[Security] Gate AI-agent package installs from untrusted llms.txt and web instructions

[seonghobae]

Threat and owned outcome

AI coding agents can turn untrusted llms.txt, README fragments, issue comments, retrieved documents, or tool output into package-install or execution requests. Wardnet owns a Rust Agent Artifact Admission Controller that evaluates a structured install intent before package installation or code execution. Source text never establishes package ownership, trust, artifact identity, install-mutation authority, network authority, or execution authority.

Wardnet owns security-artifact admission policy and evidence only. quarantine-sandbox-runtime owns hostile execution/isolation and cleanup; contextual-orchestrator owns Agent/LLM orchestration; EgressWeave owns reusable outbound-policy authority; AppGuardrail owns static package/security analysis; Noema activation remains a separate governed authority. Wardnet consumes released/versioned ports/ACLs and does not copy those implementations.

Required contract

• structured argv only; no shell command string;
• fail closed unless each requested artifact matches reviewed ecosystem/name/version/HTTPS registry/owner/SHA-256 identity;
• executable family must match artifact ecosystem;
• direct download-and-execute, shell/runtime inline execution, unknown registries, unpinned artifacts and malformed provenance are blocked;
• package-manager source, destination, workspace, configuration, registry trust/TLS, lifecycle hooks, install overwrite/tracking semantics, build output, platform/distribution identity, build variant and dependency-cardinality are admitted capabilities, not ignored syntax;
• an exact reviewed artifact set cannot be widened by resolver-selected transitive artifacts; supported direct PyPI install paths require explicit dependency-cardinality safety;
• required safety flags are interpreted semantically, including contradictory Boolean spellings, parser-equivalent shorthands and attached short-option values;
• remote instruction sources require HTTPS plus content SHA-256;
• v0.1 binds loopback only; remote exposure stays behind authenticated TLS/mTLS infrastructure;
• admin credential bootstrap stays in the credential registry boundary;
• append audit evidence before returning allow; audit failure becomes fail-closed service failure;
• audit normalized URI/command hash/artifact coordinates/decision/reason only, never secrets or raw command text;
• policy denials return a successful admission result with decision=block, distinct from transport failure.

Current owning candidate — 2026-09-06 KST

PR #129 remains the sole owning candidate at exact db921e7f855f52870b23de52a4e23f11ff996644 on protected main@5829a0f08d78de464dd24393ce5d0f25fba9d126. It remains Draft; source churn is not authorized merely to reacquire delegated control-plane evidence.

The candidate retains the complete Agent Artifact Admission surface: exact artifact/source/registry identity, executable/ecosystem matching, undeclared operand/source/destination/config/workspace rejection, lifecycle/integrity bypass rejection, Cargo/OCI/Podman/PyPI/npm-family variant binding, transitive dependency-cardinality constraints, audit-before-allow, fail-closed remote-instruction provenance, and the PyPI hash-mode repair that rejects contradictory --no-require-hashes when required hash checking is part of the reviewed intent. An admission receipt still does not prove retrieved-byte integrity; downstream execution must independently bind installed/executed bytes or equivalent immutable provenance to the reviewed digest.

Exact-current evidence

Four current repository/security lanes have completed successfully on unchanged exact db921e7f855f52870b23de52a4e23f11ff996644:

• CI 33977431401 — success;
• Fuzz 33977431523 — success;
• Security Scan 33977431400 — success;
• SAST Semgrep 33977431547 — success.

CodeQL PR 33977431418 is terminal failure, but current logs isolate a central delegated-verdict defect rather than a Wardnet source failure. Compatibility job 101354139576 acquired Ubuntu 24.04, confirmed OIDC, exchanged a repository-scoped app token successfully, and successfully sent the exact repository_dispatch for PR #129/head db921e7.... It then intentionally failed closed with VERDICT_STATE=pending, requiring the central dispatch workflow to publish authenticated terminal context codeql-dispatch/actions to this exact SHA and wake/re-run the same required job. Fresh combined commit status still contains no such terminal delegated status.

The exact current specimen and RED/GREEN acceptance have been advanced on central owner path ContextualWisdomLab/.github#712 (latest Wardnet #129 handoff comment 5555244181). GREEN there requires correlation of the dispatched (repository, PR, head SHA, language, required run/job) payload to its central run, exact target checkout, authenticated terminal status publication by the designated app identity, and a bounded rerun/wake of only the failed required job. Preserve the four existing GREEN lanes; do not create a no-op source commit, broad rerun storm, predecessor verdict, or gate weakening.

Context Fabric / EA and release authority

Wardnet does not modify context-graph-contracts or enterprise-architecture-core source/PR state. Provider-neutral artifact/evidence/activation grammar remains context-graph-contracts#27 owner work and architecture adoption/risk/provenance projection remains enterprise-architecture-core#45 owner work. Package-manager argv and Wardnet reason codes are not Shared Kernel or authoritative EA facts.

