Spec: provenance labels with typed identity

[George-RD]

Wayfinder design ticket: #193. Map: #182. Immune-system lane. Promise: Immune system ("external content fills parameters, never gives instructions"). Users: Bell, Auditor. Design, not implementation.

Sibling specs this binds to: typed owner identity #197 (PrincipalId), disclosure gating on external egress #204 (which named the two extension points below). Research ruling: #190 / research/immune-system-design-inputs — provenance is HYBRID (compile-time untrusted-content typing + runtime label/lineage in the ledger); nothing raw crosses the quarantine boundary; the branch-steering residual is bounded by grants, not eliminated.

Problem Statement

A briefcase section today carries a disclosure_class sensitivity (Public/Internal/Private/Sensitive) and its payload is referenced by digest, but it does not record whose data it is. ClassifiedBriefcaseItem is { item_ref, disclosure_class }; check_egress walks the set of sensitivity classes × relationship × egress class against relationship-scoped policy. So the deterministic egress gate can tell that an item is "Private" but cannot tell a Client's Private datum from a Vendor's Private datum. It has no typed-identity dimension.

That missing dimension is exactly the Immune system gap for Bell: a stranger (an unauthenticated conversational principal) must never receive another counterparty's — or the owner's internal — information in a reply, even when both are the same sensitivity class. Today nothing in the deterministic gate stops "internal/other-counterparty data in a reply to a stranger" or cross-counterparty leakage, because the gate cannot see origin identity. For the Auditor, a disclosure decision can be reconstructed by (sensitivity class, relationship, egress class) but not by which identity's data was evaluated — origin is not an audit dimension.

The disclosure-gating design (#204) deliberately left two extension points for this ticket, and the codebase already contains the proven identity-bound-provenance pattern (learned_artifacts::Provenance::ProducedBy { source_event_id, source_exchange, source_scope: Ulid }, consulted deterministically via SQL predicates and DB triggers, fail-closed, with the counterparty_erasure table). Typed owner identity (#197) is introducing PrincipalId(Ulid). The pieces exist; what is missing is a label that binds provenance to typed identity and is consulted deterministically at context assembly and egress.

Solution

Introduce a provenance label: an immutable, kernel-minted value carried by each classified briefcase item that records the item's typed-identity origin alongside its existing disclosure_class sensitivity and its source lineage (producing event + producing exchange digest). Generalize the proven Provenance::ProducedBy lineage shape rather than inventing a new abstraction: widen its identity binding from a bare counterparty-scope Ulid to a closed, typed ProvenanceOrigin.

The label is then consulted deterministically at two points, with no LLM or agent judgment ever involved:

• Context assembly (kernel briefcase packing) derives each classified item's origin from the resolved typed identity of its source, instead of leaving origin unrecorded. A worker-visible section that cannot be given an origin fails closed for rated egress.
• External egress gains a second ordered check, inserted at the seam Spec: disclosure gating on external egress #204 named, after the existing disclosure-coverage stage: an origin-vs-recipient closure. An outbound item whose origin is a counterparty identity other than the bound recipient counterparty (and is not the owner, system, or public) is blocked unless a covering policy authorizes it. This is the Bell "internal data to a stranger" / cross-counterparty failure mode closed deterministically.

Authority to widen that closure extends through the grant, mirroring the existing egress-class caveat exactly: a new Caveat::ProvenanceLabelAllowlist + SupportedCaveatKind::ProvenanceLabelAllowlist + an effectively_allows_provenance_label narrowing helper, compiler-enforced and fail-closed on unknown caveats, with worker sub-grants provably narrowed. The dead gate() EgressClassifier seam stays deleted (#183) and is not resurrected.

The label binds to the typed identity vocabulary, not to strings: the owner arm reuses #197's PrincipalId; the counterparty arm uses a sibling IdentityRef(Ulid) newtype under the same discipline. Identity is not authority (D-006): the label records origin only and carries zero authority fields.

The hybrid split (per #190): the compile-time half is that the label is a kernel-minted, unforgeable typed value with no worker-reachable constructor (mirroring the kernel-only Briefcase mutators), and its origins are typed newtypes that cannot be a raw string a worker sets; the runtime half is the label/lineage carried in the ledger and consulted at the gate. The broader inbound UntrustedContext<T> quarantine-decode wrapper is a distinct adjacent lane concern and is out of scope here.

User Stories

1. As Bell, I want every classified datum the kernel packs to carry the typed identity it originated from, so the runtime can later tell one counterparty's data from another's rather than seeing only a sensitivity class.
2. As Bell, I want an outbound reply to an unauthenticated stranger to be blocked deterministically when it would carry another counterparty's data, so a crafted conversation can never talk a worker into leaking a third party's information.
3. As Bell, I want the owner's internal data (owner-origin, non-public) to be blocked from a stranger-facing reply unless a policy authorizes it, so "internal data in a reply to a stranger" cannot happen by omission.
4. As Bell, I want the origin decision made from a kernel-derived typed-identity binding, never from an LLM's judgment about the text, so a compromised worker cannot assert "this is fine to send."
5. As the Auditor, I want each disclosure decision reconstructible by exactly which typed-identity origin, sensitivity class, relationship, and egress class it was evaluated against, so I can verify no cross-identity data crossed the boundary without a matching authorization.
6. As the Auditor, I want the origin binding to be immutable and append-only, so a later authorization or reconfirmation never rewrites what a datum's origin was at production time.
7. As the Auditor, I want a datum whose origin cannot be resolved to be treated as most-restrictive (fail closed), so the absence of an origin is never mistaken for "safe to send."
8. As Lyra's owner (trusted owner's assistant), I want owner-origin data labelled with my typed PrincipalId, so my own information is distinguishable from any counterparty's and is never conflated with a stranger's.
9. As Lyra's owner, I want authority to permit an origin to egress to a given scope to travel through the grant chain as a caveat that can only narrow, never widen, so answering "yes" once cannot silently broaden what a later sub-grant may disclose.
10. As a developer minting a worker sub-grant for one counterparty's task, I want the sub-grant provably closed to that counterparty's (plus owner/public/system) origins by an empty-list-narrows caveat, so a worker handling counterparty X's conversation is structurally unable to egress counterparty Y's data.
11. As a developer implementing the sibling disclosure hook (Spec: disclosure gating on external egress #204/Prefactor: extend EgressClass and split the disclosure core from web-search preparation #205), I want the provenance-label check to slot in as a new ordered stage after the existing disclosure-coverage stage, without changing DisclosurePolicyKey/DisclosurePolicy shape, so I extend the sequence rather than redesign it.
12. As a developer, I want the label's owner origin to reuse Spec: Typed Owner Identity #197's PrincipalId and the counterparty origin to be a sibling IdentityRef(Ulid) newtype, so origins are type-safe and carry no authority (D-006), and non-Ulid shapes are impossible by construction.
13. As a developer extending the model later with tenancy, I want the typed-identity origin binding to be the mechanism a future principal-facing visibility class (customer-visible/staff/owner) rides on, so that axis can be added without redesigning provenance.
14. As the Auditor, I want a single authoritative sensitivity vocabulary (DisclosureClass) with a deterministic mapping from the duplicate DataClassification (Unknown -> most-restrictive), so two enums can never disagree about what an item's sensitivity is.
15. As the Unattended workhorse (kernel-origin/proactive sends, no principal present), I want kernel-origin outbound content to pass the identical origin-closure check as worker-requested content, so an autonomous loop cannot become a second ungated path for cross-identity leakage.

