Bind provenance label to typed-identity origin (generalize ProducedBy)

[George-RD]

Parent

Spec: provenance labels with typed identity — #220 (wayfinder #193, map #182).

What to build

Make each classified datum carry its typed-identity origin. Generalize the proven learned_artifacts::Provenance::ProducedBy lineage pattern so its identity binding widens from source_scope: Ulid to a typed ProvenanceOrigin, and carry that origin on each classified briefcase item alongside its disclosure_class. The binding is immutable and append-only: a later authorization or reconfirmation never rewrites a datum's origin. Existing source_scope lineage and the counterparty-erasure (counterparty_erasure) behaviour are preserved (AD-140).

Promise: Immune system. Users: Bell, Auditor.

Acceptance criteria

• Each classified briefcase item carries a ProvenanceOrigin alongside its disclosure_class.
• Provenance::ProducedBy's identity binding is expressed as a ProvenanceOrigin (generalizing source_scope: Ulid), preserving the existing producing-scope semantics.
• Counterparty-erasure (counterparty_erasure) invalidation still resolves by producing identity (AD-140); existing erasure tests stay green.
• Immutability/append-only test: an origin, once minted, is never rewritten by a later authorization/reconfirmation event.
• scripts/check.sh stays green.

Blocked by

• Introduce ProvenanceOrigin and IdentityRef typed vocabulary #222 (ProvenanceOrigin and IdentityRef typed vocabulary).

[coderabbitai]

Coding Plan

Summary

• Define a typed ProvenanceOrigin (and supporting IdentityRef) in a new openspine-schemas/src/provenance.rs, serialized transparently as a Ulid so the AD-140 erasure wire format at $.produced_by.source_scope stays unchanged.
• Widen Provenance::ProducedBy to carry ProvenanceOrigin in place of source_scope: Ulid. Keep the field name, the erasure SQL, the triggers, and the migration unchanged. Expose a producing_scope() accessor for scalar comparisons.
• Add the typed origin to BriefcaseSection and ClassifiedBriefcaseItem, and populate it deterministically in provenance_from_sections, without changing egress-policy coverage.
• Add an immutability/append-only test that proves a minted origin is never rewritten by a later authorization or reconfirmation. Update all fixtures so the erasure and disclosure suites and scripts/check.sh stay green.

Design Choices

Design Choice 1: Wire format for ProvenanceOrigin, given AD-140 resolves erasure by the SQL JSON path $.produced_by.source_scope

Options Considered:

1. Preserve the wire format. ProvenanceOrigin serializes transparently as a single Ulid string at the same field position, where Ulid::nil() (SYSTEM_SCOPE) means the system origin and any other value means a counterparty origin. The typed vocabulary lives at the Rust level (enum plus accessors). SQL predicates, triggers, and migrate_provenance_column stay unchanged, and existing JSON blobs deserialize without a data migration.
2. Change the wire format. ProvenanceOrigin serializes as a tagged enum (for example {"counterparty": "01H..."} / "system"). Every erasure SQL predicate, both triggers, and a new json_set-style backfill migration must be rewritten to the new path, and all persisted provenance/briefcase_json blobs must be rewritten.

Chosen Option: 1

Rationale: Option 1 keeps AD-140 resolution and every erasure test exactly as-is, needs no data migration, and still delivers a typed Rust API. This is the lowest-risk way to satisfy the requirement to preserve the existing producing-scope semantics.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Define the typed provenance vocabulary

This phase introduces the shared ProvenanceOrigin and IdentityRef types that the rest of the ticket binds to. It follows the crate's one-concept-per-module convention and the tagged/opaque-reference precedents already in the codebase.

Task 1: Add a `provenance` schema module

Create the shared typed-identity origin vocabulary as pure data.

