Files
d6b0253c59 feat(facts): owner-trusted local fact reads via facts.trust_local_reads (takeover of #2427)
Salvages the owner-trusted-reads half of #2427 with the trust regression
repaired. (The other half of #2427 — dating conversation facts at claim
time — already landed on master via #2958 and is dropped here.)

Fact rows are private|world; remote callers are world-only. The stdio MCP
server is a local unauthenticated pipe on a single-owner machine, yet it
defaults remote:true — so the owner's own agent got empty find_trajectory
and world-only recall over MCP. This adds `trustedFactReads`, a narrow
READ-ONLY trust elevation decoupled from `remote` (file confinement,
source isolation, fence stripping, takes scoping all stay in force),
opted in via the new `facts.trust_local_reads` config (default off).
Only the stdio server sets it; HTTP dispatch never does.

Repair vs #2427 as submitted: its `factsWorldOnly` was fail-OPEN
(`remote === true && …`) — an unset `remote` read private rows — and it
replaced two fail-closed sites (recall's visibility filter and the facts
meta-hook), with a test codifying the regression. Now fail-closed
(`remote !== false && trustedFactReads !== true`) per the CLAUDE.md trust
invariant; the truth-table test pins it. The two engine findTrajectory
sites keep their direct-engine default-local contract by normalizing to
explicit booleans before the helper (both engines in lockstep).

Tests: test/facts-reader-trust.test.ts (fail-closed truth table);
test/engine-find-trajectory.test.ts new case (remote=true +
trustedFactReads returns private points; plain remote=true stays
world-only).

Takeover of #2427.

Co-authored-by: jeanpierre121 <jeanpierre121@users.noreply.github.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-21 14:34:48 -07:00
..