feat: bind sensitive disclosure to exact task scope

CHANGELOG.md

@@ -10,6 +10,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Canonical HTTPS and loopback-origin boundary with case-normalized schemes and hosts, default-port normalization, IPv4/IPv6 handling, browser-special numeric-host rejection, and explicit malformed-input errors.
 - Typed browser actions, capabilities, risk classes, execution modes, robots decisions, secret-delivery contracts, immutable canonical action-intent digests, and intent-bound approval scopes.
 - Deterministic fail-closed policy evaluation for untrusted instructions, origin grants, crawler restrictions, execution-mode and purpose consistency, approvals, and brokered secrets.
+- Purpose-bound sensitive-data policy that carries no protected value bytes, binds disclosure to exact tenant, task, field, purpose, canonical destination, and classification authority, constrains tenant/task/field/purpose identifiers to 1–128 byte ASCII policy tokens, preserves seven explicit disclosure outcomes, and evaluates opaque-handle admission against that same classification-bound destination scope plus exclusive expiry and maximum use count.
 - Fail-closed resolved-destination policy with IPv4/IPv6 special-purpose and reviewed cloud-platform endpoint classification, IPv4-mapped canonicalization, explicit class grants, non-empty origin-bound DNS snapshots capped at 256 resolver addresses, concrete connection pinning, DNS-set expansion detection, and per-hop redirect reauthorization.
 - Direct-only `originweave-network` TCP boundary with explicit canonical `SocketAddr` authority, zero IPv6 flow and scope metadata unless separately modeled, a non-cloneable single-use plan, a 30-second per-attempt timeout ceiling, at most four attempts, exact `peer_addr` verification before stream exposure, and no hostname re-resolution or ambient proxy inheritance.
 - Authenticated `originweave-tls` service-identity boundary that consumes an existing verified TCP stream, requires exact TLS-origin and transport-origin equality, derives RFC 9525 DNS or literal-IP reference identity only from the canonical HTTPS origin, validates WebPKI with explicit roots and fixed time, permits only TLS 1.2 and TLS 1.3, and never reconnects or resolves.
@@ -24,16 +25,17 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Universally value-redacted network evidence with explicit path, metadata, and provenance bounds; ambiguous path rejection; validated source URLs; lowercase SHA-256 identifiers; and verification state.
 - Rust 1.97.1 build contract, strict Clippy and rustdoc gates, and exact production function, line, region, and branch coverage enforcement.
 - Hourly bounded OpenCode product-development workflow using `NVIDIA_NIM_API_KEY`, an unprivileged disposable workspace, loopback-only model broker, independently verified patches, and publication through a dedicated `OPENCODE_PR_TOKEN` that cannot review or merge.
-- Architecture, agent, security, contribution, research, database naming, roadmap, quality-gate, and TLS service-identity ADR documentation.
+- Architecture, agent, security, contribution, research, database naming, roadmap, quality-gate, TLS service-identity, and purpose-bound sensitive-data ADR documentation.
 