• Create crates/openspine-schemas/src/provenance.rs.
• Define IdentityRef as an opaque newtype wrapping a Ulid (following the OwnerSurfaceRef opaque-field precedent), with a named constructor and an accessor. It references an identity or counterparty scope; it carries no authority (D-006).
• Define ProvenanceOrigin as an enum with two variants: System (kernel-produced, non-erasable) and Counterparty(IdentityRef) (externally produced under a counterparty scope). Follow the CounterpartyRef tagged-enum precedent for the Rust shape.
• Implement custom Serialize/Deserialize so ProvenanceOrigin serializes transparently as a single Ulid string: Ulid::nil() maps to System, any other value maps to Counterparty. This keeps the AD-140 wire format identical (see Assumption 1).
• Add helper methods: producing_scope(&self) -> Ulid (returns Ulid::nil() for System, the inner Ulid for Counterparty) and from_scope(Ulid) -> ProvenanceOrigin (maps nil to System, else Counterparty). These give the erasure and admission code a stable scalar view.
• Add unit tests in this file (kept under the 500-line cap) asserting round-trip serialization equals the equivalent bare Ulid, and that nil round-trips as System.

Task 2: Register the module

Expose the new types from the crate.

• Update crates/openspine-schemas/src/lib.rs to add pub mod provenance; in alphabetical order (after principal).

🤖 Prompt for AI agents

Implement the shared typed-identity provenance vocabulary as pure data in the
`openspine-schemas` crate, following the crate's one-concept-per-module
convention.

- Create `crates/openspine-schemas/src/provenance.rs`.
- Define `IdentityRef` as an opaque newtype wrapping a `Ulid`, following the
`OwnerSurfaceRef` opaque-field precedent. Give it a named constructor and an
accessor. It references an identity or counterparty scope, and it carries no
authority (D-006).
- Define `ProvenanceOrigin` as an enum with two variants: `System`
(kernel-produced, non-erasable) and `Counterparty(IdentityRef)` (externally
produced under a counterparty scope). Follow the `CounterpartyRef` tagged-enum
precedent for the Rust shape.
- Implement custom `Serialize`/`Deserialize` for `ProvenanceOrigin` so it
serializes transparently as a single `Ulid` string: map `Ulid::nil()` to
`System`, and map any other value to `Counterparty`. This preserves the AD-140
wire format exactly.
- Add helper method `producing_scope(&self) -> Ulid`: return `Ulid::nil()` for
`System`, and return the inner `Ulid` for `Counterparty`.
- Add helper method `from_scope(Ulid) -> ProvenanceOrigin`: map `nil` to
`System`, and map any other value to `Counterparty`.
- Add unit tests in this same file (keep the file under the 500-line cap).
Assert that round-trip serialization equals the equivalent bare `Ulid`
serialization, and assert that `nil` round-trips as `System`.
- Update `crates/openspine-schemas/src/lib.rs` to add `pub mod provenance;` in
alphabetical order, placed after `principal`.

Phase 2: Generalize Provenance::ProducedBy and preserve AD-140

This phase widens the learned-artifact identity binding to ProvenanceOrigin while keeping the counterparty-erasure resolution and every existing erasure test green. It also adds the immutability/append-only test.

Task 1: Widen `Provenance::ProducedBy` to carry `ProvenanceOrigin`

Change the identity binding type without changing the persisted JSON shape.

• Update crates/openspine-kernel/src/store/learned_artifacts.rs so Provenance::ProducedBy's identity binding field (source_scope) has type ProvenanceOrigin instead of Ulid. Keep the field name source_scope so the serialized JSON path $.produced_by.source_scope is unchanged.
• Because ProvenanceOrigin serializes transparently as a Ulid (Task 1.1), leave mark_learned_artifacts_erased, ensure_closure_triggers, and migrate_provenance_column unchanged; they continue to read/write the same JSON path and the same SYSTEM_SCOPE sentinel value.
• Where kernel code needs the scalar scope for comparison or scoped lookups, call .producing_scope() on the origin.

Task 2: Update all construct and match sites

Keep every producer and consumer of Provenance::ProducedBy compiling and behaving as before.

