Define adversarial participant boundary-flow semantics

[Brad-Edwards]

Parent: #812

Bounded outcome

Publish the revisioned SEM-233 semantic authority for independent confidentiality and integrity coordinates, conservative provenance and influence propagation, distinct release/authority operations, cross-participant and cross-episode carriage, and fail-closed final-sink decisions. Reuse SEM-230, ACT-617, API-409, and API-423 rather than adding an LLM-agent event or policy model.

Negative cases

• A single trusted, sensitivity, marking, confidence, signature, or monitor-score field standing in for both coordinates.
• Authentication, approval, admission, authorization, declassification, endorsement, redaction, or transformation treated as interchangeable.
• Unknown sources, missing labels, ambiguous joins, or episode/handoff boundaries resetting to public or trusted.
• Security semantics stored in open metadata, prompts, diagnostics, or backend options.
• A semantic claim that a monitor, model, human, or backend is trustworthy without a bounded declaration.

Evidence required

• Revisioned formal flow-policy profile and exact label algebra.
• Typed carrier and derivation mapping across observations, memory, proposals, action arguments, crossings, outputs, and sinks.
• Cross-participant and cross-episode examples and counterexamples.
• Clause, concept-authority, lineage, and nonclaim validation.
• Bounded executable falsification of missing-label, laundering, stale-cut, and release-operation conflation cases.

Explicit nonclaims

• No runtime or backend realization.
• No model alignment, chain-of-thought safety, private-state visibility, monitor honesty, or covert-channel control.
• No intentional-subversion robustness from the semantic definition alone.

Dependencies

• Parent design: Adopt adversarial AI-agent control and boundary-IFC threat models for participants #812.
• No child dependency; this is the first implementation package.

Requirements

• SEM-233
• SEM-230
• ACT-617
• API-409
• API-423

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 1001-boundary-flow-semantics, 2026-08-01T20:57:00.998Z.

[Brad-Edwards]

Boundary-flow control literature review

I reviewed precedents from classical information-flow control, deployed operating-system IFC, cross-domain guards, runtime tainting, provenance, zero-trust enforcement, and recent agent-control systems before architecture preflight.

Key findings:

• Denning's lattice model and decentralized labels support ordered conservative joins and principal-relative policy, but fixed global labels, label creep, and over-powered downgrade privileges are known limits.
• Robust declassification and nonmalleable IFC show that confidentiality release and integrity endorsement are related but distinct, and that attacker influence over either operation must be bounded explicitly.
• HiStar and Flume demonstrate practical decentralized IFC and conservative propagation. Their limitations—trusted declassifiers/untaint privileges, label administration, compatibility, and covert channels—rule out an unbounded scalar “trusted” claim.
• NIST SP 800-53 AC-4 and the NSA cross-domain program support controlled-interface enforcement, content/metadata checks, default deny, and lifecycle assurance. The semantics must still fail closed for missing/stale attributes, ambiguous content, bypasses, and downstream sinks.
• TaintDroid shows the value of dynamic explicit-flow tracking but also its incomplete coverage of implicit/native/control/covert flows. CamFlow supports durable source/derivation lineage, but provenance is evidence—not release, endorsement, or execution authority.
• Zero-trust policy enforcement and capabilities support per-request mediation and least authority; neither replaces end-to-end data-flow propagation.
• FIDES, CaMeL, SAMOS, AgentDojo, AI Control, ControlArena, runtime shielding, and capability literature remain the immediate agent-domain precedents, bounded by the existing Adopt adversarial AI-agent control and boundary-IFC threat models for participants #812 research.

Design consequence for SEM-233: maintain independent confidentiality and integrity coordinates; make derivation monotone/conservative; distinguish declassification, endorsement, approval, admission, authentication, authorization, redaction, and transformation; retain labels and provenance across participant, handoff, and episode boundaries; and re-evaluate at the final effect/disclosure sink. Unknown labels, ambiguous joins, stale cuts, or unexplained resets fail closed. The authority remains limited to declared explicit flows and makes no runtime, backend-completeness, monitor-honesty, model-alignment, or covert-channel claim.

The review is recorded in docs/research/adversarial-participant-control/current-state-assessment.md, docs/research/lineage/source-audit-2026-07-12.md, and the adversarial participant section of docs/explain/sdl/lineage.md.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1001). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1001). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1001). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1001). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1001). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #1001). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Outcome and scope

Publish participant-boundary-flow-policy-v1@rev1 as the first exact SEM-233 semantic authority. The delivery remains definition-only: no portable DTO/schema, runtime mediation, persistence, backend capability, API, SDL syntax, or intentional-subversion evaluation is added.

