security(admission): preserve uv Python-provider evidence when a global option value is run #438

Agent Artifact Admission's uv Python-provider classifier scanned raw tokens with position("run") / position("pip") instead of reusing the parser-aware active-command boundary. A parser-valid uv global value could therefore be mistaken for the run command.

Concrete hostile shape:

uv --project run pip install cwl-example==1.2.3 --require-hashes --no-deps --no-python-downloads --managed-python

--project is a documented uv global value option; a directory literally named run is a realistic parser-valid value, not a command boundary. The inherited classifier returned false before recording explicit Python-provider authority, so the request still failed closed generically but lost causal AlternateInstallRoot evidence.

Acceptance

• hostile test-only exact head first demonstrates semantic RED with production source byte-identical;
• ForbiddenCommand remains present for the deliberately unsupported global-option command shape;
• AlternateInstallRoot is preserved for exact --managed-python / --no-managed-python provider selection when the parser-active command is not uv run;
• actual uv run remains outside install-authority semantics and does not gain AlternateInstallRoot from child/run arguments;
• exact submitted argv hashing remains unchanged;
• minimum repair reuses the existing parser-aware uv command-boundary helper instead of introducing a second parser or runtime/execution authority.

Executed RED -> GREEN -> serialized integration

• Test-only exact ea9c817a8d0edd0e78052d18493a1f1f0954e91f established hosted semantic RED: the value token run consumed by global --project erased causal provider evidence while ForbiddenCommand remained.
• Minimum causal repair exact 1dfcdcb38b5ef9bc2bee25e48dc63a15e65117a5 removed the duplicate raw token-order heuristic and reused policy::uv_active_command_index(); Fuzz 35428398273 was GREEN. CI 35428398285 exposed only rustfmt in the new regression fixture, not a production semantic defect.
• Exact child #439@f84787e5b6bb4148be417a98957b24e102dd1137 contains the repaired source plus canonical rustfmt-only fixture follow-ups. Fresh exact-head CI 35460113884 and Fuzz 35460113893 are terminal SUCCESS; reviews and review threads were empty; its parent remained exactly #129@fdd3e3dbd73a2838ffdabad41134a9c156cddca6.
• fix(admission): preserve uv provider evidence across global option values #439 was therefore marked Ready and normally merged with fixed expected-head protection into feat(security): gate AI-agent artifact installation #129 as merge commit 9efc804006057f099190d8ffcaa7096c955abe0d. No force update, destructive rebase, self/model approval, gate weakening or bypass was used.
• Root movement invalidated every predecessor feat(security): gate AI-agent artifact installation #129 conclusion. On unchanged exact #129@9efc804006057f099190d8ffcaa7096c955abe0d, CI 35477678285, Fuzz 35477678328, SAST 35477678290, and Security 35477678327 are terminal SUCCESS. Required CodeQL 35477678309 is terminal FAILURE only at the delegated current-head settlement boundary: exact-head language detection succeeded, the compatibility job read the current-head verdict and failed at Release runner or enforce current-head CodeQL verdict, and the subsequent dispatch job succeeded. The same-head specimen is already handed to canonical central owner .github#1929; this is not Wardnet source/test/SARIF RED and does not justify source/no-op churn, synthetic status, copied central workflow logic or routine bypass.

Keep this issue open until the effective repair reaches protected main through #129 or a verified complete successor. Central hosted-runner/OpenCode and delegated CodeQL settlement remain .github#712/#1234 and .github#1929 ownership; generic solo-maintainer approval remains .github#772. Wardnet does not copy those workflows, churn source to redispatch, synthesize status, self/model approve, weaken gates or routinely bypass protection.