security(agent-admission): preserve pip global cache-directory authority evidence

[seonghobae]

Refs #128 / canonical Agent Artifact Admission PR #129.

Verified Wardnet-local finding

Fresh review of #129@71451ce3a70d4b64b380dd0566c03c0a37465d65 found a parser-phase evidence gap in direct pip cache-directory authority. Wardnet already blocked caller-selected --cache-dir after pip install, but direct pip/pip3 General Options also permit parser-valid pre-command forms. Those requests failed closed generically while losing causal alternate_install_root evidence, and a consumed cache path could contaminate artifact evidence.

This remains Wardnet's Agent Artifact Admission policy/evidence boundary only. Wardnet does not create, inspect, authorize, mount, isolate, or manage the cache directory. quarantine-sandbox-runtime owns hostile runtime/filesystem isolation, EgressWeave owns executable outbound authorization, AppGuardrail owns its guardrail implementation, and contextual-orchestrator owns Agent/LLM orchestration. No foreign source copy, cross-service SQL, mutable sibling dependency, or ownership duplication is introduced.

Hosted hostile RED

Serialized child #433 started exactly from then-current #129. Test-only exact f6adbc349353de80c55411ba08ae9ca977467073 changed only the existing cache-directory authority contract and exercised pip/pip3 parser-valid pre-command forms:

• --cache-dir=/tmp/wardnet-pip-cache
• --cache-dir /tmp/wardnet-pip-cache

The reviewed direct install remained the positive control. Hosted CI 35070280853 passed checkout/toolchain/format and reached repository tests, then failed the intended semantic assertion. Required behavior was fail-closed Block plus stable alternate_install_root, no manufactured artifact_not_approved from the consumed cache path, and exact submitted-argv command_sha256 identity.

Minimum causal GREEN and integration

Repair exact abc7a4f5aac60d028e218a6b9d8fb8347c01a189 reused the existing direct-pip General Options normalization seam and the already reviewed canonical --cache-dir selector. It did not create a second parser, widen supported command grammar, authorize a filesystem path, execute pip, or add foreign-owner runtime behavior. CI 35089942188 then failed only at cargo fmt --check; exact child 35de5dc66992c72c3d634969d72ac0de403be1a2 applied only rustfmt's canonical formatting.

Fresh exact-child CI 35133704088 and Fuzz 35133704131 subsequently reached terminal SUCCESS on unchanged 35de5dc...; fresh review/thread inventory was clean. #433 was marked Ready and normally merged with fixed expected head into canonical #129 as merge commit fdd3e3dbd73a2838ffdabad41134a9c156cddca6. No force update, destructive rebase, self/model approval, gate weakening or routine bypass was used.

Current effective state — 2026-09-17 KST

Protected/default main remains f8260f1e03836039ff9463dd99fa982e4e270c4b; the repair is therefore not protected truth yet. Canonical #129 is exact fdd3e3dbd73a2838ffdabad41134a9c156cddca6, based on protected main and mechanically mergeable, but remains Draft.

The #433 integration invalidated predecessor #129 gate conclusions. Fresh exact-root workflows are CI 35160465195, Fuzz 35160465198, Security Scan 35160465204, CodeQL PR 35160465225, and SAST Semgrep 35160465226; all remain QUEUED at the latest fresh read. Queue state is incomplete evidence, not GREEN and not a reason for source/no-op redispatch churn.

Completion gate

Keep this issue open until #129 or a verified complete successor carrying the effective implementation/test/contract/evidence delta reaches protected main. Require one unchanged integration candidate with terminal-valid then-live repository/security/coverage/package/SBOM/provenance/review/thread/governance evidence plus fresh protected-base compatibility. Predecessor results do not transfer.

No force update, destructive rebase, self/model approval, routine administrator bypass, gate weakening, source copy, cross-service SQL, mutable foreign dependency, package-manager execution, filesystem authority, or dispatch-only churn.