R003A — Host-session to governed-object binding — exact session/controller/claim/run attribution, generation fencing, correlation, isolation and retirement

[theislampill]

R003A — Host-session to governed-object binding

CANONICAL_RXX_ID=R003A
WORK_ORDER_STATE=OPEN_NOT_STARTED
RELEASE_LINE_PROPOSED=v0.4.1.0_OWNER_GATED

SEMANTIC_CENTRE=HOST_SESSION_TO_GOVERNED_OBJECT_BINDING
REPAIR_CLASS=NEW_FIRST_CLASS_RUNTIME_IDENTITY_AND_CUSTODY_OWNER
GENEALOGY_DELTA=0
NEW_RXX=YES

IMPLEMENTATION_AUTHORISED_BY_THIS_ISSUE=NO
GITHUB_MUTATION_AUTHORISED_BY_THIS_ISSUE=NO
PUBLICATION_PROVES_IMPLEMENTATION=NO

Invariant

A host lifecycle event may actuate, invalidate, correlate or record state for
an IMPLEMENTAUDIT object only after the exact host session is mechanically
bound to one current controller, claim and governed run/object.

The binding preserves cross-session and cross-worktree isolation, rejects
stale, superseded, foreign or ambiguous identity, supports deterministic event
correlation and read-only consumption, and never infers identity from cwd,
newest-run selection, target prose, child output or subagent output.

R003A creates no lifecycle transition, currentness predicate, child route,
closure predicate, mutation permission, READY/JOIN decision or runtime Cupola
agent.

Current gap and consumers

The current machine custody chain begins at the controller:

controller ref
→ claim ID
→ explicit run root
→ .controller + .claimed custody
→ continuity generation and receipt

Current source lacks:

host + session ID
→ controller + claim + exact governed object

The same upstream identity is required by:

• R0037 governed Stop;
• R0011 Codex compact re-entry actuation;
• R0033 post-boundary route obligations and route transactions;
• R0038 host-native sensor attribution;
• R0036 SubagentStart/SubagentStop provenance;
• any admitted R0035 narrow PreToolUse interlock.

Each consumer retains its own predicate and authority.

Binding key and value

binding_key:
  host_id
  host_session_id

binding_value:
  schema
  host_id
  host_session_id

  controller_id
  claim_id
  explicit_run_root

  repository_identity
  git_common_directory_identity
  worktree_identity

  binding_generation
  activation_event_id
  activation_receipt

  applicable_continuity_generation
  applicable_continuity_receipt

  status
  predecessor_generation
  supersession_or_tombstone_reason

status is:

ACTIVE
SUPERSEDED
TOMBSTONED

Custody is plugin-owned or equivalently host-owned outside target-repository
authority.

Writer, reader and lifecycle

BINDING_WRITER=
  governed activation/rebinding path only

BINDING_READERS=
  admitted event-specific adapters
  controller/currentness validators
  R0033 route-obligation and route-transaction validators
  R0038 deterministic collector

STOP_OR_SENSOR_LOOKUP=
  read-only

REBINDING=
  expected-current compare-and-swap

INVALIDATION=
  controller/claim supersession
  explicit governed-object transfer
  incompatible currentness generation
  explicit owner-authorised unbind

SESSION_END=
  may tombstone session attribution
  cannot close the governed audit object

GARBAGE_COLLECTION=
  owner-bound
  idempotent
  retention-aware
  never newest-run-wins
  never deletes unresolved run/evidence state

Route-obligation correlation

R003A does not own route semantics or satisfaction.

An R0033 route-decision, route-obligation or route transaction must bind:

host_id
host_session_id
binding_generation
controller_id
claim_id
run_root_identity
continuity_generation
obligation_id
route_transaction_id

A route transaction from an old, foreign, superseded or ambiguous binding
generation cannot satisfy or consume the current obligation.

R003A may correlate host event, turn, tool-use or agent identifiers to the
current binding. It cannot infer that a child loaded, returned or was sufficient.

Trigger and cheap path

TRIGGER=
  governed activation associates a host session with one exact current object

  OR

  an admitted host event requires exact governed-object attribution

NON_TRIGGER=
  no governed activation was attempted
  and no binding exists

No binding means immediate return:

no repository scan
no run-directory enumeration
no singleton guess
no validator execution
no state mutation

A failed governed activation is not an ordinary session. It records binding and
host-enforcement unavailability.

Security

Reject:

• cwd or newest-run identity;
• controller-singleton inference as session identity;
• target-authored binding policy or commands;
• target prose, transcript or child/subagent output as identity;
• mutable target-local counters as generation;
• symlink/reparse or cross-worktree aliases;
• same session ID under an incompatible host identity;
• delayed, duplicate or reordered stale-generation events;
• partial, untrusted or mixed-version plugin-owned state.

Expose only minimum necessary identity to consumers.

Acceptance

1. one session binds to one exact current controller/claim/run;
2. two sessions in one repository remain isolated;
3. two worktrees sharing one Git common directory remain isolated;
4. explicit rebinding advances one generation by expected-old CAS;
5. stale prior-generation event is rejected;
6. foreign controller, claim, repository or worktree is rejected;
7. cwd, newest-run, singleton, target prose and child/subagent output cannot
   establish identity;
8. duplicate/reordered event identity is deterministic;
9. ambiguous activation remains unavailable;
10. untrusted/disabled/malformed state creates no enforcement claim;
11. SessionEnd tombstoning cannot close an object;
12. GC cannot delete unresolved state;
13. route obligations and transactions reject stale binding generations;
14. ordinary unbound session takes the zero-scan cheap path;
15. source, package, install and each host activation remain separate proof
    layers.

Package, rollback and retirement

Implementation, if separately authorised:

thin host adapter
→ one R003A attribution core
→ existing event-specific owner

The standalone .skill cannot claim native event attribution without separate
host proof.

Rollback removes adapters and R003A records while preserving controller,
run-root, continuity and evidence state.

Retire or recombine when supported hosts expose an equivalent trusted
governed-object handle, no admitted consumer remains, or measured cost exceeds
the protected consequence.

Non-goals

No generic hook broker; no global lifecycle state machine; no second currentness
system; no runtime Cupola agent; no second Auto-DAG; no child route; no automatic
audit-object creation on SessionStart; no universal host claim.