric/EA handoffs were refreshed at CGC #27 comment 5543367539 and EA #45 comment 5543370231; neither foreign source nor PR state was mutated. The shared contract should distinguish registry/index package-coordinate authority from separately immutable direct-source authority, while EA should project only provenance-bound control/risk/remediation evidence rather than argv/reason codes/verdicts.

One acceptance gap remains explicit after this slice: npm-family transitive dependency resolution can still widen beyond the directly reviewed artifact operand, while pip/uv direct installs already require --no-deps. Do not close #128 or claim exact-set completion until this dependency-graph authority is bounded by executable policy/contract evidence or a verified successor fully carries it.

Fresh Wardnet Agent Artifact Admission repair on PR #129 found a remaining dependency-authority gap after the direct source/variant controls.

Finding. The v0.1 contract reviewed only direct npm-family artifacts, but npm install <pkg>, pnpm add/install <pkg>, yarn add <pkg>, and bun add/install <pkg> may resolve transitive package artifacts absent from InstallIntent/AdmissionPolicy. --ignore-scripts and pnpm --ignore-pnpmfile constrain execution hooks, not dependency identity. Treating the direct package coordinate as authority for resolver-selected transitive bytes violates the exact-artifact admission invariant and the ADR boundary that Wardnet does not own dependency resolution.

Hostile RED: debcc2645b41b9f5339c7fbd64adfb1d0aeb3b99 adds npm_dependency_cardinality_contract.rs and expects all four direct resolver paths to block after direct artifact and safety checks would otherwise pass.

Causal repair: 395bfe77118f06c9e8efc7b7ccff7cfd3788eb50 classifies the npm-family resolver paths; b7ae0d83a37f6292612bbbebe2fa9c02bfb5dee2 fails them closed with existing artifact_not_approved; a2dc368f7ea81acfd8e1704bc8866a2e22f64287 fixes the stable contract expectation. Positive allow controls were moved to exact Cargo paths (afc1268ee09db4fb6d9f8b262fdc0052567361a4, f3a3bea8756fb76e7f3657fbe339f2c6c3fbc8a9) so the evaluator is not being converted into deny-all. pnpm hook and npm source-identity tests were adjusted to keep those findings distinct (d5a5c4ac6f0f966c86b1930c5645794f2087caea, 26abebb5b42f74eb207e95279e5befa1d384ab80).

Docs/runbook/threat-model traceability is current through 96f5f28df5ce85d7b9a129e74cae72ebe819e3d6. Primary package-manager documentation confirms the future executable primitives are frozen project installs (npm ci, pnpm install --frozen-lockfile, Yarn install --immutable, Bun ci/install --frozen-lockfile), but those are not self-authorizing. A future allow requires a versioned reviewed manifest+lockfile/material-set contract plus broker verification that the admitted closure/bytes are what execute.

GREEN acceptance for this slice: exact current PR head must compile/test with direct npm-family resolver paths blocked, exact Cargo/PyPI/OCI positive controls still allowed, no valid review finding/thread, and terminal exact-head repository/security/coverage/package/SBOM/provenance evidence. Keep PR #129 Draft until that evidence exists; do not bypass queued/failed gates.

Fresh owning-candidate integration state — 2026-09-05 KST: protected main advanced through #159 to exact 5829a0f08d78de464dd24393ce5d0f25fba9d126. I read the intervening protected delta before touching #129: it is confined to Wardnet CI/Fuzz/Scorecard scheduling, AGENTS.md, and workflow-contract tests and does not overlap the 67-file Agent Artifact Admission slice. PR #129 was therefore non-destructively integrated with live protected truth using merge commit f6889079ce49b6f08865180dd6a1ffd8145a8192 (parents: prior exact 3f3da03884527d7ecea18cae9cab38b0bbbb0dbd + protected 5829a0f...), then fast-forwarded with no force push/rebase. Fresh compare now reports behind_by=0; the effective feature delta remains 67 files. The PR remains Draft/mergeable.

All predecessor workflow/review results are historical after this real base integration. Current exact-head runs are newly materialized and non-passing: CI 33904242427, Fuzz 33904242501, Security Scan 33904242429, SAST Semgrep 33904242491, CodeQL PR 33904242556 are queued. This is lane-local control-plane evidence, not a reason for source churn or bypass; .github#712 remains the owner plane if acquisition/materialization does not progress.

