[codex] Upstream hosted review dogfood stack

.github/workflows/rust-ci.yml

@@ -0,0 +1,64 @@
+name: Rust CI
+
+on:
+  pull_request:
+    paths:
+      - 'src-rust/**'
+      - '.github/workflows/rust-ci.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: rust-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  rust:
+    name: Format, lint, and test
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libasound2-dev pkg-config
+
+      - name: Cache cargo registry and build output
+        uses: actions/cache@v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            src-rust/target
+          key: rust-ci-cargo-${{ runner.os }}-${{ hashFiles('src-rust/Cargo.lock') }}
+          restore-keys: rust-ci-cargo-${{ runner.os }}-
+
+      - name: Check formatting
+        working-directory: src-rust
+        run: cargo fmt --all -- --check
+
+      - name: Check workspace
+        working-directory: src-rust
+        run: cargo check --workspace --locked
+
+      - name: Run Clippy
+        working-directory: src-rust
+        run: cargo clippy --workspace --all-targets --locked -- -D warnings
+
+      - name: Run tests
+        working-directory: src-rust
+        run: cargo test --workspace --locked --quiet

docs/advanced.md

@@ -531,8 +531,31 @@ Hosted review mode is enabled with `--hosted-review`,
 Coven Code does not load user-scope memory by default. The prompt records that
 hosted review mode is active and lists the AGENTS.md scopes that were loaded.
 Durable hosted memory and transcript namespaces are separated under a hosted
-review path and require tenant scope plus a canonical repository identity before
-they can be resolved for persistence.
+review path and require tenant scope, GitHub App installation id, stable repo
+id, and canonical repository identity before they can be resolved for
+persistence. Hosted namespaces include a domain component so default branch,
+branch, pull-request, release, and security-private memory stay separated.
+
+Hosted review mode also disables write/execute-capable tools, configured MCP
+servers, plugins, user memory, and managed rules by default. Trusted hosted
+policy settings such as `hostedReview.allowManagedRules`,
+`hostedReview.allowWriteTools`, `hostedReview.allowMcpServers`, and
+`hostedReview.allowPlugins` can opt specific surfaces back in for controlled
+deployments. Prefer tenant-approved managed rules over `allowUserMemory`.
+
+Session memory extraction is also approval-gated in hosted review mode.
+Untrusted fork or contributor sessions cannot automatically append learned
+facts to durable `.coven-code/AGENTS.md` memory. Instead, extracted memories
+are written as JSON candidates under `.coven-code/memory-candidates/` with
+content, semantic category, confidence, provenance, source trust, proposed
+scope, proposed visibility, status, and rejection reason metadata. Approved
+candidates can be promoted into durable memory as maintainer-approved entries;
+rejected candidates remain artifacts and are not loaded into future prompts.
+
+Direct hosted auto-persistence requires an explicit trusted policy:
+`hostedReview.allowAutoMemoryPersistence` must be true and
+`hostedReview.memorySourceTrust` must meet or exceed
+`hostedReview.memoryTrustThreshold`.
 
 ---
 

docs/configuration.md

@@ -129,8 +129,62 @@ Or in `settings.json`:
 When hosted review mode is active, Coven Code skips user-scope memory
 (`~/.coven-code/AGENTS.md` and `~/.coven-code/CLAUDE.md`) by default, marks
 new session artifacts as hosted review artifacts, and requires a tenant plus
-canonical repository identity before resolving hosted durable memory paths.
-Local-personal mode remains the default and continues to load user memory.
+GitHub App installation id, stable repository id, and canonical repository
+identity before resolving hosted durable memory paths. Hosted memory and
+transcripts are also split by memory domain, such as default branch, named
+branch, pull request, release, or security-private review. Local-personal mode
+remains the default and continues to load user memory.
+
+Hosted review also disables write/execute-capable tools, configured MCP
+servers, and plugins by default. A trusted hosted policy can opt individual
+shared surfaces back in:
+
+```json
+{
+  "config": {
+    "hostedReview": {
+      "enabled": true,
+      "allowManagedRules": true,
+      "allowWriteTools": true,
+      "allowMcpServers": true,
+      "allowPlugins": true
+    }
+  }
+}
+```
+
+`allowUserMemory` also exists for explicitly trusted deployments, but hosted
+review jobs should prefer tenant-approved managed rules over operator-global
+user memory.
+
+Auto-extracted memories are approval-gated in hosted review mode. By default,
+hosted sessions write reviewable JSON candidates under
+`.coven-code/memory-candidates/` instead of appending directly to durable
+`.coven-code/AGENTS.md` memory. Each candidate records content, category,
+confidence, provenance, source trust, proposed scope, proposed visibility,
+status, and any rejection reason.
+
+Trusted deployments can opt into direct durable writes only when the source
+trust meets the configured threshold:
+
+```json
+{
+  "config": {
+    "hostedReview": {
+      "enabled": true,
+      "allowAutoMemoryPersistence": true,
+      "memorySourceTrust": "maintainer-approved",
+      "memoryTrustThreshold": "maintainer-approved"
+    }
+  }
+}
+```
+
+Supported `memorySourceTrust` and `memoryTrustThreshold` values are
+`system-policy`, `maintainer-approved`, `default-branch-code`,
+`contributor-input`, `fork-input`, `model-inferred`, and `unknown`.
+Untrusted fork or contributor contexts should leave durable persistence
+disabled and promote only reviewed candidates.
 