Fresh release inventory for both context-graph-contracts and enterprise-architecture-core remains empty, and both still have open owner stacks. No mutable foreign head is production authority. Wardnet consumes only released/versioned compatible owner contracts and fails closed when required release/schema/provenance/conformance is absent or unverifiable.

Live organization ruleset 18156473 still requires one generic approving review with no required reviewer/team, central required workflows, resolved review threads, deletion/non-fast-forward protection, and exposes OrganizationAdmin/always bypass. .github#772 owns the solo-maintainer governance repair. Self-approval, model/bot-as-human approval, routine bypass, force push, gate weakening and predecessor evidence reuse remain forbidden.

Completion gate

Close only after #129 or a verified successor preserving every unique implementation/test/fixture/contract/evidence delta reaches protected main; the unchanged integration candidate has terminal current repository/security/coverage/package/SBOM/provenance/review/governance evidence; retrieved bytes or equivalent provenance are independently verified before execution; and released Context Fabric/consumer boundaries preserve the separate authorities above. Feature-branch allow evidence is not a release or runtime-execution authorization.

[seonghobae]

Fresh state correction — 2026-09-03: owning Draft PR #129 is now exact 85f0f6542a13bfdcc05024b51423851b33ae2ed8, not the older 2545b759… snapshot in this issue body. The later lineage preserves the Cargo build-variant restrictions and adds the pnpmfile-hook admission requirement; current exact-head remote gates remain non-terminal, so predecessor evidence does not transfer. Keep this issue open until the unchanged owning candidate reaches protected main with then-live security/coverage/review/governance evidence.

[seonghobae]

Fresh canonical-owner integration boundary (2026-09-04 KST): do not widen #129 or duplicate the new external-extension owner stack while those contracts are still mutable. context-graph-contracts#27 now owns the future provider-neutral external-capability-artifact / scan / isolation / activation / invocation-receipt grammar, but explicitly waits behind the existing CGC protected-source release stack and has no immutable release. appguardrail#1099 owns exact external-plugin package static scan/SARIF receipt and is still an open issue. quarantine-sandbox-runtime#14@899b02014a7de990d1aba66f52d42fc2fc14c9c3 remains Draft/unreleased; its artifact-analysis follow-on is only planned in QSR issue #17 and current #14 still carries an unexecuted P0 command-resource identity RED. Noema #545 owns external extension admission/activation/expiry/rollback; that is distinct from Wardnet's generic pre-execution package-install admission decision.

Wardnet #129 should therefore keep its present bounded-context contract: structured install intent + Wardnet-owned policy decision/audit, with external provenance behind an ACL and no direct foreign source/schema dependency. A later integration slice may consume only an immutable released CGC contract and independently authenticated AppGuardrail/QSR evidence references, mapping them into Wardnet policy/artifact identity without copying scanner, sandbox, activation, or provider-specific plugin fields.

Future adapter RED/GREEN acceptance: RED must prove a mutable PR/head URL, self-asserted pass, mismatched artifact/policy digest, expired/foreign evidence, or Noema activation alone cannot make an otherwise unapproved Wardnet install admissible. GREEN must bind one exact artifact digest + Wardnet policy revision + released CGC contract identity + independently verified evidence references, remain replay/idempotency-safe, and preserve the existing rule that the execution broker/quarantine re-verifies retrieved bytes before execution. No source churn is justified on #129 until those foreign owner releases exist; keep current fail-closed local contract and exact-head gates authoritative.

[seonghobae]

Fresh owning-candidate state supersedes the older 85f0f654... snapshot in this issue body. PR #129 remains Draft/mergeable on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; exact current head is de69e7151913d246f4f1dffec08428aa32b2dc60. The candidate now additionally fails closed on unrepresented Docker/Podman platform selectors and Podman registry-trust weakening: accepted --tls-verify=false spellings and caller-selected --cert-dir are denied as alternate trust authority while explicit TLS verification remains compatible. These are Wardnet admission decisions only; registry transport and hostile execution remain canonical downstream-owner responsibilities.

Fresh exact-head runs remain non-passing/pre-execution: CI 33816557436, Fuzz 33816557351, Security Scan 33816557337, SAST 33816557347, Scorecard PR 33816557380, OSV 33816557766. No predecessor result transfers. Keep #128 open until this full admission delta is protected-main truth and then-live exact-head/security/review/governance evidence is terminal-valid.

[seonghobae]

Current implementation override (2026-09-04): owning Draft PR #129 is now exact 3a63247e412d17b7bbee2a1d1668dfc84adf1280 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128, not the older 85f0f654... snapshot in the issue body. The intervening delta was read and adopted non-force.

