fix(admission): preserve uv global artifact operand evidence

[seonghobae]

Refs #426. Serialized child of exact #129@24747e2724e3c21b9bdf78a3a9d51aac2b6694b9.

Fresh review found that policy::validate_artifact_operands still recognized uv install grammar only when pip install was at fixed argv positions. Parser-valid uv global options could therefore erase causal ArtifactNotApproved evidence for an undeclared package even though the deliberately narrow supported-command grammar still blocked the request.

Hostile semantic RED

Test-only exact head d0a0e38f7cea8b38cb195a5f9148e39fd36e20bd exercised:

uv --color never pip install cwl-example==1.2.3 undeclared-example==9.9.9 --require-hashes --no-deps --no-python-downloads

Required behavior is fail-closed with both generic ForbiddenCommand and causal ArtifactNotApproved, while command_sha256 remains bound to the exact submitted argv. A consumed --target /tmp/... value must not be fabricated as an artifact operand, non-install uv grammar must not inherit install-operand semantics, and the ordinary supported install remains an Allow control.

CI 34795158441 reached Rust Test after formatting passed and failed on the intended semantic contract; Fuzz 34795158448 completed SUCCESS. Because production source at d0a0e38... was byte-identical to the exact parent and only the hostile contract differed, this is the semantic RED. The older 2bd7486df27bf66c5916974aa1e077b5cfd62a9f formatting failure is explicitly non-semantic.

Minimum causal production repair

Exact fd19ac126a0e90a60164f8f9a24a47ea29490336 makes validate_artifact_operands and is_install_root_selector_value reuse uv_active_command_index, so operand evidence begins only at the active pip install slice after parser-valid uv global options. supported_install_command remains deliberately narrow; no parser is duplicated, no package manager is executed, and no quarantine/EgressWeave/contextual-orchestrator/AppGuardrail logic is copied.

Fuzz 34804779748 completed SUCCESS on fd19...; CI 34804779640 failed only cargo fmt --check. Exact 630cc7fc59b7ca7ea5ebe2b1503e9e499da2fdba then applied exactly the emitted rustfmt diff with no semantic production change. On 630cc7fc..., Fuzz 34817855887 completed SUCCESS and CI 34817855860 reached workspace tests.

Causal test-contract repair

The 630cc7fc... CI failure exposed a fixture/oracle defect rather than a production regression. The non-install negative control changed argv to uv --color never pip sync undeclared-example==9.9.9 ... while InstallIntent.artifacts still declared approved cwl-example==1.2.3. Wardnet's independent immutable artifact/argv binding correctly emitted ArtifactNotApproved because the declared artifact argument was absent; that reason did not come from pip install operand parsing.

Current exact head 27e450bcfc8280376619f0331766eb2ed0efc796 changes only that negative-control fixture: it retains declared cwl-example==1.2.3 and also carries undeclared-example==9.9.9 under uv ... pip sync. This preserves the general artifact-binding invariant while isolating the intended assertion that non-install uv grammar must not inherit pip install operand semantics. Production code is byte-identical to 630cc7fc....

Exact-current CI 34847171263 and Fuzz 34847171299 are QUEUED at the latest fresh read. CodeRabbit and Devin Review commit statuses are success; there are currently no submitted PR reviews or inline review threads. Central hosted-runner admission evidence for this exact head is handed to .github#712; no Wardnet workflow/runner selector change or no-op redispatch is justified.

Keep Draft until both exact-current repository workflows are terminal GREEN. Then re-read exact #129, reviews/threads/checks and candidate-base compatibility and integrate only by ordinary expected-head/non-force merge if still valid. No force push, destructive rebase, self/model approval, gate weakening, synthetic status, source churn merely to redispatch, or routine bypass.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 6b2333b8-0f53-48f3-bc66-7a3c2cdb71c6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}