 ### Tool access
 
@@ -296,7 +350,12 @@ AGENTS.md files may begin with optional YAML frontmatter to control loading:
 ---
 memory_type: project
 priority: 10
-scope: project
+scope: repo
+trust: maintainer_approved
+visibility: public_review
+source: github_pr
+source_ref: OpenCoven/coven-code#123
+expires_at: 2099-12-31
 ---
 
 # My Project Notes
@@ -308,9 +367,37 @@ Frontmatter fields:
 
 | Field | Description |
 |-------|-------------|
-| `memory_type` | Informal label (currently informational only). |
+| `id` | Stable memory id used for hosted review citation, for example `mem_auth_policy`. If omitted, Coven Code derives a stable id from path and content. |
+| `memory_type` | Memory category label such as `project`, `user`, `reference`, or `feedback`. |
 | `priority` | Integer sort priority (lower numbers are prepended first within the same scope). |
-| `scope` | Informational label for documentation purposes. |
+| `scope` | Intended scope, such as `user`, `tenant`, `installation`, `repo`, `branch`, or `pr`. |
+| `trust` | Source trust. Hosted review enforces this against `hostedReview.memoryTrustThreshold`. Supported values include `system_policy`, `maintainer_approved`, `default_branch_code`, `model_inferred`, `contributor_input`, `fork_input`, and `unknown`. |
+| `visibility` | Intended review visibility: `public_review`, `private_review`, or `security_private`. Hosted public reviews exclude `security_private` memory by default. |
+| `source` | Provenance source kind, for example `manual`, `github_pr`, `github_pr_review`, or `session_memory_extraction`. |
+| `source_ref` | Source reference such as `owner/repo#123`, a commit SHA, or another non-secret audit handle. |
+| `expires_at` | Optional expiry date in `YYYY-MM-DD` format. Expired hosted memory is ignored. |
+| `retention_class` | Optional lifecycle class such as `standard`, `short_lived`, `security`, or `legal_hold`. |
+| `redacted_at` | Marks content as redacted. Hosted review keeps the metadata visible but replaces the body with a redaction stub. |
+| `deleted_at` | Marks memory as deleted. Hosted review excludes deleted entries from prompt loading. |
+| `created_at`, `created_by`, `session_id`, `transcript_ref`, `confidence` | Optional provenance fields for audit and review artifacts. |
+
+Local mode tolerates missing metadata for backward compatibility. Hosted review
+mode treats missing trust as `unknown`, ignores expired memory, and excludes
+memory below the configured trust threshold. Tagged hosted memory is injected
+with memory ids and provenance metadata; findings that rely on memory should
+include those ids in `memory_refs`.
+
+Hosted sync and persistence boundaries run high-confidence secret scanning
+before writing or uploading memory. Entries with detected secret patterns are
+blocked by default. Logs and review candidates include only pattern labels and
+reason codes, not matched secret values. False positives should be handled by
+redacting or editing the memory entry before retrying sync.
+
+Hosted team-memory pull is conflict-aware. Local changes are preserved when
+both local and remote content changed since the last known server checksum; a
+conflict record is written for operator review instead of overwriting local
+memory. Hosted team-memory sync also sends tenant, installation, repo, and
+domain scope metadata so the server can authorize the full tuple.
 
 ### @include directives