• Update construction sites to build the origin from a scope value using ProvenanceOrigin::from_scope(...) (or ProvenanceOrigin::system() where SYSTEM_SCOPE was used): crates/openspine-kernel/src/pipeline/artifact_reconfirmation.rs, crates/openspine-kernel/src/pipeline/artifact_activation.rs, crates/openspine-kernel/src/store/personality_seed.rs.
• Update match/read sites that destructure source_scope to consume the typed origin (via .producing_scope() for scoped blob fetches): crates/openspine-kernel/src/overlay_persona_admission.rs, crates/openspine-kernel/src/overlay_recovery.rs, and crates/openspine-kernel/src/store/learned_reconfirmation.rs.
• Preserve the existing "already ProducedBy keeps its link" behavior in artifact_reconfirmation.rs (other => other.clone()); this is the append-only guarantee for the origin.

Task 3: Update erasure and learned-artifact test fixtures

Keep the AD-140 test suite green with the new type.

• Update the shared learned_row(...) helper and fixtures in crates/openspine-kernel/src/counterparty_erasure_tests.rs to build source_scope as a ProvenanceOrigin from the same scope Ulid.
• Update fixtures in crates/openspine-kernel/src/counterparty_erasure_matrix_tests.rs, crates/openspine-kernel/src/counterparty_erasure_runtime_tests.rs, crates/openspine-kernel/src/store/learned_artifacts_tests.rs, crates/openspine-kernel/src/store/personality_seed_tests.rs, and any other test that constructs Provenance::ProducedBy.
• Confirm the critical matrix test identical_plaintext_erasure_only_flags_the_producing_counterparty still resolves invalidation by exact scope, not digest.

Task 4: Add the immutability / append-only test

Prove an origin, once minted, is never rewritten by a later authorization or reconfirmation.

• Add a test in crates/openspine-kernel/src/store/learned_artifacts_tests.rs, modeled on owner_reconfirmation_cannot_replace_erased_identity_with_other_scope and the other => other.clone() reconfirmation path.
• The test mints a ProducedBy origin, then drives a later authorization/reconfirmation event, and asserts the stored origin value is unchanged.
• Use the established append-only / hash-chained terminology already used in audit_append.rs and the erasure tests for the assertion prose.

🤖 Prompt for AI agents

Widen the learned-artifact identity binding to the typed `ProvenanceOrigin`
while preserving the AD-140 counterparty-erasure resolution and keeping every
existing erasure test green. Also add a new immutability/append-only test.

- Update `crates/openspine-kernel/src/store/learned_artifacts.rs` so the
`source_scope` field of `Provenance::ProducedBy` has type `ProvenanceOrigin`
instead of `Ulid`. Keep the field name `source_scope` unchanged, so the
serialized JSON path `$.produced_by.source_scope` stays the same.
- Do not change `mark_learned_artifacts_erased`, `ensure_closure_triggers`, or
`migrate_provenance_column`. Because `ProvenanceOrigin` serializes transparently
as a `Ulid`, these continue to read and write the same JSON path and the same
`SYSTEM_SCOPE` sentinel value.
- Where kernel code needs the scalar scope for comparison or scoped lookups,
call `.producing_scope()` on the origin.
- Update construction sites to build the origin from a scope value using
`ProvenanceOrigin::from_scope(...)` (or `ProvenanceOrigin::system()` where
`SYSTEM_SCOPE` was previously used). Apply this in
`crates/openspine-kernel/src/pipeline/artifact_reconfirmation.rs`,
`crates/openspine-kernel/src/pipeline/artifact_activation.rs`, and
`crates/openspine-kernel/src/store/personality_seed.rs`.
- Update match/read sites that destructure `source_scope` to consume the typed
origin instead, using `.producing_scope()` for scoped blob fetches. Apply this
in `crates/openspine-kernel/src/overlay_persona_admission.rs`,
`crates/openspine-kernel/src/overlay_recovery.rs`, and
`crates/openspine-kernel/src/store/learned_reconfirmation.rs`.
- Preserve the existing behavior where an already-`ProducedBy` value keeps its
link (the `other => other.clone()` arm in `artifact_reconfirmation.rs`). This is
the append-only guarantee for the origin.
- Update the shared `learned_row(...)` helper and fixtures in
`crates/openspine-kernel/src/counterparty_erasure_tests.rs` to build
`source_scope` as a `ProvenanceOrigin` derived from the same scope `Ulid`.
- Update fixtures in
`crates/openspine-kernel/src/counterparty_erasure_matrix_tests.rs`,
`crates/openspine-kernel/src/counterparty_erasure_runtime_tests.rs`,
`crates/openspine-kernel/src/store/learned_artifacts_tests.rs`,
`crates/openspine-kernel/src/store/personality_seed_tests.rs`, and any other
test that constructs `Provenance::ProducedBy`.
- Confirm the matrix test
`identical_plaintext_erasure_only_flags_the_producing_counterparty` still
resolves invalidation by exact scope, not by digest.
- Add a new test in
`crates/openspine-kernel/src/store/learned_artifacts_tests.rs`, modeled on
`owner_reconfirmation_cannot_replace_erased_identity_with_other_scope` and the
`other => other.clone()` reconfirmation path. The test must mint a `ProducedBy`
origin, then drive a later authorization/reconfirmation event, and assert the
stored origin value is unchanged. Use the established append-only and
hash-chained terminology already used in `audit_append.rs` and the erasure tests
for the assertion prose.

