fix(security): preserve global pip cache authority evidence

[seonghobae]

Refs #432 and canonical Agent Artifact Admission parent #129.

Finding and ownership

Fresh review of #129@71451ce3a70d4b64b380dd0566c03c0a37465d65 found that direct pip/pip3 General Options may place --cache-dir before command selection. Wardnet already rejected caller-selected cache directories after install, but the direct-pip global-option normalizer did not consume the parser-valid pre-command family. The request therefore failed closed generically while losing causal alternate_install_root evidence, and a separately supplied cache path could masquerade as artifact evidence.

This is Wardnet's Agent Artifact Admission policy/evidence boundary only. Wardnet does not create, inspect, authorize, mount, isolate, or manage the cache directory. quarantine-sandbox-runtime retains hostile runtime/filesystem isolation, EgressWeave retains executable outbound authorization, AppGuardrail retains its guardrails, and contextual-orchestrator retains Agent/LLM orchestration. No foreign source copy, cross-service SQL, mutable sibling dependency, or ownership duplication is introduced.

Hosted hostile RED

The test-only exact head f6adbc349353de80c55411ba08ae9ca977467073 changed only the existing cache-directory authority contract test and exercised both pip and pip3 with parser-valid pre-command forms:

• --cache-dir=/tmp/wardnet-pip-cache
• --cache-dir /tmp/wardnet-pip-cache

The reviewed baseline install remained the positive control. Required evidence was fail-closed Block plus stable alternate_install_root, no manufactured artifact_not_approved from the consumed cache path, and exact submitted-argv command_sha256 identity.

Hosted CI 35070280853 reached repository tests after checkout, toolchain and formatting succeeded, then failed the hostile contract. This is the semantic RED; runner/bootstrap/format noise is not being used as evidence.

Minimum causal repair candidate

Current exact head is 35de5dc66992c72c3d634969d72ac0de403be1a2. The semantic repair reuses the existing direct-pip General Options normalization seam:

• pypi_cache_directory_authority::direct_pip_cache_directory_selector() exposes only the already reviewed canonical --cache-dir spelling;
• pypi_global_option_authority delegates to that selector rather than duplicating a parser or broadening supported command grammar;
• attached and separate-value pre-command forms normalize only inside the policy copy, while exact submitted argv/hash remains audit identity;
• existing post-command abbreviation behavior is unchanged.

Exact predecessor abc7a4f5aac60d028e218a6b9d8fb8347c01a189 reached a hosted runner. Fuzz 35089942110 is terminal SUCCESS, but CI 35089942188 failed before tests because cargo fmt --check required the canonical one-line formatting of matches_canonical_pip_cache_directory_option. The failure log showed only that rustfmt delta. Current exact 35de5dc... applies that formatter-owned change and no semantic policy broadening.

No filesystem authorization, pip execution, runtime cache behavior, foreign-owner logic, new dependency, force update, destructive rebase, self/model approval, gate weakening, or routine bypass is part of the repair.

Exact-head acceptance

Fresh exact-head CI 35133704088 and Fuzz 35133704131 are QUEUED on 35de5dc66992c72c3d634969d72ac0de403be1a2. Keep Draft and do not integrate until both are terminal GREEN, review/thread state is freshly re-read, and parent #129@71451ce3a70d4b64b380dd0566c03c0a37465d65 remains the exact compatible base. Predecessor Fuzz success does not transfer after the formatting commit.

Once unchanged-head acceptance is GREEN, use ordinary expected-head integration into #129. Issue #432 stays open until the effective delta reaches protected main through #129 or a verified complete successor.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: bc3b7d47-0cac-4602-b55c-51bbed4f2f92

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

Review exact head 35de5dc66992c72c3d634969d72ac0de403be1a2 against exact parent #129@71451ce3a70d4b64b380dd0566c03c0a37465d65. Focus on parser-valid pip/pip3 pre-command --cache-dir normalization, causal alternate_install_root evidence, submitted-argv SHA-256 identity, false artifact-evidence suppression, and ownership boundaries. Do not broaden package grammar, authorize filesystem/runtime behavior, copy foreign-owner logic, or weaken deny-by-default admission.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head="35de5dc66992c72c3d634969d72ac0de403be1a2"
base="71451ce3a70d4b64b380dd0566c03c0a37465d65"

printf '%s\n' '=== commit presence and ancestry ==='
git cat-file -e "${head}^{commit}"
git cat-file -e "${base}^{commit}"
git merge-base --is-ancestor "$base" "$head" && echo "base_is_ancestor=true" || echo "base_is_ancestor=false"
git merge-base "$base" "$head"

printf '%s\n' '=== exact changed files ==='
git diff --name-status "$base" "$head"
printf '%s\n' '=== exact diff ==='
git diff --find-renames --find-copies --unified=80 "$base" "$head"

