Program: monotonic task capability state and protected-result release

[dinpd]

Outcome

Add a monotonic, task-scoped capability-state layer to AgentPass so protected events can remove incompatible authority across a task execution graph before sensitive results reach model context.

This milestone is informed by Cloudflare's Agent Access Model, especially its Trust Ratchet concept, while preserving AgentPass's product boundary as an action-authorization and execution-assurance layer that integrates with external identity and network systems.

Product demonstration

A reconciliation agent begins with authority to read a processor report, query two ledgers, use a vendor-support operation, and post a narrowly typed finance summary. When the processor report is classified as protected:

1. the result is held outside model context;
2. the task atomically transitions from baseline to restricted;
3. vendor-support and external destinations are removed;
4. stale parallel work under the prior state is fenced;
5. the protected result is released only after required enforcement acknowledgements;
6. injected instructions attempting an export or support upload are denied; and
7. the typed finance summary remains available.

Scope

• Task execution graph identity and immutable capability ceiling.
• Versioned, monotonic capability state and declared protected-event transitions.
• Protected-result hold, classification, transition, acknowledgement, and release.
• Local guard and hosted durable-state enforcement.
• Stale-state fencing and fail-closed concurrency behavior.
• An adapter contract for network-enforcement acknowledgements without making AgentPass a network gateway.
• Direct transition evidence, portable fixtures, and a runnable end-to-end demo.
• Alignment with existing data-flow lineage (Data-flow lineage across tool-result-to-tool-call chains #56) and structured capability degradation (Budget soft caps and structured capability degradation #7).

Non-goals

• Becoming an identity provider, authorization server, OAuth replacement, or universal network gateway.
• Automatically widening an active task from historical evidence.
• Restoring removed authority through ordinary approval.
• Solving multiplayer access control or complete transferable delegation.
• Capturing protected payloads, prompts, reasoning, or unrestricted results in portable evidence.
• Claiming complete implementation of the Agent Access Model.

Program invariants

• Dispatch establishes a capability ceiling that the active task cannot exceed.
• Capability state may remain equal or narrow; it cannot widen within the task.
• A protected result is not released until the declared transition commits.
• Conflicts, timeouts, stale versions, missing acknowledgements, or failed enforcement updates fail closed.
• Approval cannot restore a capability removed by the task state.
• Work requiring removed authority starts as a newly authorized task across a fresh boundary.
• The model cannot alter task state, forge an acknowledgement, or self-report authoritative transition evidence.
• Evidence records references, classifications, digests, and decisions rather than protected payloads.

Acceptance criteria

• A versioned task capability-state contract and policy shape are documented and implemented.
• Local and hosted paths enforce the same capability ceiling and monotonic transition semantics.
• Protected results remain unavailable to the model-facing caller until required transitions commit.
• Parallel calls carrying stale state versions are denied or safely cancelled.
• Persistent execution paths are explicitly reauthorized, closed, or unsupported during a transition.
• Ordinary approval cannot restore removed authority.
• Transition evidence identifies graph, template, ceiling, state-before, trigger, removed capabilities, acknowledgements, state-after, and outcome without protected content.
• A network-enforcement adapter contract can participate in transition acknowledgement and fails closed when required but unavailable.
• Portable fixtures prove local/hosted parity and negative behavior.
• The reconciliation/exfiltration demo is runnable and automatically proves the malicious support/export attempt is blocked while the typed summary succeeds.
• Threat-model, privacy, and concurrency documentation covers bypasses, stale work, telemetry leakage, and control-plane failure.

Acceptance-test plan

Automated

• State-machine unit and property tests proving no within-task widening.
• Held-result tests proving no release before committed transition.
• Concurrent stale-version and compare-and-set conflict tests.
• Timeout, missing-acknowledgement, and enforcement-error failure injection.
• Approval-after-removal denial tests.
• Local/hosted parity fixtures.
• Prompt-injection-style exfiltration scenario.
• Credential, PII, and protected-payload leak assertions across logs, events, receipts, and telemetry.

Human review

• Security review of trust boundaries and bypass paths.
• Operator review of policy readability and transition evidence.
• Demonstration review confirming the approved typed output remains useful while unsafe destinations close.

Dependencies and related work

• Data-flow lineage across tool-result-to-tool-call chains #56 — data-flow lineage across tool-result-to-tool-call chains.
• Budget soft caps and structured capability degradation #7 — structured capability degradation.
• Versioned policy and manifest lifecycle with staged activation and rollback #54 — versioned policy lifecycle, required before production-grade activation.
• Cross-runtime capability parity matrix and conformance suite #55 — cross-runtime capability parity.
• MCP gateway adapter production boundary hardening #57 — MCP gateway production-boundary hardening.

The task issues linked from this program are the implementation units. This program remains open until the complete demonstration and production-readiness gates pass.

Work packages

• Define the task execution graph and monotonic capability-state contract #79 — define the task execution graph and monotonic capability-state contract.
• Add protected-result hold, classify, transition, and release to the local tool gate #80 — add protected-result hold, classify, transition, and release to the local tool gate.
• Implement durable capability transitions and stale-work fencing in the hosted runtime #83 — implement durable capability transitions and stale-work fencing in the hosted runtime.
• Define a network-enforcement acknowledgement adapter for task capability transitions #81 — define a network-enforcement acknowledgement adapter.
• Ship the reconciliation exfiltration demo and capability-ratchet conformance fixtures #82 — ship the reconciliation exfiltration demo and capability-ratchet conformance fixtures.