security(agents): harden Antigravity hook policy boundary

[Copilot]

Canonical issue

Handled by canonical issue automation.

Outcome

Antigravity executions can now attest that hook policy lives outside the agent-writable sandbox boundary. Receipts capture the mounted policy identity and the result of a controlled tamper attempt without treating hook timeout/error as a denial.

Scope

• Included:
  • Read-only hook policy source: add AntigravityHookPolicy so managed runs can mount hook config from a dedicated remote source instead of writable sandbox state
  • Live-use gate: require a configured read-only hook policy source before any live Antigravity execution is allowed
  • Receipt evidence: record hook source identity, mounted path, policy result, tamper-probe target/result/reason, and fail-open behavior in receipt.policy
  • Tamper probe wiring: inject a controlled hook/config modification probe into the managed task input so conformance runs can record denial behavior
  • Regression coverage: add focused tests for source mounting, live gate enforcement, denial receipts, and timeout-as-allow semantics
• Explicitly excluded:
  • Provider calls, environment creation, mount changes, billing actions, deployment, or production mutations
  • Changes to Agent Factory’s existing MCP allowlist / approval model beyond preserving it as the primary control

Risk

• Risk level: medium
• Failure mode:
  • Live managed runs stay blocked if hook policy is not configured
  • Receipts may report hook policy as unverified when providers omit policy telemetry
• Rollback:
  • Revert /home/runner/work/EventRelay/EventRelay/src/youtube_extension/services/agents/antigravity_backend.py
  • Revert /home/runner/work/EventRelay/EventRelay/tests/unit/test_antigravity_backend.py

Verification

List exact automated and manual checks, tied to the current head SHA.

• Head SHA: 59edb02
• Automated:
  • python3 -m pytest --no-cov tests/unit/test_antigravity_backend.py -q
  • python3 -m ruff check src/youtube_extension/services/agents/antigravity_backend.py tests/unit/test_antigravity_backend.py
  • runtime-tools-secret_scanning on changed files
• Manual:
  • Built a sample Antigravity payload and verified it mounts hook policy via environment.sources and targets /workspace/hook-policy/.agents/hooks.json

AntigravityBackendConfig(
    allow_live_execution=True,
    acknowledge_fail_open_hooks=True,
    hook_policy=AntigravityHookPolicy(
        source_type="repository",
        source="https://github.com/groupthinking/antigravity-hook-policy",
        target="/workspace/hook-policy",
        identity="git:demo-sha",
    ),
)

• Focused tests
• Required CI
• Review threads resolved

Production evidence

Not applicable. This change only hardens configuration and receipt semantics for future managed runs; no live provider call or production mutation was performed.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

• Fixes security(agents): make Antigravity hooks tamper-resistant #1659

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Sep 8, 2026 11:33pm UTC

[groupthinking]

Security acceptance review — 2026-09-09 — TEST / live blocked

Reviewed implementation at 59edb024f6d386753db28c61be5cbc00601773a6 against #1659. The fixture is useful, but “acceptance criteria satisfied” is not yet supported by enforcement evidence.

Observed code gaps:

• to_environment_source serializes type/source/target, while the receipt asserts read_only_source_mount without verifying mount enforcement or immutable source identity.
• config_relative_path and probe prefix validation accept .. traversal; normalize paths and prove containment before building hook/probe locations.
• A model/provider-shaped policy_result claiming “denied” becomes counts_as_denial without independently authenticated enforcement evidence.
• Presence of a hook_policy object opens this new live prerequisite; object presence alone does not prove read-only policy discovery or tamper resistance.

Google hook documentation, updated September 4 and retrieved September 9, distinguishes configuration discovery from enforcement; errors/timeouts allow execution and hooks do not cover custom functions/MCP. These restrictions remain independent of the fixture passing.

Required next tests: reject escaping paths; prove provider-recognized config location and immutable source revision; mark mount/probe outcomes UNVERIFIED unless backed by trusted enforcement evidence; fail live validation when that evidence is missing. Retain external MCP/network policy enforcement. Do not infer that this comment verifies a specific provider mount API.

State: high-priority security review remains open; no live test approved or run. Existing-head CI is action_required, not passed. Estimated next repair/review: 0.5–1 engineering day.