Implementation Decisions

• Generalize the proven lineage pattern (not a new abstraction). A provenance label reuses the Provenance::ProducedBy shape — source_event_id, source_exchange (digest), and the producing-identity binding — widening that binding from source_scope: Ulid to a closed typed ProvenanceOrigin. The label additionally carries the item's disclosure_class. It supersedes ClassifiedBriefcaseItem's role of "sensitivity + digest" by adding the identity dimension. (Considered and rejected: a new provenance edge table keyed by a typed id, and a bolt-on Option<origin> field on ClassifiedBriefcaseItem — both fragment the already-proven, trigger-enforced pattern.)
• ProvenanceOrigin is a closed enum: Owner(PrincipalId), Counterparty(IdentityRef), System. IdentityRef(Ulid) is a new newtype mirroring Spec: Typed Owner Identity #197's PrincipalId discipline (serializes as Ulid.to_string(), zero authority, D-006). RelationshipKind/RelationshipTier/ChannelTrust are derived attributes of an identity that the egress check reads; they are never the origin key. A CounterpartyRef::Unresolved (no identity_id) yields no origin and fails closed for rated egress.
• Bind to Spec: Typed Owner Identity #197. The Owner arm reuses PrincipalId; the implementation ticket that introduces the origin type is blocked by Introduce PrincipalId newtype and OwnerPrincipal aggregate #199 (PrincipalId introduction). Owner-origin data is never labelled with a raw Ulid or an "owner" string.
• Kernel-minted and immutable. The label has no worker-reachable constructor (mirrors the kernel-only Briefcase mutators / AD-032 confused-deputy defense). A caller-supplied value can only widen scrutiny (be treated as more restrictive), never narrow it. This is the compile-time half of the hybrid.
• Context assembly derives origin from resolved typed identity. Kernel briefcase packing (provenance_from_sections and the pack path) records each classified worker-visible item's origin from the identity resolved for its source, rather than leaving origin unrecorded. A worker-visible section with no resolvable origin returns the existing fail-closed unclassified error for rated egress.
• Egress gains one ordered stage. The pure deterministic core (today check_egress) gains a second stage after disclosure-coverage: origin-vs-recipient closure. An item whose ProvenanceOrigin is a Counterparty other than the bound recipient (and not Owner/System/Public) blocks unless covered. No change to DisclosurePolicyKey/DisclosurePolicy shape. The stage is inserted at the core-vs-preparation seam Spec: disclosure gating on external egress #204/Prefactor: extend EgressClass and split the disclosure core from web-search preparation #205 established.
• Grant-side extension point, exact mirror of egress-class. Add Caveat::ProvenanceLabelAllowlist { origins }, SupportedCaveatKind::ProvenanceLabelAllowlist, and effectively_allows_provenance_label(grant, origin) — the same append-only-narrowing, empty-list-narrows, fail-closed-on-unknown-caveat pattern as EgressClassAllowlist/effectively_allows_egress_class. The caveat is designed and enforced in v1, but the v1 single-owner owner grant is minted without it (no narrowing today); worker sub-grants adopt it. MAC discipline preserved (AD-148): the caveat is chain-appended, never a root-field mutation.
• gate() stays pure; the dead EgressClassifier stays dead. The origin check lives at the same kernel-side dispatch step as the existing disclosure hook (after gate() returns Allow), never inside openspine-gate. The dead _egress: &dyn EgressClassifier parameter (Fold the settlement and reservation shape into the Effect Truth issues #183) MUST NOT be resurrected.
• Uniform across dispatch origin. Worker-requested and kernel-origin/proactive dispatches (Unattended workhorse) pass through the identical origin-closure check — no second ungated path.
• One authoritative sensitivity vocabulary. DisclosureClass is authoritative; DataClassification maps deterministically into it with Unknown -> Sensitive (most-restrictive, fail-closed). The prose-level mapping is fixed here; the code migration that removes the duplicate is its own implementation ticket.
• No LLM/agent judgment anywhere. Every consult compares typed fields or digests only, following the counterparty_erasure SQL-predicate / DB-trigger precedent.

Testing Decisions

Good tests here assert only external behaviour — given a label set (origins × sensitivity), a relationship, a recipient, an egress class, and a policy/grant set, does the deterministic core return Allow or Block with the right escalation — never internal call sequencing.

• Pure origin-closure check beside check_egress in disclosure_policy.rs: table-driven over origin × recipient × sensitivity × egress class × policy coverage × caveat. Prior art: the inline check_egress #[cfg(test)] mod tests and disclosure_tests.
• effectively_allows_provenance_label grant helper: unit, exactly mirroring the effectively_allows_egress_class tests, including empty-list-narrows and fail-closed-on-unknown-caveat.
• Kernel origin derivation (provenance_from_sections extended): unit — a resolved counterparty section carries Counterparty(IdentityRef); an owner section carries Owner(PrincipalId); an unresolved section fails closed.
• Dispatch-integration (disclosure_regression_tests): production-entering cases — an item whose origin is counterparty X blocked from egress to counterparty Y; a kernel-origin (non-worker) dispatch hitting the same origin check.
• Invariants: immutability/append-only of the origin binding; D-006 (label carries no authority); AD-148 MAC preservation when the caveat is appended. Prior art: Spec: Typed Owner Identity #197's MAC and D-006 invariant tests; learned_artifacts erasure SQL-predicate tests.

Out of Scope

• Implementation. This is a design spec; landing code is the to-tickets tickets that follow.
• The inbound UntrustedContext<T> quarantine-decode wrapper and schema-bounded extraction — a distinct adjacent Immune-system concern (the quarantine boundary), not this label.
• Capability-derived tool catalogs — the third Immune-system lane, pre-inference, no overlap.
• The principal-facing visibility class values (customer-visible/staff/owner from Bell invariant I4) — a tenancy concern, fenced post-fit-review (DIRECTION.md). This spec only names the typed-identity origin binding as the mechanism that axis will ride on.
• Multi-tenant policy storage/isolation — Bell v1 is instance-per-tenant.
• Resurrecting or re-purposing gate()'s dead EgressClassifier.
• The branch-steering residual (in-grant action selection, semantic content shaping) — bounded by grants and owner preview per Research: design inputs for the Immune-system lane #190, not eliminated here.

