Add a hosted-mode memory isolation model

[CompleteDotTech]

Local source: coven-code/issues/01-hosted-mode-memory-isolation.md

Summary

Coven Code should have an explicit hosted review mode for GitHub App and CI-style deployments where memory, session state, tools, and write behavior are isolated differently than in the local interactive CLI. The current memory model is reasonable for a single local user, but a hosted reviewer needs stronger invariants because one process may review many repositories, installations, and tenants.

Current Evidence

• src-rust/crates/core/src/session_storage.rs stores transcripts under ~/.coven-code/projects/{base64url(project_root)}/{session_id}.jsonl.
• src-rust/crates/core/src/memdir.rs stores auto memory under ~/.coven-code/projects/<sanitized-root>/memory or COVEN_CODE_REMOTE_MEMORY_DIR/projects/<sanitized-root>/memory.
• src-rust/crates/core/src/claudemd.rs loads managed, user, project, and local memory into one prompt fragment.
• docs/configuration.md documents that user memory applies to all projects.

These are path/user oriented boundaries, not hosted tenant boundaries.

Problem

If Coven Code is used as the coding agent behind a GitHub App reviewer, default local behavior can mix memory across repositories or customers. A hosted process needs to know when it is operating under stricter rules and must refuse memory sources that are appropriate only for a personal local CLI.

Proposed Design

Add a hosted mode flag, for example:

• CLI flag: --hosted-review
• Environment variable: COVEN_CODE_HOSTED_REVIEW=1
• Config field: hostedReview.enabled

When hosted mode is active:

• Disable global user memory unless explicitly enabled by a trusted tenant policy.
• Require tenant/install/repo memory scope inputs before durable memory is read or written.
• Use hosted-specific memory roots rather than ~/.coven-code/projects/<path>.
• Disable write-capable tools by default.
• Disable project-local MCP/plugins unless explicitly allowlisted.
• Mark transcripts and memory entries as hosted-mode artifacts.

Acceptance Criteria

• Hosted mode can be enabled from CLI, env, and config.
• Hosted mode changes memory path resolution so no default global user memory is loaded.
• Hosted mode refuses to persist memory unless a tenant scope and canonical repo identity are supplied.
• Unit tests prove local mode behavior remains unchanged.
• Unit tests prove hosted mode uses a separate memory/session namespace.
• Documentation explains the difference between local personal mode and hosted review mode.

Test Notes

Add tests around memdir::auto_memory_path, claudemd::load_all_memory_files, and session path construction. Tests should verify that hosted mode cannot accidentally read ~/.coven-code/AGENTS.md or path-keyed project memory.

[CompleteDotTech]

Cross-repo dependency links from the hosted GitHub App checklist:

• Define hosted memory governance contract between coven-github and coven-code coven-github#6
• Split agent read auth from publication write auth coven-github#4

[BunsDev]

Reviewed against current main (post #122). Status: foundation landed, but the acceptance criteria are only partially met. This should stay open.

Implemented by #122 (verified in code)

• Activation from all three surfaces: --hosted-review (crates/cli/src/main.rs:253), COVEN_CODE_HOSTED_REVIEW (crates/core/src/hosted_review.rs:49), and config.hostedReview.enabled (crates/core/src/lib.rs:1290).
• Context loading: MemoryLoadOptions::hosted_review() disables user memory and managed rules, wired into runtime context building (crates/cli/src/main.rs:597,609). Tests hosted_review_excludes_user_memory_by_default and hosted_review_context_skips_global_user_memory cover this, plus a local-mode-unchanged path via MemoryLoadOptions::local().
• Hosted namespaces defined with scope-required errors: memdir::auto_memory_path_for_mode and session_storage::transcript_path_for_mode resolve to ~/.coven-code/hosted-review/tenants/<tenant>/repos/<repo>/... and return a config error when no HostedReviewScope is supplied.
• Session metadata marked hostedReview: true (crates/cli/src/main.rs:1981).
• Docs: docs/configuration.md ("Hosted review mode") and docs/advanced.md ("Hosted review memory isolation").

Remaining gaps

1. The mode-aware persistence functions have no production callers. auto_memory_path_for_mode, transcript_dir_for_mode, transcript_path_for_mode, and HostedReviewScope are only exercised by their own unit tests. Runtime transcript writes still go through local transcript_path (crates/commands/src/lib.rs:8134), and sessions still save to the shared ~/.coven-code/sessions/<id>.json (crates/core/src/lib.rs:3466) regardless of mode. So the "hosted mode uses a separate memory/session namespace" and "refuses to persist without tenant scope" criteria are enforced only in dead code paths; hosted sessions currently persist into the same path-keyed local namespaces, just tagged with hostedReview: true.
2. No input surface for tenant/repo identity. There is no CLI flag, env var, or config field that constructs a HostedReviewScope, so the hosted namespaces are unreachable at runtime.
3. Write-capable tools are not disabled by default — no hosted-mode awareness in crates/tools.
4. Project-local MCP/plugin allowlisting is not implemented — no hosted-mode awareness in crates/mcp.

Suggested follow-up scope

• Add scope inputs (e.g. --hosted-tenant / --hosted-repo, or env equivalents; optionally derive canonical repo identity from the git remote) and thread HostedReviewScope into session startup.
• Route all runtime persistence (transcripts, history::save_session, auto-memory writes) through the _for_mode functions when hosted_review_enabled(), so a missing scope hard-fails or disables durable persistence instead of silently falling back to local paths.
• Gate write-capable tools and project-local MCP/plugins behind hosted-mode policy.
• Integration tests asserting a hosted-mode run without scope writes nothing under ~/.coven-code/projects/ or ~/.coven-code/sessions/.

Related: tracking issue #119, #100, and the cross-repo items OpenCoven/coven-github#6 / OpenCoven/coven-github#4.