feat: add bounded Knowledge query producers

[andrei-hasna]

Summary

• add producer-side bounded list filtering and ranked PostgreSQL search with exact totals and paging
• add private guarded query descriptors, relation metadata, opaque proofs, and fail-closed response validation
• add a packaged live private-query acceptance command and OpenAPI coverage

Verification

• TypeScript build check: pass
• affected private guarded lanes: 4 pass, 0 fail
• readback compatibility lanes: 3 pass, 0 fail
• cloud inventory and serve lanes: 11 pass, 0 fail
• package release safety: 6 pass, 0 fail
• build, contracts conformance, no-cloud scan, package validation, and generated-artifact byte check: pass
• staged secret scan: 0 findings
• full local suite: 455 pass, 2 skip; remaining failures were fixed per-test timeouts on station load above 43, with changed inventory and readback failures corrected and re-run green

Task: d5c85410-4b66-4a74-a60e-8ada99832701

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO on exact head 876d23d627756bc5d2d03944435485be5e3202ca.

Fixed reviewer: account094 / claude-fable-5, high effort. Current main was 85c31216ed6f7fe9e1847ad8ede42293739e1349; merge-result tree 2a0563929d97f97b8f0be114bf738529d273a67e matched the reviewed head tree.

Blocking P1 findings:

1. The service layer lacks a request-recording API-mode fixture proving service.search and retrieveContext / search --context use only /v1/notes/search and cannot regress to /v1/notes full-corpus paging.
2. Mixed-version rollout can silently return wrong result sets: the new server does not preserve legacy includeArchived / search semantics, and the new client cannot detect an old server ignoring new-only query fields.

Remediation cycle 1 is limited to these defects and their direct regressions. The same fixed reviewer will perform the focused re-review on the updated exact head.

[andrei-hasna]

[REVIEW] GO — #85 @ 876d23d — lens: correctness+security+gates, reviewer Damon (1 of 1)

Reviewed the exact candidate against freshly fetched origin/main 85c3121.

What I ran:

• git log --oneline origin/main..HEAD — exit 0; one commit: 876d23d feat: add bounded knowledge query producers.
• git diff origin/main...HEAD --stat — exit 0; 36 files changed, 5,366 insertions, 382 deletions.
• Full diffs for every changed file plus surrounding source — exit 0. This included TypeScript sources, migrations, guarded-query contract/writer/server paths, tests, declarations, all generated JavaScript bundles, and bin/knowledge.js.
• git diff --check 85c31216ed6f...HEAD — exit 0.
• bun install — exit 0; setup only, not counted as a test result.
• bun run test — exit 0; 464 pass, 2 skip, 0 fail, 3,830 expectations across 466 tests / 49 files.
• The repository declares no typecheck script; none was invented.
• Targeted pagination probe — exit 0; actual output: {"search_declared_limit":100,"search_results":101,"prompt_results_after_producer_offset":0}.
• Final git status --short — exit 0 with no output; the worktree remained clean.

Security and correctness review:

• Traced authenticated tenant visibility, guarded authority/scope/parent binding, selector and result digests, descriptor expiry/revocation, bounded request/response handling, exact readback, relation-target binding checks, migration constraints/indexes, and producer-side list/search pagination.
• Blocking P0/P1 findings: none.

Non-blocking follow-ups:

• P2: API-mode KnowledgeService.runPrompt sends offset to the producer and then forwards the same offset into runKnowledgePromptOverItems, so SDK ask/build calls with a non-zero offset can double-skip the already paged producer result.
• P2: API-mode KnowledgeService.search permits the cloud producer's 1–200 limit while hybridSearchFromProducerPage reports a limit clamped to 100 without truncating the returned hits; limits 101–200 therefore return more rows than the result metadata claims.

Verdict: GO. Required gate is green and there are no concrete, reachable, in-scope P0/P1 defects.

[andrei-hasna]

Review disposition: not merged. The GO verdict and green gate evidence above bind commit 876d23d627756bc5d2d03944435485be5e3202ca, but the required pre-merge read found the PR head had advanced to 7aca5afcd601d81e577edb2db94e6f04e321a80c. This lane did not inspect or test that new head, so the prior GO is stale and cannot authorize merging the current candidate. The current head needs an exact-head review and green required gates.

[andrei-hasna]

[REVIEW] GO on exact head 7aca5afcd601d81e577edb2db94e6f04e321a80c.

The same fixed account094 / claude-fable-5 reviewer completed focused remediation-cycle-1 verification of the two original P1 findings and their direct regressions.

Literal affected gate: 31 pass / 0 fail / 123 expect() calls across tests/service-cloud-query.test.ts, tests/cloud-store.test.ts, and tests/serve.test.ts. The service no-fallback cases, all five missing-capability rejection cases, the positive mixed-version compatibility control, and the legacy-alias server case executed.

REVIEW_STATUS: GO. No reachable in-scope P0/P1 remains in the focused review scope.