Extend the disclosure hook to kernel-origin and proactive dispatch paths

[George-RD]

Parent

Spec #204 (design ticket #192, wayfinder map #182)

What to build

Confirm and, where needed, fix the disclosure hook so it fires identically for kernel-origin dispatches (standing-rule fired sends, timer/headless lanes acting with no principal present — the Unattended workhorse story) as it does for worker-requested dispatches of the same rated action. No separate, ungated path may exist for proactive/autonomous outbound content — the fail-closed disclosure requirement applies the same whether or not a principal is present in the loop.

Acceptance criteria

• A production-entering test: a kernel-origin (ActionOrigin::Kernel) dispatch of a rated messaging-send action with uncovered disclosure policy blocks and raises OwnerQuestion, exactly like a worker-origin dispatch.
• If any kernel-origin / standing-rule / timer dispatch path is found to bypass the hook, it is fixed so it does not.
• scripts/check.sh green.

Blocked by

• Wire email.send into the generalized disclosure hook end-to-end #206 (Wire email.send into the generalized disclosure hook end-to-end)

[coderabbitai]

Coding Plan

Summary

• Parameterize the single shared dispatch entrypoint on ActionOrigin so the existing inline disclosure hook fires for kernel-origin rated dispatch exactly as it does for worker-origin dispatch.
• Fail closed on the one hand-rolled kernel-origin path (message_notify.rs) so no rated action can ever reach a connector without disclosure enforcement.
• Add production-entering tests that prove both kernel-origin and proactive standing-rule fired dispatch of a rated action with an uncovered policy block and raise OwnerQuestion.
• Record the guarantee in docs/threat-claims.md and the disclosure-policy spec, and keep scripts/check.sh green.

Design Choices

Design Choice 1: How to raise OwnerQuestion for the ActionOrigin::Kernel acceptance test

Options Considered:

1. Parameterize the shared entrypoint on ActionOrigin. Drive a test-only rated messaging-send stand-in action through it with ActionOrigin::Kernel. The existing inline disclosure hook then fires for the rated action regardless of origin.
2. Fully unify message_notify.rs into the shared entrypoint (register an owner.notify handler, reconcile spend and audit semantics).
3. Add only a fail-closed deny guard on the kernel-origin path (this denies but never raises OwnerQuestion, so it does not satisfy the acceptance criterion).

Chosen Option: 1

Rationale: It reuses the existing inline disclosure hook, keeps the change mechanical and low-risk, and avoids the large message_notify.rs unification refactor that Option 2 requires.

Design Choice 2: Which rated egress class and action to use for the kernel-origin test

Options Considered:

1. Use a test-only stand-in messaging-send action rated with an existing EgressClass variant, added to a custom test catalog.
2. Assume ticket #206 has landed and use its messaging EgressClass with a rated email.send.

Chosen Option: 1

Rationale: It decouples this ticket's origin-symmetry proof from the exact variant ticket #206 introduces, while the same test path applies unchanged to email.send after #206 lands.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Make disclosure enforcement reachable and mandatory for every dispatch origin

This phase removes the structural possibility that a rated action reaches an outbound connector without the disclosure hook. It parameterizes the single shared dispatch entrypoint on ActionOrigin so the inline hook applies for kernel-origin dispatch, and it fails closed on the one hand-rolled kernel-origin path.

Task 1: Parameterize the shared dispatch entrypoint on ActionOrigin

Allow the shared mediation function to run for both Shell and Kernel origins so the inline disclosure hook applies identically.

• Update mediate_and_dispatch_action_with_attribution_and_token in crates/openspine-kernel/src/api/actions.rs to accept an origin: ActionOrigin argument and pass it into the single gate(...) call instead of the hardcoded ActionOrigin::Shell.
• Keep all existing thin wrappers (mediate_and_dispatch_action, mediate_and_dispatch_action_headless, mediate_and_dispatch_action_with_attribution) passing ActionOrigin::Shell so current behavior does not change.
• Add one kernel-origin-capable wrapper (for example mediate_and_dispatch_action_kernel_origin) that passes ActionOrigin::Kernel. This wrapper reuses the same body, so the inline disclosure block (gated on egress_decl_for(&action).egress_class) runs for rated kernel-origin actions with no additional logic.
• Confirm the inline disclosure block derives provenance from the kernel-owned briefcase sections and mints the prepared query when the payload omits it, so the kernel-origin path needs no shell-supplied disclosure inputs.

Task 2: Fail closed on the hand-rolled kernel-origin notify path

Prevent the separate owner.notify path from ever dispatching a rated action without disclosure enforcement.