The PyPI contradictory hash-mode RED/causal fix and all prior package/OCI authority contracts are preserved unchanged. No new Shared Kernel schema is justified by this restack: package-manager argv and Wardnet reason codes remain Wardnet-local. Cross-product artifact/evidence/activation grammar still waits for an immutable released context-graph-contracts#27 contract, and retrieved-byte/equivalent provenance verification remains an independent execution-boundary requirement before installation/execution. Keep #128 open until the unchanged integrated candidate reaches protected main through the ordinary gate with exact-head executable evidence and released foreign contracts where actually required.

Current-head repair receipt — 2026-09-10 KST. The earlier test-only d8430278eae6c2a70f09540a58af1ffa70927542 attempt acquired hosted compute and stopped at cargo fmt --check; no semantic RED was claimed. The emitted two test-only wraps were applied without changing production code. PR #129 is now exact 61ce5d9f3d67ddf0b9dbf8bfc7234a6034cc4f0b. Its sole current CI 34426475175 / rust job 102712692502 remains pre-execution queued on ubuntu-24.04 with runner_id=0, empty runner/group identity and steps=[]. This exact queue specimen is handed to canonical owner .github#712 comment 5611451684. Keep production unchanged until the hostile uv --allow-insecure-host= assertion actually executes; if it fails for the expected missing AlternateTrustRoot, the minimum causal repair remains adding the canonical uv alias to the existing trust-root classifier, then reacquiring all evidence on the repair head. Astral's current CLI and TLS-certificate documentation was rechecked today: --allow-insecure-host / --trusted-host bypasses certificate-store verification and can expose the connection to MITM attack. No no-op redispatch, predecessor GREEN transfer, or source churn is authorized.

2026-09-10 Agent Artifact Admission trust-authority repair advanced on #129. Fresh pip 26.2.1 primary HTTPS-certificate documentation identifies --cert / PIP_CERT as certificate-store selection and also documents ambient REQUESTS_CA_BUNDLE / CURL_CA_BUNDLE.

Wardnet-owned structured-argv RED is exact edaf9bbb76a60bf7bdb56ec16e6661c9c86bf9f4: CI 34431988599, rust 102729231075, acquired real hosted Ubuntu 24.04, passed checkout/toolchain/rustfmt and every preceding workspace test, then pypi_certificate_store_trust_contract proved an otherwise approved pip install cwl-example==1.2.3 --require-hashes --no-deps --cert=/tmp/attacker-ca.pem returned Allow; separate-value --cert /tmp/attacker-ca.pem lacked the required AlternateTrustRoot classification. Positive and duplicate-reason controls passed.

Current source exact 43d5e7a8d70d9f7396451ce01402cbcfa7603025 is the minimum causal repair: a single --cert entry in the existing alternate-trust-root forbidden-flag classifier; existing flag parsing/deduplication is reused. Ambient certificate environment variables remain quarantine runtime authority and were handed to quarantine-sandbox-runtime#49; they are intentionally not copied into Wardnet. Exact current-head CI/Security/SAST/Fuzz/CodeQL evidence must now be reacquired before any promotion. Keep #128 open until protected-main/release completion criteria are actually met.

2026-09-10 KST Agent Artifact Admission continuation: test-only #129 exact 63231dcf493ff3e5f53630ffd04016299358021d has now executed on CI 34433747605 / rust job 102734457634. Hosted runner materialized without source churn, checkout and cargo fmt --check passed, the existing workspace suite remained green up to safety_flag_contract, then the new hostile uv pip install ... --require-hashes --no-deps --no-require-hashes case reproduced the semantic defect exactly: left: Allow, right: Block. This validates the RED rather than a runner/config failure.

Minimum Wardnet-owned causal repair is now exact #129 head 9aafde83990f00e70e3c7a442efc19441eadaa42: the existing PyPI hash-mode classifier now recognizes both pip/pip3 install and uv pip install, and blocks the same --no-require-hashes override through the existing MissingSafetyFlag reason. No new policy subsystem, provider authority, execution path, environment control, or sibling source was introduced. Current exact-head CI/Fuzz/Security/SAST/CodeQL runs are fresh and non-terminal; predecessor evidence does not transfer.

