@@ -1,5 +1,9 @@
 # Classified flow — capability-style non-exfiltration over the artifact
 
+> Secrecy is one of two dual flow modes; the integrity dual (prompt
+> injection: untrusted data must not steer power) and the trust
+> record/postures live in `spec/trust.md`. One walker serves both.
+
 **Status: PROPOSED (2026-08-10), awaiting ratification.** Nothing here is
 conformance surface yet: no harness op, no fixtures, no schema change. A
 working reference prototype exists (`reference/flow.py` +
@@ -65,16 +69,61 @@ LM's completion derives from its prompt). Output of a declassifier is
 clean.
 
 **Honest limits (stated, not hidden):** the prototype tracks *explicit*
-data flow plus loop-to-fixpoint; **implicit flows** (branching on a
-tainted test, then signaling through untainted assignments) are flagged
-only coarsely — a tainted `If`/`While` test inside which a sink is
-called is reported as a `control` violation, but value laundering
-through control flow is not fully closed. This is a lint with teeth,
-not a proof system — the gap between "declared and machine-checked
-across the whole orchestration layer" and Scala's capture-checked
-leaves. The leaf boundary stays trust-by-declaration (`effects: pure`
-is probe-verified, not type-proven; spec/node-set.md's standing
-position).
+data flow plus loop-to-fixpoint, and closes the branch-shaped implicit
+channels the closed node set makes enumerable:
+
+- **branch-assign laundering** (`if secret == k: y = "1" else: y =
+  "2"`) — assignments under a tainted guard are tainted;
+- **the exception channel** — a `Raise` under a tainted guard taints
+  every enclosing handler's assignments;
+- **the break channel** — a `Break`/`Continue` under a tainted guard
+  taints the loop's assignments (guarded re-walk to fixpoint);
+- a sink *called* under a tainted test with clean args is a `control`
+  violation.
+
+What remains open, by design: **sink-selection signaling** (which of
+two lawful sinks fires encodes the bit — reported only as the coarse
+`control` violation), **iteration-count channels** into out-of-band
+observers, and timing/covert channels generally. This is a lint with
+teeth, not a proof system — the gap between "declared and
+machine-checked across the whole orchestration layer" and Scala's
+capture-checked leaves. The leaf boundary stays trust-by-declaration
+(`effects: pure` is probe-verified, not type-proven;
+spec/node-set.md's standing position).
+
+## Prior art: TACIT / tracked capabilities (Odersky et al., CAIS 2026)
+
+The design's inspiration is now a published system: *Securing Agents
+with Tracked Capabilities* (Odersky, Zhao, Xu, Bračevac, Pham; TACIT
+harness; best paper, CAIS 2026; substack: "Tracked Capabilities for
+Safer Agents"). Correspondences, recorded so ratification sees the map:
+
+- their pure arrow `T -> U` ≈ our `effects: pure` + rung-0 placement —
+  with one strengthening on our side: the "pure summarizing LLM" is a
+  weights-baked entry whose manifest *has no endpoint*, a checkable
+  file fact rather than an interface promise;
+- `Classified.transform(f: T -> U)` ≈ tainted data flowing only into
+  non-sink leaves; `reveal(using CanAccess)` ≈ the receiver-held
+  declassifier grant; `aggregate` ≈ the taint join (secret ⊔ x =
+  secret), already in the prototype;
+- their "safe subset, escape hatches disabled" ≈ the closed node set
+  refusing `import`/`lambda`/ambient context.
+
+Two consequences adopted as open items:
+
+1. **Their CaMeL critique** (dedicated DSL + whole-program-then-analyze
+   vs on-the-fly checked snippets) does not reach the shipped-artifact
+   case — a portable program is closed before analysis by premise — but
+   it does reach CodeAct/PoT. The answer is theirs, transposed:
+   model-generated snippets written in the exportable subset can be
+   `node_compile`d + `flow_check`ed **per snippet, before the
+   interpreter leaf executes them** — an incremental flow mode, named
+   here as future work, not in this ratification.
+2. **Defense-in-depth gap:** TACIT grants are scoped to a computation;
+   our declassifier grants are leaf-named but policy-global (every call
+   of the granted leaf declassifies). A per-path or per-call-site grant
+   scope is the faithful translation — added to the ratification asks
+   below as question 3.
 
 ## Proposed conformance shape (on ratification, not before)
 
@@ -84,5 +133,45 @@ position).
   `PIR-E-FLOW-001` refusal form for load-time enforcement mode.
 - fixture family `cases/flow/`: the two-LLM contracts scenario as the
   seed pair (clean topology accepts; one rebinding of the summarizer to
-  an endpoint-bound LM violates), plus declassifier-grant and
-  control-flow vectors.
+  an endpoint-bound LM violates), plus declassifier-grant,
+  control-flow, exception-channel, and break-channel vectors (the
+  prototype selfcheck's nine, promoted).
+
+## Ratification asks (positions taken, for decision)
+
+Three open questions block ratification. The draft takes a position on
+each; deciding otherwise changes the schema below, not the analysis.
+
+**1. Label shape: a three-point lattice, not a single marker.**
+Classification labels are `secret < internal < public` (default:
+`public`, i.e. unlabeled). The policy maps labels to sink classes it
+refuses: `{"secret": "no_egress", "internal": "declared_endpoints_only"}`.
+Rationale: the single-bit design cannot say "may go to *my* endpoints
+but not arbitrary ones," which is the common enterprise posture; and
+widening a serialized single-bit marker later is a breaking schema
+change, while shipping the lattice now costs one enum. Odersky's story
+is the `secret` row alone. A declassifier grant names the step it
+performs (`secret → internal` or `secret → public`); an ungraded grant
+is refused at policy validation.
+
+**3. Grant scope (new, from the TACIT comparison).** Position: keep
+leaf-named global grants for this ratification (simple, receiver-
+auditable), and record per-path grant scoping as the named v1.x
+follow-up — the policy schema gains an optional `at: <call path>`
+qualifier then, an additive change. Deciding for per-path now would
+delay ratification for a scope no current scenario needs; deciding
+never would close the door on TACIT's defense-in-depth, which is the
+part of their design worth importing.
+
+**2. Export-time enforcement defaults to refuse, not warn.**
+When any field carries a non-`public` label, `flow_check` runs at
+export and a violation refuses the export, naming the flow (source
+field → leaf → entry, the teaching-error voice). Opt-down is explicit
+and recorded: `export(..., flow="warn")` stamps
+`flow_policy: "warn"` into provenance, so a receiver can see the
+author bypassed the check. Rationale: the campaign's standing
+loud-refusal doctrine (Numba's silent-fallback lesson); a labeled
+field is the author *asking* for the guarantee; and an artifact that
+exports cleanly under refuse-mode is a checkable claim, not a hope.
+Receiver-side `flow_check` is unaffected: it is always the receiver's
+own policy and never trusts the author's mode.