test(admission): expose uv global indirect source evidence gap

[seonghobae]

Refs #428. Serialized child of exact #129@625879592f0a4d7b06374df2a827cf08f304feb3 after ordinary integration of #427.

Hostile RED

The test-only lineage added a realistic parser-valid uv global-option contract around:

uv --color never pip install -r cwl-example==1.2.3 --require-hashes --no-deps --no-python-downloads

Here cwl-example==1.2.3 is the requirements-file operand consumed by -r, not a reviewed direct package operand. Global-option uv grammar intentionally remains outside supported_install_command, so the request must keep ForbiddenCommand while also preserving causal ArtifactNotApproved evidence for the unapproved indirect source.

Controls cover attached --color=never, non-install uv ... pip sync, the ordinary reviewed direct install, exact submitted-argv hashing, and the previously repaired rule that a consumed install-root value cannot masquerade as the approved artifact token.

Exact test-only 6619db4fb82203af6cc6ac55c788fa679af9c33a established the intended hosted semantic RED. Fuzz 34911607856 completed SUCCESS. CI 34911607878, rust job 104200113638, acquired hosted ubuntu-24.04, passed checkout, Rust toolchain and cargo fmt --check, then failed cargo test --locked --workspace at exactly the two new hostile assertions: uv_global_requirement_source_preserves_indirect_artifact_evidence and attached_uv_global_option_preserves_indirect_artifact_evidence. Both observed only [ForbiddenCommand], proving that parser-valid uv global options erased the required ArtifactNotApproved causal evidence. The other three controls passed. This is semantic RED, not runner/bootstrap/format noise.

Minimum causal repair

Current exact repair head is 0f206d6cb23ca88abfd6f0c0a84e1dcba6e35969. The production delta is limited to policy.rs::requests_indirect_artifact_source(): it reuses existing uv_active_command_index(), requires exact active pip followed by exact install, and scans only arguments[pip_index + 2..] for the already-reviewed indirect-source selectors. supported_install_command is unchanged, no second uv parser was introduced, and no package-manager/runtime execution or foreign-owner logic was copied.

Exact-head GREEN — refreshed 2026-09-16 KST

On unchanged exact repair head 0f206d6cb23ca88abfd6f0c0a84e1dcba6e35969:

• CI 34927770706 / rust job 104249367485 is terminal SUCCESS.
• Fuzz 34927770671 same-head retry has now materialized on hosted compute and is terminal SUCCESS; fuzz job 104374556379 completed successfully without any source/head movement.
• fresh submitted-review inventory is empty;
• fresh inline review-thread inventory is empty;
• GitHub reports this exact child mechanically mergeable against exact parent #129@625879592f0a4d7b06374df2a827cf08f304feb3.

The earlier pre-materialization Fuzz failure/queue specimen remains valid central runner evidence already handed to .github#712, but it is superseded as child readiness evidence by the successful unchanged-head retry. No no-op source churn, runner-selector change, predecessor-result transfer, synthetic status, self/model approval, gate weakening, or bypass was used.

This child is therefore ready for ordinary expected-head integration into #129. After integration, every #129 exact-head gate must be reacquired because the root head will move; issue #428 remains open until the effective repair reaches protected main or a verified complete successor.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}