Primary upstream evidence remains Astral uv's hidden --no-require-hashes option and settings resolution where it overrides require_hashes. Keep #128 open until the exact repaired lineage reaches protected main or a verified successor carries all valid deltas.

Fresh Agent Artifact Admission integration state: canonical Draft #129 moved by ordinary child merge from 473f689fa6fd0c9662e4709e5d6257715371bf36 to exact fb82aafefb6f014875867407766b7d5e1d9dfcfb. The merged child was #249 (509e6331f33533b1618bed7463dd2d4c83e7d84a), which reached exact CI 34442206881 SUCCESS, Fuzz 34442206842 SUCCESS, CodeRabbit status SUCCESS and zero unresolved review threads before integration. The delta enforces same-open-handle rejection of group/other-writable local policy configuration and keeps non-Unix ACL semantics fail closed per #248.

All #129 protected-main evidence before fb82aaf... is predecessor evidence after that ancestry movement. Fresh #129 CI/Fuzz/Security/SAST/CodeQL runs are queued and non-passing until terminal.

Next test-first child is #251 for #250, based exactly on fb82aaf..., production source unchanged at RED head 8b65dcd8febff005a18fa105ce779e4e22ddda74. It tests final-symlink refusal and private audit-file creation under isolated umask 000. Do not promote #129 while either the current exact-head gate set or the child audit-path safety contract is unresolved.

Current canonical admission status superseding stale head/check prose in the issue body: serialized defensive child #298 merged normally into #129 with expected head a01c92e86637ee58ba84b7317a5d3aef5cb5f780, producing #129 exact 1f65f7bafe763b1ba33409852b6c33954768b6c3 on protected base main@a52ccd0a24a727d9349bb32def7713882d8cad1e. #298's exact child CI 34560823251 and Fuzz 34560823249 were terminal SUCCESS before integration; those child results are historical now and do not transfer to the moved #129 head.

#129 remains Draft. Reacquire exact-current repository/security/review/governance evidence on 1f65f7b... before any protected integration claim. Issue #297 remains open until its effective uv symlink-materialization policy reaches protected main or a verified successor carries it completely.

2026-09-11 KST live admission finding update — current root #129 remains feat/agent-artifact-admission@142c473b0d706f2a75533f683b1ceae429b442e2; bounded child #316 carries a causal security-evidence repair without changing allow/deny authority. Hosted semantic RED on formatted head c0bddd842c07b91943904bf0334f1c9bd63960e5, CI 34590170121, proved uv pip install --python /usr/bin/python3 was already fail-closed for AlternateInstallRoot but also misclassified the interpreter option value as an artifact, emitting a false ArtifactNotApproved. The assigned form --python=/usr/bin/python3 was already causally correct, so no bypass claim is retained. Current repair head a6baa74d31b06362b7c6bc6aeb4c51f79442c289 excludes only the consumed --python/-p option value from artifact operand counting, retains AlternateInstallRoot, and has hostile coverage proving an actual extra package operand still produces ArtifactNotApproved. Exact-current CI is GREEN; bounded fuzz/review are still live and this child is not yet merged into #129. No quarantine/runtime/EgressWeave/CO/AppGuardrail authority is copied.

2026-09-12 KST exact-current correction to the issue body's earlier #129 snapshot; preserve the body as historical lineage evidence rather than treating its 1c5f6217... receipt as current.

Canonical Draft #129 is now exact 83514f9c9b69d9438af6fb866e5815ead737d5e7 on unchanged protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b, after ordinary expected-head integration of verified child #340. The latest causal slice is #339/#340: semantic RED d4639c9b77a458b244241ebc78dedb22c13fdd74 proved direct pip/pip3 --prefi=/tmp/... escaped the reviewed --prefix install-root classifier; minimum direct-pip-only repair 93b3f66b6bdb3e066e7360bb7a24918d75b9abbd recognizes only the pinned parser's unambiguous --prefi…--prefix language while keeping ambiguous --pref out and leaving effective filesystem/workspace/isolation authority with quarantine-sandbox-runtime.

