[dinakarjs]

Replace the proposed derived-output document with executable adapter-level controls in tests/unit/test_disclosure.py, as requested in maintainer review. No production code, signing format, schema or policy changes. Refs #660; does not close it.

The nine added parameter instances cover five former rows:

• DO02: ordinary text and relabeling instructions retain the trusted accumulated confidential restriction; explicit exact-output approval supplies the valid twin.
• DO03: edited summary bytes fail with the original approval; approved original bytes reach the callback.
• DO05: catalog-review/policy-advice text supplies no release grant; an independently signed approval is the valid twin.
• DO06: separately admitted recipient, source-scope and policy substitutions fail signature binding; signing the changed context succeeds at the correct registered callback.
• DO07: a prior approved disclosure does not authorize a new derivation/request; its durable observation stays intact and a separate approval permits the later output.

DO04 (unresolved required source) and DO08 (omitted source) remain in #660 pending controller-example placement. The adapter receives trusted labels/provenance and cannot discover omitted sources. The advice cases test model/content claims, not catalog approval verification or a Cedar integration.

Validation

Head 69e880bc48cea28e81de5a9950a68650fb39e137, Linux / Python 3.12.14, existing environment with editable checkout:

• Full unit suite: 2,497 passed, 6 skipped, eight dependency-metadata warnings.
• Disclosure and sink-policy selection: 93 passed.
• Ruff src/tests, mypy over both runtime/verify packages and configured Bandit scan pass.
• Strict documentation build passes after removal of the proposed page.
• Seven isolated in-memory trials detect bypassed within-boundary admission (DO02/05/07) or omitted exact-output, recipient, source-scope and policy approval inputs (DO03/06). Each fails a behavioral assertion; original functions restored.

The first full run encountered nine SOCKS-configuration failures in unrelated HTTP tests. The final full run clears environment proxy variables for local test traffic and passes. pip check reports no broken requirements (an existing invalid-distribution warning remains). No fresh lock rebuild, external recipient, hardware confidentiality, semantic declassification or controller completeness campaign is claimed. Exact-head CI (all Python 3.11/3.12/3.13 Ubuntu/Windows lanes), CodeQL and Confinement reference now succeed; Dependabot auto-merge is skipped. Maintainer review approved this head.

References and limits

• Existing exact-output disclosure contract defines the tested trusted-input, exact-byte and delivery boundaries.
• Denning, 1976 motivates inherited restrictions (abstract/metadata access only).
• CaMeL v2 informs control/data separation; Cedar informs applicable policy inputs; neither supplies complete provenance here.
• AgentDojo, NeurIPS 2024 motivates paired utility/adversarial evaluation; these unit spies are not its benchmark.
• disclosure-evidence draft -07 is individual prior art on coverage/reconciliation, not IETF consensus or implementation validation.

Both commits are DCO-signed. Prepared with Codex and self-reviewed. Marked ready at the maintainer's request after approval; DO04/DO08 and broader #660 decisions remain open.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

@imran-siddique the exact-head technical workflows have succeeded; this remains an informative draft with the proposed acceptance cases unexecuted. Please review the bounded scope/placement and the explicit representation decisions in the proposal, or name the maintainer who should decide them. I am not treating a green technical run as approval of the design or permission to implement a new normative contract.

[imran-siddique]

@dinakarjs this one is mine to decide. The boundary this page describes is already in spec/disclosure-authorization.md lines 13 to 17, including that the adapter cannot detect a controller omitting a source. A second page of eight unexecuted cases goes stale the day the tests land.

Please replace the doc with tests in tests/unit/test_disclosure.py for the rows that need no controller (DO02, DO03, DO05 to DO07 by my reading), and keep DO04 and DO08 in #660 until we pick a home for the controller example.

[dinakarjs]

Replaced the proposed page with the requested adapter-level DO02/DO03/DO05/DO06/DO07 controls at 69e880bc48cea28e81de5a9950a68650fb39e137. Nine parameter instances include paired valid delivery, before-callback refusals, correct-recipient spies and preserved earlier durable observations. Full unit suite 2,497 passed / 6 skipped; disclosure/sink selection 93 passed. Ruff, both-package mypy, configured Bandit and strict docs build pass. Seven isolated in-memory bypass/input-removal trials fail behaviorally; no mutations committed. The description states the initial proxy setup failure and final clean full run, primary references and trust limits. DO04/DO08 remain in #660 for the controller example; no source-completeness detection is claimed. Ready for current-head review, with draft status retained. Prepared with Codex.

[imran-siddique]

The page is gone and 69e880b only touches tests/unit/test_disclosure.py. The nine DO cases pass here, and so does the full unit suite (2481 passed, 22 skipped on Windows). I ran seven mutants of disclosure.py: any for all on labels, dropping output_sha256, recipient, source_scope or policy_version from the signed input, admitting a missing approval, and letting a prior release grant the next. Each one failed at least one DO test. Approving. Please mark it ready for review.

[carloshvp]

Approving the test-only disclosure cases at exact head 69e880bc48cea28e81de5a9950a68650fb39e137. The negative cases preserve accumulated classifications, require exact approval of edited bytes and substituted recipient/source/policy context, and show that an earlier authorized disclosure is not a grant for a later derivation. Each relevant negative case includes an explicit fresh-approval control and delivery assertions.

Independent Python 3.12 validation with hash-locked dependencies and the package installed editable from this checkout: all 62 disclosure tests pass and the full unit suite passes (2,483 passed, 20 platform/optional skips). Changed-file Ruff, pip check and diff whitespace checks pass. In isolated mutation runs, changing all-label acceptance to any-label fails both derived-label cases; separately removing the output digest, recipient, source scope or policy version from the domain-separated signed input fails its corresponding DO case.

The diff changes only tests/unit/test_disclosure.py. This does not establish external recipient behavior or authorize a broader disclosure path. All commits carry DCO sign-off; hosted checks and the current repository merge gate remain separate requirements.

Reviewed with OpenAI Codex.