docs(LGT-021): seal context authority boundary

Author: liushiao

.legatura/contracts/context-kernel-interface.json

@@ -3,29 +3,29 @@
   "id": "context-kernel-interface",
   "name": "Context Kernel Interface",
   "owner": "context-kernel",
-  "consumers": ["change-kernel", "worker-execution"],
+  "consumers": ["change-kernel"],
   "maturity": "provisional",
   "normativeSources": ["product-intent", "long-term-plan", "domain-language", "assurance-policy"],
   "claims": [
     {
       "id": "context-materialization-binds-exact-authorized-bytes",
-      "statement": "Given one logical compiled Context Capsule and one stable exact repository source product, Context Kernel emits a bounded canonical content-addressed manifest and process-local delivery whose ordered concrete regular-file entries exactly cover the authorized initial read scope; missing, extra, drifted, escaping, ambiguous, symlink, unreadable, duplicate, malformed, or over-limit source facts fail closed."
+      "statement": "Given one logical compiled Context Capsule, its frozen Git-visible path inventory, and one matching opaque Assurance Runtime Repository Source Product, Context Kernel emits a bounded canonical content-addressed manifest and process-local delivery whose ordered concrete regular-file entries exactly cover the authorized initial read scope; missing, extra, cross-repository, drifted, escaping, ambiguous, symlink, non-regular, unreadable, duplicate, malformed, forged, serialized, or over-limit source facts fail closed."
     },
     {
       "id": "context-expansion-is-recorded-before-content-disclosure",
-      "statement": "A Context Expansion grant persists an all-or-nothing settlement and append-only lineage bound to the exact execution, request, prior Context Session, stable source product, and Project Model impact product before any newly authorized source bytes are disclosed; persistence failure, stale binding, replay, partial grant, or scope broadening discloses no bytes."
+      "statement": "Every Context Expansion resolution made with the exact live controller Session product appends one successor Session and settlement bound to the exact execution, request, prior Session, stable source product, and Project Model impact product, atomically consumes the prior controller product, and returns a successor controller product; a grant commits exact process-lifetime blob state and compare-and-swap lineage before minting any newly authorized delivery, while denial or compiler-derived redundancy discloses no new bytes and persistence failure, stale binding, replay, partial grant, or scope broadening leaves the prior Session and controller current."
     },
     {
       "id": "context-expansion-resolutions-cannot-be-worker-self-granted",
-      "statement": "A Worker-authored Context Expansion Request remains inert and cannot supply its own grant, denial, successor Capsule, materialization, Context Impact, controller identity, or Authority; only a separately compiled controller settlement may advance Context Session bindings."
+      "statement": "A Worker-authored Context Expansion Request remains inert: resolution authority is possession of an opaque process-local controller Session product passed only through a process-local options seam, minted for the exact Context Kernel instance and current Session, and retained outside Worker input; no request, report, observation, Execution Record, digest, plain Session record, proxy, deserialized value, caller identity, or caller-supplied grant, successor, source, scope, materialization, or impact can mint, rehydrate, or substitute that product."
     },
     {
       "id": "context-session-lineage-is-append-only-and-non-authoritative",
       "statement": "Context Session records preserve exact previous and next materialization and Context Impact digests plus granted, denied, or redundant settlement facts, while source bodies remain out of coordination records and no Context fact creates Evidence, Knowledge Closure, Outcome or Claim satisfaction, an Authority Decision, capability enforcement, semantic code impact, or Change acceptance."
     },
     {
       "id": "context-kernel-proof-rejects-source-scope-and-settlement-attacks",
-      "statement": "The fixed Context Kernel proof accepts one reproducible initial materialization and one exact recorded-before-disclosure expansion, and rejects forged, stale, cross-execution, cross-source, replayed, broadened, partially persisted, manifest/blob-mismatched, path-escaping, symlink, unowned, worker-self-granted, impact-substituted, and resource-exhaustion inputs."
+      "statement": "The fixed Context Kernel proof accepts one reproducible initial materialization and one exact recorded-before-disclosure grant, and rejects forged, serialized, proxied, wrong-kind, cross-instance, stale, consumed, cross-execution, cross-repository, cross-source, replayed, broadened, partially persisted, manifest/blob-mismatched, path-escaping, symlink, unowned, worker-self-granted, caller-self-granted, impact-substituted, storage-failed, and resource-exhaustion inputs."
     }
   ]
 }