Exact root #129 now has CI 34651107815, Fuzz 34651107792, Security Scan 34651107865, and SAST Semgrep 34651107855 terminal SUCCESS. Required CodeQL PR 34651107816 is terminal FAILURE only at the central delegated-settlement boundary: detect 103433224284 SUCCESS; compatibility/actions 103434496295 read the current-head verdict then failed at enforcement; only afterward unchanged-head dispatch 103436263784 completed SUCCESS. The exact tuple is handed to .github#1929 comment 5641166808; Wardnet source remains stable and fail closed.

No predecessor receipt, child GREEN, later dispatch success, self/model approval, no-op churn or routine bypass is promoted to merge authority. Keep this issue and its still-unprotected child findings open until the complete aggregate reaches protected main or a verified complete successor.

2026-09-12 KST exact-current refresh: canonical Draft #129 has advanced by ordinary expected-head integration to 9e90a4abbd42e3a790ba51c460e4b35e11042e1c on unchanged protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b. The issue body’s 1c5f6217... evidence is historical and does not transfer.

Latest retained causal slice is #347/#348. RED ebbaeab99b93e1ba8a630a29b7bd6407ea23002a proved parser-valid direct pip/pip3 global --proxy authority before install escaped the intended alternate-trust-root classification. Minimum source repair 0e58a71968acd534355e4a1ad904ba04d32ad054 adds only bounded reviewed --proxy/unambiguous --prox normalization for policy evaluation and then restores the audit command_sha256 from exact submitted argv. Final child 5a3e85e2a5550e0311c2fe555b0dc0f4a03ad95e passed CI 34665161389 and Fuzz 34665161314, had zero unresolved inline threads, and merged normally into #129. The repair does not take over pip execution/networking, quarantine runtime/filesystem authority, or EgressWeave transport authorization.

Exact unchanged #129 9e90a4... now has CI 34665569341, Fuzz 34665569378, Security Scan 34665569296, and SAST Semgrep 34665569460 all SUCCESS; active unresolved review threads remain zero. Required CodeQL PR 34665569493 is still FAILURE only at the central settlement boundary: compatibility job 103476658494 read the current-head verdict then failed Release runner or enforce current-head CodeQL verdict; later unchanged-head dispatch job 103477055292 succeeded but cannot retroactively make the already-failed required workflow pass. That exact canary is handed to canonical .github#1929 in comment 5642644994.

Keep #128 open and #129 Draft. No leaf source churn, predecessor evidence, copied central workflow, self/model approval, routine rerun storm, or bypass is valid for the central RED. Close only after the complete effective admission lineage reaches protected main (or a verified complete successor) with then-current released foreign-owner prerequisites and terminal-valid exact-head evidence.

2026-09-12 exact-state refresh

Canonical integration remains Draft #129, now exact feat/agent-artifact-admission@ccebd8821a8a9865057d1681af0a255f8e069e2b on unchanged protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b. The older exact candidate in the issue body is historical after ordinary non-force child integration.

Two additional verified causal slices are now fully inherited:

security(admission): classify global pip registry authority before install #352/fix(security): classify global pip registry authority #353: direct-pip global registry/source/trust authority plus primary-source traceability. CodeRabbit's valid doctoring finding was isolated with test-only 55a51cf9c0a8e87b5310aa4de252e82458e59412; CI 34671864406 / rust 103494603347 failed on the missing causal source reference. Final child 25f4cc91a22594e91019a7f26e019a7688b0200d added pip global-option docs, PEP 503, PEP 493 and NIST SP 800-218 Rustdoc traceability without runtime widening; CI 34671948125 and Fuzz 34671948277 were SUCCESS and the child merged normally.
security(admission): reject global pip client-certificate authority before install #349/fix(security): preserve global pip client-cert operand precision #354: global separate --client-cert VALUE / --cl VALUE precision. Test-only 6dfb38763db489a63db87a9e3c9de8328e5d9141 kept production source byte-identical and CI 34672450391 / rust 103496259531 reproduced [AlternateTrustRoot, ArtifactNotApproved], proving that the consumed credential path was incorrectly counted as a package operand. Minimum repair 1863bece155dfe04c12ceaa05d0a8d0b6e744690 attaches only that consumed value in the internal policy-evaluation view. Final child cbb57b143282d962c04177c9ad7cf10ea856fd52 also proves baseline Allow, exact submitted-command audit hash, safety-flag visibility and real-extra-artifact preservation; CI 34672589672 and Fuzz 34672589676 were SUCCESS before ordinary expected-head merge.

