feat(agent): persist provenance and gate sensitive egress

[RaresKeY]

Summary

Persist monotonic agent provenance for external, workspace, Odysseus-owned, and private-data context, and use that state when authorizing later tools. Provenance accumulates across turns, reloads, forks, background continuation, model changes, and teacher escalation instead of disappearing when one model call or request ends.

The capability registry also separates integrity origin from data sensitivity. Sandbox mode requires exact approval for private reads, and workspace/private data cannot cross a brokered network or external side-effect boundary without a matching approval. Agent mode no longer gains ambient personal-document or memory retrieval as an unclassified private-data path.

Stack

This is the provenance slice in #5815 directly after #5819. Its only direct stack dependency is #5819; #6120, #6084, #6119, #6118, and #6121 are transitive or separate foundations and are not direct parents of this PR.

Target branch

• This PR targets dev, not main. All PRs land in dev; main is curated by the maintainer at each release.

Linked Issue

Part of #6093

Part of #5815

Part of #4754

Depends on #5819

Related: #2605, #3709, and #3866

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs; no open PR persists monotonic integrity/sensitivity provenance and binds private-read/egress authorization to it.
• This PR targets dev.
• My changes are limited to provenance classification/persistence, sensitive read and egress policy, session/research/teacher propagation, focused UI state, and regression coverage.
• I actually ran the app end-to-end. Focused automated tests, JavaScript syntax, Python compile, and diff checks pass; live approval/provenance flows and browser layout were not exercised.

How to Test

1. Run:

   python -m pytest -q \
     tests/test_agent_rounds_exhausted.py \
     tests/test_agent_run_policy.py \
     tests/test_chat_helpers.py \
     tests/test_execution_sandbox.py \
     tests/test_external_context_tool_gate.py \
     tests/test_fork_session_metadata.py \
     tests/test_provenance.py \
     tests/test_session_mode_helpers.py \
     tests/test_teacher_eval_tier2.py
   
   python -m compileall -q core routes src
   node --check static/app.js
   node --check static/js/chat.js
   node --check static/js/sessions.js

   Current secretless validation on the rebased public head passes 361 focused tests, with the listed syntax and compile checks still applicable.

2. In Sandbox mode, read external context and verify the thread records External provenance. Reload, change model, fork the session, and trigger teacher/background continuation; verify the applicable provenance remains set and only accumulates.

3. Request a private read and verify exact approval is required. Approve it, then change the exact action or run context and verify the grant is rejected.

4. After workspace or private data enters the thread, request network egress or an external side effect. Verify policy requires a matching exact approval before data can cross that boundary.

5. Switch between sessions and verify the provenance indicator reflects the selected thread without leaking state between sessions.

Current restacked-head validation passes 361 focused tests, Python compile, and git diff --check.

Historical full-suite evidence from the pre-restack provenance tree is not a current-head claim; the current focused suite is the validation recorded above.

Not yet validated: live Docker/native/browser behavior, desktop/mobile provenance display, multi-worker approval consumption, external database migration behavior, or independent latest-head security review.

The running-app provenance/approval flow and independent latest-head security review remain outstanding, so this PR is opening as a draft.

Visual / UI changes — REQUIRED if you touched anything that renders

This adds a thread provenance indicator and updates its state during streaming/session changes. Running-app visual evidence is required before marking the PR ready for review.

• Screenshot or short clip — missing; capture External, Workspace, Odysseus, and Private states plus session switching. Include mobile evidence if the indicator remains in the composer.
• Style match — not yet verified in the running app.
• No new component patterns — the indicator reuses existing tool-indicator styling, but its placement still needs running-app review.
• I am not an LLM agent submitting a bulk PR. This is a focused, user-directed security slice, not automated or mass submission.

Screenshots / clips

Pending running-app desktop/mobile capture after the provenance indicator placement is finalized.

[github-actions]

⚠️ PR description is complete; validation evidence is still outstanding

Changed-file classification: UI-sensitive.

Author-reported runtime / visual state

• App/runtime validation is not author-attested. Check the run box only after running it, or check the explicit not-run box and describe the gap.
• The screenshot/clip checkbox is not checked for this UI-sensitive change.
• The Screenshots / clips section does not contain an actual attachment or link.

Checkboxes are author attestations. GitHub Actions results remain the execution evidence for CI; this check does not prove that a local command ran.

---

This comment updates automatically when the description or changed files change.