P1: # prov:private routing falls through to public on same-second timestamp tie

[mattfogel]

Summary

current_turn_is_private uses strict pr > p on second-resolution now_iso8601() strings. When two UserPromptSubmit events fire in the same wall-clock second (one private, one public), the equal-stamp comparison falls through the _ arm to false, silently routing the next PostToolUse to the public ref.

Severity

P1 — privacy bypass under tight session timing. Confidence 100 (correctness + adversarial agreed).

Evidence

• crates/prov-cli/src/commands/hook.rs:262-269.
• Strict-greater-than is the active condition; ties are unhandled.

Possible fixes

• Prefer private on tie (conservative default for any privacy boundary).
• Use turn_index as a secondary sort key.
• Move to nanosecond-resolution timestamps in now_iso8601().

Acceptance criteria

• Test: two UserPromptSubmit events with the same ISO8601 stamp (one private, one public) followed by a PostToolUse — the edit lands on the private ref.
• Code comment near the comparator records the contract for which side wins on tie and why.

Reference

/tmp/compound-engineering/ce-code-review/20260502-075634-3af3d047/. See correctness.json (#2), adversarial.json (#2).