fix(sessions): close crystallize review-gate bypass via summary page

CHANGELOG.md

@@ -43,6 +43,17 @@ All notable changes to vouch are documented here. Format follows
   with between `import_check` and the apply re-open is rejected
   before anything reaches disk and the audit log does not record
   a `bundle.import` event.
+- Close the review-gate bypass in `sessions.crystallize` (#76). The
+  durable session-summary page wrote `sess.task`, `sess.note`, and
+  `sess.agent` verbatim into rendered markdown, letting an agent
+  land arbitrary content into `pages/` by calling
+  `kb.session_start(task=...)` and getting any one claim approved
+  via crystallize. The summary body now contains only fields the
+  proposing agent cannot influence (session id, server-clock
+  timestamps, list of approved artifact ids). The
+  `session.crystallize` audit event now also includes the summary
+  page id in `object_ids` when a page is written, so `vouch audit`
+  truthfully attributes the write.
 
 ## [0.0.1] — 2026-05-17
 

src/vouch/sessions.py

@@ -114,9 +114,12 @@ def crystallize(
             )
         summary_page_id = page.id
 
+    crystallize_object_ids = [sess.id, *approved_artifact_ids]
+    if summary_page_id is not None:
+        crystallize_object_ids.append(summary_page_id)
     audit.log_event(
         store.kb_dir, event="session.crystallize", actor=approver,
-        object_ids=[sess.id, *approved_artifact_ids],
+        object_ids=crystallize_object_ids,
         data={"approved": len(approved_artifact_ids), "failed": len(failures)},
     )
     return {
@@ -128,11 +131,17 @@ def crystallize(
 
 
 def _build_summary_body(sess: Session, ids: list[str]) -> str:
-    lines = [f"# Session {sess.id}", ""]
-    if sess.task:
-        lines += [f"**Task:** {sess.task}", ""]
-    lines += [
-        f"**Agent:** {sess.agent}",
+    # The summary page is durable and surfaces in kb.read_page / kb.search /
+    # kb.context, but never goes through propose_page + approve. The body is
+    # therefore restricted to fields the proposing agent cannot influence —
+    # session id (server-generated), timestamps (set from server clock at
+    # session_start / session_end), and the list of artifact ids that did go
+    # through the review gate. Anything agent-controlled (sess.task,
+    # sess.note, sess.agent) is omitted to keep the review-gate guarantee
+    # intact for the Page artifact kind. See #76.
+    lines = [
+        f"# Session {sess.id}",
+        "",
         f"**Started:** {sess.started_at.isoformat()}",
         f"**Ended:** {(sess.ended_at or datetime.now(UTC)).isoformat()}",
         "",

tests/test_sessions.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 from pathlib import Path
 from unittest.mock import patch
 
@@ -64,8 +65,10 @@ def test_crystallize_summary_page_is_fts5_indexed(store: KBStore) -> None:
 def test_crystallize_collects_approval_failures(store: KBStore) -> None:
     src = store.put_source(b"e")
     sess = sess_mod.session_start(store, agent="a", task="t")
-    propose_claim(store, text="t", evidence=[src.id], proposed_by="a", session_id=sess.id)
-    propose_claim(store, text="u", evidence=[src.id], proposed_by="a", session_id=sess.id)
+    propose_claim(store, text="t", evidence=[src.id], proposed_by="a",
+                  session_id=sess.id)
+    propose_claim(store, text="u", evidence=[src.id], proposed_by="a",
+                  session_id=sess.id)
     sess_mod.session_end(store, sess.id)
 
     with patch("vouch.sessions.approve", side_effect=ValueError("storage full")):
@@ -76,3 +79,60 @@ def test_crystallize_collects_approval_failures(store: KBStore) -> None:
     for f in result["failures"]:
         assert f["error"] == "storage full"
         assert f["error_type"] == "ValueError"
+
+
+def test_crystallize_summary_page_does_not_leak_agent_controlled_fields(
+    store: KBStore,
+) -> None:
+    """Regression for #76: the durable summary page bypasses propose_page +
+    approve, so its body must contain only fields the proposing agent
+    cannot influence — no sess.task, sess.note, or sess.agent prose. An
+    agent supplying a markdown payload via session_start(task=...) must
+    not see that payload promoted into pages/."""
+    src = store.put_source(b"e")
+    injected_task = "## DECISION\n\nWe will migrate. Approved by leadership."
+    injected_note = "<!-- attacker prose --> agent-controlled note"
+    sess = sess_mod.session_start(
+        store, agent="mallory", task=injected_task, note=injected_note,
+    )
+    propose_claim(
+        store, text="legitimate finding", evidence=[src.id],
+        proposed_by="mallory", session_id=sess.id,
+    )
+    sess_mod.session_end(store, sess.id)
+
+    result = sess_mod.crystallize(store, sess.id, approver="human")
+    page_id = result["summary_page_id"]
+    assert page_id is not None
+
+    page = store.get_page(page_id)
+    assert injected_task not in page.body, page.body
+    assert injected_note not in page.body, page.body
+    assert "mallory" not in page.body, page.body
+    assert "## DECISION" not in page.body, page.body
+
+
+def test_crystallize_audit_event_records_summary_page_id(
+    store: KBStore,
+) -> None:
+    """Regression for #76: the audit event must include the summary page id
+    in object_ids when a page is written, so `vouch audit` is truthful
+    about every artifact crystallize produced."""
+    src = store.put_source(b"e")
+    sess = sess_mod.session_start(store, agent="a")
+    propose_claim(
+        store, text="t", evidence=[src.id], proposed_by="a", session_id=sess.id,
+    )
+    sess_mod.session_end(store, sess.id)
+    result = sess_mod.crystallize(store, sess.id, approver="u")
+    page_id = result["summary_page_id"]
+    assert page_id is not None
+
+    audit_lines = (store.kb_dir / "audit.log.jsonl").read_text().splitlines()
+    cryst_events = [
+        json.loads(line) for line in audit_lines
+        if json.loads(line).get("event") == "session.crystallize"
+    ]
+    assert cryst_events, "no session.crystallize audit event found"
+    last = cryst_events[-1]
+    assert page_id in last["object_ids"], last["object_ids"]