Egress origin-closure stage: block cross-identity data deterministically (#227)

[George-RD]

What

Adds the v1 enforcement D-174 promises: a new ordered stage in the egress deterministic core, run after the existing disclosure-coverage stage, that blocks an outbound item whose typed-identity ProvenanceOrigin lies outside the bound recipient's identity closure — a counterparty other than the recipient, or owner-internal (non-public) data to a stranger — unless a grant ProvenanceLabelAllowlist caveat authorizes that origin. Fail-closed on unresolved origin. Comparison is typed-field only (no query text, no LLM judgment).

• Pure core (disclosure_policy.rs): new RecipientIdentity, check_egress gains an authorized_origins arg + RecipientIdentity on OutboundQuery, and a new DisclosureGateDecision::CrossIdentityBlock. DisclosurePolicyKey/DisclosurePolicy shape unchanged.
• Kernel (enforce_disclosure_egress): recipient resolved from the briefcase task_shape.counterparty (the is_counterparty_erased precedent), authorized origins pre-resolved via effectively_allows_provenance_label. Cross-identity blocks cancel reservations, audit a reconstructible disclosure.cross_identity_blocked row (origin + sensitivity + recipient + egress class — the Auditor story), route an owner escalation, and return the generic worker denial.

Why

Closes the Immune-system gap for Bell: a stranger must never receive another counterparty's — or the owner's internal — data, even at the same sensitivity class. This is the final provenance-track ticket; all prerequisites (#222/#224/#225/#226/#205–#207) are merged.

No second ungated path (rides #207)

Both worker-requested (mediate_and_dispatch_action) and kernel-origin/proactive (..._kernel_origin) rated dispatch already funnel through the single enforce_disclosure_egress chokepoint, so the stage is placed there once — no change to notify_owner_with_digest (owner.notify stays unrated). gate() stays pure; the dead EgressClassifier stays deleted.

Tests

• Schema matrix over origin × recipient × sensitivity × caveat (incl. widening + fail-closed).
• Dispatch-integration at the chokepoint: cross-counterparty block, owner-to-stranger block, same-identity allow, caveat widening, owner-grant no-over-block.
• Threat register: CLAIM-44 with named tests.
• ./scripts/check.sh passes.

Implementation-notes summary

1. New ordered origin-closure stage in the pure check_egress core, AFTER disclosure-coverage: blocks an item whose typed ProvenanceOrigin is outside the bound recipient's identity closure, unless a grant caveat authorizes it; fail-closed on unresolved origin. New CrossIdentityBlock decision; policy shapes unchanged.
2. Wired in the single shared enforce_disclosure_egress chokepoint: recipient from the briefcase, authorized origins via effectively_allows_provenance_label; both worker-requested and kernel-origin dispatch inherit it — no second ungated path (rides Extend the disclosure hook to kernel-origin and proactive dispatch paths #207); dead EgressClassifier untouched.
3. Cross-identity block audits disclosure.cross_identity_blocked (reconstructible from origin + sensitivity + recipient + egress class) and returns the generic worker denial.
4. Tests: schema-level matrix plus dispatch-integration cases (cross-counterparty block, owner-to-stranger block, same-identity allow, caveat widening, owner-grant no-over-block).
5. Threat register: added CLAIM-44 with named tests, closing Bell's "internal data to a stranger".

Closes #227

---

Summary by cubic

Blocks cross-identity external egress deterministically after disclosure coverage by comparing each item’s typed origin to the bound recipient. Previously, covered egress could send another counterparty’s or owner-internal data to a stranger; now the new origin-closure stage blocks unless a grant ProvenanceLabelAllowlist authorizes that origin, and fails closed on unresolved origin/recipient.

• Review notes
  • Adds an ordered origin-closure stage (typed-field only; no query text/LLM). System-origin always reaches any recipient; owner/counterparty origins reach only the same identity or an authorized origin.
  • API updates in openspine-schemas: OutboundQuery gains recipient; check_egress gains authorized_origins; new DisclosureGateDecision::CrossIdentityBlock. DisclosurePolicyKey/DisclosurePolicy unchanged. Callers and pattern matches must handle the new argument and decision.
  • Kernel wiring in openspine-kernel: implement at the single enforce_disclosure_egress chokepoint. Resolve recipient from the briefcase counterparty; pre-resolve authorized_origins from the grant chain. Both worker-requested and kernel-origin/proactive dispatch share this path; there is no second ungated path.
  • Side effects on block: cancel reservations, audit disclosure.cross_identity_blocked (origin + sensitivity + recipient + egress class), route an owner escalation, and return the existing generic worker denial. Tests cover origin × recipient × class × caveat and chokepoint integration. Adds CLAIM-44 in docs.

^{Written for commit e5c1947. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

@George-RD, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 48 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8a4a1c26-259b-4884-80c4-1e02837dadb1

📥 Commits

Reviewing files that changed from the base of the PR and between 7ea776d and e5c1947.

📒 Files selected for processing (8)

• crates/openspine-kernel/src/disclosure.rs
• crates/openspine-kernel/src/disclosure/core.rs
• crates/openspine-kernel/src/disclosure/disclosure_origin_closure_tests.rs
• crates/openspine-kernel/src/disclosure/disclosure_regression_tests.rs
• crates/openspine-kernel/src/disclosure/disclosure_tests.rs
• crates/openspine-schemas/src/disclosure_policy.rs
• crates/openspine-schemas/src/disclosure_policy_tests.rs
• docs/threat-claims.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e5c1947525

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exempt owner origins from recipient matching

For every worker sub-grant, whose provenance allowlist is empty, a covered non-public item with an Owner origin and a counterparty recipient reaches CrossIdentityBlock here. This contradicts the settled D-174 rule in .raw/openspine-decision-log.md:4162, which limits this stage to another counterparty's origin and explicitly exempts owner origins; consequently legitimate egress based on owner context is denied even after disclosure coverage was granted. Treat ProvenanceOrigin::Owner as reaching any recipient at this stage.

AGENTS.md reference: AGENTS.md:L60-L65

Useful? React with 👍 / 👎.