• Update notify_owner_with_digest in crates/openspine-kernel/src/pipeline/message_notify.rs to check state.action_catalog.egress_decl_for(&action).and_then(|d| d.egress_class) before its connector send.
• If the action is rated (the egress_class is Some), fail closed: return a clear NotifyOutcome refusal variant rather than sending. This path cannot construct the counterparty/briefcase disclosure context, so it must not send rated content.
• owner.notify is unrated, so this guard never triggers in production. It removes the future silent-bypass path required by the ticket ("No separate, ungated path may exist for proactive/autonomous outbound content").

🤖 Prompt for AI agents

Implement Phase 1: make disclosure enforcement structurally reachable and
mandatory for every dispatch origin, removing any way for a rated action to skip
the disclosure hook.

- In `crates/openspine-kernel/src/api/actions.rs`, update
`mediate_and_dispatch_action_with_attribution_and_token` to accept an `origin:
ActionOrigin` parameter and pass it into the single `gate(...)` call, replacing
the hardcoded `ActionOrigin::Shell`.
- Keep existing thin wrappers (`mediate_and_dispatch_action`,
`mediate_and_dispatch_action_headless`,
`mediate_and_dispatch_action_with_attribution`) passing `ActionOrigin::Shell` so
current behavior is unchanged.
- Add a new kernel-origin-capable wrapper (for example
`mediate_and_dispatch_action_kernel_origin`) that passes `ActionOrigin::Kernel`
and reuses the same function body, so the inline disclosure block (gated on
`egress_decl_for(&action).egress_class`) runs identically for rated
kernel-origin actions.
- Confirm the inline disclosure block derives provenance from kernel-owned
briefcase sections and mints the prepared query when the payload omits it, so
the kernel-origin path needs no shell-supplied disclosure inputs.
- In `crates/openspine-kernel/src/pipeline/message_notify.rs`, update
`notify_owner_with_digest` to check
`state.action_catalog.egress_decl_for(&action).and_then(|d| d.egress_class)`
before the connector send.
- If the action is rated (`egress_class` is `Some`), fail closed by returning a
clear `NotifyOutcome` refusal variant instead of sending. Do not attempt to
construct the counterparty/briefcase disclosure context on this path.
- Note that `owner.notify` is unrated today, so this guard never triggers in
production; its purpose is to remove any future silent-bypass path for
proactive/autonomous outbound content.

Phase 2: Prove origin-symmetric fail-closed enforcement with production-entering tests

This phase adds tests that drive the real dispatch entrypoints, not internal primitives, and assert that rated dispatch with an uncovered disclosure policy blocks and raises OwnerQuestion for kernel-origin and proactive paths.

Task 1: Add test scaffolding for kernel-origin rated dispatch

Provide reusable setup for a synthetic kernel grant and a custom rated test catalog.

• Add a synthetic kernel-origin grant builder modeled on kernel_notify_grant() in crates/openspine-kernel/src/pipeline/message_notify.rs: empty allow/deny/approval/selection lists, mode: Live, sealed root, plus the target EgressClass in allowed_egress_classes so the origin-symmetric AD-060 gate() check passes.
• Build a custom ActionCatalog in the test that registers a test-only messaging-send action (for example test.messaging.send), marks it with with_kernel_origin([...]), and declares a Some(egress_class) egress rating. Assign it onto state.action_catalog after test_support::fixtures::test_state, following the existing precedent in api/effect_readiness_tests.rs.
• Seed a briefcase for the grant with a CounterpartyRef::Bound relationship and at least one section that carries a non-public DisclosureClass not covered by any policy.
• Place this test code in a new file (for example crates/openspine-kernel/src/api/disclosure_origin_tests.rs) to keep disclosure/disclosure_tests.rs and disclosure.rs under the 500-line gate.

Task 2: Assert kernel-origin dispatch blocks and raises OwnerQuestion

Prove the first acceptance criterion with a production-entering test.

• Drive the kernel-origin wrapper from Task 1.1 with ActionOrigin::Kernel, the rated stand-in action, and the uncovered briefcase.
• Assert the dispatch returns the generic blocked dispatch error and does not reach the connector.
• Assert a DisclosurePendingQuestion row is persisted and an EscalationPayload::OwnerQuestion escalation is routed, following the assertion patterns in disclosure/disclosure_tests.rs and dark_window_cap_tests.rs (audit-count / pending-question / escalation-message checks).
• Assert the outcome matches the worker-origin behavior for the same rated action and uncovered policy.

