Rich UI slice 7: carrier session reads under the session's policy

Merged
AF
5d ago
+2258-23

Rich UI slice 7. Publication stays off.

  • A versioned (tool-provider/v1) rich UI carrier call resolves the viewed session's role and policy route (ordered qualification, agreement, root and label checks, positive Head/Worker proof) and runs session reads under that session's policy-route disables and confinement, with AskRoute::Deny. Legacy-format carrier calls keep their existing pre-admission confinement read.
  • Viewed-task reads (bash_output, deferred bash_watch) are the next slice; their call-scoped operations return task_not_found after admission, never a silent success.
  • A carrier-only guard keeps the agent's saved scope grants from widening what the carrier reads, including during path traversal, symlinks and policies captured for off-thread work. Ordinary callers keep their grant/Deny precedence.
  • The 14 carrier samples CKIOS consumes are unchanged.

Build server, merged with main: full lib 10,922 passed (the 2 slice-caused failures fixed in ae5d187eb8; 4 load failures pass alone), consent/route/rich_ui/access_policy 437 passed, integration 2,574 passed (3 subc_format goldens that also fail on main there), bin 184 passed, Linux and Windows compile with warnings as errors.

Summary by cubic

Versioned rich UI carrier calls now resolve the viewed session's policy route and run session reads under that route's disables and confinement instead of the carrier's own grants. Saved agent file grants apply only to the agent's own connections. Legacy-format carrier calls keep their existing pre-admission confinement read.

Session reads

  • Session resolution orders exact-worker-preset qualification, non-root agreement, root selection, and positive Head/Worker proof; a carrier-only guard keeps saved agent grants from widening carrier reads during path traversal, symlinks, and off-thread work. Ordinary callers keep their grant/Deny precedence.
  • Viewed-task reads (bash_output, deferred bash_watch) fail closed with task_not_found until the next slice; publication stays off and the 14 CKIOS carrier samples are unchanged.

Saved grants

  • Saved file grants apply only to direct, reserved:broca, and reserved:thalamus-harness connections on head and worker scopes, plus reserved:basal code-mode runs whose parent is that head or worker.
  • Any other scope, including those with a flow_id and the rich UI carrier itself, gets no saved grants and is offered no card that could save one.
  • Built-in Cargo/Rustup worker library reads stay as ordinary worker policy, separate from saved grants.

Saved access grants (replaces the narrow carrier guard). Saved file-access grants now apply only to the agent's own connections: direct, reserved:broca and reserved:thalamus-harness on head and worker scopes, plus reserved:basal code-mode runs whose parent is that head or worker. Any scope with a flow_id, the rich UI carrier, and any other principal get no saved grants (typed reason: flow, not a session host, unknown scope kind), and are offered no card that could save one. The agent-visible refusal stays the existing outside-project refusal. Built-in Cargo/Rustup library reads for workers stay as ordinary worker policy, separate from saved grants. Tests seed a grant and check each case.