Trusted identity via tool-call _meta

Parent: access-control

The session's trusted identity — OwnerID, Subject{Kind, ID} (an access code or an outbound key; it was CodeID until 2026-08-20, 162f09833, when key-path sessions got a subject so quota had something to count against), RoleID, and the frozen corpus-ACL scope (CorpusScope, one opaque blob — since 2026-08-10, eef128481, no longer two hand-copied string lists) — travels in the tool-call _meta side-channel under standmeet/session, not in the LLM-controllable arguments (backend/internal/capabilities/mcpclient/client.go:171-227).

Why it's load-bearing: the LLM (and any visitor text it parrots) cannot forge the ACL scope, because the scope never passes through anything the model controls. Corpus access is prompt-injection-proof by construction — the Ring-3 problem of prompt-injection-is-buffer-overflow solved at the boundary, not by hoping the model behaves.