Further Notes

• Canon cited: D-006 (identity != authority), AD-032/AD-121 (kernel-owned briefcase, no worker mutators), AD-140 (producing scope recorded in the provenance edge, not inferred), AD-146 (single owner principal v1), AD-148 (kernel-owned MAC-covered grant fields), AD-060 (typed egress classes; caveat mirror), D-107 (budget-scoped standing rules). The new load-bearing decision — "provenance and visibility labels bound to typed identity, consulted deterministically at context assembly and egress; kernel-minted, immutable, fail-closed, no LLM judgment" — should be recorded as a new D-0XX by the map owner / implementing change.
• Grilling round recorded on Design provenance labels with typed identity #193 (2026-08-20): Q1-Q9 settled with the coordinator standing in for the owner per the wayfinder map's owner ruling; see the resolution comment on Design provenance labels with typed identity #193.
• Glossary proposals (for the map owner to fold into CONTEXT.md, not applied by this worker): provenance label — an immutable, kernel-minted value carried by a classified datum, binding its typed-identity origin to its sensitivity class and source lineage; provenance origin — the typed identity a datum originated from (owner principal, counterparty identity, or system); consulted deterministically, never by LLM judgment.

[coderabbitai]

Coding Plan

Summary

This change delivers one OpenSpec change proposal only. The ticket forbids landing code, so the deliverable is a design specification.

The design generalizes the proven Provenance::ProducedBy lineage into a kernel-minted, immutable provenance label with a closed typed ProvenanceOrigin. This approach reuses an existing, proven pattern instead of inventing a new abstraction.

The design specifies one new ordered origin-vs-recipient closure stage at egress. This stage runs after the disclosure-coverage stage. The design also specifies a grant-side Caveat::ProvenanceLabelAllowlist that mirrors EgressClassAllowlist exactly. Both mechanisms are fail-closed and free of LLM judgment.

The design splits requirements across a new provenance-labels capability spec and MODIFIED deltas on disclosure-policy, responsibility-contract, and gate-action-api. The design records the load-bearing rule as a new D-0XX decision.

Design Choices

Design Choice 1: Where should the new provenance-label contract live: a new capability spec folder or a delta on the existing disclosure-policy spec?

Options Considered:

1. Create a new capability spec folder openspec/specs/provenance-labels/ and add its requirements as ## ADDED Requirements in the change delta. Keep the origin-closure egress stage as ## MODIFIED Requirements under disclosure-policy.
2. Add every new requirement as ## MODIFIED/## ADDED Requirements under the existing disclosure-policy spec, with no new folder.

Chosen Option: 1

Rationale: The label type, ProvenanceOrigin, typed newtypes, and kernel-minted immutability form an independently versioned contract that mirrors how responsibility-contract and grant-chain contracts were introduced. The egress-stage change is a genuine modification of disclosure-policy and stays a MODIFIED delta.

Design Choice 2: Which existing capability spec owns the grant-side Caveat::ProvenanceLabelAllowlist requirement?

Options Considered:

1. Add the caveat requirement as a ## MODIFIED/## ADDED Requirements delta under the gate-action-api capability spec, where grant-caveat enforcement requirements already live.
2. Add it under the new provenance-labels spec.

Chosen Option: 1

Rationale: Caveat narrowing, SupportedCaveatKind, fail-closed-on-unknown-caveat, and worker sub-grant narrowing are gate/authority concerns that already have a home in gate-action-api, so the caveat mirror sits beside EgressClassAllowlist.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Scaffold the change proposal and frame dependencies

This phase creates the change folder and the proposal.md that states the problem, the proposed solution, and the dependency edges. The goal is a proposal that a reviewer can accept before any spec prose is written.

Task 1: Create the dated change folder

Create the change directory that holds all deliverables for this ticket.

• Create openspec/changes/<YYYY-MM-DD>-spec-provenance-labels-typed-identity/ using the authoring date as the leading date-slug, per openspec/conventions.md.
• Reserve subpaths for proposal.md, design.md, tasks.md, and specs/<capability>/spec.md delta files added in later phases.

Task 2: Author proposal.md

Write the proposal with the required sections and the dependency framing.

• Include the mandatory sections ## Dependencies, ## Problem/Context, ## Proposed Solution, ## Acceptance Criteria, and ## Out of Scope.
• In ## Dependencies, cite the sibling specs and their status: typed owner identity #197 (PrincipalId) and its introduction ticket #199 marked HARD; disclosure gating #204 (the source of the two extension points) marked HARD; the research ruling #190 (research/immune-system-design-inputs); the dead EgressClassifier #183 named as an explicit non-goal that MUST NOT be resurrected.
• In ## Problem/Context, state the missing typed-identity dimension: ClassifiedBriefcaseItem records disclosure_class but not whose data it is; check_egress cannot distinguish a Client's Private datum from a Vendor's; the Auditor cannot reconstruct a decision by origin identity.
• In ## Proposed Solution, summarize the four moves: generalize Provenance::ProducedBy into a typed provenance label, derive origin at context assembly, add an ordered origin-vs-recipient closure stage at egress, and add the mirror Caveat::ProvenanceLabelAllowlist.
• Per openspec/config.yaml, state that the change affects OpenSpine core (Immune-system lane), that it is authority-sensitive (identity resolution, memory scope, external writes, containment), and list the ## Out of Scope items verbatim from the ticket (inbound UntrustedContext<T>, capability-derived tool catalogs, principal-facing visibility class values, multi-tenant storage, resurrecting EgressClassifier, the branch-steering residual, and any code landing).
• Add a ## Decision-log check bullet noting that a new D-0XX decision entry will be recorded for the load-bearing rule.

🤖 Prompt for AI agents

Summary: Scaffold the OpenSpec change folder and author `proposal.md`, the first
deliverable that a reviewer must accept before spec prose is written.

