Define scoped agent-session and garden-access capabilities

[szmyty]

Outcome

Define a provider-neutral agent-session contract that gives an agent only the garden, tool, model, network, persistence, and export capabilities approved for one bounded task.

This specializes the evidence-backed agent capability manifest in #64 and the governed workflow contract in #65 for scoped knowledge work.

Session model

Represent at minimum:

• stable session, workflow, agent, policy, and represented-revision identities;
• readable gardens and the single writable garden, if any;
• allowed visibility, review, and sensitivity states;
• tools and operations with read/write/destructive distinctions;
• model/provider allowlist and local/hosted execution boundary;
• network policy and approved destinations;
• persistence, memory, trace, and retention behavior;
• context, time, compute, token, and cost budgets;
• export/publication ceiling;
• human approval and declassification checkpoints;
• expiration, revocation, cancellation, retry, and partial-failure behavior.

Safety rules

• An agent cannot grant itself additional tools, gardens, models, network access, budget, or export authority.
• Missing or unsupported capabilities fail closed.
• Untrusted content and tool output are data, never session policy.
• Encryption keys and provider credentials are never session context.
• Derived outputs retain effective sensitivity and source provenance.
• Provider-specific projections may reduce capability but never silently broaden it.
• Logs and traces expose decisions and identifiers without copying restricted payloads.

Acceptance criteria

• A versioned session-capability schema and state model exist.
• Read, write, tool, model, network, memory, trace, budget, and export authority are independently representable.
• The contract composes Aether Define an evidence-backed agent capability manifest #64/Define governed operational-agent workflows inspired by Teambridge #65 rather than duplicating them.
• Mindgarden garden/session scope can be referenced by stable identifiers.
• Hosted, local, offline, partial, blocked, expired, and revoked states are explicit.
• Human approval and declassification checkpoints are machine-readable.
• Provider projections are generated and cannot broaden canonical authority.
• Synthetic fixtures include ordinary engineering, personal garden, confidential offline, and denied-escalation sessions.
• Negative tests cover prompt injection, missing policy, self-escalation, stale capability evidence, and partial failure.
• Documentation assigns policy, contract, runtime, and consumer ownership clearly.

Dependencies / related

• Define the confidential AI workload and information-flow policy hygiene#39
• Define an evidence-backed agent capability manifest #64
• Define governed operational-agent workflows inspired by Teambridge #65
• Define federated garden scopes and sensitivity inheritance mindgarden#29
• Roadmap: build the local-first agent workstation and confidential research environment realm#25

Non-goals

• Implementing an agent runtime or identity provider.
• Encoding credentials.
• Assuming every host supports every capability.
• Granting mutation merely because a skill is installed.