.legatura/contracts/project-model-interface.json

@@ -25,7 +25,11 @@
     },
     {
       "id": "context-expansion-impact-is-derived-from-frozen-sources",
-      "statement": "Given a frozen Project Model, its opaque exact path-ownership product, a current Context Session projection, and requested concrete paths, Project Model derives the exact newly disclosed path owners, Contract relations, Assurance crossings, disposition references, and Context Impact digest; worker or caller supplied owner, Module, Contract, assurance, semantic-impact, or verification classifications cannot substitute those facts."
+      "statement": "Given a frozen Project Model, its opaque exact path-ownership product, an exact prior-disclosed path list and digest, requested concrete paths, and a stable repository source binding, Project Model derives the exact newly disclosed path owners, Contract relations, Assurance crossings, disposition references, and Context Impact digest; Context Session objects and worker or caller supplied owner, Module, Contract, assurance, semantic-impact, or verification classifications cannot substitute those neutral inputs or facts."
+    },
+    {
+      "id": "context-expansion-impact-proof-rejects-binding-and-classification-attacks",
+      "statement": "The fixed Context Impact proof accepts one exact neutral prior-path and requested-path compilation and rejects forged or serialized ownership products, stale Model or source bindings, duplicate, malformed, unowned, disposition-only, already-disclosed, broadened, over-limit, Context-Session-coupled, and caller-classified impact inputs."
     },
     {
       "id": "module-path-ownership-proof-rejects-coverage-and-binding-attacks",

.legatura/contracts/worker-execution-interface.json

@@ -3,7 +3,7 @@
   "id": "worker-execution-interface",
   "name": "Worker Execution Interface",
   "owner": "worker-execution",
-  "consumers": ["change-kernel"],
+  "consumers": ["change-kernel", "context-kernel"],
   "maturity": "provisional",
   "normativeSources": ["product-intent", "domain-language", "assurance-policy"],
   "claims": [

.legatura/gates/minimum.json

@@ -235,7 +235,7 @@
       ],
       "oracle": {
         "kind": "context-kernel-interface-proof-exit",
-        "description": "The fixed Context Kernel cross-Interface proof must accept exact initial materialization and recorded-before-disclosure expansion while every declared source, scope, settlement, lineage, authority, and resource attack exits nonzero inside the scenario."
+        "description": "The fixed Context Kernel cross-Interface proof must accept exact initial materialization and one controller-product-authorized recorded-before-disclosure expansion while every declared source, scope, capability-product, settlement, lineage, authority, storage, and resource attack exits nonzero inside the scenario."
       },
       "applicability": {
         "phase": "acceptance",
@@ -244,17 +244,19 @@
       "discriminatoryPower": {
         "rejects": [
           "initial materialization that includes bytes outside the logical Context Capsule read scope",
-          "missing, extra, drifted, ambiguous, escaping, symlink, unreadable, duplicate, or over-limit source entries",
-          "a Worker request that grants its own scope, successor Context, or Context Impact",
+          "missing, extra, cross-repository, drifted, ambiguous, escaping, symlink, non-regular, unreadable, duplicate, malformed, forged, serialized, manifest/blob-mismatched, or over-limit source entries or products",
+          "a Worker request or arbitrary caller that grants its own scope, successor Context, source product, materialization, or Context Impact",
+          "a forged, serialized, proxied, wrong-kind, cross-instance, stale, consumed, or delivery-product-substituted controller Session product",
           "stale, cross-execution, cross-source, replayed, broadened, partial, or impact-substituted settlement",
-          "new source-byte disclosure before the exact expansion ledger and blob state persist",
+          "new source-byte disclosure before exact process-lifetime blob state and compare-and-swap expansion lineage commit",
+          "a blob or lineage persistence failure that rotates the prior Session or mints any delivery",
           "Context lineage that changes write scope or creates capability, semantic-impact, Evidence, Knowledge Closure, Authority, or acceptance conclusions"
         ]
       },
       "residualUncertainty": [
-        "The proof establishes the local Context delivery seam, not that a same-user Worker process cannot read the repository or acquire knowledge through another channel.",
+        "The proof establishes process-local dataflow capability and Context delivery non-forgeability, not authenticated controller identity or that a same-user Worker process cannot read the repository or acquire knowledge through another channel.",
         "Raw filesystem read and write enforcement remains the worker-capability-enforcement-not-proven Gap and LGT-022 responsibility.",
-        "Real provider delivery, use of disclosed content, adapter parity, and intent-to-acceptance remain LGT-023 and LGT-024 responsibilities."
+        "Worker adoption of successor Context, real provider delivery, use of disclosed content, adapter parity, and intent-to-acceptance remain LGT-023 and LGT-024 responsibilities."
       ]
     }
   ]