Phase 3: Carry ProvenanceOrigin on classified briefcase items

This phase threads the typed origin through the disclosure classification pipeline so each classified datum carries its producing identity next to disclosure_class, without changing egress-policy coverage semantics.

Task 1: Add origin to the section and classified-item schema

Give each section and each classified item a typed origin.

• Update crates/openspine-schemas/src/briefcase.rs to add an origin: ProvenanceOrigin field on BriefcaseSection, marked #[serde(default)] so legacy briefcase_json blobs deserialize (defaulting to the system origin, matching the migrate_provenance_column backfill-to-SYSTEM_SCOPE precedent).
• In pack() and the top-up section-construction logic, set origin per section: the kernel-produced sections (grant, preference, skill) use the system origin; the counterparty slice uses the counterparty identity origin.
• Update crates/openspine-schemas/src/disclosure_policy.rs to add an origin: ProvenanceOrigin field on ClassifiedBriefcaseItem.

Task 2: Populate origin in the classification pipeline

Derive the classified-item origin deterministically from the section.

• Update provenance_from_sections in crates/openspine-kernel/src/disclosure.rs to copy section.origin into each ClassifiedBriefcaseItem.origin.
• Preserve the existing fail-closed behavior on disclosure_class == None; origin does not relax that check.
• Confirm DisclosureProvenance::classes() and check_egress still key policy coverage only on disclosure_class, so the new origin field does not change egress decisions.

Task 3: Update disclosure tests and binding equality

Keep binding-match strictness correct with the new field.

• Update the provenance() helper and fixtures in crates/openspine-kernel/src/disclosure/disclosure_tests.rs and disclosure_regression_tests.rs, and the inline fixtures/tests in crates/openspine-schemas/src/disclosure_policy.rs, to construct ClassifiedBriefcaseItem with an origin.
• Because origin participates in the derived PartialEq used by PreparedQuery::binding_matches, verify the mint-time and consume-time origin values derive identically from the same persisted sections, so binding still matches for legitimate requests.
• Add a binding_matches regression (mirroring binding_matches_rejects_a_different_provenance_set) that asserts a differing origin is rejected, confirming the field participates in binding equality.

Task 4: Respect file-size and check-script constraints

Keep the gate green.

• If crates/openspine-schemas/src/disclosure_policy.rs (currently 491 lines) exceeds the 500-line cap after edits, move its inline #[cfg(test)] mod tests into a sibling disclosure_policy_tests.rs and include it with #[cfg(test)] #[path = "disclosure_policy_tests.rs"] mod tests;, following the repository split-test convention. Do not add new work under openspec/changes/ (ceremony retired per DIRECTION.md).
• Run scripts/check.sh and resolve cargo fmt, clippy -D warnings, workspace tests, and scripts/check-file-sizes.sh findings.

