Implement all Step 11b actor-session review feedback in the current Simard repository. Replace circular row-derived provenance with a parent-held immutable authoritative ActorSessionBinding trust anch

[rysweet]

Task Description

Implement all Step 11b actor-session review feedback in the current Simard repository. Replace circular row-derived provenance with a parent-held immutable authoritative ActorSessionBinding trust anchor; remove ledger_path and all writable ledger credentials/access from goal-session actor subprocess inputs; broker mutations through the privileged parent; require and compare the immutable binding within the same SQLite write transaction for every validated terminal/outbox mutation; fail closed for missing, expired, malformed, mismatched, or unverifiable sessions; preserve separate explicit permissive legacy APIs; never self-upgrade unkeyed legacy provenance; keep migration atomic; extract binding/provenance logic from schema.rs; consolidate duplicated actor_sessions DDL; write a realistic regression test that modifies authorization fields and recomputes every current fingerprint/digest yet still fails authentication and terminal commit; add/maintain coverage for deletion race, expiry, scope mismatch, registration not repairing forgery, migration rollback, and absence of ledger credentials from child process inputs. Preserve GoalSessionExecutor constructor compatibility, validated constructor behavior, mandatory execution-time validation, narrow telemetry behavior, and all same-transaction checks. Update directly related documentation if needed. Work autonomously, modify the code, run targeted tests, and do not stop until complete.

Requirements

Final Requirements for Design

Minor implementation ambiguities remain; resolve them as follows:

1. Trust anchor ownership: Create ActorSessionBinding from trusted registration inputs and retain it only in privileged parent memory. Database rows, fingerprints, digests, tokens, and child-supplied values are never authoritative.

2. Binding immutability: Bind the stable authorization identity and scope required to authorize the session. Mutable lifecycle fields such as expiry may be validated separately but cannot alter or regenerate the binding. Changing binding-relevant fields requires a new trusted session registration.

3. Registration behavior: Registration may create a new trusted binding but must reject conflicting existing rows. It must never repair, bless, rotate, or overwrite forged, malformed, mismatched, or legacy-unkeyed provenance.

4. Legacy isolation: Preserve weaker compatibility only through APIs explicitly named and documented as permissive legacy operations. Existing validated APIs must never fall back to legacy behavior or self-upgrade legacy rows.

5. Parent broker: Actor subprocesses return typed mutation requests through a narrow parent-controlled IPC channel. They receive no SQLite path, writable connection information, authentication token, binding secret, or equivalent writable capability.

6. Transactional authorization: Every validated terminal and outbox mutation must:

   • Begin one SQLite write transaction.
   • Load and validate the current session row.
   • Compare it with the parent-held immutable binding.
   • Validate format, expiry, scope, and operation-specific constraints.
   • Perform idempotency checks and the protected mutation.
   • Commit atomically.

   Authorization must occur before replay/idempotency success is returned.

7. Outbox coverage: “Outbox mutation” includes claim, renew, complete/finish, retry/fail, block, recovery, and all associated lease or mutation-request writes when actor-session authorization applies.

8. Fail-closed behavior: Missing parent binding, process restart without restored trusted authority, deleted row, malformed data, expiry, scope mismatch, binding mismatch, unverifiable legacy provenance, or database error must reject the operation without partial writes.

9. Race handling: Preliminary and constructor-time checks are advisory only. Execution-time transactional validation is mandatory, including deletion and mutation races.

10. Executor compatibility: Preserve existing GoalSessionExecutor public constructor signatures and call patterns. new_validated retains construction-time validation, while every execution and effect path independently revalidates.

11. Migration: Use one authoritative actor_sessions DDL definition. Run schema and data migration in one transaction. Historical unkeyed provenance remains untrusted; migration must not synthesize trusted bindings. Any failure restores the exact pre-migration schema and data.

12. Module boundaries: Move binding construction, comparison, provenance parsing, and trust classification into a focused actor-session module. schema.rs may only invoke migration/integration functions and reference the shared DDL.

13. Telemetry: Emit only narrow authorization classification or outcome telemetry. Never include ledger paths, tokens, bindings, IPC credentials, database connection details, or writable capabilities.

14. Regression coverage: Tests must prove:

• Authorization fields can be modified and every current row-derived fingerprint/digest recomputed, yet authentication and terminal commit still fail.
• Deletion between preliminary validation and mutation fails atomically.
• Expired, malformed, missing, unverifiable, and scope-mismatched sessions fail.
• Registration does not repair forged or legacy provenance.
• Migration failure fully rolls back.
• Child command, context, environment, telemetry, and recipe inputs expose no ledger credentials.
• Validated terminal and outbox paths perform same-transaction binding checks.
• Explicit permissive legacy APIs remain available and isolated.

15. Documentation: Update only references describing actor-session trust, legacy APIs, migration behavior, parent-brokered mutations, and subprocess inputs.

These requirements are sufficiently unambiguous for the design phase.

Acceptance Criteria

• All explicit requirements met
• Tests passing
• Philosophy compliant
• Documentation updated

Classification

Generated via default-workflow recipe