Steps:
- Create the directory
`openspec/changes/<YYYY-MM-DD>-spec-provenance-labels-typed-identity/`, using
the authoring date as the leading date-slug, following
`openspec/conventions.md`.
- Reserve subpaths inside this folder for `proposal.md`, `design.md`,
`tasks.md`, and `specs/<capability>/spec.md` delta files that later phases will
add.
- Write `proposal.md` with these mandatory sections in order: `## Dependencies`,
`## Problem/Context`, `## Proposed Solution`, `## Acceptance Criteria`, `## Out
of Scope`.
- In `## Dependencies`, list: typed owner identity `#197` (`PrincipalId`) and its
introduction ticket `#199`, both marked HARD; disclosure gating `#204` marked HARD
as the source of the two extension points; research ruling `#190`
(`research/immune-system-design-inputs`); the dead `EgressClassifier` `#183`,
named explicitly as a non-goal that must not be resurrected.
- In `## Problem/Context`, state that `ClassifiedBriefcaseItem` records
`disclosure_class` but not whose data it is, that `check_egress` cannot
distinguish a Client's Private datum from a Vendor's, and that the Auditor
cannot reconstruct a decision by origin identity.
- In `## Proposed Solution`, summarize four moves: generalize
`Provenance::ProducedBy` into a typed provenance label; derive origin at context
assembly; add an ordered origin-vs-recipient closure stage at egress; add the
mirror `Caveat::ProvenanceLabelAllowlist`.
- Per `openspec/config.yaml`, state that the change affects OpenSpine core
(Immune-system lane) and is authority-sensitive (identity resolution, memory
scope, external writes, containment).
- List `## Out of Scope` items verbatim: inbound `UntrustedContext<T>`,
capability-derived tool catalogs, principal-facing visibility class values,
multi-tenant storage, resurrecting `EgressClassifier`, the branch-steering
residual, and any code landing.
- Add a `## Decision-log check` bullet noting that a new `D-0XX` decision entry
will be recorded for the load-bearing rule.

Phase 2: Author design.md

This phase writes the design rationale that grounds every spec requirement. The goal is a design document that explains the typed-identity provenance model, the hybrid split, the deterministic checks, and the rejected alternatives, with authority, containment, audit, and failure-mode analysis.

Task 1: Specify the provenance label and typed origin model

Describe the label as a generalization of the proven lineage pattern.

• State that the label reuses the Provenance::ProducedBy shape (source_event_id, source_exchange digest, producing-identity binding) and widens the identity binding from source_scope: Ulid to a closed typed ProvenanceOrigin, and that the label additionally carries disclosure_class.
• Define ProvenanceOrigin as a closed enum with exactly three arms: Owner(PrincipalId) (reusing #197's type), Counterparty(IdentityRef), and System.
• Define IdentityRef(Ulid) as a new newtype that mirrors the PrincipalId discipline: #[serde(transparent)], serializes as Ulid.to_string(), carries zero authority fields (D-006).
• State that RelationshipKind, RelationshipTier, and ChannelTrust are derived attributes read by the egress check, never the origin key.
• State that a CounterpartyRef::Unresolved source (no identity_id) yields no origin and fails closed for rated egress.
• Record the rejected alternatives in a table: a new provenance-edge table keyed by typed id, and a bolt-on Option<origin> field on ClassifiedBriefcaseItem — both fragment the trigger-enforced pattern.

Task 2: Specify the compile-time/runtime hybrid and the kernel-minted invariant

Describe the hybrid split from research ruling #190.

• State the compile-time half: the label is kernel-minted and unforgeable, has no worker-reachable constructor (mirroring the kernel-only Briefcase mutators, AD-032/AD-121), and its origins are typed newtypes that a worker cannot set as a raw string.
• State the runtime half: the label and lineage are carried in the ledger and consulted deterministically at the gate.
• State that a caller-supplied value can only widen scrutiny (be treated as more restrictive), never narrow it.
• Note that the broader inbound UntrustedContext<T> quarantine wrapper is a separate lane and out of scope.

Task 3: Specify context-assembly origin derivation and the ordered egress stage

Describe where origin is derived and where the second deterministic check runs.

• State that kernel briefcase packing derives each classified worker-visible item's origin from the resolved typed identity of its source, and that owner-pool sections (grant, preference, skill) resolve to Owner(PrincipalId) while counterparty-sourced sections resolve to Counterparty(IdentityRef).
• State that a worker-visible section with no resolvable origin returns the existing fail-closed unclassified error for rated egress.
• State that the pure deterministic core gains a second ordered stage after the existing disclosure-coverage stage: origin-vs-recipient closure. An item whose origin is a Counterparty other than the bound recipient counterparty, and not Owner/System/Public, is blocked unless a covering policy authorizes it.
• State that DisclosurePolicyKey and DisclosurePolicy shapes do not change, and that the stage is inserted at the core-vs-preparation seam that #204/Prefactor: extend EgressClass and split the disclosure core from web-search preparation #205 named.
• State that worker-requested and kernel-origin/proactive dispatches pass through the identical origin-closure check, so no second ungated path exists.
• Reference the concrete insertion point for the follow-up implementer: enforce_disclosure_egress in openspine-kernel/src/disclosure.rs, immediately around the single check_egress call, where request.relationship and query.provenance are in scope and the recipient identity_id from CounterpartyRef::Bound can be threaded.

Task 4: Specify the grant-side caveat mirror and the sensitivity vocabulary rule

Describe the grant extension and the DisclosureClass mapping.

• State that a new Caveat::ProvenanceLabelAllowlist { origins }, a new SupportedCaveatKind::ProvenanceLabelAllowlist, and an effectively_allows_provenance_label(grant, origin) helper mirror the EgressClassAllowlist pattern exactly: append-only narrowing, empty-list-narrows, and fail-closed-on-unknown-caveat via the exhaustive has_unsupported_caveats_except match.
• State that MAC discipline is preserved (AD-148): the caveat is chain-appended, never a root-field mutation.
• State that the v1 single-owner owner grant is minted without the caveat (no narrowing today), and that worker sub-grants adopt it, appended unconditionally with an empty list in mint_worker_grant (openspine-authority/src/worker_grant.rs) beside the existing empty OutputChannelAllowlist/EgressClassAllowlist pushes.
• State that gate() stays pure and the dead _egress: &dyn EgressClassifier parameter (#183) is not resurrected; the origin check lives kernel-side after gate() returns Allow.
• State the one authoritative sensitivity vocabulary rule: DisclosureClass is authoritative; DataClassification maps deterministically into it with Unknown -> Sensitive (most-restrictive, fail-closed). Note that the code migration removing the duplicate is its own follow-up ticket.
• Add the authority/containment/audit/failure-mode analysis required for authority-sensitive changes, including the fail-closed behavior when origin is unresolved and the audit reconstruction by (origin, sensitivity class, relationship, egress class).

🤖 Prompt for AI agents

Summary: Author `design.md`, the design rationale document that grounds every
spec requirement, covering the typed-identity provenance model, the
compile-time/runtime hybrid, the deterministic checks, the rejected
alternatives, and the authority/containment/audit/failure-mode analysis.

