Agent Artifact Admission: preserve uv global artifact-operand evidence

[seonghobae]

Finding

Agent Artifact Admission previously recognized uv install artifact operands only when pip install occupied fixed positions immediately after the executable. Parser-valid uv global options could therefore erase causal ArtifactNotApproved evidence even though the deliberately narrow supported_install_command grammar continued to fail closed with generic ForbiddenCommand.

A representative hostile argv was:

uv --color never pip install cwl-example==1.2.3 undeclared-example==9.9.9 --require-hashes --no-deps --no-python-downloads

The repair belongs to Wardnet's admission/evidence boundary. It does not widen executable grammar or duplicate quarantine-sandbox-runtime, EgressWeave, contextual-orchestrator, AppGuardrail, CGC or EA authority.

Hosted semantic RED

Draft #427 was created as the sole serialized child of then-current canonical #129. Test-only exact d0a0e38f7cea8b38cb195a5f9148e39fd36e20bd kept production source byte-identical to its parent.

CI 34795158441, rust job 103826690234, passed checkout/toolchain and cargo fmt --check, then failed the intended semantic contract: the hostile global-option install returned only ForbiddenCommand instead of preserving causal ArtifactNotApproved. The ordinary supported install and consumed-install-root controls passed. Fuzz 34795158448 completed SUCCESS. The earlier exact 2bd7486df27bf66c5916974aa1e077b5cfd62a9f failed only formatting and is not semantic RED.

Minimum causal repair and exact GREEN

The production repair reused the existing uv_active_command_index() parser boundary in validate_artifact_operands() and install-root operand handling. It evaluates only the active uv pip install slice after reviewed global options, keeps consumed install-root values out of artifact operands, leaves non-install uv grammar free of install-artifact semantics, and does not widen supported_install_command.

A later CI result exposed a test-oracle confound in the non-install control: the fixture had removed the approved artifact token, so independent exact artifact/argv binding correctly emitted ArtifactNotApproved. Final exact child 27e450bcfc8280376619f0331766eb2ed0efc796 corrected only that fixture while retaining the repaired production semantics.

On unchanged exact #427 27e450bcfc8280376619f0331766eb2ed0efc796:

• CI 34847171263 — SUCCESS;
• Fuzz 34847171299 — SUCCESS;
• no valid submitted review or inline review finding remained at the merge sweep.

Integration status — refreshed 2026-09-15 KST

#427 was normally merged into canonical Draft #129 with expected-head/non-force protection. Current #129 exact head is merge commit 625879592f0a4d7b06374df2a827cf08f304feb3, based on protected main@f8260f1e03836039ff9463dd99fa982e4e270c4b. No force update, destructive rebase, self/model approval, gate weakening or routine bypass was used.

The effective repair is therefore present in the canonical unprotected admission candidate, but it has not reached protected main. Keep this issue open until #129 or a verified complete successor carrying the full code/test/fixture/evidence delta reaches protected truth.

The next independent serialized finding is #428 / Draft #429. It covers indirect requirement-source attribution after uv global options and is not a reason to reopen or rewrite this already-integrated causal repair.

Completion gate

Close only after the effective #426/#427 delta reaches protected main through #129 or a verified complete successor and one unchanged protected integration candidate satisfies then-live repository/security/coverage/package/SBOM/provenance/review/thread/governance gates with fresh protected-base compatibility.

No predecessor-evidence transfer, source churn for redispatch, force push, destructive rebase, self/model approval, routine administrator bypass, gate weakening, mutable foreign dependency, source copy, cross-service SQL or foreign-owner logic duplication.