.legatura/gates/path-ownership.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "id": "path-ownership",
-  "name": "Module Path Ownership Proof Gate",
-  "purpose": "Produce direct Evidence that tracked-path facts are exact, Module write ownership is total and exclusive, and Context Capsules consume the same opaque ownership product.",
+  "name": "Project Model Path and Context Impact Proof Gate",
+  "purpose": "Produce direct Evidence that tracked-path facts are exact, Module write ownership is total and exclusive, Context Capsules consume the same opaque ownership product, and Context Expansion Impact is derived only from neutral frozen structural inputs.",
   "appliesTo": ["assurance-runtime", "project-model", "change-kernel"],
   "commands": [
     {
@@ -62,6 +62,34 @@
         "The selector grammar is deliberately restricted to exact paths and literal recursive prefixes rather than general glob intersection."
       ]
     },
+    {
+      "id": "context-expansion-impact-proof",
+      "appliesTo": ["project-model"],
+      "command": ["node", "--test", "test/project-model/context-impact.test.mjs"],
+      "timeoutMs": 120000,
+      "claimRefs": [
+        "context-expansion-impact-is-derived-from-frozen-sources",
+        "context-expansion-impact-proof-rejects-binding-and-classification-attacks"
+      ],
+      "oracle": {
+        "kind": "node-test-runner-exit",
+        "description": "The fixed Project Model neutral Context Expansion Impact compilation and attack scenario must exist and exit zero."
+      },
+      "applicability": {
+        "phase": "acceptance",
+        "purpose": "context-expansion-impact-proof"
+      },
+      "discriminatoryPower": {
+        "rejects": [
+          "a Context Kernel Session object or caller classification substituted for neutral exact prior-path, request-path, ownership, Model, or source inputs",
+          "a forged, serialized, wrong-Model, stale-path-facts, stale-source, duplicate, malformed, already-disclosed, unowned, disposition-only, or over-limit impact input",
+          "a broadened owner, Module, Contract, assurance crossing, disposition, semantic-impact, verification, Evidence, or acceptance conclusion"
+        ]
+      },
+      "residualUncertainty": [
+        "The proof derives structural Context Impact from declared Model and ownership facts; it does not infer semantic code impact, verify source behavior, enforce reads, or decide acceptance."
+      ]
+    },
     {
       "id": "path-ownership-kernel-adoption-proof",
       "appliesTo": ["change-kernel"],

.legatura/knowledge-gaps.json

@@ -314,10 +314,11 @@
     {
       "id": "context-materialization-and-expansion-binding-not-proven",
       "status": "open",
-      "affects": ["context-kernel", "project-model", "worker-execution", "change-kernel"],
+      "affects": ["assurance-runtime", "context-kernel", "project-model", "worker-execution", "change-kernel"],
       "owner": "governance-maintainer",
-      "statement": "No fixed proof binds a logical compiled Context Capsule to one exact bounded source-byte materialization or proves that only a controller-owned recorded-before-disclosure settlement can produce an append-only successor Context with compiler-derived Context Impact facts.",
+      "statement": "No fixed proof binds one stable opaque Assurance Runtime source-byte product to a logical compiled Context Capsule and exact materialization, derives neutral Context Impact from frozen Project Model sources, or proves that only an unforgeable process-local controller Session product can append a recorded-before-disclosure successor Context.",
       "proofClaimRefs": [
+        "context-expansion-impact-proof-rejects-binding-and-classification-attacks",
         "context-kernel-proof-rejects-source-scope-and-settlement-attacks"
       ],
       "expansionTrigger": "Before LGT-021 is achieved or any Worker Adapter receives a Context materialization."

