feat(context): enforce monotonic instruction provenance ceilings

[ruvnet]

Implements the production candidate tracked in #57 and ADR 159.

What changes

Adds an additive InstructionProvenance primitive to rvm-context so model-facing context reconstruction can preserve or reduce instruction authority but cannot silently increase it.

The portable authority order is Data < Agent < User < Developer < System. Ordinary transformations can only keep or lower the current ceiling. Re-upgrading requires a new root classification at an external trusted host boundary.

The primitive records source category, original level, current ceiling, exact content digest, deterministic transformation lineage, and bounded depth. Original is reserved for root classification and cannot be synthesized through the transform API.

Hashes are explicitly evidence identity only. They do not sign content and do not grant execution authority. Privileged side effects still require an independently valid RVM capability.

Tests added

Unit tests cover:

1. tool output cannot become a user instruction
2. retrieved content cannot become developer policy
3. peer-agent messages do not inherit user authority
4. authenticated user forwarding preserves legal authority
5. explicit downgrade cannot be reversed by ordinary transformation
6. scheduled content without provenance defaults to Data
7. synthetic root transformations fail closed
8. content mutation is detected
9. lineage changes with transformation or content
10. root digest determinism
11. transformation depth exhaustion fails closed

Evidence status

Motivating source: When Context Gets Root: Privilege Escalation in LLM Harnesses, arXiv:2608.27299, submitted 2026-08-27.

Evidence class: originating-team measured report. The published attack results have not yet been independently reproduced in RuV. This PR therefore makes no performance or security efficacy claim beyond the deterministic unit-level invariant.

Integration plan

After independent reproduction, enforce the same envelope in MetaHarness, Ruflo and Autogenous delegation, MCP tool outputs, Core Memory persisted state, and the RVM Context WASM provider adapter.

Promotion gate

Keep this PR draft until:

• hosted CI and security checks are green
• MetaHarness reproduces the baseline attacks and verifies zero authority increases through the candidate adapter
• benign task completion remains within 3 absolute percentage points of baseline
• context construction overhead remains below 1% of model invocation latency
• root classification is bound to authenticated host principals

No autonomous merge or deployment.

[ruvnet]

Validation update for head 9600adb599648fd7a13b2d35b9975489ee08d41a:

• hosted CI run 33170379541 completed successfully
• Rust 1.77.2 minimum supported version checks passed, including aarch64-unknown-none for rvm-context
• workspace formatting, locked dependency check, full workspace tests, and clippy with -D warnings passed
• rvm-context-service all-features tests and clippy passed
• rvm-launch all-features tests passed
• rvm-hal, rvm-context, and rvm-kernel bare-metal target checks passed
• WASM clippy, wasm-pack test --node, npm build, and smoke test passed
• RustSec audit passed

The first CI attempt correctly caught formatting plus missing # Errors documentation. Those failures were fixed rather than bypassed.

This validates build, unit/integration, lint, MSRV, WASM, bare-metal, and dependency-audit compatibility. It does not validate the motivating paper's attack-success claims or prove end-to-end security efficacy. The PR should remain draft until MetaHarness issue 244 independently reproduces the baseline attack paths and tests the provider-bound enforcement path, including trusted root classification.