 ### Changed
 
 - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result.
 - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port.
 - Separated exact TCP peer proof from authenticated TLS service identity; an observed peer becomes an authenticated HTTPS stream only after explicit-root, fixed-time, SAN-bound WebPKI verification over that same stream.
+- Separated sensitive-data disclosure from network, session, repository, administrator, and model-credential authority; later storage, broker, model-disclosure, evidence, and lifecycle modules must consume explicit field-level policy instead of inferring raw-value access.
 - Replaced single resource-pressure directives with a cumulative mitigation plan so simultaneous RAM, VRAM, frame, model, and admission pressure cannot discard required actions.
 - Changed generic network capture from finite deny-lists or safe-name allow-lists to unconditional value redaction. Typed metadata values and bodies now require a separate schema-specific capture contract.
-- Updated the first Chromium slice to distinguish implemented origin, destination, direct TCP, and TLS identity kernels from the remaining trusted DNS adapter, proxy/PAC, HTTP budget, MIME, download, and Chromium integration required before safe navigation can be claimed.
+- Updated the first Chromium slice to distinguish implemented origin, destination, direct TCP, TLS identity, and sensitive-data policy kernels from the remaining trusted DNS adapter, proxy/PAC, HTTP budget, MIME, download, broker, and Chromium integration required before safe navigation and protected-value disclosure can be claimed.
 - Separated hourly product PR publication authority from the organization review and merge system, and added live default-branch and release-blocker rechecks immediately before publication.
 - Moved autonomous-agent Cargo targets and Python bytecode caches outside the proposed source tree and prefetched locked Cargo dependencies for offline verification.
 - Updated research doctoring to pin Chromium canonicalizer evidence to an immutable revision, add RFC 9293, RFC 5280, RFC 8446, RFC 9525, rustls 0.23.42, and Rust `TcpStream` evidence, distinguish the April 2026 Fugu beta from the June 2026 release, and treat vendor benchmark claims as first-party evidence rather than independent validation.
@@ -42,6 +44,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 - Raw page content cannot become a trusted instruction.
 - Raw secrets are rejected and secret-capable actions require an opaque broker handle.
+- Sensitive-data policy denies disclosure when tenant, task, field, business purpose, canonical destination, or classification differs from the explicit scope; malformed, oversized, whitespace-bearing, control-bearing, or non-ASCII authority identifiers also fail closed even when both sides match. Opaque-handle evaluation fails closed on the same bounded destination and classification scope, including field reclassification, expiry, or exhausted use count, and the first authority API contains no protected value bytes. Later broker/service adapters must consume this same scope and atomically enforce authoritative use state before value resolution.
 - Crawler mode is read-only, must pair with the public-crawl purpose, and fails closed without an applicable robots-policy decision.
 - State-changing actions are same-origin by default.
 - R3 and R4 approvals are bound to the exact action, target origin, and immutable digest of the complete canonical action intent; R5 legal consent is non-delegable.
@@ -69,4 +72,4 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - The hourly product agent has no Git metadata or repository authority. A separate post-verification publisher opens one PR and cannot approve or merge it.
 - The unprivileged OpenCode user is restricted to loopback egress during model execution, preventing runner-wide allow-listed endpoints from becoming direct source-exfiltration channels.
 
-[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD
+[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD

README.md

@@ -4,19 +4,20 @@
 
 OriginWeave is a Chromium-compatible, Rust-first control plane for governed AI agents on the web. It is designed to let an agent observe, extract, and act without turning untrusted page content into authority, exposing secrets to a model, connecting to an unapproved network destination, accepting an unauthenticated web service, or losing the evidence required to explain what happened.
 
-> Project status: pre-alpha. The current repository contains independently reusable safety, resolved-destination, direct TCP peer-binding, and authenticated TLS service-identity kernels. Chromium, WebDriver BiDi, CDP, MCP, HTTP, proxy, WARC, and persistent provenance adapters are planned but not yet shipped.
+> Project status: pre-alpha. The current repository contains independently reusable safety, resolved-destination, direct TCP peer-binding, authenticated TLS service-identity, and purpose-bound sensitive-data policy kernels. Chromium, WebDriver BiDi, CDP, MCP, HTTP, proxy, WARC, and persistent provenance adapters are planned but not yet shipped.
 
 ## Why OriginWeave
 
-Existing browser automation commonly exposes raw selectors, unrestricted script evaluation, ambient cookies, implicit resolver authority, host-dependent TLS assumptions, and screenshots with weak provenance. OriginWeave instead establishes seven product contracts:
+Existing browser automation commonly exposes raw selectors, unrestricted script evaluation, ambient cookies, implicit resolver authority, host-dependent TLS assumptions, and screenshots with weak provenance. OriginWeave instead establishes eight product contracts:
 
