From ea9c817a8d0edd0e78052d18493a1f1f0954e91f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 19 Sep 2026 09:09:43 +0900 Subject: [PATCH 1/5] test(admission): expose uv global provider value boundary gap --- ...python_provider_value_boundary_contract.rs | 171 ++++++++++++++++++ 1 file changed, 171 insertions(+) create mode 100644 crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs diff --git a/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs b/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs new file mode 100644 index 00000000..618702ce --- /dev/null +++ b/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs @@ -0,0 +1,171 @@ +use wardnet_agent_artifact_admission::{ + AdmissionPolicy, ApprovedArtifact, ApprovedManifest, ArtifactCoordinate, DecisionKind, + InstallIntent, InstructionSource, InstructionSourceKind, ReasonCode, admission_decision, + sha256_hex, +}; + +#[test] +fn parser_valid_global_project_value_named_run_preserves_python_provider_evidence() { + for option in ["--managed-python", "--no-managed-python"] { + let (policy, mut intent) = approved_uv_install(); + intent.argv = vec![ + "uv".to_string(), + "--project".to_string(), + "run".to_string(), + "pip".to_string(), + "install".to_string(), + "cwl-example==1.2.3".to_string(), + "--require-hashes".to_string(), + "--no-deps".to_string(), + "--no-python-downloads".to_string(), + option.to_string(), + ]; + + let decision = admission_decision(&policy, &intent); + + assert_eq!(decision.decision, DecisionKind::Block); + assert!( + decision + .reason_codes + .contains(&ReasonCode::ForbiddenCommand), + "global-option uv install remains deliberately outside the supported command grammar: {:?}", + decision.reason_codes + ); + assert!( + decision + .reason_codes + .contains(&ReasonCode::AlternateInstallRoot), + "the value token `run` consumed by --project is not the uv run command and must not erase causal {option} provider evidence: {:?}", + decision.reason_codes + ); + assert_eq!( + decision.command_sha256, + sha256_hex(intent.argv.join("\u{1f}").as_bytes()), + "audit identity must remain bound to the exact submitted argv" + ); + } +} + +#[test] +fn ordinary_global_project_value_keeps_existing_provider_evidence_control() { + for option in ["--managed-python", "--no-managed-python"] { + let (policy, mut intent) = approved_uv_install(); + intent.argv = vec![ + "uv".to_string(), + "--project".to_string(), + "workspace".to_string(), + "pip".to_string(), + "install".to_string(), + "cwl-example==1.2.3".to_string(), + "--require-hashes".to_string(), + "--no-deps".to_string(), + "--no-python-downloads".to_string(), + option.to_string(), + ]; + + let decision = admission_decision(&policy, &intent); + + assert_eq!(decision.decision, DecisionKind::Block); + assert!( + decision + .reason_codes + .contains(&ReasonCode::ForbiddenCommand) + ); + assert!( + decision + .reason_codes + .contains(&ReasonCode::AlternateInstallRoot), + "a non-command global value already preserves {option} provider evidence: {:?}", + decision.reason_codes + ); + } +} + +#[test] +fn actual_uv_run_after_global_project_value_does_not_gain_install_provider_semantics() { + for option in ["--managed-python", "--no-managed-python"] { + let (policy, mut intent) = approved_uv_install(); + intent.argv = vec![ + "uv".to_string(), + "--project".to_string(), + "workspace".to_string(), + "run".to_string(), + option.to_string(), + "python".to_string(), + ]; + + let decision = admission_decision(&policy, &intent); + + assert_eq!(decision.decision, DecisionKind::Block); + assert!( + decision + .reason_codes + .contains(&ReasonCode::ForbiddenCommand) + ); + assert!( + !decision + .reason_codes + .contains(&ReasonCode::AlternateInstallRoot), + "actual uv run remains outside Agent Artifact Admission install-provider semantics: {:?}", + decision.reason_codes + ); + assert_eq!( + decision.command_sha256, + sha256_hex(intent.argv.join("\u{1f}").as_bytes()) + ); + } +} + +fn approved_uv_install() -> (AdmissionPolicy, InstallIntent) { + let artifact = ArtifactCoordinate { + ecosystem: "pypi".to_string(), + name: "cwl-example".to_string(), + version: "1.2.3".to_string(), + registry_url: "https://pypi.org/simple".to_string(), + owner: "ContextualWisdomLab".to_string(), + sha256: "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc".to_string(), + artifact_argument: "cwl-example==1.2.3".to_string(), + }; + let policy = AdmissionPolicy { + policy_id: "uv-global-python-provider-value-boundary".to_string(), + policy_revision: "2026-09-19.1".to_string(), + allowed_executables: vec!["uv".to_string()], + approved_manifests: vec![ApprovedManifest { + workspace_id: "ContextualWisdomLab/wardnet".to_string(), + sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(), + }], + approved_artifacts: vec![ApprovedArtifact { + ecosystem: artifact.ecosystem.clone(), + name: artifact.name.clone(), + version: artifact.version.clone(), + registry_url: artifact.registry_url.clone(), + owner: artifact.owner.clone(), + sha256: artifact.sha256.clone(), + artifact_argument: artifact.artifact_argument.clone(), + }], + }; + let intent = InstallIntent { + request_id: "req-uv-global-python-provider-value-boundary".to_string(), + actor_id: "agent:wardnet:admission".to_string(), + workspace_id: "ContextualWisdomLab/wardnet".to_string(), + operation: "install".to_string(), + argv: vec![ + "uv".to_string(), + "pip".to_string(), + "install".to_string(), + "cwl-example==1.2.3".to_string(), + "--require-hashes".to_string(), + "--no-deps".to_string(), + "--no-python-downloads".to_string(), + ], + manifest_sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + .to_string(), + source: InstructionSource { + kind: InstructionSourceKind::ReviewedConfig, + uri: None, + content_sha256: None, + }, + artifacts: vec![artifact], + }; + (policy, intent) +} From 1dfcdcb38b5ef9bc2bee25e48dc63a15e65117a5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 19 Sep 2026 16:05:57 +0900 Subject: [PATCH 2/5] fix(security): parse uv provider authority at active command boundary --- .../src/pypi_python_interpreter_authority.rs | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/crates/agent-artifact-admission/src/pypi_python_interpreter_authority.rs b/crates/agent-artifact-admission/src/pypi_python_interpreter_authority.rs index e07d655c..88efa022 100644 --- a/crates/agent-artifact-admission/src/pypi_python_interpreter_authority.rs +++ b/crates/agent-artifact-admission/src/pypi_python_interpreter_authority.rs @@ -1,4 +1,4 @@ -use crate::InstallIntent; +use crate::{policy::uv_active_command_index, InstallIntent}; /// Return whether a direct-pip General Option token selects the Python interpreter. /// @@ -124,10 +124,9 @@ pub(crate) fn requests_unapproved_uv_python_provider_authority(intent: &InstallI } let arguments = &intent.argv[1..]; - let run_index = arguments.iter().position(|argument| argument == "run"); - let pip_index = arguments.iter().position(|argument| argument == "pip"); - - if run_index.is_some_and(|run_index| pip_index.is_none_or(|pip_index| run_index < pip_index)) { + if uv_active_command_index(arguments) + .is_some_and(|command_index| arguments[command_index] == "run") + { return false; } From d5ccf81300ca7dfa830ab8431999728a8034a972 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sat, 19 Sep 2026 22:03:45 +0900 Subject: [PATCH 3/5] style(admission): apply rustfmt to uv provider boundary regression --- .../uv_global_python_provider_value_boundary_contract.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs b/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs index 618702ce..74d18eaa 100644 --- a/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs +++ b/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs @@ -123,7 +123,8 @@ fn approved_uv_install() -> (AdmissionPolicy, InstallIntent) { version: "1.2.3".to_string(), registry_url: "https://pypi.org/simple".to_string(), owner: "ContextualWisdomLab".to_string(), - sha256: "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc".to_string(), + sha256: "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" + .to_string(), artifact_argument: "cwl-example==1.2.3".to_string(), }; let policy = AdmissionPolicy { @@ -132,7 +133,8 @@ fn approved_uv_install() -> (AdmissionPolicy, InstallIntent) { allowed_executables: vec!["uv".to_string()], approved_manifests: vec![ApprovedManifest { workspace_id: "ContextualWisdomLab/wardnet".to_string(), - sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(), + sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + .to_string(), }], approved_artifacts: vec![ApprovedArtifact { ecosystem: artifact.ecosystem.clone(), From 0213b7eeee6f4714c07361ec9586a5bfabcf9c11 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 20 Sep 2026 03:05:38 +0900 Subject: [PATCH 4/5] style(admission): apply exact rustfmt import order --- .../src/pypi_python_interpreter_authority.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/agent-artifact-admission/src/pypi_python_interpreter_authority.rs b/crates/agent-artifact-admission/src/pypi_python_interpreter_authority.rs index 88efa022..8af85435 100644 --- a/crates/agent-artifact-admission/src/pypi_python_interpreter_authority.rs +++ b/crates/agent-artifact-admission/src/pypi_python_interpreter_authority.rs @@ -1,4 +1,4 @@ -use crate::{policy::uv_active_command_index, InstallIntent}; +use crate::{InstallIntent, policy::uv_active_command_index}; /// Return whether a direct-pip General Option token selects the Python interpreter. /// From f84787e5b6bb4148be417a98957b24e102dd1137 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Sun, 20 Sep 2026 03:05:55 +0900 Subject: [PATCH 5/5] style(admission): finish exact rustfmt output --- .../uv_global_python_provider_value_boundary_contract.rs | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs b/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs index 74d18eaa..618702ce 100644 --- a/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs +++ b/crates/agent-artifact-admission/tests/uv_global_python_provider_value_boundary_contract.rs @@ -123,8 +123,7 @@ fn approved_uv_install() -> (AdmissionPolicy, InstallIntent) { version: "1.2.3".to_string(), registry_url: "https://pypi.org/simple".to_string(), owner: "ContextualWisdomLab".to_string(), - sha256: "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" - .to_string(), + sha256: "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc".to_string(), artifact_argument: "cwl-example==1.2.3".to_string(), }; let policy = AdmissionPolicy { @@ -133,8 +132,7 @@ fn approved_uv_install() -> (AdmissionPolicy, InstallIntent) { allowed_executables: vec!["uv".to_string()], approved_manifests: vec![ApprovedManifest { workspace_id: "ContextualWisdomLab/wardnet".to_string(), - sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" - .to_string(), + sha256: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa".to_string(), }], approved_artifacts: vec![ApprovedArtifact { ecosystem: artifact.ecosystem.clone(),