V6: Session state and provenance carriage

[afogel]

Master doc: docs/shaping/acs-reference-impl-slices.md §V6 — authoritative for this slice's scope.

Demo: The SessionContext chain grows per step. AGT emits result_labels at one step and gets them back as input.ifc.source_labels at the next, carried by ACS provenance.

Blocked by: #6
Plan: (added when planned)

Amendments

[afogel]

V6 is implemented and pushed. slice/v6 is at 6403dca; slice/v7 and slice/v8 have been rebased onto it and force-pushed, and all eight PRs report MERGEABLE.

What shipped

Affordance	Where
S3 hash-chained SessionContext	packages/guardian/src/session-context.ts, session-context-store.ts
S4 immutable per-session Intent	same store — first intent wins, later ones dropped
S5 provenance carrying AGT's labels	Provenance.ifc_labels, a named field on the ACS record rather than a widening of it
N22 append-on-arrival	evaluateStep rewired from V1's direct N21 → N23 to N21 → N22 → N23
N25 persistIfcLabels() ∥ supplySourceLabels()	packages/guardian/src/ifc-labels.ts
N23 session state in both snapshots	both assemblers gained a required AgtSessionState, emitting input.ifc.source_labels
U22 the chain view	packages/inspector/src/tail-session-context.ts, render.ts

The IFC gate is AGT's own, turned on through data.agt.defaults.config alone. Zero Rego authored; every .rego stays byte-identical and verify:pin proves it. policy/lib/data.json gained one key.

791 pass / 1 skip / 0 fail, typecheck clean, verify:pin clean.

Three findings, each measured against the rego rather than reasoned about

1. AGT's stock IFC gate is fail-closed on absent labels. flow_allowed requires count(labels) > 0 before it checks dominance, so a snapshot carrying no labels is not a permitted flow — it is a denied one, ifc_clearance_violation. Turning the gate on with nothing seeding a first label took the suite from 775 pass to 744 pass / 35 fail across nine files.

This composes with the gap V6 set out to demonstrate. ACS v0.1.0's provenance.json defines provenance_id, origin, source_id, derived_from — nothing a sensitivity label can be read from — and AGT propagates labels it is given while originating none. So a conforming ACS deployment cannot obtain a first label from the wire, and AGT denies every session that lacks one. The seed (["public"], the lattice floor) is therefore mandatory rather than a design preference. Filed in §V6 as a V7 matrix cell: green for the Guardian, red for a wire consumer.

2. IFC deny outranks every other gate. agt_default.rego's own header states the order — IFC deny > confidence deny > budget deny > content_hash deny > egress deny > pattern deny > drift warn > allow. A label-free snapshot does not merely lose IFC; it reports ifc_clearance_violation in place of whatever the policy would otherwise have said. Measured: a rm -rf / that reported destructive_shell_command_blocked reported ifc_clearance_violation instead. Still denied, differently blamed.

3. Turning the gate on makes input.ifc.source_labels a required member of every snapshot in the deployment — including for callers with no session concept at all, such as packages/agt-bridge, whose own tests now carry a label. That is a real cost of shipping the gate on, and it is recorded rather than absorbed.

What V6 does not claim

• The round trip is measured in pieces, not end to end. One test proves the real bundle emits result_labels for a carried label; another proves the store carries them across steps; a third proves the server wires emit → persist → next snapshot, but through a stub bridge. No single test drives a real Guardian over two steps against the real bundle.
• The shipped label set is a fixed point at ["public"]. result_labels = [max_sensitivity(source_labels)] and source_labels comes from the store, so labels can never rise above the seed. An end-to-end test could only ever show public → public, which read alone is equally consistent with the labels not being carried at all. The runbook says so in those words.
• The chain check compares links; it never recomputes hashEntry. A self-consistent rewrite, a trailing truncation, and a deleted first entry all read as unbroken — verified by running the real renderer over each case. It detects corruption and naive edits, not an adversary with write access to the log.

Retracted

Risk row 13 said a per-session monotonic sequence "would need the duplicate closed first" and named V6 as the slice that would need it. That expectation was checked and did not hold: S14's seq is derived per subprocess by re-reading a log, while S3's is assigned inside one synchronous append in a single Bun.serve process, and the chain's order rides prev_hash rather than the counter. The row is amended rather than left to imply a dependency V6 never took.

The plan, including the three points where measurement overturned it mid-execution, is tracked at docs/superpowers/plans/2026-08-14-v6-session-state-and-provenance-carriage.md. The runbook is docs/demos/v6-runbook.md.