test(security): prove global pip log authority causal evidence

[seonghobae]

Refs #270. Serialized child of canonical Agent Artifact Admission #129.

Finding

Exact parent #129@951b3cb68621e4fbb8c6076d0b447b8481551b16 already rejects pip install ... --log... as caller-selected filesystem write authority, but pip defines --log, --log-file, and --local-log in its General Options and accepts them before command selection. The current Wardnet direct-pip global-option normalizer did not consume this reviewed option family, while the dedicated log classifier required install to be the first argument after pip/pip3.

As a result, a parser-valid request such as pip --log /tmp/wardnet-pip.log install cwl-example==1.2.3 --require-hashes --no-deps --no-input failed closed generically, lost the causal alternate_install_root evidence, and misclassified the consumed log path as artifact evidence. For a security evidence/policy product, generic rejection is not a sufficient successor to the specific write-authority evidence already promised by #270.

Primary-source check: pypa/pip@2b28a816d043826f2ba10ff1d22ec3d94d2ed7c5 defines the log aliases in cmdoptions.py; main_parser.py installs general_group before command selection; pip's tests/unit/test_options.py explicitly exercises main(["--local-log", "path", "fake"]) and the post-command equivalent.

This stays inside Wardnet's pre-execution argv admission/evidence boundary. It does not duplicate filesystem isolation from quarantine-sandbox-runtime, outbound policy from EgressWeave, orchestration from contextual-orchestrator, or AppGuardrail logic.

Hostile RED

Test-only exact head ea5e4994d7bee013178c04c7b9d6bfb0a0d3f9f6 changed only crates/agent-artifact-admission/tests/pypi_log_output_authority_contract.rs; production source was byte-identical to the parent.

Hosted CI 35031897218, rust job 104592062846, passed checkout/toolchain/format and the existing workspace suite until the new hostile contract. valid_global_pip_log_options_remain_causal_write_authority_evidence then failed semantically on parser-valid --log=/tmp/wardnet-pip.log, observing [ForbiddenCommand, ArtifactNotApproved] instead of causal alternate_install_root without manufactured artifact evidence. Fuzz 35031897252 was terminal SUCCESS on the same test-only source head.

The contract covers pip and pip3, complete aliases, separated/attached values, and representative already-reviewed unambiguous prefixes in the valid pre-command position. It requires:

• Block before execution;
• causal alternate_install_root evidence;
• no manufactured artifact_not_approved from the log path consumed by pip option grammar;
• exact submitted argv hash preservation.

Minimum causal repair

Current exact repair head: eedaa3fb46e89ce740c28269654235ba99c51912.

The repair makes the already-reviewed pip log spelling predicate reusable by the existing direct-pip General Options normalization seam. Pre-command attached log values remain option tokens; separate log paths are attached only in the internal normalized policy copy so consumed option grammar cannot masquerade as an artifact operand. The submitted intent remains authoritative for command hashing/audit identity. No new parser, accepted log spelling, path authorization, foreign-owner runtime logic, dependency, or gate weakening was added.

Exact-head CI 35046405436 and Fuzz 35046405418 have materialized for this repair head and are currently QUEUED. Keep Draft until the unchanged exact head reaches terminal GREEN and current review/thread evidence remains clear. Do not churn the source merely to redispatch queued jobs.

No force update, destructive rebase, self/model approval, routine bypass, mutable sibling dependency, or protected-base source churn.

Summary by CodeRabbit

• 버그 수정
  • pip 및 pip3 명령에서 전역 로그 옵션(--log 등)을 올바르게 인식합니다.
  • 별도 로그 경로와 --log=값 형식을 지원하며, 비어 있거나 유효하지 않은 값은 계속 안전하게 거부합니다.
  • 로그 옵션이 포함된 승인되지 않은 설치 명령은 적절한 사유로 차단됩니다.
  • 차단 결과에서 로그 경로가 잘못된 오류로 분류되지 않으며, 감사용 명령 식별자가 보존됩니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a1b235fc-5c3e-46ff-8b26-4a607799d7d8

📥 Commits

Reviewing files that changed from the base of the PR and between 951b3cb and eedaa3f.

📒 Files selected for processing (3)

• crates/agent-artifact-admission/src/pypi_global_option_authority.rs
• crates/agent-artifact-admission/src/pypi_log_output_authority.rs
• crates/agent-artifact-admission/tests/pypi_log_output_authority_contract.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

pip 전역 --log 옵션을 검토된 문법으로 인식하도록 변경했습니다. 분리된 로그 경로를 정규화하고 유효하지 않은 값은 거부합니다. pip 및 pip3 회귀 테스트는 차단 사유와 감사 식별자를 검증합니다.

Changes

pip 전역 로그 옵션 지원

Layer / File(s)	Summary
로그 옵션 정규화 crates/agent-artifact-admission/src/pypi_log_output_authority.rs, crates/agent-artifact-admission/src/pypi_global_option_authority.rs	matches_pip_log_option을 pub(crate)으로 변경했습니다. normalize_reviewed_direct_pip_global_options는 분리된 로그 경로를 --log=VALUE로 정규화하고, 결합된 형식은 그대로 전달합니다. 빈 값, install로 시작하는 값, 옵션처럼 보이는 값은 None을 반환합니다.
로그 옵션 회귀 검증 crates/agent-artifact-admission/tests/pypi_log_output_authority_contract.rs	pip 및 pip3의 유효한 전역 로그 옵션 조합이 Block 결정과 alternate_install_root 사유를 유지하는지 검증합니다. 로그 경로가 artifact_not_approved 사유로 분류되지 않고, 제출된 argv의 SHA-256 감사 식별자가 유지되는지 확인합니다.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant PipCommand
  participant normalize_reviewed_direct_pip_global_options
  participant ArtifactAdmission
  PipCommand->>normalize_reviewed_direct_pip_global_options: 전역 --log 옵션과 경로 전달
  normalize_reviewed_direct_pip_global_options->>ArtifactAdmission: 정규화된 --log=VALUE 전달
  ArtifactAdmission-->>PipCommand: Block 및 alternate_install_root 결정 반환

Loading

Merge Risk: ⚪ Minimal · up to eedaa

No actionable issue remains from the reviewed change.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 80.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 전역 pip 로그 옵션에 대한 보안 회귀 테스트와 인과적 권한 증거 검증을 정확히 설명합니다. 프로덕션 정규화 수정 전체를 언급하지 않지만 주요 변경과 직접 관련됩니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/pip-global-log-output-authority-20260916

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.