bug(memory): an explicit SourceScope argument is widened back to the ambient scope

[senamakel]

On current main, memory::guard::families::tests::guard_explicit_scope_argument_wins_over_the_ambient_one fails deterministically, in isolation (not an ordering or parallelism artifact):

assertion `left == right` failed: a caller that computed a narrower scope must not be widened back
  left: Some("")
 right: Some("gmail:me")
   at src/openhuman/memory/guard/families_tests.rs:179

Repro:

cargo test --lib memory::guard::families::tests::guard_explicit_scope_argument_wins_over_the_ambient_one

The test passes an explicit SourceScope::new(["gmail:me"]) to query_source while an ambient scope of slack:#eng is installed via with_source_scope. The explicit argument is supposed to win; what reaches the driver is Some("") — neither the explicit scope nor the ambient one, which suggests the explicit Option<&SourceScope> is being dropped somewhere and an empty scope substituted, rather than the ambient one simply overriding it.

This matters beyond the test: the assertion message is a security-shaped invariant — a caller that deliberately narrowed a scope must not have it widened underneath them.

Surfaced while repairing the #5459 / #5446 collision. Deliberately not fixed in that PR (it is a behavioural question for the memory-subsystem author, not a mechanical path rename), and the file is untouched there.

[M3gA-Mind]

Thanks for catching this — a deterministically failing test is exactly the kind of report worth filing.

The failure is resolved as of #5469, though it is worth being explicit about how: the semantics were settled as intersection with fail-closed, not as "the explicit argument wins". The test is now guard_explicit_scope_is_intersected_with_the_ambient_one (src/openhuman/memory/guard/families_tests.rs:167) and asserts that a request outside the ambient allowlist returns nothing. So the widening you reported no longer happens.

If you specifically needed a caller-computed narrower scope to be honoured rather than intersected away, that is a live design question rather than a fixed one — please reopen or file separately and it can be picked up.