Publish adversarial participant flow-control contracts

[Brad-Edwards]

Parent: #812

Bounded outcome

Publish closed portable contracts for the SEM-233 flow-policy profile, effective labels and derivations, release operations, sink decisions, and their API-409/API-423/runtime-fact bindings. Preserve existing participant occurrence identities, contextual validators, and schema-publication authority.

Negative cases

• Open taint, security_labels, policy, monitor, context, or agent-message maps.
• A confidentiality-only or integrity-only shortcut that silently supplies the other coordinate.
• In-place mutation of historical labels or provenance.
• Handoff, transformation, participant change, or episode reset erasing upstream influence.
• Schema-valid records accepted without exact profile, revision, source, sink, authority, and predecessor resolution.

Evidence required

• Hand-governed schemas, models, valid/invalid fixtures, publication entries, and generator parity.
• Resolver-backed contextual validation across runtime facts, API-409, API-423, action arguments, and sinks.
• Exact source/result identities for declassification and endorsement.
• Cross-participant/cross-episode lineage and stale/unknown/fail-closed tests.
• Contract and concept-authority traceability.

Explicit nonclaims

• Contract validity is not final-sink enforcement, backend realization, monitor trust, or adversarial robustness.
• No chain-of-thought, prompt, credential, private model state, or raw secret carriage.

Dependencies

• Blocked by Define adversarial participant boundary-flow semantics #1001.
• Parent design: Adopt adversarial AI-agent control and boundary-IFC threat models for participants #812.

Requirements

• SEM-233
• API-409
• API-423
• SEM-230

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 1002-flow-control-contracts, 2026-08-02T02:07:46.783Z.

[Brad-Edwards]

Pre-preflight research grounding: portable SEM-233 contracts and cyber use

I reviewed the merged outputs of parent issue #812 and dependency #1001, then checked the primary literature and primary implementation/institutional sources most relevant to the contract layer.

Inherited authority

• Adopt adversarial AI-agent control and boundary-IFC threat models for participants #812 established ADR-101, the participant-neutral threat model, participant-boundary-flow-policy-v1@rev1, the typed propagation path, four boundary-faithful attacks, and the ordered child program. It deliberately did not publish wire contracts or claim runtime/backend/adversarial robustness.
• Define adversarial participant boundary-flow semantics #1001 is merged into dev and publishes sem-233/rev1: two independent closed finite confidentiality/integrity obligation powersets, subset order, componentwise-union join, deny-equivalent unresolved state, conservative complete-possible-input derivation, fresh coordinate-specific release results, immutable provenance/influence history, cross-participant/cross-episode carriage, and the exact-cut MayFlowAtSink predicates. Its executable model remains bounded falsification evidence, not a production contract.
• Publish adversarial participant flow-control contracts #1002 must therefore serialize and contextually bind that exact authority. It must not reinterpret the algebra, introduce a second policy engine, replace incumbent occurrence identities, or promote SEM-233 beyond DRAFT.

Primary-source and cyber precedent findings

1. Denning's lattice model, decentralized labels, robust declassification, and nonmalleable IFC support closed ordered labels, conservative joins, principal-relative policies, and authority-bounded coordinate-specific release. A portable record must name the exact profile/revision, source and result, changed and unchanged coordinate, owner/authority basis, and intended audience/destination/sink; approval or authentication cannot stand in for declassification or endorsement.

2. HiStar and Flume demonstrate IFC in deployed operating-system abstractions using independent secrecy/integrity labels, immutable endpoints, persistent labels/capabilities, and reference-monitor checks. Their cyber lesson for Publish adversarial participant flow-control contracts #1002 is that labels and authority need stable identities across persistence and process/machine boundaries, while possession of a powerful downgrade capability must remain a separately resolved fact. Their limits—trusted declassifiers, administration, compatibility, metadata/implicit/covert flows—preclude an open trusted field or a claim that schema validity establishes enforcement.

3. DStar extends decentralized IFC across mutually distrustful networked components using cryptography plus host reference monitors, and demonstrates it with a three-tier web application resilient to compromised components. The portable lesson is cross-boundary identity continuity: a receiver must resolve issuer/profile/source/predecessor identities and local effective authority instead of accepting caller-asserted trust or silently translating unknown labels.

4. SIF/Jif applied confidentiality and integrity IFC to multi-tier web applications. It treats action invocation and database query construction as information-bearing effects, requires explicit endorsement/declassification authority, and reports SQL-injection resistance as one practical benefit. For Publish adversarial participant flow-control contracts #1002, action/tool arguments, destination selection, errors, outputs, and invocation occurrence all remain possible influences and sinks; integrity admission and confidentiality release stay independently represented.

