[drk-ram]

What changed

steps/subagentStart now accepts only spawns a Guardian can check, and the specification states the rules a second Guardian would implement from.

• subagent_intent is required on every spawn, with parsed and parser_provenance.
• derived_from_parent requires a new parent_intent_id and a parser_provenance.derived_from that cites something. The rule now compares provenance_id with provenance_id: parent_intent_id is the provenance_id of the parent's Intent, where the old text asked derived_from to hold the parent's step_id, a different identifier space. parent_step_id stays for the audit trail.
• fresh requires parser_provenance.origin to be user_input, which is the evidence the old prose said the payload had no member for.
• Capability ceiling, stated as a Guardian MUST: subagent_intent.parsed equals the parent's for inherit_full, is a subset for inherit_subset, and is a subset for derived_from_parent unless Guardian policy admits more. The Guardian compares against the Intent.parsed it holds for parent_session_id, never one the payload supplies.
• subagent_session_id MUST differ from parent_session_id, from the envelope's metadata.session_id, and from any session the Guardian tracks. JSON Schema cannot compare two members, so this is a Guardian MUST in the schema text and in hooks.md, and the test pins the wording.
• The child's SessionContext starts from the parent's provenance and IFC labels (MUST for inherit_full, inherit_subset and derived_from_parent, SHOULD for fresh). An optional parent_provenance_summary (provenance-summary.json) carries the summary, as a floor the Guardian never seeds below.

Files: specification/v0.1.0/hooks/subagent-start.json, docs/spec/instrument/hooks.md, docs/concepts/session-lifecycle.md, tests/test_subagent_start_schema.py.

Which issue does this implement

Closes #474

• This is an editorial correction (typo, grammar, link, formatting) with no change in
  meaning, so it needs no issue

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI
• main, because every changed path is on the documentation lane allowlist in
  CONTRIBUTING.md

Type of change

• Specification change (schema, hooks, events, AgBOM)
• Reference implementation or adapter
• Documentation
• Tooling or CI
• Governance (licensing, security policy, contributor docs)

Specification changes

• I opened a Discussion before this PR (the design is the one [Bug] subagentStart accepts a spawn with no intent, a derivation that cites no parent, and a child session id equal to the parent's, and only inherit_subset has a capability ceiling #474 proposes; the issue carries the discussion)
• Schema changes validate against the JSON Schema spec
• I described the impact on downstream implementers below

Breaking for implementers? Yes, for a sender of steps/subagentStart. A spawn with no subagent_intent, with an intent lacking parsed or parser_provenance, a derived_from_parent with no parent_intent_id or an empty derived_from, or a fresh intent whose origin is not user_input no longer validates. An inherit_full sender now restates the parent's parsed. The reference Guardian does not evaluate steps/subagentStart (METHODS_EVALUATED is the two tool-call methods), so nothing in the reference implementation changes.

I tested this

• I synced my branch with the base branch before opening this (branch is on bba1b84, the current integration head)
• uv run pytest -v passes on my machine (run as python -m pytest, see below)
• uv run mkdocs build --strict passes on my machine (run as python -m mkdocs build --strict)

Results, Windows x64, Python 3.11:

• python -m pytest -k subagent: 26 passed. Against the unchanged schema from origin/integration, the same file is 16 failed, 10 passed, so the tests fail before the fix and pass after it.
• python -m pytest --ignore=tests/test_closing_choice.py: 1160 passed, 11 failed. The same 11 fail on origin/integration without this change (Windows path, symlink and CRLF-patch cases in test_fetch_roadmap, test_overrides, test_pr_intake_workflow, test_publish_schemas, test_site_config). test_closing_choice.py aborts on Windows with an environment-variable length error before and after.
• python -m mkdocs build --strict: built, no warnings or errors from the project.

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

• This change has no security impact

This closes a delegation-boundary gap (ASI03): a spawn could widen a child's capabilities, alias the parent's session, or launder the parent's untrusted context. It does not describe an unreported vulnerability beyond what #474 states.

[github-actions]

Thanks for this. It is queued rather than ignored. A lead has not reviewed this pull request yet. A lead will read it when they have time, and we can't promise a date. Nothing here is rejected. If a check below fails, please fix it. A pull request that waits a long time may be closed, and you can reopen it later.