New hostile artifact-set slice: RED d7f429c37a3bd26ea746254defc5d65f33ef71f2 proves Docker/Podman pull -a/--all-tags can expand one reviewed digest request into every mutable tag in the repository; causal GREEN 7f06137453dc2296e4c4ac8c439777bf19ba7244 rejects that caller capability as artifact_not_approved; 37751afc97dd318ae1dd2be48faf54e60069163a records the CHANGELOG invariant and current head 3a63247... adds primary Docker/Podman/NIST traceability. This remains Wardnet pre-execution security admission; it does not fetch/execute workloads or duplicate quarantine/OCI transport authority.

Fresh exact-head runs are materialized but still queued/non-passing: CI 33825032608, Fuzz 33825032507, Security Scan 33825032518, SAST 33825032753, Scorecard 33825032564, OSV 33825033384; CI job 100875751793 is pre-checkout. Exact control-plane RED/GREEN is on .github#712.

A cross-owner contract defect was also handed read-only to Context Fabric: CGC #27 currently names generic external-capability Admission as Noema-owned, which must not collapse Wardnet artifact security admission with Noema governed activation/orchestration. The CGC handoff requires separate provider-neutral authority/evidence grammar and hostile fixtures for Wardnet block/missing/stale/foreign admission vs Noema active, plus the inverse Wardnet allow + Noema missing/expired; EA #45 has matching projection acceptance. Keep this issue open until the Wardnet slice is protected truth and a released CGC contract preserves that authority separation.

[seonghobae]

Current owner-candidate advance — 2026-09-04

PR #129 is now exact 6fe642f454b912fb618f30849d8fb410b8b7b5a3 on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; all f25e20... and earlier workflow evidence is predecessor-only.

New hostile-case finding closes Cargo artifact-version selection authority. RED 4484acd2f7c9609ab16ddc68a748cac6cd49b51d proves that a reviewed Cargo version could otherwise coexist with caller-selected --version / --vers or a mismatched crate@version operand. Production a19326641bcf23fe0fd04b44df568785fd77c582 plus d26890854c5dc6f8c76c859655cc1fd861405fe8 fail closed on separate selectors and require the operand to encode the reviewed name@version; exact 6fe642f... isolates the selector regression using a canonical approved operand. Doctoring aa24fb90bec30866f7d09f89cff88c493627d380 records current Cargo primary-source/APA traceability. Fetch/build/install and retrieved-byte/provenance verification remain outside Wardnet.

Current remote evidence is non-passing: CI 33873894749, Fuzz 33873894792, SAST 33873894721, Security 33873894763, and required CodeQL 33873894850 are queued. CodeQL job 101026130083 is pre-checkout with runner_id=0, empty runner/group identity and steps=[]; .github#712 comment 5540583456 owns the exact current-head control-plane acceptance. The organization ruleset now includes CodeQL but still retains the structurally impossible generic one-approval requirement; .github#772 comment 5540538992 owns that central repair.

CGC #27 comment 5540525764 and EA #45 comment 5540528275 carry the provider-neutral artifact-version/projection acceptance criteria. Keep this issue open until the protected integration/release completion gate is actually satisfied.

[seonghobae]

Owning-candidate refresh, 2026-09-05 KST. PR #129 has advanced non-force to exact 66e31739a0b20935cc3a93401d07fc827c59ab4c on protected main@cc15cc2c34daf8c104eeb83d52a6a66f3cd6e128; all 4cfdaf90... check conclusions are predecessor evidence only.

The current TDD slice closes an artifact-source identity gap not covered by the earlier alternate-source flags. npm and pip both accept direct operands whose material source may differ from a registry/index package coordinate. Hostile REDs 7caadbb13b30ddbaf1890603cb473a4b431639c5 (npm tarball/Git/alias/local folder) and 551101f24973751a59e173717d3460ae633e84c4 (pip direct URL/VCS/local source) prove that an opaque artifact_argument must not inherit approval merely because policy and intent repeat it. The current repair through 66e31739... binds npm-family registry operands to exact <name>@<version> and PyPI index operands to exact <name>==<version>, rejects conflicting policy during config admission, documents npm Package Spec and pip Requirement Specifiers/install semantics, and places the new domain helper under the existing DDD architecture fitness gate.

Exact-current-head workflows are CI 33894187971, Fuzz 33894187933, Security 33894188047, SAST 33894187861, CodeQL 33894187936, currently queued/non-passing. CI job 101092814074 is still pre-checkout/no-step; .github#712 comment 5543377488 owns current acquisition RCA. Current reviews are advisory COMMENTED only and the sole inline review thread is resolved/outdated.

Context Fabric/EA handoffs were refreshed at CGC #27 comment 5543367539 and EA #45 comment 5543370231; neither foreign source nor PR state was mutated. The shared contract should distinguish registry/index package-coordinate authority from separately immutable direct-source authority, while EA should project only provenance-bound control/risk/remediation evidence rather than argv/reason codes/verdicts.