Fresh exact-root #129 evidence on ccebd8821a8a9865057d1681af0a255f8e069e2b: CI 34674219948, Fuzz 34674219919, Security Scan 34674219916, and SAST Semgrep 34674219944 are SUCCESS; current valid unresolved inline review threads are zero. Required CodeQL PR 34674219947 remains FAILURE only at delegated current-head settlement: detect 103501044256 succeeded, compatibility 103501063660 read the verdict then failed Release runner or enforce current-head CodeQL verdict, and downstream dispatch 103501320039 later succeeded on the same head. Exact owner handoff is .github#1929 comment 5643589820; Wardnet source churn or bypass is not valid.

PR #130 sole-ledger lane has been refreshed to this exact state at codex/main-gap-followup@81ea1c2408aba21a95f9d5819d841b8354f4dc1b. This issue remains open because the effective lineage is not yet protected main truth and Wardnet still has no immutable release.

fix(security): bind uv hash-verification authority (#373)

Current canonical amendment — 2026-09-13 KST

The issue body’s #129@81c35ec... / latest-#390 snapshot is now historical. Fresh canonical Agent Artifact Admission is Draft #129@30e81ad13e49a0dc6d0e3c53affa60c51471f9bb, still based on protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b.

Serialized child #394 (af03a1aa7770bf7467d61ae872eb322bd4b71ffb) was re-read at its live head after intervening concurrent deltas. Exact-head CI 34733933433 and Fuzz 34733933445 were SUCCESS, current valid unresolved review threads were zero, and the minimum repair remained inside Wardnet’s existing bytecode-authority bounded context. #394 was then merged normally into #129 with expected-head protection, producing parent 30e81ad13e49a0dc6d0e3c53affa60c51471f9bb; no force update, destructive rebase, self/model approval, gate weakening or foreign-owner logic copy occurred. The integrated repair preserves causal ArtifactNotApproved evidence for uv-owned uv run --compile-bytecode / --compile while keeping unsupported uv run generically ForbiddenCommand and excluding delegated child argv.

Fresh review of that exact parent found the next Wardnet-owned evidence-integrity gap: the same bytecode classifier still assumed fixed-position uv pip install, so reviewed uv global options could suppress causal generated-artifact evidence. Issue #395 records the finding and exact owner boundary. Draft child #396 is serialized directly from exact parent 30e81ad...; its first head 6c24a3d9d4e2f554649346fcb06222e01ff380e9 is intentionally test-only and keeps production source byte-identical. The hostile cases require uv --color never pip install ... --compile-bytecode|--compile to remain ForbiddenCommand while also carrying ArtifactNotApproved, with nearby spelling/non-install controls and exact submitted-argv hashing.

As of this amendment, #396 CI 34734372758 and Fuzz 34734372762 are still queued. That queue is not semantic RED and no production repair has been applied. The minimum implementation, only after hosted semantic RED, is to reuse the already-reviewed uv_active_command_index for the active pip install slice without widening supported_install_command; uv_run_owned_argument_end remains the delegated-child boundary. Runner/materialization remains central .github#712/#1234; delegated CodeQL settlement .github#1929; solo-maintainer approval .github#772. These are owner paths, not Wardnet source defects or user blockers.

Protected main and release truth are unchanged: main@f8260f1e03836039ff9463dd99fa982e4e270c4b; Wardnet GitHub Release inventory remains empty. #129 remains unprotected Draft evidence until ordinary protected integration with exact-current gates and an immutable release boundary.

