security(admission): reject group/other-writable policy configuration #248

Finding

Fresh review of Agent Artifact Admission after #247 integration at exact feat/agent-artifact-admission@473f689fa6fd0c9662e4709e5d6257715371bf36 found an asymmetric local-authority boundary. The administrator credential file now rejects group/other permission bits, but load_config still opens and accepts the reviewed policy/configuration with no filesystem-integrity permission check. That configuration carries the executable allowlist, approved workspace manifest digests, exact artifact coordinates and policy revision, so local group/other write authority can mutate admission authority before startup.

The runbook already requires the reviewed admission policy/configuration to be a local file with restrictive filesystem permissions. This issue makes only the integrity portion executable: group/other write permission must fail closed. Read-only visibility such as 0644 remains permitted because this configuration is not the credential secret boundary.

Hostile RED acceptance

On a child of exact 473f689fa6fd0c9662e4709e5d6257715371bf36, write a syntactically valid, deny/allow-capable configuration and set its Unix mode to representative unsafe values such as 0664, 0646, and 0666. load_config must reject each before treating its policy as authority. Positive controls 0600, 0640, 0644, and 0400 must continue to load.

The RED must execute on the ordinary hosted CI path with production source unchanged. A formatting/runner/bootstrap failure is not semantic evidence.

Minimum GREEN acceptance

Validate metadata on the same already-open configuration file handle before materializing/parsing policy bytes. On Unix, reject only group/other write bits (mode & 0o022 != 0) with a stable non-secret configuration error; do not copy the credential file's confidentiality rule onto non-secret policy configuration. Preserve the existing bounded read, strict JSON/schema validation, loopback listener rule and immutable policy semantics.

Do not add runtime policy mutation, directory ownership policy, Keyverse/secret distribution, quarantine execution, EgressWeave transport policy, contextual-orchestrator behavior, or AppGuardrail analysis in this slice. Non-Unix behavior must remain explicitly fail-closed unless a native ACL contract is separately implemented.

Traceability

MITRE CWE-732 (Incorrect Permission Assignment for Critical Resource) and NIST SP 800-53 Rev. 5 AC-6/CM-5 are the governing least-privilege/configuration-change controls. The exact source and current primary references must be re-read when the repair is documented.

Keep this work stacked under #129. No force push/destructive rebase, self/model approval, routine bypass, gate weakening, predecessor-result transfer, or foreign-owner source copy.