Steps for the provenance label and typed origin model:
- State that the label reuses the `Provenance::ProducedBy` shape
(`source_event_id`, `source_exchange` digest, producing-identity binding) and
widens the identity binding from `source_scope: Ulid` to a closed typed
`ProvenanceOrigin`, and additionally carries `disclosure_class`.
- Define `ProvenanceOrigin` as a closed enum with exactly three arms:
`Owner(PrincipalId)` (reusing `#197`'s type), `Counterparty(IdentityRef)`, and
`System`.
- Define `IdentityRef(Ulid)` as a new newtype mirroring the `PrincipalId`
discipline: `#[serde(transparent)]`, serializes as `Ulid.to_string()`, carries
zero authority fields (D-006).
- State that `RelationshipKind`, `RelationshipTier`, and `ChannelTrust` are
derived attributes read by the egress check, never the origin key.
- State that a `CounterpartyRef::Unresolved` source (no `identity_id`) yields no
origin and fails closed for rated egress.
- Record rejected alternatives in a table: a new provenance-edge table keyed by
typed id, and a bolt-on `Option<origin>` field on `ClassifiedBriefcaseItem` —
note both fragment the trigger-enforced pattern.

Steps for the compile-time/runtime hybrid:
- State the compile-time half: the label is kernel-minted and unforgeable, has
no worker-reachable constructor (mirroring the kernel-only `Briefcase` mutators,
AD-032/AD-121), and its origins are typed newtypes that a worker cannot set as a
raw string.
- State the runtime half: the label and lineage are carried in the ledger and
consulted deterministically at the gate.
- State that a caller-supplied value can only widen scrutiny, never narrow it.
- Note that the broader inbound `UntrustedContext<T>` quarantine wrapper is a
separate lane and out of scope.

Steps for context-assembly origin derivation and the ordered egress stage:
- State that kernel briefcase packing derives each classified worker-visible
item's origin from the resolved typed identity of its source; owner-pool
sections (grant, preference, skill) resolve to `Owner(PrincipalId)`,
counterparty-sourced sections resolve to `Counterparty(IdentityRef)`.
- State that a worker-visible section with no resolvable origin returns the
existing fail-closed unclassified error for rated egress.
- State that the pure deterministic core gains a second ordered stage after the
existing disclosure-coverage stage: origin-vs-recipient closure. An item whose
origin is a `Counterparty` other than the bound recipient counterparty, and not
`Owner`/`System`/`Public`, is blocked unless a covering policy authorizes it.
- State that `DisclosurePolicyKey` and `DisclosurePolicy` shapes do not change,
and that the stage is inserted at the core-vs-preparation seam that `#204/`#205
named.
- State that worker-requested and kernel-origin/proactive dispatches pass
through the identical origin-closure check, so no second ungated path exists.
- Reference the concrete insertion point for the follow-up implementer:
`enforce_disclosure_egress` in `openspine-kernel/src/disclosure.rs`, immediately
around the single `check_egress` call, where `request.relationship` and
`query.provenance` are in scope and the recipient `identity_id` from
`CounterpartyRef::Bound` can be threaded.

Steps for the grant-side caveat mirror and sensitivity vocabulary rule:
- State that a new `Caveat::ProvenanceLabelAllowlist { origins }`, a new
`SupportedCaveatKind::ProvenanceLabelAllowlist`, and an
`effectively_allows_provenance_label(grant, origin)` helper mirror the
`EgressClassAllowlist` pattern exactly: append-only narrowing,
empty-list-narrows, fail-closed-on-unknown-caveat via the exhaustive
`has_unsupported_caveats_except` match.
- State that MAC discipline is preserved (AD-148): the caveat is chain-appended,
never a root-field mutation.
- State that the v1 single-owner owner grant is minted without the caveat, and
that worker sub-grants adopt it, appended unconditionally with an empty list in
`mint_worker_grant` (`openspine-authority/src/worker_grant.rs`) beside the
existing empty `OutputChannelAllowlist`/`EgressClassAllowlist` pushes.
- State that `gate()` stays pure and the dead `_egress: &dyn EgressClassifier`
parameter (`#183`) is not resurrected; the origin check lives kernel-side after
`gate()` returns `Allow`.
- State the one authoritative sensitivity vocabulary rule: `DisclosureClass` is
authoritative; `DataClassification` maps deterministically into it with `Unknown
-> Sensitive` (most-restrictive, fail-closed). Note that removing the duplicate
is a separate follow-up ticket.
- Add authority/containment/audit/failure-mode analysis required for
authority-sensitive changes, including fail-closed behavior when origin is
unresolved and audit reconstruction by (origin, sensitivity class, relationship,
egress class).

Phase 3: Author the capability spec deltas

This phase writes the requirement deltas across the affected capability specs. The goal is a set of ### Requirement: blocks with #### Scenario: bullets that name the exact future test functions, following the prose style already used in disclosure-policy/spec.md.

Task 1: Add the new provenance-labels capability delta spec

Create the delta spec for the label contract.

• Create specs/provenance-labels/spec.md in the change folder with a ## ADDED Requirements header (this capability does not exist in the canonical openspec/specs/).
• Add requirements for: the label carries a typed ProvenanceOrigin plus disclosure_class plus source lineage; the label is kernel-minted with no worker-reachable constructor; the origin binding is immutable and append-only (a later authorization never rewrites origin at production time); IdentityRef and PrincipalId carry no authority (D-006); the DataClassification -> DisclosureClass mapping with Unknown -> Sensitive.
• Write MUST/MUST NOT prose and #### Scenario: WHEN/THEN/AND blocks that name the exact backing test function for each scenario.

Task 2: Add the disclosure-policy MODIFIED delta

Extend the disclosure-policy contract with the origin-closure stage.

• Create specs/disclosure-policy/spec.md in the change folder with ## MODIFIED Requirements (the canonical spec is pre-seeded, so touched requirements use MODIFIED, never re-ADDED).
• Add or modify requirements for: origin-vs-recipient closure runs as an ordered stage after disclosure-coverage; an item whose origin is a non-recipient counterparty and not owner/system/public blocks unless covered; an unresolved origin is treated as most-restrictive and fails closed; the decision is reconstructible by typed-identity origin as an audit dimension; worker-requested and kernel-origin dispatch pass the identical check.
• Name the exact future test functions in each #### Scenario: block, mirroring the existing convention in the canonical disclosure-policy/spec.md.

Task 3: Add the responsibility-contract MODIFIED delta

Place the kernel-derived origin binding alongside the resolved-context requirement.

• Create specs/responsibility-contract/spec.md in the change folder with ## MODIFIED Requirements.
• Add a requirement that origin is kernel-derived at the kernel boundary and never shell/caller-supplied, phrased in the same "the kernel MUST construct that context at its own boundary ... rather than a shell-supplied payload" style as the existing "Trusted action context MUST be resolved by the kernel" requirement.

Task 4: Add the gate-action-api delta for the caveat mirror

Specify the grant-side narrowing caveat.

• Create specs/gate-action-api/spec.md in the change folder; use ## MODIFIED Requirements for any existing caveat/grant requirement touched and ## ADDED Requirements only for requirements genuinely absent from the canonical spec.
• Add requirements for: Caveat::ProvenanceLabelAllowlist narrows append-only and never widens; empty-list narrows to nothing; unknown caveats remain fail-closed at the verifier boundary; worker sub-grants are provably closed to non-recipient origins; the v1 owner grant is minted without the caveat; MAC discipline is preserved.
• Name the exact future test functions in each #### Scenario: block.