Existing coverage and reuse

• Reuse SEM-230/ADR-085/ADR-095 for participant-relative projection, exact cuts, memory, adaptive strategies, dynamic purge, declassification schedule, MayCross, and policy-noninterference.
• Reuse SEM-211 action admission, ACT-617/API-409 control and handoff semantics, API-423 crossing identities/history, runtime-fact source/derivation/sink concepts, API-407 capability posture, and RUN-310/RUN-319 atomic-history semantics by reference only.
• Reuse the current behavioral-relation catalog/claim validators, historical catalog loader, lineage ledger/checker, formal-assurance inventory, and existing test-local SEM-230/Hypothesis patterns.

Implementation

1. Write failing SEM-233 tests first for the exact two-coordinate algebra and boundary failures. Add a test-local finite model only after observing the intended import/behavior failures.
2. Define revision sem-233/rev1 in specs/formal/participant-semantics/adversarial-flow-control.md as independent finite confidentiality- and integrity-obligation powersets, subset order, union join, explicit bottom/top, closed normalization, deny-equivalent unknown defaults, sink predicates, immutable provenance/influence history, and fresh coordinate-specific declassification/endorsement transitions.
3. Complete the typed carrier/derivation map for observation/tool/runtime facts, context/memory, proposals/action arguments, API-409 handoffs, API-423 crossings/transformations, participant/external outputs, persistence/replay, errors, shared state, and cross-episode carriage. Extend SEM-230's final crossing predicate at the same exact cut; do not add a relation or policy engine.
4. Evolve the existing participant-information-flow-policy claim surface and policy-noninterference catalog entry to name the SEM-233 profile and bounded evidence. Archive byte-identical catalog rev11, register it in the historical loader, advance current/fixture expectations together, and preserve the behavioral-relations/v1 schema shape.
5. Record the new formal and operational precedents in the machine-readable lineage ledger and source audit; keep docs/explain/sdl/lineage.md, the adversarial-control assessment/index, participant-semantics README, and formal-assurance fulfillment aligned. No changelog fragment or version edit.

Requirement coverage

• SEM-233: exact independent coordinates, conservative/traversal-independent derivation, distinct authority operations, typed cross-participant/cross-episode carriage, final-sink deny-first semantics, and explicit nonclaims are implemented in the formal profile and bounded test model. SEM-233 remains DRAFT because Publish adversarial participant flow-control contracts #1002/Enforce participant flow policy at final runtime sinks #1003/Declare adversarial-control apparatus and backend capabilities #1004/Evaluate intentional participant subversion under declared control profiles #1007 retain downstream positive obligations.
• SEM-230: its relation, projection, exact-cut, memory, strategy, purge, and declassification definitions remain authoritative; SEM-233 parameterizes rather than replaces them.
• ACT-617 / API-409: control, approval, controller, authority, and handoff remain separate from flow release and action admission; their contracts are unchanged.
• API-423: crossing stages, transformations, decisions, delivery/observation distinctions, predecessor/order refs, and append-only history remain the carriers; SEM-233 adds label/sink predicates by reference without changing the contract.

TDD and verification

• Red/green tests cover closure, associativity, commutativity, idempotence, monotonicity, traversal-order independence, coordinate independence, conservative derivation, missing labels, unknown revisions, laundering attempts, stale cuts, release/approval conflation, immutable source history, cross-participant handoff, cross-episode replay, and fail-closed final sinks.
• Targeted verification: new SEM-233 tests plus behavioral-catalog, SEM-230, lineage, assurance, concept-authority, and issue-812 suites.
• Completion verification runs with RAES_REQUIREMENT_UID=SEM-233: implementations/python/.venv/bin/python tools/check_repo_policy.py, implementations/python/.venv/bin/python tools/check_requirement_governance.py, and implementations/python/.venv/bin/python tools/verify_all.py.

Cross-cutting design check

• Security: closed finite domains and deny-equivalent unknowns prevent public/trusted defaults; safe synthetic refs only; provenance is evidence, never permission; no policies, values, prompts, credentials, or secret-derived digests enter metadata, environment, argv, filenames, logs, diagnostics, or fixtures.
• Maintainability: build on the incumbent catalog loader, validators, lineage model, assurance inventory, and test-local model style; add no validator/store/error/logging hierarchy.
• Extensibility: (profile_id, profile_revision) plus source-label, derivation, sink-policy, authority, participant/audience, destination, sink-class, and exact-cut resolver refs is the seam for later contracts/backends. New sources and sinks extend a profile revision instead of every carrier.
• Whole repository: formal authority, participant-semantics index, behavioral catalog/history/fixture/loader/tests, lineage ledger/prose/source audit, assurance fulfillment, research index, and canonical policy/governance/verifier commands are in scope. Runtime, transport, authentication, persistence, subprocess/network, and host/OS surfaces are explicitly not traversed by this issue.