[sstriker]

This is package 10 of PLAN.md: access freshness, section 6 and Appendix E of the paper.

This branch is on top of #78 (the rule lifecycle). Until #78 merges, the diff of this pull request also shows #78. Review commits 71fbc51 and 8441f88 for this package.

The paper says that a request made after a revocation cannot use the old grant. The code kept the grants, the policy and the read filter of a session until the session ended.

What changes

• Grants. A session records the digest of grants.toml when it starts. Before each read, each decision, each spend check, each call of a hosted tool, each import and each request through the egress, it reads the file again. If the file changed or cannot be read, the session stops: each of those calls gives stopped: .... A new session starts under the grants as they are.
• Policy. state/policy.stamp changes when a session changes what is in force. The stamp also has the digest of the root's policy/*.rego. A session that sees a different stamp loads the policy again, and computes its read filter and its handling again. If the policy does not load, the call is refused.
• Expiry. The policy compares the expiry of an exception with the clock at each decision.
• Recall. recall with a deputy withholds its brief when the read filter changed while the deputy wrote the brief.
• Board. The board opens a new session when its session stops, and keeps its claims.
• Demo. Act 3 has a step for a grant that the owner withdraws while a session is open.

A defect on main that this branch corrects

The last step of act 3 printed the length of the answer object of an agent's search. That length is always 1. The step now counts the hits. On a record that I seeded from examples/decisions and docs, the agent gets 0 hits under the narrow policy, and docs/demo-narrative.md now says so.

Not in this change

README.md ("Access freshness, in part") and row 10 of PLAN.md list what is open:

• Any change to the grants file stops each open session, not only a session that the change affects.
• A read that waits, for example on the index, does not check again before it gives its answer.
• Some commands of the owner and of the launcher do not do the check. No memory tool is in this group.
• The files that a session rendered stay on disk, and the harness of a stopped session continues to run.
• A grant has no expiry of its own.

Checks

make check passed with 1011 tests on 5a9a3ce. make corpus-check passed on 71fbc51. Act 3 ran on a scratch record with the debug binary: the open session got 5 hits, then two stopped: refusals, and the grants were put back. I did not run the act with a gateway key.

The new assertions failed when I removed the mechanism: the check in fresh() (four tests), the expiry at the decision, the reopen of the board, and the refusal in the egress.

Adversarial pass

One pass ran on b7a80c5. It found that each task operation on the ledger does the check. It confirmed these, and 8441f88 answers them:

1. A stopped session still made model calls, because the egress read an error from the spend check as "not over the limit". Now an error is a refusal, and the egress checks the session before a model call, a tunnel and a tool request.
2. A stopped session got a stored source from a hosted tool. Now use_tool checks first.
3. A stopped session could import a bundle. Now import checks first.
4. An import, and an entry of any type that replaced a policy entry, did not change the stamp. Open sessions kept the old policy. Now both load the policy again and write the stamp.
5. A root policy directory that could not be read gave the built-in policy. Now it is an error.
6. After the policy narrowed and widened again, get and the tasks of the session stayed narrow. Now the handling follows the filter.
7. The reload of the policy opened the index with its schema set-up and waited five seconds on a writer. Now it opens the index to read.
8. The board lost its claims when it opened a new session, and answered 500. Now it carries the claims and answers 403.
9. Four sentences did not agree with the code. The text changed.

Open from the pass:

• A read that waits does not check again (in the list above).
• The commands that do not do the check (in the list above).
• No test holds the reset of the pushed-pack cache when the filter changes, the check in use_tool, or the read-only open of the index.
• Two exceptions with one id: when the first lapses, the policy also removes the second. This refuses more, not less.
• Two requests to a stopped board each open a session.

A second pass ran on 5a9a3ce (8441f88 with #78 and main merged in). It confirmed these defects, and 4eb0aca fixes them. Each fix has a test that fails without it, except the script, which a run under three signals showed.

• A tunnel that was open when the grants changed kept carrying bytes. The egress now closes it.
• reindex and materialize changed the entries that the policy is compiled from, and open sessions kept the old policy. Both now reload the policy.
• A board whose session stayed stopped answered 500, gave the domain list, and served the files of a bundle that it exported before. It now answers 403 to each.
• The trap of act 3 did not put the grants back after a signal. It now does.

The pass also found fixes of 8441f88 that no test holds. These are still open, with no test: the refusal of over_budget on an error; the check in post of the egress; the check in use_tool; the reload after a release from quarantine; the index check in load_policy_again; the reset of the pack cache; adopt_claims on the board.

Two more items are open. The expiry of an exception does not reach a read filter that a root policy computes from the exceptions, or the advisory rules; local/README.md and PLAN.md say so. A demo root with a quote in its path breaks the run item of act 3.

No pass ran on 4eb0aca. This pull request stays a draft until #78 merges.

Posted by Claude on behalf of @sstriker

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.