27e277c820
The flow lattice says what a label is; this crate computes one from real bytes. As a run reads tool outputs and derives new values, FlowStore tracks where each value's bytes came from and folds a derived value's label from the ancestors it was actually computed from — so authorization can be conditioned on where an argument came from, not merely on its literal content, the gap the one-bit Trust tag cannot express. Two properties make this a reference monitor rather than a heuristic. The carry detector is an exact blake3 window index, deliberately not a rolling hash: each W-byte window is hashed independently, so two values share a fingerprint exactly when they share a verbatim run, with no carry state to get wrong and identical fingerprints on every platform. And every verdict emits a self-contained, content-addressed Witness — the ancestor cut, the taint edges, and the folded label — so a third party re-folds it offline to re-derive the verdict rather than trusting it; a receipt commits only its id. label_payload folds over four sources, each an edge kind the witness records: verbatim carry the scan found (Witnessed, proven by grams), a registered sensitive term appearing verbatim (Witnessed, for secrets below the window floor), a caller declaration (Declared — or top, fail-closed, if that parent was evicted), and in HighWater mode the coarse session floor (Ambient). Every collection is BTree, so a witness content-addresses deterministically. Ten tests carry the laws L17-L20 and the residuals as executable claims: verbatim carry yields a witnessed edge; a sub-window unregistered token yields nothing (the residual, pinned so it is never mistaken for a guarantee); a registered term of any length is caught; verify_witness re-folds the cut and catches a label tampered to look clean; a declared-but-lost parent fails closed to top; and — the attack this exists to stop — a summary carrying an attacker email verbatim does not sit below a principal-only ceiling, while HighWater still taints a laundered payload the scan alone cannot see. Increment 2 of the FL-2 plan; the runtime gate, jcp/3 receipt seal, and gateway relay follow. The receipt-stream replay (the eight-check chain walk) lands with the receipt integration, where jcp/3 receipts exist to walk. Co-Authored-By: Claude Opus 4.8 <[email protected]>
17 lines
727 B
TOML
17 lines
727 B
TOML
[package]
|
|
name = "jcp-flow"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
rust-version.workspace = true
|
|
description = "Propagated provenance for JCP — the witness scan and session store that fold a derived value's flow Label from the tool outputs it was computed from, so authorization can be conditioned on where a value CAME FROM, not just its literal bytes. An exact blake3 window index detects verbatim carry across tool calls; each verdict emits a content-addressed, offline-checkable Witness."
|
|
|
|
[dependencies]
|
|
jcp-schema = { workspace = true }
|
|
blake3 = { workspace = true }
|
|
serde = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|