Delegate Sensitive Research

The fixer needs Harbor Goods’ negotiated terms to fix issue #417, where quote() drops the tier discount for sku-204. Delegate the review to reviewer, return the review to your pricing team, and post exactly one summary that your pricing lead approved to the public pull request. The terms’ restrictions stay on everything the workflow learned.

Starts from chio new security-research --example security-research, a host for the pricing project with Harbor Goods’ terms and issue #417 in its documents.

The host in the security-research project runs the kernel’s native flow lifecycle against durable SQLite state and two independently journaled HTTP receivers. It is a trusted local operator program: it holds the fixer and reviewer identities, signed tool manifests, a classifier, and the pricing lead’s disclosure key, performs file reads and loopback sends, and runs no language model or confined worker. To expose the same operations to an agent, connect an authenticated process host.

The workflow separates three decisions. Reading the terms gives the fixer a customer’s confidential pricing, delegating gives the reviewer narrower permission to work with it, and posting to the pull request changes the audience to anyone who can read a public repository, so it needs its own disclosure decision.

1. Build the host and start its receiver

chio new security-research --example security-research
cd security-research/host
cargo build --locked --bin research

The host depends on the published chio-kernel, chio-flow, chio-process, and chio-store-sqlite crates; Cargo checks their versions against the lockfile. The result is a separate research binary beside the installed chio. If the build fails, check rustc --version and the project’s lockfile before changing source.

python3 receiver.py .receiver

The receiver binds 127.0.0.1:19041 and logs /internal, the pricing team’s channel, and /public, the public pull request, to separate JSONL files: two destination policies in one local service. Give it a fresh directory and a free port; the receiver counts in later steps assume empty journals. Open a second terminal in security-research/host/ and put the built command on its path, repeating this in any new terminal:

export PATH="$PWD/target/debug:$PATH"

2. Read Harbor Goods’ terms as the fixer

research init
research read terms \
  --as fixer --operation terms-v1

Allow: terms-v1
Caller: fixer
Document: terms

CONTRACT-HARBOR-GOODS-17
Harbor Goods pays 18 percent below list on sku-204 through June, with a floor of USD 41.00. Do not quote these terms outside Larkfield.

You should see the terms: 18 percent below list on sku-204, with a USD 41.00 floor. Initialization issued the fixer capability and a signed, attenuated reviewer capability, retained the keys and manifests, and initialized the native flow authority. Before releasing the text, the kernel recorded the larkfield-pricing owner and the harbor-goods-terms compartment in principal, lineage, and session state.

3. Continue the work as the narrower reviewer

research read issue \
  --as reviewer --operation review-source-v1

Allow: review-source-v1
Caller: reviewer
Document: issue

Issue #417: quote() drops the tier discount for sku-204 when one order spans two price lists.

You should see issue #417 returned to the reviewer. Its delegation depth is 1: the grant removes permission to delegate, halves each per-tool invocation limit from 64 to 32, and expires after 30 minutes instead of the fixer’s hour. The host registers the reviewer’s fixed budget share when it reopens. The public issue adds context, and the shared lineage keeps the terms’ restrictions.

Each command reopens the same stores in a new host process. Actor names select retained grants in this operator interface; an untrusted worker never receives these keys and never chooses its own principal, lineage, or isolation epoch.

4. Return the review to the pricing team

Save the reviewer’s summary as summary.txt, then send it to the internal destination:

quote() applies the tier discount for sku-204 across both price lists; a new test covers the split order.

research publish summary.txt \
  --as reviewer --to internal \
  --operation internal-review-v1

Allow: internal-review-v1
Caller: reviewer
Destination: internal

You should see the internal destination acknowledged, and the internal receiver logs the exact summary with its digest. Two conditions admitted the send: the grant permits invoking the publisher, and the publisher’s clearance preserves the contract label. Tool permission alone never decides where previously learned information may go.

5. Post the same summary to the pull request and see it refused

research publish summary.txt \
  --as reviewer --to public \
  --operation public-unreviewed-v1

Deny: public-unreviewed-v1
Caller: reviewer

You should see a deny for public-unreviewed-v1, and the command exits 2. The native flow boundary refused before the public connector sent anything, so no public journal exists; that receiver observation is separate from the signed decision. The summary names no customer, and the refusal stands anyway: it was written by a session that read the terms. Rewriting it without the contract marker, or reading more public material, leaves the accumulated label in place.