 1. **Compatibility** — preserve Chromium web and Manifest V3 extension compatibility rather than rewriting Blink or V8.
 2. **Governance** — evaluate typed actions against session mode, purpose, capability, browser-equivalent origin, robots policy, secret-delivery evidence, and approval bound to the complete action intent.
 3. **Destination safety** — classify resolved addresses, bind a non-empty and bounded approved address set to each origin, preserve `localhost` and literal-IP host semantics, reject DNS-rebinding through set expansion, and reauthorize every redirect target.
 4. **Transport proof** — consume a single-use direct connection plan, submit one exact canonical socket address to the operating system, and verify the observed TCP peer before exposing the stream.
 5. **TLS service identity** — authenticate the canonical HTTPS DNS or IP identity over that same verified stream with explicit trust roots, fixed verification time, bounded protocol policy, and credential-free evidence.
-6. **Resource control** — protect interactive rendering before agent inference and background collection with cumulative RAM, VRAM, admission, model-offload, batch, and frame-pressure mitigations.
-7. **Evidence** — retain bounded, universally value-redacted network metadata and verifiable provenance for extracted values and state-changing actions.
+6. **Sensitive-data authority** — authorize disclosure from exact tenant, task, field, purpose, canonical destination, and classification scope; authorize opaque-handle admission only within its exact scope, expiry, and use-count bounds; never make network or session membership equivalent to raw-value access.
+7. **Resource control** — protect interactive rendering before agent inference and background collection with cumulative RAM, VRAM, admission, model-offload, batch, and frame-pressure mitigations.
+8. **Evidence** — retain bounded, universally value-redacted network metadata and verifiable provenance for extracted values and state-changing actions.
 
 ## Architecture
 
@@ -25,21 +26,23 @@ User experience and enterprise administration
                     |
 Chromium compatibility kernel: Blink, V8, Skia, Viz, Dawn, MV3
                     |
-Rust control plane: policy, destination, network, TLS, observation, action, resource, evidence
+Rust control plane: policy, destination, network, TLS, sensitive data, observation, action, resource, evidence
                     |
 Adapters: HTTP, proxy/PAC, WebDriver BiDi, CDP, WebMCP, MCP, WARC, PROV-O
 ```
 
 The repository is organized as independently consumable Rust crates:
 
 - `originweave-core`: normalized origins, immutable action-intent digests, session modes, typed actions, capabilities, approvals, and policy contexts.
-- `originweave-policy`: deterministic fail-closed action evaluation.
+- `originweave-policy`: deterministic fail-closed action evaluation plus the first purpose-bound sensitive-data disclosure and opaque-handle authority kernel.
 - `originweave-destination`: address classification, explicit destination policy, origin-bound DNS snapshots, connection pinning, rebinding detection, and redirect reauthorization.
 - `originweave-network`: direct-only, single-use TCP connection plans that bind an approved canonical address to the exact operating-system peer and emit credential-free evidence.
 - `originweave-tls`: single-use WebPKI handshakes over an existing verified TCP stream, with RFC 9525 DNS/IP identity, explicit roots and time, TLS 1.2/1.3, bounded ALPN and certificate evidence, and no reconnect or verifier bypass.
 - `originweave-resource`: task-level RAM, VRAM, thread, and frame-time budgets with cumulative mitigation plans.
 - `originweave-evidence`: universally value-redacted network evidence and source-bound provenance records.
 
+The full enterprise sensitive-data gap still requires a separately versioned reusable authority/service crate, broker, storage, evidence, lifecycle, and adapter contracts. The current policy kernel is the fail-closed foundation, not a claim that those later components are implemented.
+
 See [ARCHITECTURE.md](ARCHITECTURE.md) and the [architecture decision records](docs/adr/) for binding design decisions.
 
 ## Safety model
@@ -54,6 +57,10 @@ Protected secret: cookies, passwords, API keys, session tokens, personal data
 
 Web content can provide evidence but cannot grant a capability, approve an action, change policy, or request secret disclosure. Public crawler work is read-only and requires an explicit robots-policy result. R3 and R4 actions require approval bound to the exact action kind, target origin, and immutable lowercase SHA-256 digest of the complete canonical action intent; R5 legal consent is non-delegable.
 
+Sensitive-data authority is separate from ordinary session and network authority. The first policy kernel carries no protected value bytes. It permits a configured disclosure decision only when tenant, task, field, purpose, canonical destination, and data classification match exactly; any mismatch denies access. Approval-required outcomes are not execution permission: the required approval evidence must be collected and the exact same sensitive-data scope re-evaluated before a broker, browser fill, export, or model-disclosure path can continue.
+
+Opaque handle admission is separately bound to tenant, task, field, purpose, canonical destination, exclusive expiry, and maximum use count. The pure policy function only evaluates a supplied trusted-time and broker-state snapshot; it does not consume a use or resolve the handle. A future trusted broker must own caller-unforgeable handle state and trusted time, atomically compare the scope/expiry/count and reserve or increment a use before resolving any protected value, reject replay or concurrent overuse, and recheck revocation and the reserved scope immediately before release. A downstream action failure does not implicitly refund an already reserved use unless an explicit auditable compensation contract permits it.
+
 The origin type rejects shortened, integer, hexadecimal, and legacy octal-looking IPv4 spellings that a browser could reinterpret differently from a DNS validator. This protects logical origin identity. The destination kernel separately canonicalizes IPv4-mapped IPv6, classifies IPv4 and IPv6 special-purpose ranges and reviewed cloud platform endpoints, permits only public destinations by default, accepts at most 256 resolver addresses per snapshot, pins approved DNS address sets, rejects set expansion, and re-evaluates origin, resolution, downgrade, cycle, and hop authority for each redirect. The special `localhost` name may resolve only to loopback, and a literal IPv4 or IPv6 origin may approve only its exact canonical address.
 
 The direct network kernel then accepts one explicit canonical `SocketAddr`, rejects port zero and unbounded timeout or retry requests, consumes a non-cloneable plan, calls the standard-library single-address timeout API, and checks the stream's reported peer. It releases the stream only when the requested and observed IP and port match exactly. This proves the exact operating-system peer without resolving a hostname again or inheriting proxy configuration.
@@ -97,7 +104,7 @@ isolated Chromium session
 → redacted provenance bundle
 ```
 