Task 3: Assert proactive standing-rule fired dispatch blocks and raises OwnerQuestion

Cover the Unattended-workhorse path (standing-rule fired send, no principal present), which dispatches through the shared entrypoint with ActionOrigin::Shell.

• Add a production-entering test modeled on pipeline/standing_rule_timer.rs's test helpers: activate a rated standing rule, schedule and claim a dark-window fired send, and drive claim_and_redispatch (which calls mediate_and_dispatch_action).
• Use a rated messaging-send action with an uncovered disclosure policy.
• Assert the fired send blocks, rolls back any reserved envelope budget, and raises OwnerQuestion, proving the proactive path enforces disclosure identically to worker dispatch.
• Add a fail-closed guard test for Task 1.2: assert that notify_owner_with_digest refuses to send when the action is rated.

🤖 Prompt for AI agents

Implement Phase 2: add production-entering tests that prove disclosure
enforcement is origin-symmetric, using the real dispatch entrypoints rather than
internal primitives.

- Add a synthetic kernel-origin grant builder modeled on `kernel_notify_grant()`
in `crates/openspine-kernel/src/pipeline/message_notify.rs`, with empty
allow/deny/approval/selection lists, `mode: Live`, a sealed root, and the target
`EgressClass` included in `allowed_egress_classes` so the AD-060 `gate()` check
passes.
- Build a custom `ActionCatalog` in the test that registers a test-only
messaging-send action (for example `test.messaging.send`), marks it with
`with_kernel_origin([...])`, and declares a `Some(egress_class)` egress rating.
Assign it onto `state.action_catalog` after
`test_support::fixtures::test_state`, following the pattern in
`api/effect_readiness_tests.rs`.
- Seed a briefcase for the grant with a `CounterpartyRef::Bound` relationship
and at least one section carrying a non-public `DisclosureClass` not covered by
any policy.
- Place this scaffolding and the new tests in a new file, for example
`crates/openspine-kernel/src/api/disclosure_origin_tests.rs`, to keep
`disclosure/disclosure_tests.rs` and `disclosure.rs` under the 500-line
file-size gate.
- Write a test that drives the kernel-origin wrapper added in Phase 1 with
`ActionOrigin::Kernel`, the rated stand-in action, and the uncovered briefcase.
Assert the dispatch returns the generic blocked dispatch error, does not reach
the connector, persists a `DisclosurePendingQuestion` row, and routes an
`EscalationPayload::OwnerQuestion` escalation. Follow the assertion patterns
used in `disclosure/disclosure_tests.rs` and `dark_window_cap_tests.rs`
(audit-count, pending-question, escalation-message checks). Assert this outcome
matches worker-origin behavior for the same rated action and uncovered policy.
- Write a test modeled on the test helpers in `pipeline/standing_rule_timer.rs`:
activate a rated standing rule, schedule and claim a dark-window fired send, and
drive `claim_and_redispatch` (which calls `mediate_and_dispatch_action`) using a
rated messaging-send action with an uncovered disclosure policy. Assert the
fired send blocks, rolls back any reserved envelope budget, and raises
`OwnerQuestion`.
- Write a fail-closed guard test for the Phase 1 `notify_owner_with_digest`
change: assert that it refuses to send when the action is rated.

Phase 3: Update guarantees and keep all CI gates green

This phase records the new origin-symmetric guarantee and confirms scripts/check.sh passes end to end.

Task 1: Register the new guarantee in the claims register

Document the origin-symmetric disclosure guarantee so scripts/check-claims.sh validates it.

• Add new CLAIM-NN rows to docs/threat-claims.md (next sequential IDs) stating that disclosure enforcement is origin-symmetric: a rated action cannot bypass the disclosure hook via kernel-origin or proactive standing-rule/timer dispatch.
• Cite the exact new test function names from Tasks 2.2 and 2.3 in the test: <fn_name> verification cells, and confirm the names match cargo test --workspace -- --list.

Task 2: Align the disclosure-policy spec with origin-independence

Reflect the new guarantee in the normative spec through a proper OpenSpec change so strict validation passes.

• Add an OpenSpec change under openspec/changes/ that adds or amends a requirement in openspec/specs/disclosure-policy/spec.md stating that fail-closed disclosure enforcement and OwnerQuestion escalation apply identically regardless of dispatch origin or whether a principal is present.
• Keep the change minimal and validate with openspec validate <change_id> --strict.

Task 3: Confirm all CI gates

Ensure the full gate passes.