6. Approve one summary and publish it

Your pricing lead reads the final contents of summary.txt and approves exactly those bytes for the pull request. The host signs the grant with the lead’s approver key and prints the path where it retains the grant.

research approve summary.txt \
  --as reviewer --operation public-reviewed-v1

Approved exact summary: public-reviewed-v1
Grant: .research/operations/public-reviewed-v1/disclosure.json

research publish summary.txt \
  --as reviewer --to public \
  --operation public-reviewed-v1 \
  --grant .research/operations/public-reviewed-v1/disclosure.json

Allow: public-reviewed-v1
Caller: reviewer
Destination: public

You should see the public destination acknowledged. The pricing lead’s grant binds this summary and this destination for ten minutes, and native dispatch consumes the use: the public receiver observes one summary while retained state stays restricted. A later post needs its own compatible clearance or grant. Declassification, the embedder API behind this grant, continues with exact replay, changed drafts, and refused reuse.

7. Verify the receipt and the receiver journals

chio receipt verify \
  --input .research/operations/public-reviewed-v1/completed.receipt.json \
  --trusted-kernel-pubkey .research/kernel.pub

Verified 1 receipt signatures, signer pins and action hashes.

You should see one receipt verified. The verifier checks the receipt’s signature, signer pin, and action hash against the separately retained kernel public key, which establishes what the kernel signed. The receiver journal separately establishes which summary reached the pull request.

research release public-reviewed-v1 --json > release.json
jq '{state, raw_recorded, evaluated, schema: .release.schema}' release.json
research read issue --as reviewer --operation review-source-v1 --json > child.json
jq '{depth: .receipt.metadata.attribution.delegation_depth,
     label: .flow.snapshot.lineage_label}' child.json
research inspect --as reviewer --json > flow.json
jq .snapshot.session_label flow.json
cat .receiver/internal.jsonl
cat .receiver/public.jsonl

Stop the receiver with Ctrl-C. Keep the state directory while you examine receipts or replay the original operation. Its retained grants expire; after expiry, start a fresh exercise instead of replacing keys or clearing stores inside an old operation.

Portable label programs

chio new security-research --example security-research
cd security-research
cargo run --locked --quiet
cargo test --locked

ALLOW pricing-team destination: clearance retains the contract restrictions
DENY public destination: source label does not flow to destination clearance
RETAIN later public input: session restrictions unchanged
DENY missing clearance: egress clearance is missing
DENY Top clearance: top is not an operational egress clearance
NARROW shared owner: readers intersect to larkfield-pricing and fixer
DENY Larkfield-only destination: Harbor Goods obligations also apply
RETAIN delegated input: Larkfield and Harbor Goods obligations remain

use chio_flow::{authorize_egress, EgressDenial};
use chio_security_types::{InformationLabel, PrincipalId};
use std::collections::{BTreeMap, BTreeSet};

fn owned(name: &str) -> InformationLabel {
    let owner = PrincipalId::new(name).unwrap();
    InformationLabel::try_known(
        BTreeMap::from([(owner.clone(), BTreeSet::from([owner]))]),
        BTreeSet::new(),
    )
    .unwrap()
}

fn main() {
    let parent_knowledge = owned("larkfield-pricing");
    let child_read = owned("harbor-goods");
    let child_knowledge = parent_knowledge.join_restrictions(&child_read).unwrap();
    let returned_knowledge = parent_knowledge
        .join_restrictions(&child_knowledge)
        .unwrap();

    assert_eq!(returned_knowledge, child_knowledge);
    assert_eq!(
        authorize_egress(&returned_knowledge, Some(&parent_knowledge)),
        Err(EgressDenial::FlowViolation),
    );
    assert_eq!(
        authorize_egress(&returned_knowledge, Some(&child_knowledge)),
        Ok(())
    );
    println!("Child input and returned result retain both Larkfield and Harbor Goods owners");
}

cargo run --locked --quiet --example delegated_restrictions

Child input and returned result retain both Larkfield and Harbor Goods owners

fn contract_label() -> InformationLabel {
    let owner = PrincipalId::new("larkfield-pricing").expect("canonical owner");
    let fixer = PrincipalId::new("fixer").expect("canonical reader");
    InformationLabel::try_known(
        BTreeMap::from([(owner.clone(), BTreeSet::from([owner, fixer]))]),
        BTreeSet::from([Compartment::new("harbor-goods-terms").expect("canonical compartment")]),
    )
    .expect("bounded label")
}

let public = InformationLabel::bottom();
let internal = contract_label();
let session = public.join_restrictions(&internal).expect("valid join");

assert_eq!(authorize_egress(&session, Some(&internal)), Ok(()));
assert_eq!(
    authorize_egress(&session, Some(&public)),
    Err(EgressDenial::FlowViolation),
);

let customer = label_for("harbor-goods", &["harbor-goods", "fixer"], &["harbor-goods-nda"]);
let combined = session
    .join_restrictions(&customer)
    .expect("independent owner join");
assert_eq!(
    authorize_egress(&combined, Some(&internal)),
    Err(EgressDenial::FlowViolation)
);
assert_eq!(authorize_egress(&combined, Some(&combined)), Ok(()));