Moirai: isolate the generative memory layer to global admins

[nikita-rulenko]

Summary

Moirai execution is correctly exposed only through the global-admin surface, but its persisted output is not represented as an explicit RBAC security domain. Generated insight memories rely on being unscoped to become admin-only, while Clotho category bridges and Lachesis stitch edges can still influence ordinary graph reads. The generative layer needs an explicit graph-backed admin-only boundary.

Findings

1. Invocation is globally authorized

helixir/src/core/helixir_client/client.rs:203 gates HelixirAdmin through authorize_admin_surface, and the CLI routes Moirai commands through this facade.

2. Insight privacy is accidental

helixir/src/agents/atropos/mod.rs:248 and helixir/src/agents/atropos/verify.rs:288 persist generated memories with no RBAC scope or group edge. Non-admin denial is only a side effect of unscoped-memory fail-closed handling.

3. Generated graph structure remains in ordinary traversal

helixir/src/toolkit/mind_toolbox/search/smart_traversal/connect.rs:185 enables the global Clotho category bridge for every caller, and helixir/src/agents/lachesis/stitch.rs:160 writes hypothesis-grade BECAUSE edges directly between ordinary memories.

Proposed fix

• Add a protected reserved moirai group as an explicit system memory domain in HelixDB.
• Allow global admins to read the domain without assigning ordinary group memberships.
• Scope new Atropos hypotheses and retirement notes to moirai, with idempotent recovery if edge materialization is interrupted.
• Keep Moirai analysis global across all groups while preventing non-admin reads from consuming generative-only paths.
• Protect moirai from membership grants, deletion, dedup federation, onboarding inference, and principal-registry semantics.
• Update bootstrap, installer/doctor, README, engineering docs, prompts, skill, and E2E tests.

Acceptance criteria

• Bootstrap and doctor require the protected moirai group.
• No non-global role can be assigned to moirai.
• New Moirai memories have a scoped fingerprint and a MEMORY_IN_RBAC_GROUP edge to moirai.
• Global admins can inspect Moirai output across all source groups.
• Workers, viewers, moderators, and groupadmins cannot read Moirai memories or generative-only paths.
• Existing unscoped Moirai memories remain admin-only and can be repaired idempotently.
• Unit, HQL, CLI, and live RBAC tests cover the boundary.

[nikita-rulenko]

Implementation is ready on branch codex/rbac-moirai-patch (uncommitted). Reserved membership-free moirai is global-admin-only; CLI/Rust Moirai entrypoints are gated by admin_as; generated hypotheses use scoped fingerprints and non-traversable MOIRAI_DERIVED_FROM provenance. Bootstrap migrates legacy Atropos provenance and reifies/removes legacy Lachesis BECAUSE stitches. Non-admin category bridging is disabled. The disposable upgrade E2E now covers the legacy transition and visibility denial; it is compiled/ignored until run against a disposable v4 HelixDB. All non-live quality gates pass, including HelixDB v2.3.5 compilation of 178 queries. The issue remains open until commit and deployment validation.