printf '%s\n' '=== candidate Rust files ==='
fd -e rs . | sort

printf '%s\n' '=== relevant definitions and uses ==='
rg -n -C 8 --type rust \
  'direct_pip_cache_directory_selector|pypi_global_option_authority|matches_canonical_pip_cache_directory_option|alternate_install_root|command_sha256|cache-dir' \
  . -g '!target/**' || true

printf '%s\n' '=== PR metadata and checks ==='
gh pr view 433 --repo ContextualWisdomLab/wardnet --json number,state,isDraft,headRefOid,baseRefOid,statusCheckRollup,reviewDecision,url \
  --jq '{number,state,isDraft,headRefOid,baseRefOid,reviewDecision,url,statusCheckRollup:[.statusCheckRollup[]|{name,conclusion,status,detailsUrl}]}'
printf '%s\n' '=== parent PR metadata ==='
gh pr view 129 --repo ContextualWisdomLab/wardnet --json number,state,headRefOid,url \
  --jq '{number,state,headRefOid,url}'

Length of output: 201955

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

head="35de5dc66992c72c3d634969d72ac0de403be1a2"
base="71451ce3a70d4b64b380dd0566c03c0a37465d65"

printf '%s\n' '=== changed files ==='
git diff --name-status "$base" "$head"

printf '%s\n' '=== commits from base to head ==='
git log --oneline "$base..$head"

printf '%s\n' '=== focused source diff ==='
git diff --unified=120 "$base" "$head" -- \
  crates/agent-artifact-admission/src/pypi_global_option_authority.rs \
  crates/agent-artifact-admission/src/pypi_cache_directory_authority.rs \
  crates/agent-artifact-admission/tests/pypi_cache_dir_authority_contract.rs

printf '%s\n' '=== global normalizer ==='
sed -n '1,260p' crates/agent-artifact-admission/src/pypi_global_option_authority.rs
printf '%s\n' '=== cache directory authority ==='
sed -n '1,180p' crates/agent-artifact-admission/src/pypi_cache_directory_authority.rs
printf '%s\n' '=== cache directory contract ==='
sed -n '1,210p' crates/agent-artifact-admission/tests/pypi_cache_dir_authority_contract.rs
printf '%s\n' '=== decision orchestration and install-root attribution ==='
sed -n '45,110p' crates/agent-artifact-admission/src/lib.rs
sed -n '150,190p' crates/agent-artifact-admission/src/policy.rs
sed -n '807,870p' crates/agent-artifact-admission/src/policy.rs
sed -n '320,365p' crates/agent-artifact-admission/src/lib.rs

Length of output: 46823

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '=== pypi cache authority call sites ==='
rg -n -C 10 --type rust \
  'requests_unapproved_pypi_cache_directory_authority\s*\(' \
  crates/agent-artifact-admission/src

printf '%s\n' '=== complete pip branch of alternate install-root classifier ==='
sed -n '850,960p' crates/agent-artifact-admission/src/policy.rs

printf '%s\n' '=== artifact source and artifact variant operand classifiers ==='
sed -n '1,280p' crates/agent-artifact-admission/src/artifact_source_identity.rs
sed -n '1,260p' crates/agent-artifact-admission/src/artifact_variant.rs

printf '%s\n' '=== relevant selector and normalizer unit tests ==='
rg -n -C 12 --type rust \
  'matches_canonical_pip_cache_directory_option|normalize_reviewed_direct_pip_global_options|cache-dir' \
  crates/agent-artifact-admission/src/pypi_global_option_authority.rs \
  crates/agent-artifact-admission/src/pypi_cache_directory_authority.rs

printf '%s\n' '=== all exact-head changes outside Agent Artifact Admission ==='
git diff --name-only 71451ce3a70d4b64b380dd0566c03c0a37465d65 35de5dc66992c72c3d634969d72ac0de403be1a2 \
  | grep -v '^crates/agent-artifact-admission/' || true

Length of output: 34216

---

@seonghobae Reviewed exact head 35de5dc66992c72c3d634969d72ac0de403be1a2 against exact parent #129@71451ce3a70d4b64b380dd0566c03c0a37465d65.

I found no code-level findings in the requested scope.

• The change accepts only canonical pre-command --cache-dir forms for direct pip and pip3.
• The change does not add pre-command abbreviation support.
• Attached and separate values normalize only in the policy copy.
• The cache selector remains visible to the existing cache-authority classifier.
• The classifier produces alternate_install_root and keeps the decision as Block.
• The consumed separate cache path does not become an artifact operand.
• command_sha256 is restored from the exact submitted argv.
• The test covers both executables and both parser-valid forms.
• The diff is limited to crates/agent-artifact-admission. It does not add filesystem, runtime, foreign-owner, or cross-service behavior.

The exact-head rust and fuzz checks were still queued when I inspected the PR. PR #433 remains Draft. Do not integrate before the exact-head checks are terminal green and the required final thread review is complete.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.