test(core): scope-isolation suite and shared two-namespace fixture (#1467, part 1)

[ajianaz]

What

Part 1 of 3 of the scope-isolation regression gate (#1467).

• uteke_core::test_support (behind the new test-support feature, hidden from docs, never enabled by a release build) now exports the keyword embedder and seed_two_scopes(): two namespaces, alpha and beta, whose memories share the SAME vocabulary (so every surface has hits in both scopes for one query), two project tags (project:alpha, project:beta) plus a shared tag, one room per namespace and one global document.
• crates/uteke-core/src/isolation_tests.rs, 7 tests, each non-vacuous (it first asserts the scope has hits): recall and recall_hybrid over all five strategies, tag filters (a foreign project tag matches nothing), unified recall (All and Memory, all strategies), keyword search, list (with and without a tag), tag counts, export, count, scoped room recall and room listing, graph_data and graph_view.
• Pinned design fact: SearchType::Document is the global document view (documents have no namespace, fix: unified recall scopes docs to namespace, reports honest scores (#1270) #1271), so it returns documents only and never a memory; All and Memory never return a document when scoped.

Parts 2 (HTTP) and 3 (MCP and CLI, plus the coverage document) follow.

Why

#1353 showed one shape of scope leak; the class is any retrieval surface returning records outside the requested scope, and new search features keep adding surfaces. The suite makes that a test failure instead of a review finding. The fixture lives in core so the other transports seed the identical store.

Testing

• cargo test -p uteke-core: 748 pass, 7 of them new; clippy is clean with and without --features test-support.
• Mutation checks, then reverted: making Uteke::search ignore the namespace fails keyword_search_list_tags_and_export_stay_in_scope ("search scoped to alpha returned a beta record"); making scoped room recall ignore the namespace fails room_surfaces_stay_in_scope.
• Not covered here on purpose: fetching by ID (get, provenance, timeline, edges) takes no namespace, so IDs are global handles; that is listed in the coverage document in part 3 as an explicit exemption, not silently skipped.

[github-actions]

🔍 Cora AI Code Review

✅ No issues found. Code looks good!

---

Review powered by cora-code · BYOK · MIT