Fresh canonical status refresh after the two serialized child integrations on 2026-09-13 KST:

protected/default main is still f8260f1e03836039ff9463dd99fa982e4e270c4b;
sole Agent Artifact Admission integration PR feat(security): gate AI-agent artifact installation #129 is now exact fff3c349891a7a3fb12b1eee507595eba7588576, Draft and mergeable against that protected base;
fix(agent-admission): require uv Python download guard #398 completed the implicit-managed-Python-download RED→GREEN and merged normally into feat(security): gate AI-agent artifact installation #129 as parent merge 38844f847e97c76cbe549f0b6cda0a4f05e28f44; issue security(agent-admission): forbid implicit uv Python downloads for approved installs #397 stays open until protected-main integration;
fix(agent-admission): reject unsafe uv index strategies #400 then completed the unsafe uv index-strategy RED→GREEN and merged normally into feat(security): gate AI-agent artifact installation #129 as current exact fff3c349891a7a3fb12b1eee507595eba7588576; issue security(agent-admission): reject unsafe uv index strategies #399 likewise stays open until protected-main integration.

Exact-current #129 repository/security evidence: CI 34744861636 SUCCESS, Fuzz 34744861673 SUCCESS, Security Scan 34744861639 SUCCESS, SAST Semgrep 34744861657 SUCCESS; Devin Review and CodeRabbit commit statuses are SUCCESS; the only inline review thread is resolved/outdated and there is still no independent approving review. Required CodeQL PR 34744861693 is FAILURE in the delegated central settlement lane, not a Wardnet source RED; canonical owner remains .github#1929 / its active successor stack. Do not source-churn, synthesize status, copy central workflow logic, or bypass that gate.

The effective AAI lineage therefore remains unprotected. Keep #128 and child security issues open until #129 or a verified complete successor carrying every unique code/test/fixture/evidence delta reaches protected main. Mutable sibling heads remain development evidence only; Wardnet does not acquire foreign runtime/egress/orchestration ownership.

Current exact-state supersession — 2026-09-15 KST

The issue body’s 24747e... / #427-queued section is historical. Do not use it for a current integration or release decision.

Protected/default Wardnet remains main@f8260f1e03836039ff9463dd99fa982e4e270c4b; GitHub Release inventory remains empty.
Canonical admission root feat(security): gate AI-agent artifact installation #129 is now exact 625879592f0a4d7b06374df2a827cf08f304feb3, produced by ordinary expected-head merge of fix(admission): preserve uv global artifact operand evidence #427 after child CI 34847171263 and Fuzz 34847171299 both completed SUCCESS. No force update, destructive rebase, self/model approval, gate weakening or mutable foreign dependency was used.
Exact-current feat(security): gate AI-agent artifact installation #129 repository lanes: CI 34884595676 SUCCESS, Fuzz 34884595640 SUCCESS, SAST Semgrep 34884595634 SUCCESS; Security Scan 34884595678 and CodeQL PR 34884595690 remain QUEUED. Queued is incomplete, not passing.
Current serialized successor is issue admission: uv global options can hide indirect requirement-source evidence #428 / Draft test(admission): expose uv global indirect source evidence gap #429 at test-only exact 6619db4fb82203af6cc6ac55c788fa679af9c33a, based exactly on feat(security): gate AI-agent artifact installation #129. Production source is byte-identical to the parent. Initial 973dcec1... failed only cargo fmt --check, so it was not semantic RED; formatting-only successor CI 34911607878 and Fuzz 34911607856 remain queued. No production repair is authorized until CI reaches and fails the intended indirect-source assertion.
If semantic RED is established, the minimum repair is to reuse uv_active_command_index() inside requests_indirect_artifact_source(), require exact active pip + install, and inspect only that install slice. Do not widen supported grammar or duplicate quarantine-sandbox-runtime, EgressWeave, contextual-orchestrator or AppGuardrail ownership.
Fresh read-only Context Fabric truth remains CGC develop@99cb5468ba3c15c5e79688f53dee74724fae2d13 and EA develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece; both release inventories are empty. Wardnet writes neither repository.

Keep #128 open until the complete effective admission lineage reaches protected main or a verified complete successor, and then satisfies one unchanged protected exact-head release/governance evidence set. This comment supersedes only stale current-status fields in the body; it does not replace the threat model, ownership boundary, historical RED→GREEN evidence or completion contract.