One acceptance gap remains explicit after this slice: npm-family transitive dependency resolution can still widen beyond the directly reviewed artifact operand, while pip/uv direct installs already require --no-deps. Do not close #128 or claim exact-set completion until this dependency-graph authority is bounded by executable policy/contract evidence or a verified successor fully carries it.

[seonghobae]

Fresh Wardnet Agent Artifact Admission repair on PR #129 found a remaining dependency-authority gap after the direct source/variant controls.

Finding. The v0.1 contract reviewed only direct npm-family artifacts, but npm install <pkg>, pnpm add/install <pkg>, yarn add <pkg>, and bun add/install <pkg> may resolve transitive package artifacts absent from InstallIntent/AdmissionPolicy. --ignore-scripts and pnpm --ignore-pnpmfile constrain execution hooks, not dependency identity. Treating the direct package coordinate as authority for resolver-selected transitive bytes violates the exact-artifact admission invariant and the ADR boundary that Wardnet does not own dependency resolution.

Hostile RED: debcc2645b41b9f5339c7fbd64adfb1d0aeb3b99 adds npm_dependency_cardinality_contract.rs and expects all four direct resolver paths to block after direct artifact and safety checks would otherwise pass.

Causal repair: 395bfe77118f06c9e8efc7b7ccff7cfd3788eb50 classifies the npm-family resolver paths; b7ae0d83a37f6292612bbbebe2fa9c02bfb5dee2 fails them closed with existing artifact_not_approved; a2dc368f7ea81acfd8e1704bc8866a2e22f64287 fixes the stable contract expectation. Positive allow controls were moved to exact Cargo paths (afc1268ee09db4fb6d9f8b262fdc0052567361a4, f3a3bea8756fb76e7f3657fbe339f2c6c3fbc8a9) so the evaluator is not being converted into deny-all. pnpm hook and npm source-identity tests were adjusted to keep those findings distinct (d5a5c4ac6f0f966c86b1930c5645794f2087caea, 26abebb5b42f74eb207e95279e5befa1d384ab80).

Docs/runbook/threat-model traceability is current through 96f5f28df5ce85d7b9a129e74cae72ebe819e3d6. Primary package-manager documentation confirms the future executable primitives are frozen project installs (npm ci, pnpm install --frozen-lockfile, Yarn install --immutable, Bun ci/install --frozen-lockfile), but those are not self-authorizing. A future allow requires a versioned reviewed manifest+lockfile/material-set contract plus broker verification that the admitted closure/bytes are what execute.

GREEN acceptance for this slice: exact current PR head must compile/test with direct npm-family resolver paths blocked, exact Cargo/PyPI/OCI positive controls still allowed, no valid review finding/thread, and terminal exact-head repository/security/coverage/package/SBOM/provenance evidence. Keep PR #129 Draft until that evidence exists; do not bypass queued/failed gates.

[seonghobae]

Fresh owning-candidate integration state — 2026-09-05 KST: protected main advanced through #159 to exact 5829a0f08d78de464dd24393ce5d0f25fba9d126. I read the intervening protected delta before touching #129: it is confined to Wardnet CI/Fuzz/Scorecard scheduling, AGENTS.md, and workflow-contract tests and does not overlap the 67-file Agent Artifact Admission slice. PR #129 was therefore non-destructively integrated with live protected truth using merge commit f6889079ce49b6f08865180dd6a1ffd8145a8192 (parents: prior exact 3f3da03884527d7ecea18cae9cab38b0bbbb0dbd + protected 5829a0f...), then fast-forwarded with no force push/rebase. Fresh compare now reports behind_by=0; the effective feature delta remains 67 files. The PR remains Draft/mergeable.

All predecessor workflow/review results are historical after this real base integration. Current exact-head runs are newly materialized and non-passing: CI 33904242427, Fuzz 33904242501, Security Scan 33904242429, SAST Semgrep 33904242491, CodeQL PR 33904242556 are queued. This is lane-local control-plane evidence, not a reason for source churn or bypass; .github#712 remains the owner plane if acquisition/materialization does not progress.

The PyPI contradictory hash-mode RED/causal fix and all prior package/OCI authority contracts are preserved unchanged. No new Shared Kernel schema is justified by this restack: package-manager argv and Wardnet reason codes remain Wardnet-local. Cross-product artifact/evidence/activation grammar still waits for an immutable released context-graph-contracts#27 contract, and retrieved-byte/equivalent provenance verification remains an independent execution-boundary requirement before installation/execution. Keep #128 open until the unchanged integrated candidate reaches protected main through the ordinary gate with exact-head executable evidence and released foreign contracts where actually required.