ZeroClaw’s shared tools expose missing per-agent ownership

zeroclaw-labs/zeroclaw issue #9646 is the inspected primary source: “[Bug]: Session/channel read+write tools lack per-agent ownership scoping (sessions_list/history/send, discord_search).” The two related records below were inspected as supporting context, not treated as independent confirmation.

The facts

- zeroclaw-labs/zeroclaw issue #9646 was created 2026-08-01T23:56:43Z and was open at inspection; its title is “[Bug]: Session/channel read+write tools lack per-agent ownership scoping (sessions_list/history/send, discord_search).” - zeroclaw-labs/zeroclaw issue #9647 was created 2026-08-01T23:57:51Z and was open at inspection; its title is “[Bug]: Knowledge graph has no per-agent attribution — any agent reads/mutates another agent's knowledge.” - zeroclaw-labs/zeroclaw PR #9319 was created 2026-07-23T22:41:31Z and was open at inspection; its title is “refactor(runtime): seal the engine tool registry as ScopedToolRegistry.” - The repository reported 32481 stars, 683 open issues, default branch master, and last push 2026-08-01T23:22:30Z. - The latest tagged-release baseline checked was v0.8.3 published 2026-07-16T01:47:13Z.

What changed

zeroclaw-labs/zeroclaw issue #9646 reports: Affected component tools Severity S0 - data loss / security risk Current behavior Several built-in tools take a target identifier (session_id, channel_id) **from model-supplied arguments** and act on it with no per-agent ownership check. Any agent can therefore reach another agent's session/channel data. This violates ADR-011 (docs/book/src/architecture/decisions/ADR-011-multi-agent-runtime-boundaries.md:24,56), which declares agents must not share workspace, memory, or channel reachability by accident, and ADR-011:46,86, which require every cross-agent capability to define its own authorization boundary. The ownership primitive **already exists** (SessionOwnershipScope::authorize, crates/zeroclaw-tools/src/sessions.rs:90-126) and is wired into sessions_reset/sessions_delete — but the read/write session tools and discord_search never call it. Verified by source inspection at commit c1b04dbc0c (master, v0.8.3):

zeroclaw-labs/zeroclaw issue #9647 reports: Affected component memory Severity S0 - data loss / security risk Current behavior The knowledge tool exposes a **single, globally-shared** knowledge graph to every agent with no per-agent attribution and no ownership scoping. Any agent can read and mutate another agent's captured knowledge, client networks, and interaction logs. This is the knowledge-plane analogue of the session-tool ownership gap (#9646) and violates ADR-011 (docs/book/src/architecture/decisions/ADR-011-multi-agent-runtime-boundaries.md:24,56,86), which requires memory isolation per agent identity and that every cross-agent capability define its own authorization boundary. Verified by source inspection at commit c1b04dbc0c (master, v0.8.3): KnowledgeTool holds a raw Arc with no identity of any kind (crates/zeroclaw-tools/src/knowledge_tool.rs:30-38); execute dispatches on an

zeroclaw-labs/zeroclaw PR #9319 reports: Summary **Base branch:** master **What changed and why:** Flip the turn engine's tools_registry carrier field from &[Box ] to &ScopedToolRegistry (agent/turn/execution.rs: ResolvedIo + ResolvedAgentExecution). ScopedToolRegistry is a private-field newtype that only assemble() (production) or from_raw_for_test (tests) can mint, so **handing the engine an unscoped tool registry is now a compile error**. This is the capstone (Epic A P2, "the seal") of the agent-policy tool-exposure unification. Every construction path was routed through the assemble() seam in prior PRs (#8640/#8700/#8701/#8711/#8744/#8761/#8812/#8830), but nothing stopped a future path from re-inlining a raw registry and silently un-routing the policy filter (the way #8011 did to the channel path once). The

Why it matters

A per-agent registry is only a control-plane boundary if stored rows and every read, write and search carry the same owner identity. Tool filtering alone cannot stop cross-agent access through shared tables. This is an operator boundary: persisted state, execution ownership and visible controls must describe the same event. A workaround that broadens access, deletes state or hides the symptom would trade a visible defect for an unmeasured one.

Current

The primary record was open when captured on 2026-08-02. The release baseline was v0.8.3 published 2026-07-16T01:47:13Z. Current repository metadata, pull requests, issues, release records, Google News discovery, Hacker News discovery, Lobsters, Metamesh and the rendered ClawCharts row were checked. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/zeroclaw-labs/zeroclaw/issues/9646. Supporting records are https://github.com/zeroclaw-labs/zeroclaw/issues/9647 and https://github.com/zeroclaw-labs/zeroclaw/pull/9319. Their source bodies, timestamps and states were captured in the daily evidence bundle. Test counts, reproductions and deployment observations remain attributed to their authors unless explicitly identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Issue closure would not by itself prove a deployed fix. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Add owner identifiers with fail-closed migration policy, enforce them below tool dispatch, test forged agent arguments and legacy rows, and treat the scoped registry as direction rather than shipped remediation. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently after intervention.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.