🤖 Prompt for AI agents

Summary: Author capability spec deltas across four files in the change folder,
each with `### Requirement:` blocks and `#### Scenario:` bullets naming exact
future test functions, following the prose style used in
`disclosure-policy/spec.md`.

For `specs/provenance-labels/spec.md`:
- Use a `## ADDED Requirements` header, since this capability does not exist in
canonical `openspec/specs/`.
- Add requirements: the label carries a typed `ProvenanceOrigin` plus
`disclosure_class` plus source lineage; the label is kernel-minted with no
worker-reachable constructor; the origin binding is immutable and append-only (a
later authorization never rewrites origin at production time); `IdentityRef` and
`PrincipalId` carry no authority (D-006); the `DataClassification ->
DisclosureClass` mapping with `Unknown -> Sensitive`.
- Write MUST/MUST NOT prose and WHEN/THEN/AND scenario blocks, each naming the
exact backing test function.

For `specs/disclosure-policy/spec.md`:
- Use `## MODIFIED Requirements` (the canonical spec is pre-seeded, so touched
requirements use MODIFIED, never re-ADDED).
- Add or modify requirements: origin-vs-recipient closure runs as an ordered
stage after disclosure-coverage; an item whose origin is a non-recipient
counterparty and not owner/system/public blocks unless covered; an unresolved
origin is treated as most-restrictive and fails closed; the decision is
reconstructible by typed-identity origin as an audit dimension; worker-requested
and kernel-origin dispatch pass the identical check.
- Name the exact future test functions in each scenario block, mirroring the
existing convention in the canonical `disclosure-policy/spec.md`.

For `specs/responsibility-contract/spec.md`:
- Use `## MODIFIED Requirements`.
- Add a requirement that origin is kernel-derived at the kernel boundary and
never shell/caller-supplied. Phrase it in the same style as the existing
"Trusted action context MUST be resolved by the kernel" requirement: "the kernel
MUST construct that context at its own boundary ... rather than a shell-supplied
payload."

For `specs/gate-action-api/spec.md`:
- Use `## MODIFIED Requirements` for any existing caveat/grant requirement
touched, and `## ADDED Requirements` only for requirements genuinely absent from
the canonical spec.
- Add requirements: `Caveat::ProvenanceLabelAllowlist` narrows append-only and
never widens; empty-list narrows to nothing; unknown caveats remain fail-closed
at the verifier boundary; worker sub-grants are provably closed to non-recipient
origins; the v1 owner grant is minted without the caveat; MAC discipline is
preserved.
- Name the exact future test functions in each scenario block.

Phase 4: Author tasks.md and the decision-log entry

This phase writes the implementation slices for the follow-up tickets and records the new decision. The goal is a numbered task checklist that a later implementing change can execute, plus the decision-log update.

Task 1: Author tasks.md with numbered implementation slices

Write the task breakdown for follow-up implementation tickets.

• Use numbered ## N. <slice title> sections with - [ ] checklist items, per openspec/conventions.md.
• Include slices for: introduce IdentityRef(Ulid) and ProvenanceOrigin (blocked by #199 PrincipalId); generalize Provenance::ProducedBy and add the label carrying disclosure_class; extend provenance_from_sections and the pack path to derive origin; add the pure origin-closure check beside check_egress in disclosure_policy.rs; wire the ordered stage into enforce_disclosure_egress; add the Caveat::ProvenanceLabelAllowlist, SupportedCaveatKind, and effectively_allows_provenance_label helper; append the empty-list caveat in mint_worker_grant; ensure kernel-origin dispatch passes the same check; a separate slice for the DataClassification -> DisclosureClass migration.
• Include explicit verification tasks for authority, containment, audit, and prompt-injection boundaries: fail-closed on unresolved origin, immutability/append-only of the origin binding, D-006 (label carries no authority), and AD-148 MAC preservation when the caveat is appended.
• Include a documentation-update task that records the glossary proposals (provenance label, provenance origin) for the map owner to fold into CONTEXT.md.
• Reference the testing decisions verbatim: table-driven pure origin-closure tests, effectively_allows_provenance_label unit tests mirroring effectively_allows_egress_class, kernel origin-derivation unit tests, and dispatch-integration regression tests for cross-counterparty and kernel-origin cases.

Task 2: Record the new decision-log entry

Add the task and text for the new D-0XX decision.

• Add a tasks.md slice to append a new D-0XX entry to .raw/openspine-decision-log.md (next number after the current ceiling D-173), with ## Decision, ## Rationale, ## Consequences, and ## Would change if blocks.
• State the decision text: provenance and visibility labels are bound to typed identity, consulted deterministically at context assembly and egress, kernel-minted, immutable, fail-closed, with no LLM judgment.
• Cite the grounding canon in the entry: D-006, AD-032/AD-121, AD-140, AD-146, AD-148, AD-060, D-107.

🤖 Prompt for AI agents

Summary: Author `tasks.md`, the numbered implementation slice checklist for
follow-up tickets, and record a new decision-log entry documenting the
load-bearing rule.

Steps for `tasks.md`:
- Use numbered `## N. <slice title>` sections with `- [ ]` checklist items, per
`openspec/conventions.md`.
- Include slices for: introducing `IdentityRef(Ulid)` and `ProvenanceOrigin`
(blocked by `#199` `PrincipalId`); generalizing `Provenance::ProducedBy` and
adding the label carrying `disclosure_class`; extending
`provenance_from_sections` and the pack path to derive origin; adding the pure
origin-closure check beside `check_egress` in `disclosure_policy.rs`; wiring the
ordered stage into `enforce_disclosure_egress`; adding
`Caveat::ProvenanceLabelAllowlist`, `SupportedCaveatKind`, and the
`effectively_allows_provenance_label` helper; appending the empty-list caveat in
`mint_worker_grant`; ensuring kernel-origin dispatch passes the same check; a
separate slice for the `DataClassification -> DisclosureClass` migration.
- Include explicit verification tasks for authority, containment, audit, and
prompt-injection boundaries: fail-closed on unresolved origin;
immutability/append-only of the origin binding; D-006 (label carries no
authority); AD-148 MAC preservation when the caveat is appended.
- Include a documentation-update task recording the glossary proposals
(provenance label, provenance origin) for the map owner to fold into
`CONTEXT.md`.
- Reference the testing decisions verbatim: table-driven pure origin-closure
tests; `effectively_allows_provenance_label` unit tests mirroring
`effectively_allows_egress_class`; kernel origin-derivation unit tests;
dispatch-integration regression tests for cross-counterparty and kernel-origin
cases.