🤖 Prompt for AI agents

Thread the typed `ProvenanceOrigin` through the disclosure classification
pipeline so each classified datum carries its producing identity next to
`disclosure_class`, without changing egress-policy coverage semantics.

- Update `crates/openspine-schemas/src/briefcase.rs` to add an `origin:
ProvenanceOrigin` field on `BriefcaseSection`, marked `#[serde(default)]` so
legacy `briefcase_json` blobs deserialize correctly (defaulting to the system
origin, matching the `migrate_provenance_column` backfill-to-`SYSTEM_SCOPE`
precedent).
- In `pack()` and the top-up section-construction logic, set `origin` per
section: use the system origin for kernel-produced sections (grant, preference,
skill), and use the counterparty identity origin for the counterparty slice.
- Update `crates/openspine-schemas/src/disclosure_policy.rs` to add an `origin:
ProvenanceOrigin` field on `ClassifiedBriefcaseItem`.
- Update `provenance_from_sections` in
`crates/openspine-kernel/src/disclosure.rs` to copy `section.origin` into each
`ClassifiedBriefcaseItem.origin`.
- Preserve the existing fail-closed behavior when `disclosure_class == None`.
The origin field must not relax that check.
- Confirm `DisclosureProvenance::classes()` and `check_egress` continue to key
policy coverage only on `disclosure_class`, so the new origin field does not
change egress decisions.
- Update the `provenance()` helper and fixtures in
`crates/openspine-kernel/src/disclosure/disclosure_tests.rs` and
`disclosure_regression_tests.rs`, and the inline fixtures/tests in
`crates/openspine-schemas/src/disclosure_policy.rs`, to construct
`ClassifiedBriefcaseItem` with an `origin`.
- Because `origin` participates in the derived `PartialEq` used by
`PreparedQuery::binding_matches`, verify that mint-time and consume-time origin
values derive identically from the same persisted sections, so binding still
matches for legitimate requests.
- Add a `binding_matches` regression test, mirroring
`binding_matches_rejects_a_different_provenance_set`, that asserts a differing
`origin` is rejected. This confirms the field participates in binding equality.
- If `crates/openspine-schemas/src/disclosure_policy.rs` (currently 491 lines)
exceeds the 500-line cap after these edits, move its inline `#[cfg(test)] mod
tests` into a sibling file `disclosure_policy_tests.rs`, and include it with
`#[cfg(test)] #[path = "disclosure_policy_tests.rs"] mod tests;`, following the
repository split-test convention. Do not add new work under `openspec/changes/`,
since that ceremony is retired per `DIRECTION.md`.
- Run `scripts/check.sh` and resolve any findings from `cargo fmt`, `clippy -D
warnings`, workspace tests, and `scripts/check-file-sizes.sh`.

Research

The project is a Rust workspace. crates/openspine-schemas holds pure data types, one concept per module, declared in lib.rs. crates/openspine-kernel holds storage, pipeline, and gate logic.

The per-artifact write provenance type Provenance (with variant ProducedBy { source_event_id, source_exchange, source_scope: Ulid }) lives in crates/openspine-kernel/src/store/learned_artifacts.rs. Counterparty crypto-erasure (AD-140) resolves which artifacts to invalidate by matching source_scope at the SQLite JSON path $.produced_by.source_scope, both in Store::mark_learned_artifacts_erased and in fail-closed triggers. SYSTEM_SCOPE = Ulid::nil() (in counterparty_keys.rs) is the reserved, non-erasable scope.

Classified disclosure data uses ClassifiedBriefcaseItem { item_ref, disclosure_class } and DisclosureProvenance in crates/openspine-schemas/src/disclosure_policy.rs. The only construction site is provenance_from_sections in crates/openspine-kernel/src/disclosure.rs, which derives items from BriefcaseSections (each already carrying disclosure_class).

