Prerequisites
Area
Auth / Security
Problem or Motivation
Run-local untrusted-context state is not enough once an agent session reloads, forks, changes models, starts a background continuation, or escalates through Teacher. Authority decisions also need to distinguish where data came from from how sensitive it is: external, workspace, Odysseus-owned, and private data have different integrity and egress implications.
This is the fourth focused acceptance-criteria slice of #5815. It should persist monotonic provenance and apply it to private reads and sensitive egress without folding process sandbox construction or the underlying exact-grant mechanism into the same ownership boundary.
Proposed Solution
- Define separate integrity-origin and data-sensitivity classifications for model-visible context and tool results.
- Persist monotonic provenance per thread/session so applicable state survives turns, reloads, forks, model changes, research or background continuations, and Teacher flows without being cleared by later trusted content.
- Propagate structured provenance through context assembly, tool-result folding, session persistence, and continuation boundaries rather than inferring it from rendered text.
- Require deterministic policy and an exact server-owned grant for private reads and for network or external-side-effect egress after workspace or private data enters the applicable context.
- Keep provenance isolated between owners and sessions, and revalidate current provenance when an approval is claimed.
- Add migration, mixed-origin, reload/fork, continuation, private-read, sensitive-egress, and session-isolation regression coverage plus running-app validation of any provenance indicator.
Alternatives Considered
Prompt markers and run-local booleans lose meaning across persistence and reconstruction boundaries. Treating every source as only trusted or untrusted conflates integrity with sensitivity. Logging provenance after execution would help auditing but would not enforce the data boundary before a private read or external side effect occurs.
Prior Art / Related Issues
Parent tracker: #5815
Candidate implementation: #5821.
Related: #2605, #3709, #3866, #4754, #6021, and Discussion #335.
Are you willing to implement this?
Yes — I can open a PR
Prerequisites
Area
Auth / Security
Problem or Motivation
Run-local untrusted-context state is not enough once an agent session reloads, forks, changes models, starts a background continuation, or escalates through Teacher. Authority decisions also need to distinguish where data came from from how sensitive it is: external, workspace, Odysseus-owned, and private data have different integrity and egress implications.
This is the fourth focused acceptance-criteria slice of #5815. It should persist monotonic provenance and apply it to private reads and sensitive egress without folding process sandbox construction or the underlying exact-grant mechanism into the same ownership boundary.
Proposed Solution
Alternatives Considered
Prompt markers and run-local booleans lose meaning across persistence and reconstruction boundaries. Treating every source as only trusted or untrusted conflates integrity with sensitivity. Logging provenance after execution would help auditing but would not enforce the data boundary before a private read or external side effect occurs.
Prior Art / Related Issues
Parent tracker: #5815
Candidate implementation: #5821.
Related: #2605, #3709, #3866, #4754, #6021, and Discussion #335.
Are you willing to implement this?
Yes — I can open a PR