Steps for the decision-log entry:
- Add a `tasks.md` slice to append a new `D-0XX` entry to
`.raw/openspine-decision-log.md` (next number after the current ceiling D-173),
with `## Decision`, `## Rationale`, `## Consequences`, and `## Would change if`
blocks.
- State the decision text: provenance and visibility labels are bound to typed
identity, consulted deterministically at context assembly and egress,
kernel-minted, immutable, fail-closed, with no LLM judgment.
- Cite the grounding canon in the entry: D-006, AD-032/AD-121, AD-140, AD-146,
AD-148, AD-060, D-107.

Research

OpenSpine splits disclosure logic between pure schema types in openspine-schemas (disclosure_policy.rs: ClassifiedBriefcaseItem, DisclosureClass, check_egress, DisclosurePolicy) and kernel orchestration in openspine-kernel (disclosure.rs: prepare_disclosure_query, enforce_disclosure_egress, provenance_from_sections).

Egress enforcement runs inline in api/actions.rs after gate() returns Allow; the gate() EgressClassifier parameter is dead (#183).

Grant caveats live in grant_chain.rs with the EgressClassAllowlist / effectively_allows_egress_class / SupportedCaveatKind pattern, sealed by an append-only MAC chain.

Worker sub-grants are minted in openspine-authority/src/worker_grant.rs, which appends empty-list narrowing caveats unconditionally.

The proven identity-bound lineage pattern is learned_artifacts::Provenance::ProducedBy { source_event_id, source_exchange, source_scope: Ulid }, consulted through SQL predicates and DB triggers and fail-closed against the erased_counterparties table.

No PrincipalId, IdentityRef, or Ulid-wrapping newtype exists yet.

Design deliverables follow the OpenSpec change convention (openspec/conventions.md): a dated change folder with proposal.md, design.md, tasks.md, and per-capability delta specs using ## ADDED/## MODIFIED Requirements headers.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Summary: Scaffold the OpenSpec change folder and author `proposal.md`, the first
deliverable that a reviewer must accept before spec prose is written.

Steps:
- Create the directory
`openspec/changes/<YYYY-MM-DD>-spec-provenance-labels-typed-identity/`, using
the authoring date as the leading date-slug, following
`openspec/conventions.md`.
- Reserve subpaths inside this folder for `proposal.md`, `design.md`,
`tasks.md`, and `specs/<capability>/spec.md` delta files that later phases will
add.
- Write `proposal.md` with these mandatory sections in order: `## Dependencies`,
`## Problem/Context`, `## Proposed Solution`, `## Acceptance Criteria`, `## Out
of Scope`.
- In `## Dependencies`, list: typed owner identity `#197` (`PrincipalId`) and its
introduction ticket `#199`, both marked HARD; disclosure gating `#204` marked HARD
as the source of the two extension points; research ruling `#190`
(`research/immune-system-design-inputs`); the dead `EgressClassifier` `#183`,
named explicitly as a non-goal that must not be resurrected.
- In `## Problem/Context`, state that `ClassifiedBriefcaseItem` records
`disclosure_class` but not whose data it is, that `check_egress` cannot
distinguish a Client's Private datum from a Vendor's, and that the Auditor
cannot reconstruct a decision by origin identity.
- In `## Proposed Solution`, summarize four moves: generalize
`Provenance::ProducedBy` into a typed provenance label; derive origin at context
assembly; add an ordered origin-vs-recipient closure stage at egress; add the
mirror `Caveat::ProvenanceLabelAllowlist`.
- Per `openspec/config.yaml`, state that the change affects OpenSpine core
(Immune-system lane) and is authority-sensitive (identity resolution, memory
scope, external writes, containment).
- List `## Out of Scope` items verbatim: inbound `UntrustedContext<T>`,
capability-derived tool catalogs, principal-facing visibility class values,
multi-tenant storage, resurrecting `EgressClassifier`, the branch-steering
residual, and any code landing.
- Add a `## Decision-log check` bullet noting that a new `D-0XX` decision entry
will be recorded for the load-bearing rule.
===============================================================================

Task: 2

Summary: Author `design.md`, the design rationale document that grounds every
spec requirement, covering the typed-identity provenance model, the
compile-time/runtime hybrid, the deterministic checks, the rejected
alternatives, and the authority/containment/audit/failure-mode analysis.

Steps for the provenance label and typed origin model:
- State that the label reuses the `Provenance::ProducedBy` shape
(`source_event_id`, `source_exchange` digest, producing-identity binding) and
widens the identity binding from `source_scope: Ulid` to a closed typed
`ProvenanceOrigin`, and additionally carries `disclosure_class`.
- Define `ProvenanceOrigin` as a closed enum with exactly three arms:
`Owner(PrincipalId)` (reusing `#197`'s type), `Counterparty(IdentityRef)`, and
`System`.
- Define `IdentityRef(Ulid)` as a new newtype mirroring the `PrincipalId`
discipline: `#[serde(transparent)]`, serializes as `Ulid.to_string()`, carries
zero authority fields (D-006).
- State that `RelationshipKind`, `RelationshipTier`, and `ChannelTrust` are
derived attributes read by the egress check, never the origin key.
- State that a `CounterpartyRef::Unresolved` source (no `identity_id`) yields no
origin and fails closed for rated egress.
- Record rejected alternatives in a table: a new provenance-edge table keyed by
typed id, and a bolt-on `Option<origin>` field on `ClassifiedBriefcaseItem` —
note both fragment the trigger-enforced pattern.

Steps for the compile-time/runtime hybrid:
- State the compile-time half: the label is kernel-minted and unforgeable, has
no worker-reachable constructor (mirroring the kernel-only `Briefcase` mutators,
AD-032/AD-121), and its origins are typed newtypes that a worker cannot set as a
raw string.
- State the runtime half: the label and lineage are carried in the ledger and
consulted deterministically at the gate.
- State that a caller-supplied value can only widen scrutiny, never narrow it.
- Note that the broader inbound `UntrustedContext<T>` quarantine wrapper is a
separate lane and out of scope.

Steps for context-assembly origin derivation and the ordered egress stage:
- State that kernel briefcase packing derives each classified worker-visible
item's origin from the resolved typed identity of its source; owner-pool
sections (grant, preference, skill) resolve to `Owner(PrincipalId)`,
counterparty-sourced sections resolve to `Counterparty(IdentityRef)`.
- State that a worker-visible section with no resolvable origin returns the
existing fail-closed unclassified error for rated egress.
- State that the pure deterministic core gains a second ordered stage after the
existing disclosure-coverage stage: origin-vs-recipient closure. An item whose
origin is a `Counterparty` other than the bound recipient counterparty, and not
`Owner`/`System`/`Public`, is blocked unless a covering policy authorizes it.
- State that `DisclosurePolicyKey` and `DisclosurePolicy` shapes do not change,
and that the stage is inserted at the core-vs-preparation seam that `#204/`#205
named.
- State that worker-requested and kernel-origin/proactive dispatches pass
through the identical origin-closure check, so no second ungated path exists.
- Reference the concrete insertion point for the follow-up implementer:
`enforce_disclosure_egress` in `openspine-kernel/src/disclosure.rs`, immediately
around the single `check_egress` call, where `request.relationship` and
`query.provenance` are in scope and the recipient `identity_id` from
`CounterpartyRef::Bound` can be threaded.

