Files Changed: harden external assessment isolation and egress privacy

[jeonghun-jj-lee]

Files Changed: harden external assessment isolation and egress privacy

Important

Problem - A basic external assessment can still misattribute a same-path write, inherit ownership through a fork, lose or retain host-local artifacts incorrectly, or leak generated external content through persistence and sharing paths.

Approach - Make expected-digest assessment conservative, keep external ownership strictly session-local across fork, restart, and deletion, and make the assessed detail response the sole carrier of generated external patches.

Scope - in: contention, baseline lifecycle persistence and cleanup, generated-artifact redaction, and legacy compatibility. out: new mutation sources, arbitrary shell attribution, client presentation redesign, and global writer locking.

Assumptions - Earlier children provide durable baselines, mutation reservations, and changed/unchanged/unavailable detail assessment.

Acceptance Criteria

• When sessions commit different bytes to one external reference, an owner whose expected digest no longer matches current bytes receives unavailable with no patch.
• A later session whose expected digest matches current bytes may receive its own changed assessment.
• Restoring a baseline reports unchanged rather than fabricated contention.
• A fork has no owned external references or baseline artifacts, even if copied transcript data mentions historic opaque references.
• A same-host restart rehydrates committed ownership and preserves truthful assessment.
• Removing a session deletes records and artifacts; orphan cleanup is idempotent and never removes live artifacts.
• A sentinel in a baseline or generated patch is absent from result and permission metadata, events, summaries, exports, share payloads, and the legacy diff response.
• The sentinel appears only in the authenticated no-store assessed detail response when a changed patch is requested.
• Legacy session diffs remain a wire-compatible array of in-worktree changed rows.

Testing Decisions

• Extend the session-scoped diff harness for the two-session expected-digest matrix and legacy exclusion.
• Extend session lifecycle tests for fork isolation and recursive removal.
• Extend the reload harness for same-host baseline rehydration.
• Extend sharing payload interception and tool metadata tests with a generated-artifact sentinel.
• Extend HTTP and SDK contract tests for no-store detail responses and unchanged legacy array behavior.

Key Decisions

• Current bytes are attributed only when they match the session's expected digest or are provably unchanged from its baseline.
• Identical-byte restoration is not detectable history and is reported by final byte state.
• Generated external patches are transient; ordinary tool arguments retain their existing session policy.
• Cleanup failures are repaired by an orphan sweep, never by serializing host-local artifacts into session data.

Constraints & Invariants

• Do not copy external ownership into a session fork.
• Do not widen or version-break the legacy diff array.
• Do not infer authorship for undeclared writers.
• Do not add UI behavior or new mutation sources in this slice.

Prior Art

• Parent Files Changed: full session-lineage mutation ledger #972
• fix(app): trust server session diff for Files Changed panel #720, Slice 1: Contamination fix — derive agent-file filter from tool filediff only #742, Slice 2: External-change reactivity — watcher ungating + client event handler #743, and Files Changed: per-session file watcher for reliable external-change refresh #845
• Existing session lifecycle, sharing, and scoped-diff coverage

Source

Part of #972. Blocked by #974.

Notes

This child starts as hitl because the parent review is degraded. Its own deliberate review must pass before implementation begins.

[jeonghun-jj-lee]

Deliberation addendum: mechanical checks are degraded because model critics were unavailable; independent adversarial review found no remaining blocker. The accepted local contract keeps every assessed detail response, including patch-bearing responses, out of persistent caches, telemetry, and logs; patches are render-memory-only. It also adds manifest lease and tombstone generation fencing so deletion wins over stale or in-flight artifact creation. This issue remains hitl pending implementation review.

[jeonghun-jj-lee]

Merged into the #972 integration branch after TDD verification; continuing with dependent slice #976.