security: isolate JWT fact-backed tenants (red-steel S3c)

[CueCrux-Myles]

Continues the red-steel replay (#630) per redsteel-remediation-replay-2026-08-07. Replays 426ea8a0 onto current main.

The measurement matters more than the diff

The plan estimated 9 conflicts for this slice. Replayed in branch order after #686 landed, the actual count is 2 — both in generated files (CHANGELOG.md, llms-full.txt), zero code conflicts. The remaining slices should be re-measured before scheduling rather than costed off the 2026-08-07 figures.

Three commits, deliberately separate

1. 426ea8a0 cherry-picked. JWT HTTP fact surfaces default to verified tenant stamping; the posture is frozen at startup, ambiguous authority fails closed, and paired reads/caches/receipts/overlays/candidates/replay/result-envelopes stay on one authorized tenant.

The CHANGELOG resolution kept only 426ea8a0's own entry. The three-way merge pulled in adjacent text belonging to c093c006 (S5, not landed), which would have published a claim that coordination and punchcard binding had shipped. llms-full.txt was regenerated with scripts/build-llms-full.sh, never hand-merged.

2. Migrating main's call sites. It applies cleanly but does not compile: main has grown call sites and tests against the weaker API this commit replaces. Each migration is noted at the site.

• escrow.rs — this route landed after the branch was written, so it never learned that tenant_hash_for_read_context is fail-closed; it now propagates the problem response like every other fact-backed route.
• replay.rs — store_answer_capsule takes an explicit tenant instead of hardcoding "default"; the five test call sites pass "default", the value it used to bake in, so their behaviour is unchanged.

Tests that asserted the old contract, migrated rather than deleted:

Was	Now pins
tenant_stamp_mode_from_env_reads_the_real_env	Under JWT an unset variable resolves to On, not Off, and an unrecognised value is an error rather than a silent fall to Off. A typo in a deployment used to disable tenant isolation and say nothing.
scope_context_write_and_read_tenant_follow_the_env_posture	The posture is frozen into Authz at startup — the old name described the behaviour this commit removes. A late set_var can no longer move an authenticated caller between tenants.
multi_tenant_token_needs_a_selector_when_stamping_is_on	A multi-tenant token naming no tenant is refused on the read side, in lockstep with the write side, instead of falling back to reading default.

3. Resolving one genuine disagreement. 426ea8a0 routes fact-backed reads through fact_visible_to_agent, which hides born-private reserved namespaces from a caller with no passport. Main's b36a72b1 guarantees the opposite for the addressed path: internal namespaces are out of undirected recall but stay reachable when named. Both are right; they met on one code path. On an auth-off daemon passport_id is None and the operator is still the owner, so applying the first rule everywhere made the daemon's own seeded manual unreadable through /v1/context even by name.

Isolated by instrumentation, not inference — the fact is present in the tenant and entity_matches_for_agent(…, None) is true, while fact_visible_to_agent(fact, None) is false.

Operator decision, 2026-08-22: exempt seeded documentation only. The distinction is content, not prefix shape. __bootstrap__:: is documentation the daemon seeded about itself, safe for anyone who can already reach the port; __agent:: and __ops:: are private state whose disclosure would be wider than the problem being solved. The exemption is one namespace wide and addressed-only; undirected recall still excludes every internal namespace.

Both directions are tested, because testing only the permissive one would let the exemption widen silently. The boundary test is positive-controlled: widening the helper to is_internal_namespace returns __agent::alice::secret and fails it.

Behaviour changes reviewers should expect

• JWT daemons with CORECRUXD_TENANT_WRITE_STAMP unset now isolate by tenant (previously shared default).
• An invalid value for that variable is now a startup error, not a silent Off.
• A multi-tenant token with no selector is refused on reads.

Gates: cargo test --workspace --no-fail-fast --locked 8339 passed / 0 failed · clippy --workspace -D warnings clean · fmt clean · unwrap-ratchet 389/389.

🤖 Generated with Claude Code