Fresh canonical child status supersedes the body’s queued wording for #429: exact 0f206d6cb23ca88abfd6f0c0a84e1dcba6e35969 CI 34927770706 / rust 104249367485 is SUCCESS; Fuzz 34927770671 / job 104249367457 is FAILURE only because no runner materialized (runner_id=0, empty runner name/group, no steps). This is central hosted-runner assignment failure, not Agent Artifact Admission semantic RED. Exact specimen/acceptance is handed to .github#712 comment 5678309257; #428 comment 5678351595 and #429 body carry the same current truth. Keep #429 Draft/source-stable until unchanged-head materialized Fuzz GREEN and then-live review/security evidence; do not start the next serialized admission issue yet.

Exact-root evidence refresh — 2026-09-16 KST: #129 remains unchanged at 951b3cb68621e4fbb8c6076d0b447b8481551b16. Security Scan 34998621202 has advanced from queued to terminal SUCCESS. CI 34998621152, Fuzz 34998621208, and SAST Semgrep 34998621097 also remain SUCCESS; CodeQL PR 34998621229 remains QUEUED. This supersedes the queued Security Scan status in the issue body without changing the admission contract. Active child #431 remains exact eedaa3fb46e89ce740c28269654235ba99c51912 with CI/Fuzz still queued; no predecessor evidence transfers and no bypass/redispatch is warranted.

Fresh exact-state correction — 2026-09-16 KST

Canonical Agent Artifact Admission root #129 remains exact 951b3cb68621e4fbb8c6076d0b447b8481551b16 on protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b; no source/head change is being manufactured for control-plane settlement.

Current exact-root evidence is now: CI 34998621152 SUCCESS, Fuzz 34998621208 SUCCESS, Security Scan 34998621202 SUCCESS, SAST Semgrep 34998621097 SUCCESS, and CodeQL PR 34998621229 terminal FAILURE only at delegated terminal settlement. CodeQL language detection succeeded; compatibility job 104549031674 observed VERDICT_STATE=pending; dispatch job 104616894785 subsequently succeeded. Exact owner evidence and acceptance were handed to .github#1929 in comment 5692672620. No Wardnet source repair, local workflow copy, synthetic status, no-op churn, self/model approval, or routine bypass is warranted for that owner defect.

The sole active admission source child remains Draft #431 at exact eedaa3fb46e89ce740c28269654235ba99c51912, based exactly on #129. Its hosted semantic RED is unchanged; the minimum repair remains the reviewed direct-pip General Options normalization of pre-command verbose-log authority. Exact-current CI 35046405436 and Fuzz 35046405418 remain queued. Fresh submitted-review and inline-thread inventories are empty. Keep the exact child unchanged until terminal evidence materializes, then require fresh parent compatibility before ordinary expected-head integration.

Keep #128 open until the complete lineage reaches protected main or a verified complete successor carries every valid implementation/test/fixture/contract/evidence delta.

Fresh exact-current correction, 2026-09-17 KST: canonical Agent Artifact Admission remains #129@fdd3e3dbd73a2838ffdabad41134a9c156cddca6 on exact protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b. The issue body’s statement that every current-root workflow remains queued is now stale. Exact-head CI 35160465195, Fuzz 35160465198, and SAST Semgrep 35160465226 are terminal SUCCESS. Security Scan 35160465204 remains QUEUED after Detect changed scope acquired a runner and succeeded; its dependency-review/OSV/Trivy/Scorecard jobs are materialized but pre-checkout queued with runner_id=0. CodeQL PR 35160465225 remains QUEUED. This is mixed current-head evidence, not root GREEN and not a reason for a new hostile child yet. Keep #129 Draft until the same unchanged head has terminal-valid remaining security/CodeQL/review/governance evidence.

Status correction / superseding exact-root evidence (2026-09-18 KST): canonical Agent Artifact Admission remains Draft #129@fdd3e3dbd73a2838ffdabad41134a9c156cddca6 on protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b. Current-root CI 35160465195, Fuzz 35160465198, SAST Semgrep 35160465226, and Security Scan 35160465204 are terminal SUCCESS. CodeQL PR 35160465225 is terminal FAILURE only at the centrally delegated current-head settlement step after the exact-head dispatch returned pending; the exact specimen is handed to .github#1929. This is not a Wardnet source/test/SARIF RED and does not authorize source churn, synthetic status, self/model approval, or routine bypass. The body’s earlier queued Security/CodeQL snapshot is historical.