.legatura/modules/context-kernel.json

@@ -8,19 +8,23 @@
   "decisionAuthority": "module-maintainer",
   "interface": {
     "entrypoints": [
-      "createContextSession(input, options)",
-      "resolveContextExpansion(input, options)",
+      "createContextKernel(options)",
+      "kernel.createContextSession(input, options)",
+      "kernel.resolveContextExpansion(input, { controllerSessionProduct })",
+      "kernel.readContextDeliveryFile(deliveryProduct, pathRef)",
       "validateContextKernelDocument(value)",
       "CONTEXT_KERNEL_SCHEMA_VERSION",
       "CONTEXT_KERNEL_PROOF_VERSION",
       "CONTEXT_KERNEL_LIMITS"
     ],
     "invariants": [
-      "A Context Session binds one execution, compiled Change, logical Context Capsule, stable repository source product, exact content-addressed manifest, and compiler-derived Context Impact.",
-      "Source bodies live only in a bounded process-local delivery or content-addressed blob store; Context Session, Worker Execution, Change, HTTP, CLI, and Profile records carry manifests and digests rather than source bodies.",
-      "Initial materialization expands only the logical Capsule read scope into concrete regular-file entries, rejects symlink and path escape, and fails closed on missing, extra, ambiguous, drifted, unreadable, duplicate, malformed, or over-limit source facts.",
-      "A Worker-authored Context Expansion Request is inert; only a controller-owned settlement bound to the exact execution, request, prior Context Session, source product, and Project Model impact product may grant, deny, or mark it redundant.",
-      "A granted expansion is all-or-nothing, appends lineage and persistence before disclosure, preserves write scope, adds only exact authorized bytes, and records previous and next materialization and Context Impact digests.",
+      "A Context Session binds one execution, compiled Change, logical Context Capsule, frozen Git-visible path inventory, opaque Assurance Runtime Repository Source Product, exact content-addressed manifest, and compiler-derived Context Impact.",
+      "Source bodies live only in bounded process-lifetime content-addressed blob state and delivery products; Context Session, Worker Execution, Change, Store, HTTP, CLI, and Profile records carry manifests and digests rather than source bodies.",
+      "Initial materialization expands only the logical Capsule read scope over the frozen repository inventory, consumes the exact matching live source product, and fails closed on missing, extra, cross-repository, path-escaping, symlink, non-regular, ambiguous, drifted, unreadable, duplicate, malformed, forged, serialized, or over-limit source facts.",
+      "Session creation returns distinct unforgeable process-local controller and delivery products; the controller product stays outside Worker input, cannot be reconstructed from any plain record, and is the only resolution capability for that kernel instance and Session.",
+      "A Worker-authored Context Expansion Request is inert; the controller holder may choose only grant or deny, while redundancy, successor scope, source selection, manifest, Context Impact, and lineage are compiler-derived from exact frozen sources.",
+      "Every resolution through the process-local controller-product options seam appends a successor Session, atomically consumes the prior controller product, and returns a successor controller product; a grant is all-or-nothing and mints delivery only after process-lifetime blob commit and compare-and-swap lineage persistence, while deny or derived redundancy discloses no new bytes and failed commit leaves the prior controller product current.",
+      "Context Kernel does not settle or resume a Worker Execution Record; Adapter adoption of a successor Context belongs to LGT-023 and must not create a Worker Execution to Context Kernel dependency cycle.",
       "Context Kernel owns disclosure facts, not raw filesystem enforcement, worker knowledge, semantic code impact, Evidence, Knowledge Closure, Outcome, Claim, Authority, or Change acceptance conclusions."
     ]
   },
@@ -48,6 +52,11 @@
       "module": "assurance-runtime",
       "via": "assurance-runtime-interface",
       "access": "interface-only"
+    },
+    {
+      "module": "worker-execution",
+      "via": "worker-execution-interface",
+      "access": "interface-only"
     }
   ]
 }