security(admission): reject pip caller-selected verbose log write paths

[seonghobae]

Verified security gap

Refs #128 / canonical Agent Artifact Admission PR #129. Protected/default main remains f8260f1e03836039ff9463dd99fa982e4e270c4b. Canonical #129 is exact 71451ce3a70d4b64b380dd0566c03c0a37465d65, produced by ordinary integration of the completed repair for this issue through #431. No force update, destructive rebase, self/model approval, gate weakening or routine bypass was used.

Wardnet's pip admission rejects alternate install roots, trust roots, indirect artifact sources and installation-report output authority, but direct-pip General Options can place pip's verbose-log family before command selection. Exact upstream pypa/pip@2b28a816d043826f2ba10ff1d22ec3d94d2ed7c5 defines --log, --log-file, and --local-log as path options. Caller-selected verbose-log output is filesystem write authority independent of the approved package artifact.

The verified parser-phase defect was narrower than the initial attached-after-command example: the existing dedicated log classifier could recognize the family after install, but the direct-pip global-option normalizer did not consume parser-valid pre-command forms. The request therefore failed closed generically while losing causal alternate_install_root evidence, and a separate log path could masquerade as artifact evidence.

This remains Wardnet pre-execution argv-admission responsibility only. Wardnet must not open, canonicalize or sandbox the path. quarantine-sandbox-runtime remains canonical owner of effective filesystem/mount/workspace isolation; EgressWeave remains outbound transport owner; AppGuardrail remains static package/security analysis owner.

Hosted hostile RED — established

Test-only #431 exact ea5e4994d7bee013178c04c7b9d6bfb0a0d3f9f6 kept production source byte-identical to its then-current #129 parent and exercised parser-valid pre-command pip / pip3 General Options, including attached and separate log-value forms, with a reviewed direct install as the positive control.

Fuzz 35031897252 completed SUCCESS. CI 35031897218, rust job 104592062846, passed checkout/toolchain/format and reached the semantic assertion. For pre-command --log=/tmp/wardnet-pip.log, Wardnet observed [ForbiddenCommand, ArtifactNotApproved] instead of causal alternate_install_root evidence without manufactured artifact evidence. This was the required hostile semantic RED, not runner/bootstrap/format noise.

Minimum causal repair — exact GREEN and normally integrated

Repair exact eedaa3fb46e89ce740c28269654235ba99c51912 reused the existing reviewed pip log-option spelling predicate in the direct-pip General Options normalization seam. Attached values remain option grammar; separately supplied log paths are attached only in the internal normalized policy copy so they cannot be interpreted as package operands. Exact submitted argv/hash remains the audit identity.

The repair did not add a second pip parser, broaden accepted option spellings, authorize or inspect the requested path, execute pip, duplicate quarantine-sandbox-runtime policy, copy foreign-owner logic, add mutable sibling dependencies, or change the supported-install command boundary.

On that unchanged repair head, CI 35046405436 and Fuzz 35046405418 completed SUCCESS. Fresh review generated no actionable finding. #431 was then normally merged into canonical #129 as merge commit 71451ce3a70d4b64b380dd0566c03c0a37465d65.

That parent movement invalidated predecessor #129 gate conclusions. On exact-current #129, CI 35069871595, Fuzz 35069871570, Security Scan 35069871562, and SAST Semgrep 35069871667 are terminal SUCCESS; CodeQL PR 35069871577 remains QUEUED at the latest fresh read. The active serialized admission child is issue #432 / Draft #433 exact 35de5dc66992c72c3d634969d72ac0de403be1a2. Its test-only predecessor established repository-native semantic RED for parser-valid pip/pip3 pre-command --cache-dir; its minimum semantic repair plus formatter-owned correction now await exact-head CI 35133704088 and Fuzz 35133704131, both currently QUEUED.

Completion gate

Keep this issue open because the effective repair is not yet on protected main. Close only after #129 or a verified complete successor preserving this exact implementation/test/fixture/contract/evidence delta reaches protected main. Predecessor checks do not transfer; no force update, destructive rebase, self/model approval, routine bypass, gate weakening, source copy, cross-service SQL, mutable foreign dependency or dispatch-only churn.

[seonghobae]

Fresh parser-phase follow-up from canonical #129@951b3cb68621e4fbb8c6076d0b447b8481551b16: the integrated #270 repair covers log authority only when install is the first pip argument, but upstream pip's General Options accept the same --log / --log-file / --local-log family before command selection. The live Wardnet global-option normalizer does not currently preserve that family into causal policy evaluation.

Serialized Draft child #431 now holds a test-only hostile head ea5e4994d7bee013178c04c7b9d6bfb0a0d3f9f6. It requires parser-valid pre-command log options to remain Block with causal alternate_install_root, without manufactured artifact_not_approved, while preserving the exact submitted argv hash. Production source is byte-identical to the exact parent. Hosted CI/Fuzz are currently queued; no production repair will be made until hosted execution reaches the semantic assertion.

Primary source remains pypa/pip@2b28a816d043826f2ba10ff1d22ec3d94d2ed7c5: cmdoptions.py defines these aliases as General Options, main_parser.py installs general_group before command selection, and pip's unit tests exercise main(["--local-log", "path", "fake"]) as valid pre-command grammar. This is an extension of #270's existing Wardnet-owned admission/evidence boundary, not a new foreign-owner capability.