Current canonical admission status — 2026-09-18 KST

This supersedes only dated current-state/check/foreign-head fields in the issue body; the threat model, ownership boundary and completion gate remain unchanged.

Canonical Draft #129 remains exact fdd3e3dbd73a2838ffdabad41134a9c156cddca6, based exactly on protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b and mechanically mergeable. On that unchanged root, CI 35160465195, Fuzz 35160465198, SAST Semgrep 35160465226, and Security Scan 35160465204 are terminal SUCCESS. CodeQL PR 35160465225 is terminal FAILURE only at delegated terminal settlement after exact-head dispatch; the same-SHA specimen remains with central .github#1929. This is not Wardnet source/test/SARIF RED and does not justify no-op churn, synthetic status or bypass.

Fresh read-only owner inventory is CGC develop@99cb5468ba3c15c5e79688f53dee74724fae2d13, EA develop@dd71e40a86385fb7861b0f1be19891a3f3e29ece, quarantine-sandbox-runtime develop@60a85c7633e03b425b67159ec6822c8178cf87ea, EgressWeave main@bd0339bf43cf5041e861bac86a84cb6e7e32637e, contextual-orchestrator main@afad3e90caac73d5b94eb68f70953b5589a01008, and appguardrail develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8. Every checked immutable GitHub Release inventory remains empty. Contextual-orchestrator #1083 already carries the exact afad3e90... current-head/no-release Wardnet handoff. Mutable owner heads remain inventory/compatibility evidence only.

No competing Agent Artifact Admission source writer is active. Keep #128 open until #129 or a verified complete successor reaches protected main with every still-valid code/test/fixture/contract/evidence delta and one unchanged integration head satisfies then-live repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence.

Navigation Menu

Repository navigation

[Security] Gate AI-agent package installs from untrusted llms.txt and web instructions #128

Threat and owned outcome

Current canonical candidate

Latest integrated serialized repairs

#270 / #431 — pip General Options log-output authority

#432 / #433 — pip `--cache-dir` causal evidence

#438 / #439 — uv global-option value boundary

Context Fabric / EA and release boundary

Completion gate

1 remaining item

2026-09-12 exact-state refresh

Current canonical amendment — 2026-09-13 KST

Current exact-state supersession — 2026-09-15 KST

Current canonical admission status — 2026-09-18 KST

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Security] Gate AI-agent package installs from untrusted llms.txt and web instructions #128

Description

Threat and owned outcome

Current canonical candidate

Latest integrated serialized repairs

#270 / #431 — pip General Options log-output authority

#432 / #433 — pip --cache-dir causal evidence

#438 / #439 — uv global-option value boundary

Context Fabric / EA and release boundary

Completion gate

Activity

seonghobae commented on Sep 3, 2026

seonghobae commented on Sep 3, 2026

seonghobae commented on Sep 4, 2026

seonghobae commented on Sep 4, 2026

seonghobae commented on Sep 4, 2026

seonghobae commented on Sep 4, 2026

seonghobae commented on Sep 4, 2026

seonghobae commented on Sep 4, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

seonghobae commented on Sep 10, 2026

1 remaining item

seonghobae commented on Sep 11, 2026

seonghobae commented on Sep 11, 2026

seonghobae commented on Sep 11, 2026

seonghobae commented on Sep 12, 2026

seonghobae commented on Sep 12, 2026

2026-09-12 exact-state refresh

seonghobae commented on Sep 13, 2026

Current canonical amendment — 2026-09-13 KST

seonghobae commented on Sep 13, 2026

seonghobae commented on Sep 15, 2026

Current exact-state supersession — 2026-09-15 KST

seonghobae commented on Sep 15, 2026

seonghobae commented on Sep 16, 2026

seonghobae commented on Sep 16, 2026

seonghobae commented on Sep 17, 2026

seonghobae commented on Sep 17, 2026

seonghobae commented on Sep 18, 2026

Current canonical admission status — 2026-09-18 KST

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

#432 / #433 — pip `--cache-dir` causal evidence