security(admission): make audit append path link-safe and private #250

Finding

Fresh review of Agent Artifact Admission at exact parent feat/agent-artifact-admission@473f689fa6fd0c9662e4709e5d6257715371bf36 found a second local-filesystem authority gap after the policy-file integrity lane.

FileAuditSink::open_append_only currently uses ordinary OpenOptions::create(true).append(true).open(path). On Unix this follows a final symbolic link and creates a new audit file under the process umask rather than an explicit evidence confidentiality/integrity mode. The audit stream intentionally contains minimized but security-relevant actor/workspace/source/artifact/policy evidence. An attacker able to pre-place the configured audit filename as a symlink can redirect append writes to an unintended target; a permissive umask can also make newly created security evidence visible beyond the intended service/security-operator boundary.

This is Wardnet's own security-evidence persistence boundary. It does not move storage/IAM authority into Wardnet, create a log shipper, duplicate quarantine isolation, EgressWeave transport policy, contextual-orchestrator behavior, AppGuardrail analysis or Context Graph truth.

Hostile RED acceptance

Stack after the current configuration-permission child is integrated into #129; do not create parallel source churn while that exact-head RED is waiting for compute.

On a Unix test fixture:

1. Create an unrelated regular target containing a sentinel, create the configured audit path as a symlink to that target, then append one valid record through FileAuditSink. The append must fail closed and the sentinel target must remain byte-for-byte unchanged.
2. Create a fresh audit path under a temporary directory while the process umask permits broader creation. After one successful append, the resulting regular audit file must have no group/other permission bits.
3. Existing append-order, sync, oversized-record and unavailable-parent controls must remain GREEN.

A runner/bootstrap/rustfmt failure is not semantic RED.

Minimum GREEN acceptance

Use the OS-native open/create boundary rather than a pre-open symlink_metadata check that introduces a TOCTOU window. On Unix, open the final audit file without following a symlink and create it with service-private permissions; after open, verify the descriptor names a regular file before writing. Keep O_APPEND semantics, the existing process-local serialization lock, flush + sync_data, bounded line encoding and stable non-secret AuditError::StorageUnavailable behavior. Do not truncate or rewrite existing evidence.

If a portable equivalent cannot preserve the same security property on another platform, fail closed rather than silently falling back to link-following evidence writes; document the supported deployment boundary.

Traceability

• MITRE CWE-59, Improper Link Resolution Before File Access ('Link Following'): link following can let an attacker redirect file modification and bypass protection mechanisms.
• Linux open(2) / openat2(2): O_NOFOLLOW prevents following the final pathname component; stronger resolution constraints are available through openat2 where an implementation chooses to use them.
• NIST SP 800-53 Rev. 5 CM-5: access restrictions for system changes must be defined and enforced; audit/evidence files are part of the security-control implementation and must not be writable through unintended filesystem aliases.

Re-read the current primary references when doctoring the repair. Keep ADR/runbook/threat-model statements code-current without editing docs/product-technical-gap-baseline.md outside its sole writer #130.