• Run scripts/check.sh and confirm cargo fmt --check, cargo clippy -D warnings, full cargo test --workspace, the file-size gate, the threat-claims gate, and openspec validate --all --strict all pass.
• Confirm new test code lives in new files rather than growing actions.rs, standing_rule_timer.rs, or the near-limit disclosure files past their caps.

🤖 Prompt for AI agents

Implement Phase 3: record the new origin-symmetric disclosure guarantee in
project documentation and specs, and confirm all CI gates pass.

- Add new `CLAIM-NN` rows to `docs/threat-claims.md` (using the next sequential
IDs) stating that disclosure enforcement is origin-symmetric: a rated action
cannot bypass the disclosure hook via kernel-origin or proactive
standing-rule/timer dispatch.
- In the `test: <fn_name>` verification cells for these new claim rows, cite the
exact new test function names from Phase 2's kernel-origin and standing-rule
tests, and confirm these names match the output of `cargo test --workspace --
--list`.
- Add an OpenSpec change under `openspec/changes/` that adds or amends a
requirement in `openspec/specs/disclosure-policy/spec.md`, stating that
fail-closed disclosure enforcement and `OwnerQuestion` escalation apply
identically regardless of dispatch origin or whether a principal is present.
Keep the change minimal and validate it with `openspec validate <change_id>
--strict`.
- Run `scripts/check.sh` and confirm all gates pass: `cargo fmt --check`, `cargo
clippy -D warnings`, full `cargo test --workspace`, the 500-line-per-file gate,
the threat-claims gate, and `openspec validate --all --strict`.
- Confirm new test code lives in new files rather than growing `actions.rs`,
`standing_rule_timer.rs`, or any near-limit disclosure files past their line
caps.

Research

The kernel routes almost all effect dispatch through one shared entrypoint, mediate_and_dispatch_action_with_attribution_and_token in crates/openspine-kernel/src/api/actions.rs. This function calls gate(...) with a hardcoded ActionOrigin::Shell, then runs the disclosure hook inline for any action whose catalog entry declares an egress_class. The disclosure hook itself lives in crates/openspine-kernel/src/disclosure.rs (enforce_disclosure_egress) and the pure decision logic in crates/openspine-schemas/src/disclosure_policy.rs (check_egress). An uncovered disclosure class blocks the effect and raises an EscalationPayload::OwnerQuestion through route_escalation.

Standing-rule fired sends (pipeline/standing_rule_timer.rs), the headless lane (pipeline/headless.rs), the reflection miner, and worker-result dispatch all funnel through the same shared entrypoint with ActionOrigin::Shell, so they already invoke the disclosure hook for rated actions. The only literal ActionOrigin::Kernel production path is notify_owner_with_digest in crates/openspine-kernel/src/pipeline/message_notify.rs, which is a hand-rolled path for the single action owner.notify. That path bypasses the shared entrypoint and the disclosure hook entirely. Today this is harmless because owner.notify carries egress_class: None and is not counterparty-facing. The gate() AD-060 egress-class authorization check is already origin-symmetric. The remaining gap is that the disclosure-policy / OwnerQuestion coverage layer is not reachable from the ActionOrigin::Kernel path, so a future rated kernel-origin action could send outbound content without disclosure enforcement.

CI runs scripts/check.sh: cargo fmt --check, cargo clippy -D warnings, full cargo test --workspace, a 500-line-per-.rs-file gate, a docs/threat-claims.md test-name cross-check, and openspec validate --all --strict.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement Phase 1: make disclosure enforcement structurally reachable and
mandatory for every dispatch origin, removing any way for a rated action to skip
the disclosure hook.

- In `crates/openspine-kernel/src/api/actions.rs`, update
`mediate_and_dispatch_action_with_attribution_and_token` to accept an `origin:
ActionOrigin` parameter and pass it into the single `gate(...)` call, replacing
the hardcoded `ActionOrigin::Shell`.
- Keep existing thin wrappers (`mediate_and_dispatch_action`,
`mediate_and_dispatch_action_headless`,
`mediate_and_dispatch_action_with_attribution`) passing `ActionOrigin::Shell` so
current behavior is unchanged.
- Add a new kernel-origin-capable wrapper (for example
`mediate_and_dispatch_action_kernel_origin`) that passes `ActionOrigin::Kernel`
and reuses the same function body, so the inline disclosure block (gated on
`egress_decl_for(&action).egress_class`) runs identically for rated
kernel-origin actions.
- Confirm the inline disclosure block derives provenance from kernel-owned
briefcase sections and mints the prepared query when the payload omits it, so
the kernel-origin path needs no shell-supplied disclosure inputs.
- In `crates/openspine-kernel/src/pipeline/message_notify.rs`, update
`notify_owner_with_digest` to check
`state.action_catalog.egress_decl_for(&action).and_then(|d| d.egress_class)`
before the connector send.
- If the action is rated (`egress_class` is `Some`), fail closed by returning a
clear `NotifyOutcome` refusal variant instead of sending. Do not attempt to
construct the counterparty/briefcase disclosure context on this path.
- Note that `owner.notify` is unrated today, so this guard never triggers in
production; its purpose is to remove any future silent-bypass path for
proactive/autonomous outbound content.
===============================================================================

