feat(security): gate AI-agent artifact installation

[seonghobae]

Closes #128 only when this candidate reaches protected main.

Boundary

wardnet-agent-artifact-admission is Wardnet's Rust-first pre-execution policy/evidence boundary for structured installer intents. It does not fetch, decrypt, install, execute, isolate, activate, or route workloads. quarantine-sandbox-runtime owns hostile execution/isolation, contextual-orchestrator owns Agent/LLM orchestration, EgressWeave owns reusable outbound HTTP policy, AppGuardrail owns static package/security analysis, and Noema owns governed activation/orchestration. Foreign capabilities are consumed only through released/versioned ports or ACLs; no sibling source copy, mutable production dependency, or cross-service SQL is introduced.

Policy is deny-by-default and binds reviewed workspace-manifest SHA-256 plus exact artifact ecosystem/name/version/HTTPS registry/owner/SHA-256, executable family, declared operands and bounded provenance. An allow receipt is admission authority only; it is not proof of retrieved bytes or runtime activation.

Retained TDD and security contract

The branch preserves hostile RED→causal-fix lineage for package-manager ecosystem binding; exact npm/PyPI source coordinates; alternate registry/index/config/workspace/install-root denial; npm/pnpm/Yarn/Bun lifecycle and trust controls; Cargo source/version/build/overwrite/tracking authority; PyPI build/target variants and exact --no-deps dependency cardinality; npm-family direct resolver denial until an immutable reviewed lock/material-set contract exists; OCI digest/platform/cardinality; and Podman TLS/certificate/authentication/decryption authority. Resolver-selected or caller-selected material absent from the reviewed intent does not inherit approval.

The PyPI hash-mode repair remains retained: RED 032d74e060e778add00a2cc757ce3582c1135232 proves --require-hashes plus hostile --no-require-hashes cannot remain admissible; classifier 4c0de8a3445d6b062b69440507cd3c81a3323308 isolates pip/pip3 hash-mode authority; causal repair bba656c1d776da38a7315d9ec8e6cb5bdfd621d1 fails the contradictory request closed. Retrieved bytes still require independent digest/equivalent immutable-provenance verification before installation/execution.

Protected-main adoption — 2026-09-06 KST

The prior exact source candidate db921e7f855f52870b23de52a4e23f11ff996644 was based on protected 5829a0f08d78de464dd24393ce5d0f25fba9d126. Fresh comparison to current protected/default main@a52ccd0a24a727d9349bb32def7713882d8cad1e proved the entire intervening protected delta is exactly two #171 files: docs/adr/2026-09-05-anti-bot-acquisition-boundary.md and docs/adr/README.md. Fresh inventory of this PR's 67 feature paths proves neither path is modified by Agent Artifact Admission.

The branch therefore adopted current protected truth non-destructively with two-parent merge 14c0af32e7e4f68c682d55a1b1117629fa940336, preserving exact prior candidate db921e7... and exact protected main@a52ccd0... as parents and carrying both protected ADR blobs byte-for-byte. No force push or destructive rebase was used. Fresh compare against protected main is merge-base=a52ccd0..., ahead 251 / behind 0; the effective product/security delta remains the same 67 Agent Artifact Admission paths.

All workflow conclusions from db921e7... are predecessor evidence after this real ancestry movement. Current exact source remains 14c0af32e7e4f68c682d55a1b1117629fa940336 and remains Draft.

Exact-current execution — refreshed 2026-09-07 KST

The earlier queued snapshot is superseded. On unchanged exact 14c0af32e7e4f68c682d55a1b1117629fa940336, CI 34020063254, Fuzz 34020063220, Security Scan 34020063214, and SAST Semgrep 34020063245 are terminal SUCCESS.

CodeQL PR 34020063240 is the sole failing repository gate. Detect CodeQL languages job 101450870096 is terminal success on a real ubuntu-24.04 runner. CodeQL compatibility analysis (actions) job 101455085963 also acquired a real hosted runner and successfully completed Request current-head CodeQL scan dispatch; it fails only at Release runner or enforce current-head CodeQL verdict. This is the same central authenticated-dispatch/verdict boundary tracked in .github#1927/#1929 after .github#1926 repaired the earlier matrix-serialization defect. Do not source-churn this unchanged Agent Artifact Admission candidate or promote predecessor/manual/synthetic CodeQL evidence.

Current inline review-thread inventory is fully resolved/outdated. The only recorded review submissions are COMMENTED records and do not constitute independent approval. Keep Draft while CodeQL and the live solo-maintainer governance rule remain non-passing.

Context Fabric / EA

Wardnet does not modify context-graph-contracts or enterprise-architecture-core source/PR state. Shared artifact/activation objects remain canonical owner work and architecture adoption/risk/provenance projection remains EA owner work. Package-manager argv and Wardnet-local reason codes stay local. Fresh foreign release inventory remains empty for the required CGC/EA/EgressWeave boundaries, so mutable owner heads are not Wardnet production authority.

The sole docs/product-technical-gap-baseline.md writer remains PR #130; this PR does not edit that ledger.

Merge only through ordinary protected governance after one unchanged exact head has terminal-valid repository/security/coverage/package/SBOM/provenance/review/thread gates, fresh protected-base compatibility, and governance satisfiable without self/model approval or routine administrator bypass. No mutable foreign dependency, source churn solely to redispatch, gate weakening, force push/destructive rebase, or predecessor-evidence reuse.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@jules Exact-head repair request for feat/agent-artifact-admission only.

Expected head: f6889079ce49b6f08865180dd6a1ffd8145a8192; protected base observed: main@5829a0f08d78de464dd24393ce5d0f25fba9d126.

CI 33904242427, job 101230630469, reached checkout and failed deterministically at cargo fmt --check under Rust/rustfmt 1.98.1. This is a mechanical formatting defect, not a runner wait. Please re-read the branch head before writing; if it is no longer the expected SHA, do not overwrite intervening work. On the unchanged head, run repository cargo fmt with the effective toolchain and commit only the resulting rustfmt changes on the existing PR branch. Do not change semantics, dependencies, workflows, PR base/state, gates, or history; no force push/rebase. Then run cargo fmt --check locally if available and leave remote CI/security evidence to the new exact head. The PR must remain Draft until exact-head deterministic/security gates are terminal and valid review threads are clear.