brokerd: inherit parent taint for a new subagent

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/brokerd/src/state.rs

@@ -72,7 +72,9 @@ impl StateStore {
         let path = self.path(session);
         let text = match fs::read_to_string(&path) {
             Ok(text) => text,
-            Err(err) if err.kind() == io::ErrorKind::NotFound => return Ok(SessionState::default()),
+            Err(err) if err.kind() == io::ErrorKind::NotFound => {
+                return inherit_or_default(self, session);
+            }
             Err(err) => return Err(StateError::Unreadable(path, err.to_string())),
         };
         let file = match serde_json::from_str::<StateFile>(&text) {
@@ -140,6 +142,31 @@ impl StateStore {
     }
 }
 
+/// A missing `sub-<parent>-<n>` file copies the parent's taint and untrusted flag (M6 spec 3.4).
+fn inherit_or_default(store: &StateStore, session: &SessionId) -> Result<SessionState, StateError> {
+    let Some(parent) = parent_of_sub(session) else {
+        return Ok(SessionState::default());
+    };
+    let inherited = store.read(&parent)?;
+    store.raise(
+        session,
+        SessionState::default(),
+        Label {
+            class: inherited.taint,
+            untrusted: inherited.untrusted,
+        },
+    )
+}
+
+fn parent_of_sub(session: &SessionId) -> Option<SessionId> {
+    let rest = session.as_str().strip_prefix("sub-")?;
+    let (parent, n) = rest.rsplit_once('-')?;
+    if n.is_empty() || !n.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    SessionId::new(parent).ok()
+}
+
 /// One line on disk: the taint and the untrusted flag.
 #[derive(Serialize, Deserialize)]
 #[serde(deny_unknown_fields)]

crates/brokerd/tests/state_subagent.rs

@@ -0,0 +1,71 @@
+//! A `sub-*` session copies its parent's taint. Do not edit.
+
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use brokerd::policy::{Label, SessionState};
+use brokerd::state::StateStore;
+use bxcore::{DataClass, SessionId};
+use tmp::TempDir;
+
+fn id(text: &str) -> SessionId {
+    SessionId::new(text).unwrap()
+}
+
+fn store(home: &TempDir) -> StateStore {
+    StateStore::new(&home.path().join("broker/sessions"))
+}
+
+#[test]
+fn a_new_subagent_copies_the_parents_untrusted_flag() {
+    let home = TempDir::new("state-sub");
+    let store = store(&home);
+    let parent = id("mm-thread");
+    store
+        .raise(
+            &parent,
+            SessionState::default(),
+            Label {
+                class: DataClass::Private,
+                untrusted: true,
+            },
+        )
+        .unwrap();
+    let child = store.read(&id("sub-mm-thread-3")).unwrap();
+    assert_eq!(
+        child,
+        SessionState {
+            taint: DataClass::Private,
+            untrusted: true,
+        }
+    );
+    let path = home.path().join("broker/sessions/sub-mm-thread-3.json");
+    assert!(path.exists());
+}
+
+#[test]
+fn a_nested_subagent_copies_through_a_missing_middle_child() {
+    let home = TempDir::new("state-sub-nest");
+    let store = store(&home);
+    store
+        .raise(
+            &id("mm-thread"),
+            SessionState::default(),
+            Label {
+                class: DataClass::Secret,
+                untrusted: true,
+            },
+        )
+        .unwrap();
+    let leaf = store.read(&id("sub-sub-mm-thread-1-2")).unwrap();
+    assert_eq!(leaf.taint, DataClass::Secret);
+    assert!(leaf.untrusted);
+}
+
+#[test]
+fn a_plain_session_still_creates_nothing_on_read() {
+    let home = TempDir::new("state-plain");
+    let store = store(&home);
+    let _ = store.read(&id("chat-1")).unwrap();
+    assert!(!home.path().join("broker").exists());
+}