Steps for the grant-side caveat mirror and sensitivity vocabulary rule:
- State that a new `Caveat::ProvenanceLabelAllowlist { origins }`, a new
`SupportedCaveatKind::ProvenanceLabelAllowlist`, and an
`effectively_allows_provenance_label(grant, origin)` helper mirror the
`EgressClassAllowlist` pattern exactly: append-only narrowing,
empty-list-narrows, fail-closed-on-unknown-caveat via the exhaustive
`has_unsupported_caveats_except` match.
- State that MAC discipline is preserved (AD-148): the caveat is chain-appended,
never a root-field mutation.
- State that the v1 single-owner owner grant is minted without the caveat, and
that worker sub-grants adopt it, appended unconditionally with an empty list in
`mint_worker_grant` (`openspine-authority/src/worker_grant.rs`) beside the
existing empty `OutputChannelAllowlist`/`EgressClassAllowlist` pushes.
- State that `gate()` stays pure and the dead `_egress: &dyn EgressClassifier`
parameter (`#183`) is not resurrected; the origin check lives kernel-side after
`gate()` returns `Allow`.
- State the one authoritative sensitivity vocabulary rule: `DisclosureClass` is
authoritative; `DataClassification` maps deterministically into it with `Unknown
-> Sensitive` (most-restrictive, fail-closed). Note that removing the duplicate
is a separate follow-up ticket.
- Add authority/containment/audit/failure-mode analysis required for
authority-sensitive changes, including fail-closed behavior when origin is
unresolved and audit reconstruction by (origin, sensitivity class, relationship,
egress class).
===============================================================================

Task: 3

Summary: Author capability spec deltas across four files in the change folder,
each with `### Requirement:` blocks and `#### Scenario:` bullets naming exact
future test functions, following the prose style used in
`disclosure-policy/spec.md`.

For `specs/provenance-labels/spec.md`:
- Use a `## ADDED Requirements` header, since this capability does not exist in
canonical `openspec/specs/`.
- Add requirements: the label carries a typed `ProvenanceOrigin` plus
`disclosure_class` plus source lineage; the label is kernel-minted with no
worker-reachable constructor; the origin binding is immutable and append-only (a
later authorization never rewrites origin at production time); `IdentityRef` and
`PrincipalId` carry no authority (D-006); the `DataClassification ->
DisclosureClass` mapping with `Unknown -> Sensitive`.
- Write MUST/MUST NOT prose and WHEN/THEN/AND scenario blocks, each naming the
exact backing test function.

For `specs/disclosure-policy/spec.md`:
- Use `## MODIFIED Requirements` (the canonical spec is pre-seeded, so touched
requirements use MODIFIED, never re-ADDED).
- Add or modify requirements: origin-vs-recipient closure runs as an ordered
stage after disclosure-coverage; an item whose origin is a non-recipient
counterparty and not owner/system/public blocks unless covered; an unresolved
origin is treated as most-restrictive and fails closed; the decision is
reconstructible by typed-identity origin as an audit dimension; worker-requested
and kernel-origin dispatch pass the identical check.
- Name the exact future test functions in each scenario block, mirroring the
existing convention in the canonical `disclosure-policy/spec.md`.

For `specs/responsibility-contract/spec.md`:
- Use `## MODIFIED Requirements`.
- Add a requirement that origin is kernel-derived at the kernel boundary and
never shell/caller-supplied. Phrase it in the same style as the existing
"Trusted action context MUST be resolved by the kernel" requirement: "the kernel
MUST construct that context at its own boundary ... rather than a shell-supplied
payload."

For `specs/gate-action-api/spec.md`:
- Use `## MODIFIED Requirements` for any existing caveat/grant requirement
touched, and `## ADDED Requirements` only for requirements genuinely absent from
the canonical spec.
- Add requirements: `Caveat::ProvenanceLabelAllowlist` narrows append-only and
never widens; empty-list narrows to nothing; unknown caveats remain fail-closed
at the verifier boundary; worker sub-grants are provably closed to non-recipient
origins; the v1 owner grant is minted without the caveat; MAC discipline is
preserved.
- Name the exact future test functions in each scenario block.
===============================================================================

Task: 4

Summary: Author `tasks.md`, the numbered implementation slice checklist for
follow-up tickets, and record a new decision-log entry documenting the
load-bearing rule.

Steps for `tasks.md`:
- Use numbered `## N. <slice title>` sections with `- [ ]` checklist items, per
`openspec/conventions.md`.
- Include slices for: introducing `IdentityRef(Ulid)` and `ProvenanceOrigin`
(blocked by `#199` `PrincipalId`); generalizing `Provenance::ProducedBy` and
adding the label carrying `disclosure_class`; extending
`provenance_from_sections` and the pack path to derive origin; adding the pure
origin-closure check beside `check_egress` in `disclosure_policy.rs`; wiring the
ordered stage into `enforce_disclosure_egress`; adding
`Caveat::ProvenanceLabelAllowlist`, `SupportedCaveatKind`, and the
`effectively_allows_provenance_label` helper; appending the empty-list caveat in
`mint_worker_grant`; ensuring kernel-origin dispatch passes the same check; a
separate slice for the `DataClassification -> DisclosureClass` migration.
- Include explicit verification tasks for authority, containment, audit, and
prompt-injection boundaries: fail-closed on unresolved origin;
immutability/append-only of the origin binding; D-006 (label carries no
authority); AD-148 MAC preservation when the caveat is appended.
- Include a documentation-update task recording the glossary proposals
(provenance label, provenance origin) for the map owner to fold into
`CONTEXT.md`.
- Reference the testing decisions verbatim: table-driven pure origin-closure
tests; `effectively_allows_provenance_label` unit tests mirroring
`effectively_allows_egress_class`; kernel origin-derivation unit tests;
dispatch-integration regression tests for cross-counterparty and kernel-origin
cases.

Steps for the decision-log entry:
- Add a `tasks.md` slice to append a new `D-0XX` entry to
`.raw/openspine-decision-log.md` (next number after the current ceiling D-173),
with `## Decision`, `## Rationale`, `## Consequences`, and `## Would change if`
blocks.
- State the decision text: provenance and visibility labels are bound to typed
identity, consulted deterministically at context assembly and egress,
kernel-minted, immutable, fail-closed, with no LLM judgment.
- Cite the grounding canon in the entry: D-006, AD-032/AD-121, AD-140, AD-146,
AD-148, AD-060, D-107.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!