5. TaintDroid operationalized dynamic flow labels for mobile privacy monitoring. CamFlow operationalized whole-system provenance for compliance, intrusion detection, and data-loss prevention, including distributed integration. These systems show the cyber value of durable source/derivation carriage, but their coverage and overhead boundaries matter: provenance is evidence, not permission, and caller-supplied predecessor lists cannot prove complete influence. Contextual validation must resolve every declared predecessor/source and fail closed on missing, stale, cyclic, profile-mismatched, or incomplete state.

6. W3C PROV-DM gives interoperable identities for entities, activities, generation, use, derivation, influence, attribution, and delegation, and explicitly models a transformation/update as producing a new entity. Publish adversarial participant flow-control contracts #1002 should adapt its fresh-result and explicit predecessor discipline, not import PROV's generic extensible attribute bags or treat delegation/attribution as release authority.

7. In the agent-security domain, FIDES tracks confidentiality and integrity labels and applies deterministic policy; CaMeL separates trusted control from untrusted data and enforces capabilities at tool calls; and SAMOS retains session flow state and intercepts MCP calls. Their shared cyber lesson is persistent influence state plus complete mediation of consequential calls. RAES keeps the portable contracts participant- and transport-neutral: no prompt/message DTO, MCP dependency, planner topology, raw content, or model-trust assertion.

8. AgentDojo, AI Control, ControlArena, and runtime shielding reinforce the boundary between runtime authorization and evaluation evidence. Monitor scores, honest/attack roles, audit outcomes, editing, and deferral are not flow authority. A contract-level sink decision can record deterministic inputs/results, but only Enforce participant flow policy at final runtime sinks #1003's real last-boundary enforcement can establish a shielding/runtime claim.

Contract consequences for #1002

The implementation should publish closed, revisioned DTOs/schemas for:

• the flow-policy profile and its closed confidentiality/integrity obligation universes;
• an effective two-coordinate label with canonical unique obligation refs and explicit resolved/unsupported status;
• source-label and derivation records binding fresh result identity to the complete declared source/predecessor set, exact profile/revision, state/policy cut, derivation kind, and safe evidence refs;
• distinct declassification and endorsement records binding exact source/result identities, one changed coordinate, one unchanged coordinate, exact removed obligations, authority, destination/audience/sink, predecessor/order refs, and cut;
• a deny-first sink-decision record binding source/effective label, participant occurrence, authority, destination, sink class, capability posture, policy/cut, API-409/API-423/runtime-fact/action-argument refs, individual gate results, decision/disposition, and append-only predecessors; and
• reference-only bindings into incumbent runtime-fact, API-409 control/handoff, API-423 crossing/transformation/delivery, action-argument, participant occurrence, and sink identities.

Schema validation will establish closed structural shape only. Resolver-backed contextual validation must establish exact profile/revision/token/source/result/authority/destination/sink/participant/predecessor existence and consistency, canonical joins, fresh-result/no-history-mutation rules, coordinate-specific release, acyclic ordering, stable expected heads, and fail-closed stale/unknown behavior.

Repository and lineage obligations

The contract change must update models, hand-governed schemas, valid/invalid fixtures, schema-publication entries and manifest change ledger, generated schema_bundle() parity, exports, concept authority, and Ground Control IMPLEMENTS/TESTS traceability together.

The research also adds a contract-plane lineage delta beyond #1001's semantic-only mapping. As appropriate, update:

• docs/explain/sdl/lineage.md with the contract adaptation and cyber-use boundary;
• contracts/provenance/sdl-lineage-ledger-v1.json with DStar, SIF/Jif, and W3C PROV-DM source identities plus a contract-plane adapted mapping;
• docs/research/lineage/source-audit-2026-07-12.md with verified source identity/licensing/compatibility notes; and
• the adversarial-participant current-state/index surfaces so Publish adversarial participant flow-control contracts #1002 is recorded as the portable-contract delivery, without erasing Define adversarial participant boundary-flow semantics #1001's semantic boundary.

Explicit nonclaims remain: contract validity is not final-sink enforcement, backend realization, complete dynamic-taint coverage, provenance trust, monitor honesty, intentional-subversion robustness, model alignment, safe private reasoning, or control of undeclared covert channels.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1002). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1002). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1002). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1002). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.