[MaojiaSheng]

Description

Enable GLOBAL identities to read one explicit owner's policy-authorized user subtree within their account. Requests intersect the target scope with the owner's GLOBAL policy, retain both include and exclude rules, and preserve the authenticated actor. This covers find, grep, ls, tree, glob, read, get, abstract, and overview.

The submitter recommends merging this implementation now and addressing the confirmed risks below in follow-up work. Security validation remains incomplete because the L0 summary disclosure is confirmed.

Human Involvement

• A human participated in the implementation or review loop
• This PR was generated entirely by AI agents without human participation in the loop

Related Issue

#6183

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test update

Changes Made

• Add immutable policy scopes and delegated request contexts with ALLOWED / CONTAINER / DENIED decisions. Container directories support navigation without exposing their derived listing fields.
• Apply policy scopes before query limits and filter returned candidates. GLOBAL grep uses filesystem traversal; shared namespaces keep the actor's existing ACL behavior.
• Carry authorized contexts through text, binary, and directory-summary reads. Delegated reads preserve Privacy placeholders and cannot write owner data.
• Restrict overview access to completely allowed directory subtrees, including direct overview sidecar reads. File-to-parent summary fallback reauthorizes its actual source.

Testing

• Focused scope/CLI and grep regression: .venv/bin/python -m pytest tests/server/test_global_policy_scope.py tests/storage/test_global_policy_scope.py tests/storage/test_viking_fs_grep.py -q --no-cov — 64 passed after syncing with current upstream main. The two local scope fixture files are excluded from this PR because the submitter requested committing only already-staged files.

• Live API-key CLI matrix on macOS: 2 owners × 24 target categories × 4 read commands = 192 cases. Permission statuses matched the current policy rules; content inspection identified the L0 issue described below. Supplementary checks covered exact allow rules, explicit sidecar denies, missing policy, URI encoding/traversal, account boundaries, and byte comparisons.

• Related content/download/record-ID checks: 30 passed, 2 failed. Both failures were reproduced with the pre-change staged baseline: test_read_content mocks a text reader while the visible-read path uses a byte reader; test_read_directory_uri_returns_invalid_argument expects different directory-error wording.

• Ruff lint/format checks and Git whitespace checks passed on the changed implementation paths.

• Remote index backends, signed-download/WebDAV surfaces, and concurrent policy-revocation behavior were not validated. The existing policy-cache consistency window is 600 seconds.

• I have added tests that prove my fix is effective or that my feature works

• New and existing unit tests pass locally with my changes

• I have tested this on the following platforms:

  • Linux
  • macOS
  • Windows

Checklist

• My code follows the project's coding style
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published

Additional Notes: known risks and merge recommendation

1. High priority — confirmed L0 summary disclosure. Stored abstracts can contain information derived from denied descendants or protected content. L0 access currently checks the summary's own path without establishing that its complete source scope was permitted. Overview has the stronger source-scope check. This PR therefore does not provide complete confidentiality for generated abstracts; this remains unresolved.
2. Cross-user search is outside the supported scope, but rejection is inconsistent. Explicit permitted owner targets can return a successful empty result. No cross-user response content was observed in the matrix; a uniform unsupported/rejection boundary remains follow-up work.
3. CLI get accepts Viking URIs but rejects raw vector IDs. read resolves authorized L2 IDs, whereas the HTTP download route validates URI syntax before reaching the ID-capable byte reader. Rejected downloads did not create files. This is a capability limitation rather than an observed authorization bypass.

The submitter has reviewed these findings and recommends merging the current scope first. The known issues above are intentionally left unresolved in this PR. Detailed local reports and reproduction artifacts remain outside this submission because they contain local credentials and security-sensitive reproduction details; the commit contains only the 12 implementation files that were already staged.