fix(ai): exempt seeded/built-in KB content from AI-residency gating

[cuttlefisch]

Summary

• AI-residency policy on the primary KB blocks MAE's own seeded built-in manual, with no way to exempt it #358: Restricting primary's AI-residency to local_models_only (to protect a user's own locally-ingested notes) also blocked AI access to MAE's own seeded/built-in manual content living in the same KB instance — compiled in at startup, identical on every install, never sensitive. This locked an AI agent out of MAE's own help system as an unintended side effect of a policy meant to protect private notes.
• A root-cause audit of all 20 kb_*/help_open AI tools across every ToolResidencyShape bucket grounds this fix's scope: exempt wherever a real Node is already in hand or free to get (implemented here), file one follow-up issue for tools needing deeper plumbing (Extend AI-residency seed-content exemption (#358) to graph/list/health/history tools #361), document why three tool shapes stay structurally unable to apply the exemption at all rather than leaving them a silent gap.

What changed

• New crates/core/src/ai_residency.rs: is_residency_exempt (keys on the already-existing Node::source == Some(NodeSource::Seed), stamped once at startup — no new tagging infrastructure) and filter_residency_exempt/filter_residency_exempt_primary, the shared filter primitives. These live in mae-core rather than crates/mae (where the rest of ADR-048's gate lives) purely because the mae package has no [lib] target and is therefore unreachable from mae-ai's tool implementations — a Rust crate-graph constraint, not a conceptual split.
• SingleTarget tools (kb_get, kb_update, kb_delete, kb_add_link, kb_set_role, help_open, kb_preview_show): resolve_restricted_label now checks the already-resolved node's exemption before denying — zero new plumbing.
• kb_agenda, kb_search, kb_search_context: reclassified into two new shapes (PrimaryOnlyFilterable, ScopedFederatedScanFilterable) where the gate allows the call through unconditionally and the tool impl post-filters its own materialized results instead of denying the whole call outright. kb_raw_query/kb_view_query (arbitrary Datalog, no per-row node-identity to filter) stay in the original hard-deny PrimaryOnly bucket; kb_vector_search (a permanent stub with no real results yet) stays in the original ScopedFederatedScan bucket.
• Threaded requester_provider: Option<&str> down to these three tool impls via a minimal-blast-radius wrapper split (execute_tool/execute_tool_with_requester, dispatch_tool, kb_exec::dispatch) — only the one dispatch point that needs it changes signature; the other 7 category dispatchers are untouched. The embedded/delegate() path needed zero new plumbing (editor.ai.provider was already reachable); the external-MCP path's already-computed requester_provider, previously discarded right after the gate check, is now threaded through. Also caught and flagged (not fixed — separate, pre-existing, out of scope): the headless self-test loop's tool-call path never called check_kb_residency at all.
• ADR-048 gains a new Decision §7 and Verification bullets; ai_residency.rs's module doc documents why kb_raw_query/kb_view_query/kb_id_audit/the two count-only graph-view tools stay unchanged, and cross-links Extend AI-residency seed-content exemption (#358) to graph/list/health/history tools #361 for the real remaining candidates (kb_related, kb_graph, kb_graph_view_state, kb_list, kb_links_to, kb_shortest_path, kb_neighborhood, kb_links_from, kb_health, kb_history/kb_restore).

Test plan

• New crates/core/src/ai_residency.rs unit tests — every NodeSource variant (not just seed-vs-one-other), open-KB no-op, local-provider bypass
• crates/mae/src/ai_residency.rs — critical negative case (a genuine user node in the same restricted primary as an allowed seed node must still be denied), rewritten/retargeted gate-level tests reflecting the two tools that now defer to their own post-filter, every_kb_tool_and_help_open_is_explicitly_classified still passing with the new shapes
• crates/ai/src/tool_impls/kb.rs — real adversarial positive/negative/local-provider-bypass/no-op-when-open coverage for all three post-filter tools, including a check that an all-filtered result set hits kb_search_context's low-result guidance branch rather than a mislabeled empty array
• cargo build --workspace + cd daemon && cargo build
• cargo test --workspace (0 failures) + cd daemon && cargo test (0 failures)
• cargo clippy --workspace --all-targets -- -D warnings (both workspaces)
• cargo fmt --check (both workspaces)
• make code-map regenerated (was stale, now current)
• Filed Extend AI-residency seed-content exemption (#358) to graph/list/health/history tools #361 (Tier-2 follow-up) cross-linking this PR and ADR-048

🤖 Generated with Claude Code

[cuttlefisch]

Superseded — this commit was fast-forwarded onto fix/kb-search-residency-scope and is now part of #354 instead, since it's part of the same series of fixes.