fix(scope): tenant-isolation batch — suppressions, env scope ceiling, forget override, session pinning, entity-link edges (#106–#112)

[devinmlowe]

Scope-isolation bug hunt (phase 1) turned into seven fixes (phase 2). Every
finding was re-verified against current main before an issue was filed; the
bridge finding from the same audit was already open as #87 and is untouched
here.

Issues fixed

Issue	Fix	Commit
#106	memory_suppressions keyed on (content_hash, scope) (new checkpointed migration suppression_scope_v1); suppression lookups take the caller's scope, clearSuppression/restore delete only that scope's row, dream dropSuppressed passes the conversation's scope	a32fab7
#108	resolveCallScoping intersects a call's read_scopes with ENGRAM_READ_SCOPES and requires a call's scope to be readable — the env is a ceiling, not a default	b85f08a
#109	forget's scope: "global" override is ignored when the process env pins the server to a tenant	9a9fe2c
#110	A recall session stores the scopes it was created with and reuses them on every refine	77491fb
#111	linkMemoryToEntities stamps new related_to edges with the caller's scope and widens an existing edge seen from a second scope	00e560b
#107	scopeInClause coalesces a NULL scope column to 'global', matching scopeVisible	07ea87a
#112	ftsIndexedRowids enumerates memories_fts_docsize instead of an fts5vocab('instance') scan, so zero-token documents are audited	2a5af6b

Docs in 54f90f1 (CHANGELOG [Unreleased], CLAUDE.md).

Predicate log

npm run build && npm run test:run after every commit. No revert was needed.

issue	attempt	predicate	action
baseline	-	137 files / 1798 tests pass	-
108	1	1 failed (per-request-scoping asserted the escalation being removed)	amend
108	2	137 / 1801 pass	keep
109	1	137 / 1802 pass	keep
106	1	1 failed (update.test.ts hardcoded schema version 4 -> 5)	amend
106	2	137 / 1805 pass	keep
111	1	137 / 1806 pass	keep
110	1	137 / 1807 pass	keep
107+112	1	137 / 1808 pass	keep
docs	1	137 / 1808 pass	keep

Two pre-existing tests changed because they asserted the old behaviour, not
because the fix broke them:

• tests/interfaces/mcp/per-request-scoping.test.ts asserted that a call's
  read_scopes could widen past ENGRAM_SCOPE. That is exactly [mcp] resolveCallScoping lets client read_scopes / scope replace ENGRAM_READ_SCOPES / ENGRAM_SCOPE instead of intersecting — an env-pinned stdio child can read and write any tenant #108; it now
  asserts the refusal.
• tests/interfaces/cli/update.test.ts hardcoded version 4 -> 5; it now
  derives the number from SCHEMA_VERSION.

Each new test was checked to fail without its fix (#110 and #112
explicitly reverted and re-run).

Not fixed here

• [mcp] stdio start bridges to the daemon and silently drops ENGRAM_SCOPE / ENGRAM_READ_SCOPES / ENGRAM_DB_PATH from its own env — Hermes stdio profile isolation is bypassed #87 (stdio bridge drops ENGRAM_SCOPE / ENGRAM_READ_SCOPES /
  ENGRAM_DB_PATH when it proxies to the daemon) — already open, separate
  change, and the largest remaining hole: under the recommended deployment the
  env ceiling added in [mcp] resolveCallScoping lets client read_scopes / scope replace ENGRAM_READ_SCOPES / ENGRAM_SCOPE instead of intersecting — an env-pinned stdio child can read and write any tenant #108 is never seen by the daemon that executes the call.
• recall_drill scope re-check (part of [search] recall sessions do not pin read_scopes — a refine with different scopes merges other tenants' results into the session, and recall_drill re-checks nothing #110) — a drill still identifies a
  result by session id + index and re-checks nothing, because SearchResult
  metadata carries no scope today. Pinning the session closes the only path by
  which a foreign result can enter a session, so the remaining exposure needs a
  guessed session UUID. Noted in the commit message and left for a follow-up
  that adds scope to the result metadata.
• NOT NULL on the four scope columns ([db] scopeInClause does not COALESCE NULL scope to 'global' the way scopeVisible does — a NULL-scope row is visible to one reader and hidden from the other #107) — the COALESCE makes the two
  helpers agree; tightening the schema is a separate migration with no current
  producer of NULL to justify it.

Draft — not for merge until #87 is decided, since the two changes overlap in
what they promise about stdio isolation.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K88GYGYEE6wuuhewcsTbso

[devinmlowe]

Superseded by PRs #142, #143, #144, #145 — each issue (#106, #108, #109, #87) landed as its own fix on main for v0.5.0.