-Subsequent work connects the live Chromium network service, adds explicit proxy and download policy, WARC/PROV persistence, MCP and Browser Agent Protocol adapters, extension compatibility testing, GPU/RAM telemetry, prompt-injection benchmarks, and an accessible approval interface. See [docs/product-roadmap.md](docs/product-roadmap.md).
+Subsequent work connects the live Chromium network service, adds explicit proxy and download policy, purpose-bound sensitive-data broker/service contracts, WARC/PROV persistence, MCP and Browser Agent Protocol adapters, extension compatibility testing, GPU/RAM telemetry, prompt-injection benchmarks, and an accessible approval interface. See [docs/product-roadmap.md](docs/product-roadmap.md).
 
 ## Hourly product-development loop
 
@@ -109,4 +116,4 @@ Read [AGENTS.md](AGENTS.md), [CONTRIBUTING.md](CONTRIBUTING.md), and [SECURITY.m
 
 ## License
 
-Apache License 2.0. See [LICENSE](LICENSE).
+Apache License 2.0. See [LICENSE](LICENSE).

crates/originweave-policy/src/lib.rs

@@ -7,6 +7,14 @@
 #![forbid(unsafe_code)]
 #![deny(missing_docs)]
 
+mod sensitive_data;
+
+pub use sensitive_data::{
+    DataClassification, DisclosureDecision, DisclosureScope, HandleUseDecision, HandleUseRequest,
+    SensitiveDataAuthority, SensitiveDataRequest, SensitiveValueHandleScope, evaluate_disclosure,
+    evaluate_handle_use,
+};
+
 use originweave_core::{
     ActionRequest, ApprovalEvidence, ApprovalScope, Capability, ExecutionPurpose,
     InstructionSource, PolicyContext, RiskClass, RobotsDecision, SecretDelivery, SessionMode,