fix(memory): reject path-escaping agent IDs

[cursor]

Summary

• Fixes a critical path escape where stdio/executor memory_write / memory_search joined unvalidated agent_id into memory/{agent_id}.sqlite. Absolute IDs (e.g. /tmp/pwn) replace the memory root via Path::join, creating/opening SQLite files outside the chat tree; traversal IDs escape the same way.
• Adds validate_agent_id, makes index_path fallible with post-join containment check, and fail-closes executor RPC plus agent memory indexing callers.
• Adds regression tests for absolute / traversal / drive / separator reject paths and valid single-segment accept path.

Bug Impact

• Arbitrary SQLite create/open outside <chat_root>/memory/ under process permissions.
• Concrete trigger: stdio RPC memory_write with agent_id: "/tmp/pwn" (or ../../../tmp/pwn) and a valid rel_path/content.

Task Linkage

• Task ID: TASK-2026-076
• Task folder: tasks/TASK-2026-076-memory-agent-id-path-safety/

Injected Specs

• spec/verification-integrity.md
• spec/task-artifact-language.md
• spec/security-nonnegotiables.md
• spec/rust-conventions.md
• spec/testing-policy.md
• spec/docs-sync.md (N/A: fail-closed validation only; no user-facing path grammar docs)
• spec/architecture-boundaries.md (reviewed; no boundary changes)

Validation Evidence

• Commands executed:
  • cargo fmt --all -- --check → clean
  • cargo test -p skilllite-core path_validation → 2 passed
  • cargo test -p skilllite-executor --lib → 6 passed
  • cargo test -p skilllite-agent --lib → 247 passed
  • cargo clippy -p skilllite-core -p skilllite-executor -p skilllite-agent --all-targets -- -D warnings → clean
  • python3 scripts/validate_tasks.py → passed (71 task directories)
• Key results:
  • Absolute /tmp/pwn and traversal ../../../tmp/pwn rejected
  • Valid default still resolves under memory/default.sqlite

Regression Scope

• Areas likely affected:
  • Memory index path construction, stdio memory RPC, agent memory tools/indexing
• Explicit non-goals:
  • Open session_key hardening (PR fix(chat): reject path-escaping session keys #126)
  • Other open critical PRs (fix(evolution): constrain pending skill path operations #89, Fix Linux sandbox filtered network fail-open #112–Fix Life Pulse rhythm workspace scoping #116, fix(evolution): scope destructive reset to requested workspace #120–fix(security): reject path-escaping skill directory names #125, fix(evolution): reject path-escaping skill entry points #127)
  • Symlink follow bypasses in workspace file tools

Docs Sync (EN/ZH)

• Not needed
• Updated EN + ZH docs
  Files:
  • N/A

Security Review Notes

• What security policy changed, and why is it needed? Memory agent IDs must be single-segment before filesystem join.
• Is default behavior more permissive? No — fail-closed.
• Does this affect SKILLLITE_* config semantics? No.
• Were tests and EN/ZH docs updated? Tests yes; docs N/A as above.

Review Checklist

• Acceptance criteria in tasks/TASK-2026-076-memory-agent-id-path-safety/TASK.md satisfied
• tasks/TASK-2026-076-memory-agent-id-path-safety/STATUS.md updated with latest progress
• tasks/TASK-2026-076-memory-agent-id-path-safety/REVIEW.md includes merge readiness decision
• tasks/board.md status is up to date