Layer 2 (future): hard visibility isolation for teams (read-scope + security)

[CheeryProgrammer]

Part of #113 (Layer 2 — opt-in, future).

For the subset of teams with privacy/compliance/multi-tenant needs: a hard
visibility wall on top of Layer 1. Not needed by solo users or most teams.

• read = a set of namespaces an agent may see; write = a single target.
• Enforced at the storage layer (not a forgettable query filter) + auth.
• Per-namespace uniqueness/quotas/backup/export; whole-namespace delete & hand-off.

Only build once a real multi-tenant/compliance requirement exists. Until then,
Layer 1 (scoped identity + soft lens) covers solo-multi-project and most teams;
hard isolation = a separate Brainiac stack per team.

Acceptance: an agent scoped to namespace A cannot retrieve namespace B's data
by any query; Layer 1 deployments keep working unchanged (everything = one visible pool).

[CheeryProgrammer]

Design locked — one server, multi-namespace, per-token (not per-process)

Key decision: hard isolation must be one server serving many namespaces with per-token enforcement. Process-per-namespace adds nothing over "run a second stack" (the current fallback); the whole value is a shared graph + shared/global layer behind a per-caller wall.

Model

• Namespace = the project discriminator value (reuse Layer 1 identity — no migration).
• Bearer token → principal {read: [namespaces], write: single}; many principals in one process.
• Reads require auth once principals are configured; principal derived from the token.
• Enforcement in core (single choke point): readLens(ctx, project) clamps every read; writeDisc(ctx, ...) pins writes. ?project= narrows within the read-set, never widens.
• Wall predicate (nodes/chunks): COALESCE(NULLIF(discriminators->>'project',''),'') = ANY($wall); $wall IS NULL = Layer 1. Edges: visible only when both endpoints are in the wall.
• Secure default: no global bleed unless the read-set explicitly lists global.
• Backward-compat: no principals ⇒ exactly Layer 1 today.

Decomposition

• Layer 2 foundation: per-token principal + enforced read-wall + write-pin (#120) #185 Foundation — per-token principal + enforced read-wall + write-pin ← building now
• Layer 2: per-namespace quotas / rate limits (#120) #186 Per-namespace quotas / rate limits
• Layer 2: per-namespace export / backup (#120) #187 Per-namespace export / backup
• Layer 2: whole-namespace delete + handoff (#120) #188 Whole-namespace delete + handoff (needs principal-scoped id-based curation)
• Layer 2: WebUI sends auth on reads under hard isolation (#120) #189 WebUI sends auth on reads under hard isolation

Full plan (predicate, edge-join, nil-vs-empty array semantics, nodeName cache leak, test plan) tracked in #185.