security(admission): reject direct-pip Requires-Python compatibility override

[seonghobae]

Refs #128 / canonical Agent Artifact Admission #129.

Verified Wardnet-local gap

Fresh exact review of #129@22c50d886d9e2ed8f5c376bacff8ec1f8a0d5b6c shows direct pip/pip3 install admission has explicit fail-closed handling for caller-selected package-manager safety overrides such as --break-system-packages, but no classifier for canonical --ignore-requires-python.

Pinned upstream authority pypa/pip@2b28a816d043826f2ba10ff1d22ec3d94d2ed7c5 defines --ignore-requires-python as a store_true install option whose documented behavior is “Ignore the Requires-Python information.” The install command passes options.ignore_requires_python into resolver construction. An otherwise reviewed exact artifact can therefore ask pip to disregard publisher-declared Python compatibility without changing Wardnet's approved ecosystem/name/version/registry/owner/hash coordinate.

This is a caller-selected structured-argv safety override at Wardnet's Agent Artifact Admission boundary. Wardnet must not inspect the effective interpreter, infer runtime compatibility, execute pip, or duplicate quarantine-sandbox-runtime environment/isolation authority. Runtime compatibility remains the executor/runtime owner's responsibility; Wardnet only refuses an explicit request to disable the package manager's metadata safety check.

Hostile realistic RED

Create one serialized Draft child from exact current #129. Keep production source byte-identical in the RED commit. Hosted CI must pass checkout/toolchain/format and reach a semantic assertion proving, for both pip and pip3:

• the exact reviewed baseline install remains Allow;
• adding canonical --ignore-requires-python must be required to return Block with stable ReasonCode::MissingSafetyFlag;
• the denial is causal to this selector, not incidental artifact-cardinality or command-path rejection.

Do not claim parser abbreviations in this slice. Canonical exact spelling is sufficient to prove and repair the current gap; any accepted prefix language requires separate pinned-parser verification.

Minimum causal GREEN

Add one narrow direct-pip classifier for canonical --ignore-requires-python and wire it to MissingSafetyFlag. Preserve uv and other installer grammars independently; do not inspect environment variables, interpreter state, package metadata, wheels/sdists, or executor filesystem/network state.

Preserve all existing artifact/manifest/hash/dependency/source/trust/proxy/config/keyring/output/cache/install-root/system-package/mutation/audit invariants.

Completion gate

Require one unchanged child head with formatting, locked workspace tests, strict Clippy, Fuzz, Security Scan, SAST and then-live review/thread evidence before ordinary expected-head integration into still-exact #129. After integration, reacquire #129 exact-current evidence. Keep this issue open until #129 or a verified complete successor carrying the full RED/GREEN/test/doc/evidence delta reaches protected main.

No force update, destructive rebase, self/model approval, routine administrator bypass, gate weakening, mutable foreign dependency, source copy, cross-service SQL, ambient-runtime inference, or predecessor-evidence promotion.

TRACEABILITY

• Python Packaging Authority. (2026). pip command options, commit 2b28a816d043826f2ba10ff1d22ec3d94d2ed7c5: --ignore-requires-python explicitly disables Requires-Python compatibility enforcement.
• Python Packaging Authority. (2025). Core Metadata Specifications — Requires-Python: Requires-Python declares the Python version requirement for a distribution.
• National Institute of Standards and Technology. (2022). Secure Software Development Framework (SSDF) Version 1.1 (NIST SP 800-218), PW.8 secure-by-default verification context.
• MITRE. (2025). CWE-693: Protection Mechanism Failure.

[seonghobae]

Live workflow topology clarification after opening this finding: serialized child PR #332 targets feat/agent-artifact-admission, so repository-owned child checks materialize as exact-head CI (format + locked workspace tests + strict Clippy) and Fuzz. The central Security Scan/SAST/CodeQL required workflows materialize on canonical #129 when its head changes against protected main; copying or retargeting those central workflows into the child would violate the owner boundary.

Accordingly the executable integration sequence is: exact child CI + Fuzz GREEN and fresh review/thread inventory -> ordinary expected-head merge into still-exact #129 -> reacquire #129 exact-current CI/Fuzz/Security Scan/SAST and central CodeQL settlement. The original requirement for security/SAST is preserved at the canonical parent head where those gates actually bind; it is not waived or replaced by predecessor evidence.

[seonghobae]

Serialized repair is now ordinarily integrated into canonical Agent Artifact Admission. Child #332 final exact bda53128beb22953c9ec0c0f719a60cdd401e89a passed CI 34637443344 and Fuzz 34637443599 with fresh review submissions=0 and review threads=0, then merged with expected head into still-exact parent 22c50d886d9e2ed8f5c376bacff8ec1f8a0d5b6c as new #129 exact head a341f70d9629511c0fba0f8b5a7e042f26549f37.

#129 exact-current root gates have re-materialized: CI 34638134781, Fuzz 34638134319, Security Scan 34638134381, SAST Semgrep 34638134439, CodeQL PR 34638134302. Predecessor/child receipts are not promoted. Keep #331 open until the effective delta reaches protected main or a verified complete successor.