brokerd: the ledger raises a session's state by the stricter label

M5a task 21. The work is Ornith's, from the stopped run; the design
model checked it against the task file and committed it after finding
that the gate's failure came from its own reference worktree's stale
test binaries in the shared target/ (fixed with cargo clean; 944 tests).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/brokerd/tests/ledger_label.rs

@@ -0,0 +1,123 @@
+//! The ledger raises a session's state by the stricter of the grant's label and the result's own
+//! (M5a spec, section 8). `memoryd` can make a `recall` result untrusted; if the session did not
+//! follow, a clean session could recall a tainted note and then write it into `memory.md`. Do not
+//! edit.
+
+#[path = "support/build.rs"]
+mod build;
+#[path = "support/rig.rs"]
+mod rig;
+#[path = "support/sink.rs"]
+mod sink;
+#[path = "support/tmp.rs"]
+mod tmp;
+
+use brokerd::ledger::Call;
+use brokerd::policy::{Label, SessionState};
+use build::now;
+use proto::{AuditEvent, CallId, DataClass, SessionId, ToolResponse};
+use rig::Rig;
+
+fn label(class: DataClass, untrusted: bool) -> Label {
+    Label { class, untrusted }
+}
+
+fn call(label: Label) -> Call {
+    Call {
+        session: SessionId::new("s1").unwrap(),
+        call: CallId(1),
+        decision: 0,
+        label,
+    }
+}
+
+fn result(label: Label) -> ToolResponse {
+    ToolResponse::Result {
+        content: "[1] memory-tainted · note".to_string(),
+        class: label.class,
+        untrusted: label.untrusted,
+        truncated: false,
+    }
+}
+
+fn state(rig: &Rig) -> SessionState {
+    rig.state().read(&SessionId::new("s1").unwrap()).unwrap()
+}
+
+/// The one result record's (class, untrusted, taint_after).
+fn recorded(rig: &Rig) -> (DataClass, bool, DataClass) {
+    match rig.events().as_slice() {
+        [
+            AuditEvent::Result {
+                class,
+                untrusted,
+                taint_after,
+                ..
+            },
+        ] => (*class, *untrusted, *taint_after),
+        other => panic!("{other:?}"),
+    }
+}
+
+#[test]
+fn a_recall_of_a_tainted_note_makes_a_clean_session_untrusted() {
+    let rig = Rig::new("label-recall");
+    let ledger = rig.ledger();
+    // `recall`'s built-in grant labels its results private and trusted; `memoryd` found a
+    // `memory-tainted` hit and said untrusted.
+    let found = label(DataClass::Private, true);
+    let answer = ledger.finish(
+        &call(label(DataClass::Private, false)),
+        result(found),
+        now(),
+    );
+    assert_eq!(answer, result(found), "passed on unchanged");
+    assert_eq!(
+        state(&rig),
+        SessionState {
+            taint: DataClass::Private,
+            untrusted: true
+        }
+    );
+    assert_eq!(
+        recorded(&rig),
+        (DataClass::Private, true, DataClass::Private)
+    );
+}
+
+#[test]
+fn a_result_of_a_higher_class_than_its_grant_raises_the_taint() {
+    let rig = Rig::new("label-class");
+    let ledger = rig.ledger();
+    let found = label(DataClass::Secret, false);
+    ledger.finish(&call(label(DataClass::Public, false)), result(found), now());
+    assert_eq!(
+        state(&rig),
+        SessionState {
+            taint: DataClass::Secret,
+            untrusted: false
+        }
+    );
+    assert_eq!(
+        recorded(&rig),
+        (DataClass::Secret, false, DataClass::Secret)
+    );
+}
+
+#[test]
+fn a_result_laxer_than_its_grant_still_raises_the_state_by_the_grant() {
+    let rig = Rig::new("label-laxer");
+    let ledger = rig.ledger();
+    ledger.finish(
+        &call(label(DataClass::Secret, true)),
+        result(label(DataClass::Public, false)),
+        now(),
+    );
+    assert_eq!(
+        state(&rig),
+        SessionState {
+            taint: DataClass::Secret,
+            untrusted: true
+        }
+    );
+}