Task: 2

Implement Phase 2: add production-entering tests that prove disclosure
enforcement is origin-symmetric, using the real dispatch entrypoints rather than
internal primitives.

- Add a synthetic kernel-origin grant builder modeled on `kernel_notify_grant()`
in `crates/openspine-kernel/src/pipeline/message_notify.rs`, with empty
allow/deny/approval/selection lists, `mode: Live`, a sealed root, and the target
`EgressClass` included in `allowed_egress_classes` so the AD-060 `gate()` check
passes.
- Build a custom `ActionCatalog` in the test that registers a test-only
messaging-send action (for example `test.messaging.send`), marks it with
`with_kernel_origin([...])`, and declares a `Some(egress_class)` egress rating.
Assign it onto `state.action_catalog` after
`test_support::fixtures::test_state`, following the pattern in
`api/effect_readiness_tests.rs`.
- Seed a briefcase for the grant with a `CounterpartyRef::Bound` relationship
and at least one section carrying a non-public `DisclosureClass` not covered by
any policy.
- Place this scaffolding and the new tests in a new file, for example
`crates/openspine-kernel/src/api/disclosure_origin_tests.rs`, to keep
`disclosure/disclosure_tests.rs` and `disclosure.rs` under the 500-line
file-size gate.
- Write a test that drives the kernel-origin wrapper added in Phase 1 with
`ActionOrigin::Kernel`, the rated stand-in action, and the uncovered briefcase.
Assert the dispatch returns the generic blocked dispatch error, does not reach
the connector, persists a `DisclosurePendingQuestion` row, and routes an
`EscalationPayload::OwnerQuestion` escalation. Follow the assertion patterns
used in `disclosure/disclosure_tests.rs` and `dark_window_cap_tests.rs`
(audit-count, pending-question, escalation-message checks). Assert this outcome
matches worker-origin behavior for the same rated action and uncovered policy.
- Write a test modeled on the test helpers in `pipeline/standing_rule_timer.rs`:
activate a rated standing rule, schedule and claim a dark-window fired send, and
drive `claim_and_redispatch` (which calls `mediate_and_dispatch_action`) using a
rated messaging-send action with an uncovered disclosure policy. Assert the
fired send blocks, rolls back any reserved envelope budget, and raises
`OwnerQuestion`.
- Write a fail-closed guard test for the Phase 1 `notify_owner_with_digest`
change: assert that it refuses to send when the action is rated.
===============================================================================

Task: 3

Implement Phase 3: record the new origin-symmetric disclosure guarantee in
project documentation and specs, and confirm all CI gates pass.

- Add new `CLAIM-NN` rows to `docs/threat-claims.md` (using the next sequential
IDs) stating that disclosure enforcement is origin-symmetric: a rated action
cannot bypass the disclosure hook via kernel-origin or proactive
standing-rule/timer dispatch.
- In the `test: <fn_name>` verification cells for these new claim rows, cite the
exact new test function names from Phase 2's kernel-origin and standing-rule
tests, and confirm these names match the output of `cargo test --workspace --
--list`.
- Add an OpenSpec change under `openspec/changes/` that adds or amends a
requirement in `openspec/specs/disclosure-policy/spec.md`, stating that
fail-closed disclosure enforcement and `OwnerQuestion` escalation apply
identically regardless of dispatch origin or whether a principal is present.
Keep the change minimal and validate it with `openspec validate <change_id>
--strict`.
- Run `scripts/check.sh` and confirm all gates pass: `cargo fmt --check`, `cargo
clippy -D warnings`, full `cargo test --workspace`, the 500-line-per-file gate,
the threat-claims gate, and `openspec validate --all --strict`.
- Confirm new test code lives in new files rather than growing `actions.rs`,
`standing_rule_timer.rs`, or any near-limit disclosure files past their line
caps.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!