Neither ProvenanceOrigin nor IdentityRef exists yet. The ticket lists them as blocked by #222, but they must be defined as part of this work. Existing tagged-reference types (CounterpartyRef, OwnerSurfaceRef, ActionOrigin) are the shape precedents.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement the shared typed-identity provenance vocabulary as pure data in the
`openspine-schemas` crate, following the crate's one-concept-per-module
convention.

- Create `crates/openspine-schemas/src/provenance.rs`.
- Define `IdentityRef` as an opaque newtype wrapping a `Ulid`, following the
`OwnerSurfaceRef` opaque-field precedent. Give it a named constructor and an
accessor. It references an identity or counterparty scope, and it carries no
authority (D-006).
- Define `ProvenanceOrigin` as an enum with two variants: `System`
(kernel-produced, non-erasable) and `Counterparty(IdentityRef)` (externally
produced under a counterparty scope). Follow the `CounterpartyRef` tagged-enum
precedent for the Rust shape.
- Implement custom `Serialize`/`Deserialize` for `ProvenanceOrigin` so it
serializes transparently as a single `Ulid` string: map `Ulid::nil()` to
`System`, and map any other value to `Counterparty`. This preserves the AD-140
wire format exactly.
- Add helper method `producing_scope(&self) -> Ulid`: return `Ulid::nil()` for
`System`, and return the inner `Ulid` for `Counterparty`.
- Add helper method `from_scope(Ulid) -> ProvenanceOrigin`: map `nil` to
`System`, and map any other value to `Counterparty`.
- Add unit tests in this same file (keep the file under the 500-line cap).
Assert that round-trip serialization equals the equivalent bare `Ulid`
serialization, and assert that `nil` round-trips as `System`.
- Update `crates/openspine-schemas/src/lib.rs` to add `pub mod provenance;` in
alphabetical order, placed after `principal`.
===============================================================================

Task: 2

Widen the learned-artifact identity binding to the typed `ProvenanceOrigin`
while preserving the AD-140 counterparty-erasure resolution and keeping every
existing erasure test green. Also add a new immutability/append-only test.

- Update `crates/openspine-kernel/src/store/learned_artifacts.rs` so the
`source_scope` field of `Provenance::ProducedBy` has type `ProvenanceOrigin`
instead of `Ulid`. Keep the field name `source_scope` unchanged, so the
serialized JSON path `$.produced_by.source_scope` stays the same.
- Do not change `mark_learned_artifacts_erased`, `ensure_closure_triggers`, or
`migrate_provenance_column`. Because `ProvenanceOrigin` serializes transparently
as a `Ulid`, these continue to read and write the same JSON path and the same
`SYSTEM_SCOPE` sentinel value.
- Where kernel code needs the scalar scope for comparison or scoped lookups,
call `.producing_scope()` on the origin.
- Update construction sites to build the origin from a scope value using
`ProvenanceOrigin::from_scope(...)` (or `ProvenanceOrigin::system()` where
`SYSTEM_SCOPE` was previously used). Apply this in
`crates/openspine-kernel/src/pipeline/artifact_reconfirmation.rs`,
`crates/openspine-kernel/src/pipeline/artifact_activation.rs`, and
`crates/openspine-kernel/src/store/personality_seed.rs`.
- Update match/read sites that destructure `source_scope` to consume the typed
origin instead, using `.producing_scope()` for scoped blob fetches. Apply this
in `crates/openspine-kernel/src/overlay_persona_admission.rs`,
`crates/openspine-kernel/src/overlay_recovery.rs`, and
`crates/openspine-kernel/src/store/learned_reconfirmation.rs`.
- Preserve the existing behavior where an already-`ProducedBy` value keeps its
link (the `other => other.clone()` arm in `artifact_reconfirmation.rs`). This is
the append-only guarantee for the origin.
- Update the shared `learned_row(...)` helper and fixtures in
`crates/openspine-kernel/src/counterparty_erasure_tests.rs` to build
`source_scope` as a `ProvenanceOrigin` derived from the same scope `Ulid`.
- Update fixtures in
`crates/openspine-kernel/src/counterparty_erasure_matrix_tests.rs`,
`crates/openspine-kernel/src/counterparty_erasure_runtime_tests.rs`,
`crates/openspine-kernel/src/store/learned_artifacts_tests.rs`,
`crates/openspine-kernel/src/store/personality_seed_tests.rs`, and any other
test that constructs `Provenance::ProducedBy`.
- Confirm the matrix test
`identical_plaintext_erasure_only_flags_the_producing_counterparty` still
resolves invalidation by exact scope, not by digest.
- Add a new test in
`crates/openspine-kernel/src/store/learned_artifacts_tests.rs`, modeled on
`owner_reconfirmation_cannot_replace_erased_identity_with_other_scope` and the
`other => other.clone()` reconfirmation path. The test must mint a `ProducedBy`
origin, then drive a later authorization/reconfirmation event, and assert the
stored origin value is unchanged. Use the established append-only and
hash-chained terminology already used in `audit_append.rs` and the erasure tests
for the assertion prose.
===============================================================================

