brokerd: inherit parent taint for a new subagent

Co-Authored-By: ornith-1.5-35b-a3b <agent@wntrmute.dev>

crates/brokerd/tests/state_subagent.rs

@@ -0,0 +1,71 @@
+//! A `sub-*` session copies its parent's taint. Do not edit.
+
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use brokerd::policy::{Label, SessionState};
+use brokerd::state::StateStore;
+use bxcore::{DataClass, SessionId};
+use tmp::TempDir;
+
+fn id(text: &str) -> SessionId {
+    SessionId::new(text).unwrap()
+}
+
+fn store(home: &TempDir) -> StateStore {
+    StateStore::new(&home.path().join("broker/sessions"))
+}
+
+#[test]
+fn a_new_subagent_copies_the_parents_untrusted_flag() {
+    let home = TempDir::new("state-sub");
+    let store = store(&home);
+    let parent = id("mm-thread");
+    store
+        .raise(
+            &parent,
+            SessionState::default(),
+            Label {
+                class: DataClass::Private,
+                untrusted: true,
+            },
+        )
+        .unwrap();
+    let child = store.read(&id("sub-mm-thread-3")).unwrap();
+    assert_eq!(
+        child,
+        SessionState {
+            taint: DataClass::Private,
+            untrusted: true,
+        }
+    );
+    let path = home.path().join("broker/sessions/sub-mm-thread-3.json");
+    assert!(path.exists());
+}
+
+#[test]
+fn a_nested_subagent_copies_through_a_missing_middle_child() {
+    let home = TempDir::new("state-sub-nest");
+    let store = store(&home);
+    store
+        .raise(
+            &id("mm-thread"),
+            SessionState::default(),
+            Label {
+                class: DataClass::Secret,
+                untrusted: true,
+            },
+        )
+        .unwrap();
+    let leaf = store.read(&id("sub-sub-mm-thread-1-2")).unwrap();
+    assert_eq!(leaf.taint, DataClass::Secret);
+    assert!(leaf.untrusted);
+}
+
+#[test]
+fn a_plain_session_still_creates_nothing_on_read() {
+    let home = TempDir::new("state-plain");
+    let store = store(&home);
+    let _ = store.read(&id("chat-1")).unwrap();
+    assert!(!home.path().join("broker").exists());
+}