security: `--admin` and other privileged flags ride past merge-guard auth binding

[michael-wojcik]

Discovered during PR #1040 / v4.4.43 (merge-guard auth-symmetry, #1031/#1032).

Problem

The merge-guard binding model is (operation, target) — e.g. (merge, 1040). The extractor drops dash-flags when finding the PR positional (merge_guard_common.py, ~L303). So an approved gh pr merge 1040 and an executed gh pr merge 1040 --admin bind to the same (merge, 1040) — the --admin flag (which bypasses branch protection) rides past the guard undetected.

Same integrity-of-binding class as #1032 (approved-command == executed-command), but for privileged flags rather than op/target.

Proposed direction

Extend the binding to a small denylist of consequential flags (--admin, force variants, possibly --delete-branch): such a flag must be present in the approved option to be permitted in the executed command, else refuse. Touches merge_guard_common + both hooks + tests + security/architect re-review.

Related

multiSelect bundles are currently refused as a mint source (security-safe); revisit if privileged-flag approval ever needs multiSelect.

Severity: security hardening (narrow privilege-escalation-past-approval for a user who already has admin).

[michael-wojcik]

Post-install live-probe: PASS — closing per gated-closure discipline

The post-install live-probe gating this issue's closure is complete: dual-independent convergent PASS against the INSTALLED v4.4.44 merge-guard (hooks/shared/merge_guard_common.py + the real merge_guard_pre.py / merge_guard_post.py entry points), where installed v4.4.44 == merge commit b01639d5 (the #1042 fix), lead-verified on disk before probing.

Method

Two independent verifiers under an independence guard (each locked its full verdict before reading the other; reconciliation routed through the lead; honesty-disclosed all sources):

• security-engineer (primary probe): crafted-stdin driven through the real hooks.json PreToolUse/PostToolUse entry points as subprocesses, isolated CLAUDE_CONFIG_DIR (zero ~/.claude contamination). Decision-only — no real destructive op executed.
• test-engineer (independent faithfulness verifier): deterministic-token READ arm + genuine post-hook MINT seam (minted=True per case), authored in an isolated te_indep/ dir.

Results — all cases, both arms (read-arm pre; mint→read seam post→pre)

Case	Execute	Verdict
C1 FAITHFUL	bare merge	AUTHORIZE (token consumed)
C2 ADDED PRIVILEGE	--admin	REFUSE (TOKEN_MISMATCH)
C3 TARGET REDIRECT	-R other/repo	REFUSE (TOKEN_MISMATCH)
C4 FORCE-PUSH BYPASS	--no-verify	REFUSE (TOKEN_MISMATCH)
C5 DROPPED CONSTRAINT	approve carrying --match-head-commit <sha>, exec without	REFUSE (TOKEN_MISMATCH)

Non-vacuity / discrimination (the U3 unknown, discharged)

Every REFUSE is a MISMATCH-quality deny (token found; op-type AND target held identical; only bound_flags differ), proven non-artifact independently by both verifiers:

• in-process denylist-pop FLIPs REFUSE→AUTHORIZE (couples the deny to the security: --admin and other privileged flags ride past merge-guard auth binding #1042 denylist, not an incidental asymmetry);
• faithful-with-flag AUTHORIZEs (the deny is driven by the flag difference, not flag presence) — observed for C2c/C3c/C4c/C5c;
• the ALLOW path consumes the token (the AUTHORIZE branch is genuinely reached, not a deny-everything stub);
• rules out always-allow / always-deny / silent-no-op / parse-error, identically across the deterministic READ arm and the genuine MINT seam.

Completeness sweep

11/11 CLI spelling variants of an added privilege past a bare approval all REFUSE — short alias, attached =-value, the combined -dR cluster (the R4 remediation's redirect-under-block class) end-to-end DENY, and the git --no-veri abbreviation expansion (security-load-bearing). This bounds the bypass-enumeration completeness across the realistic spelling space.

Residuals (disclosed; none is an under-block — closure not blocked)

• Backtick-into-value capture (mint scanning) — over-block-only usability refinement (a backtick-wrapped pinned merge re-prompts); zero security impact. Future-class.
• Shell-quote / op-token obfuscation of a flag token — the control's pre-existing literal-string boundary (op-token obfuscation already bypasses the whole guard, strictly easier); already classified accepted-boundary in the security: --admin and other privileged flags ride past merge-guard auth binding #1042 review; tracked under the obfuscation-hardening umbrella.
• --no-verify approval refused by the post-hook decline-veto (the word "no" matches the veto wordset) — an independent over-block in the safe direction, same class as the decline-veto false-positives tracked separately; NOT a security: --admin and other privileged flags ride past merge-guard auth binding #1042 binding gap (the C4 exec-side negative holds in both arms).

Conclusion

The privileged-flag binding genuinely evaluates and is sound and complete on the probed surface — every privileged-flag bypass (added-privilege, target-redirect, force-push-bypass, dropped-constraint) REFUSES across both arms, faithful re-exec AUTHORIZES, and the result is non-vacuous. The post-install live-probe gate is satisfied. Closing as completed.