Function fork_context 

pub fn fork_context(
    parent_token: &str,
    parent_public_key: PublicKey,
    child_subject: String,
    time_config: TokenTimeConfig,
    keypair: &KeyPair,
) -> Result<String, Box<dyn Error>>

Fork a context token for a sub-agent, inheriting the parent’s exposure.

Creates a fresh context token for the child subject, pre-populated with all of the parent’s exposure labels. This prevents contamination laundering through delegation.

Arguments

• parent_token - The base64-encoded parent context token
• parent_public_key - The public key used to verify the parent token
• child_subject - The child subject identifier (e.g., “agent:openclaw:subtask-1”)
• time_config - Time configuration for the child context token
• keypair - The keypair to sign the child token with

Returns

Base64-encoded child context token with inherited exposure