Task: 3

Thread the typed `ProvenanceOrigin` through the disclosure classification
pipeline so each classified datum carries its producing identity next to
`disclosure_class`, without changing egress-policy coverage semantics.

- Update `crates/openspine-schemas/src/briefcase.rs` to add an `origin:
ProvenanceOrigin` field on `BriefcaseSection`, marked `#[serde(default)]` so
legacy `briefcase_json` blobs deserialize correctly (defaulting to the system
origin, matching the `migrate_provenance_column` backfill-to-`SYSTEM_SCOPE`
precedent).
- In `pack()` and the top-up section-construction logic, set `origin` per
section: use the system origin for kernel-produced sections (grant, preference,
skill), and use the counterparty identity origin for the counterparty slice.
- Update `crates/openspine-schemas/src/disclosure_policy.rs` to add an `origin:
ProvenanceOrigin` field on `ClassifiedBriefcaseItem`.
- Update `provenance_from_sections` in
`crates/openspine-kernel/src/disclosure.rs` to copy `section.origin` into each
`ClassifiedBriefcaseItem.origin`.
- Preserve the existing fail-closed behavior when `disclosure_class == None`.
The origin field must not relax that check.
- Confirm `DisclosureProvenance::classes()` and `check_egress` continue to key
policy coverage only on `disclosure_class`, so the new origin field does not
change egress decisions.
- Update the `provenance()` helper and fixtures in
`crates/openspine-kernel/src/disclosure/disclosure_tests.rs` and
`disclosure_regression_tests.rs`, and the inline fixtures/tests in
`crates/openspine-schemas/src/disclosure_policy.rs`, to construct
`ClassifiedBriefcaseItem` with an `origin`.
- Because `origin` participates in the derived `PartialEq` used by
`PreparedQuery::binding_matches`, verify that mint-time and consume-time origin
values derive identically from the same persisted sections, so binding still
matches for legitimate requests.
- Add a `binding_matches` regression test, mirroring
`binding_matches_rejects_a_different_provenance_set`, that asserts a differing
`origin` is rejected. This confirms the field participates in binding equality.
- If `crates/openspine-schemas/src/disclosure_policy.rs` (currently 491 lines)
exceeds the 500-line cap after these edits, move its inline `#[cfg(test)] mod
tests` into a sibling file `disclosure_policy_tests.rs`, and include it with
`#[cfg(test)] #[path = "disclosure_policy_tests.rs"] mod tests;`, following the
repository split-test convention. Do not add new work under `openspec/changes/`,
since that ceremony is retired per `DIRECTION.md`.
- Run `scripts/check.sh` and resolve any findings from `cargo fmt`, `clippy -D
warnings`, workspace tests, and `scripts/check-file-sizes.sh`.

💡 Iterate on the plan with: `@coderabbitai` <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!