@geraldmaron/construct 1.4.2 → 1.5.0

package/lib/embed/daemon.mjs

@@ -31,17 +31,21 @@ import { dirname, join } from 'node:path';
 import { loadEmbedConfig } from './config.mjs';
 import { Scheduler } from './scheduler.mjs';
 import { rotateIfOversized } from '../logging/rotate.mjs';
+import { resolveStatePath } from '../state-root.mjs';
 import { SnapshotEngine, renderMarkdown } from './snapshot.mjs';
 import { ApprovalQueue } from './approval-queue.mjs';
 import { dispatchOutputs } from './output.mjs';
 import { AuthorityGuard } from './authority-guard.mjs';
 import { ProviderRegistry } from './providers/registry.mjs';
 import { addObservation, searchObservations } from '../observation-store.mjs';
+import { filterHash, matchesFilter, validateFilterConfig } from '../providers/contract.mjs';
+import { recordFilterAudit } from '../providers/filter-audit.mjs';
 import { listSessions, loadSession } from '../session-store.mjs';
 import { syncEvalDatasets } from '../telemetry/eval-datasets.mjs';
 import { runLLMJudgeEvaluations } from '../telemetry/llm-judge.mjs';
 import { InboxWatcher } from './inbox.mjs';
 import { InboxLiveWatcher } from './inbox-live-watcher.mjs';
+import { registerEmbedCapabilityJobs } from './capability-jobs.mjs';
 import { generateRoadmap } from './roadmap.mjs';
 import { runDocsLifecycle } from './docs-lifecycle.mjs';
 import { emitEmbedNotification, notifySlack } from './notifications.mjs';
@@ -49,6 +53,7 @@ import { intentToCategory } from './providers/slack.mjs';
 import { runTelemetrySetup } from '../telemetry/setup.mjs';
 import { emitTraceEvent, newTraceId, newSpanId } from '../worker/trace.mjs';
 import { doctorRoot } from '../config/xdg.mjs';
+import { resolveNonNegativeSetting } from '../env-config.mjs';
 
 /**
  * Log a non-fatal error to stderr. Use instead of empty catch {} blocks
@@ -117,7 +122,7 @@ function resolveLockPath(env = process.env) {
 }
 
 function resolveDaemonStatePath(env = process.env) {
-  return join(resolveRootDir(env), '.cx', 'runtime', 'embed-daemon.json');
+  return resolveStatePath(resolveRootDir(env), 'runtime', 'embed-daemon.json');
 }
 
 // ─── Self-repair helpers ────────────────────────────────────────────────────
@@ -221,12 +226,101 @@ function distillRecentSessions(rootDir) {
   return distilled;
 }
 
+// ─── ADR-0060 filter enforcement (LMCP-B11) ─────────────────────────────────
+
+/**
+ * Match each snapshot section back to the source record that produced it.
+ * Sections are pushed in config.sources order but a source with no
+ * registered provider is skipped upstream (lib/embed/snapshot.mjs), so
+ * position alone is unreliable — walk both lists in lockstep, consuming one
+ * unmatched source per section by provider name.
+ */
+function matchSourceForSections(sources) {
+  const remaining = [...(sources ?? [])];
+  return (providerName) => {
+    const idx = remaining.findIndex((s) => s.provider === providerName);
+    if (idx === -1) return null;
+    return remaining.splice(idx, 1)[0];
+  };
+}
+
+/**
+ * Enforce the ADR-0060 filter block on every snapshot section before any
+ * item reaches observation distillation. Validates the source's `filter`
+ * config first (fail closed: an unknown/invalid key throws, the section's
+ * items are dropped entirely, and the failure is recorded as a source
+ * error visible in the snapshot). Valid filters run the plane-side
+ * `matchesFilter` predicate over every item — the mandatory backstop even
+ * when the provider already pushed the filter down server-side — and a
+ * `{provider, instance, filterHash, matched, dropped}` audit line is
+ * appended per section, matched or not.
+ *
+ * Mutates `snapshot.sections[].items` in place and appends to
+ * `snapshot.errors` on a filter config failure. Returns nothing.
+ */
+export function enforceSectionFilters(rootDir, snapshot, sources) {
+  const nextSourceFor = matchSourceForSections(sources);
+
+  for (const section of snapshot.sections ?? []) {
+    const source = nextSourceFor(section.provider);
+    const filter = source?.filter ?? null;
+    const fetched = section.items?.length ?? 0;
+
+    if (filter == null) {
+      recordFilterAudit(rootDir, {
+        provider: section.provider,
+        instance: source?.instance ?? null,
+        filterHash: null,
+        pushdown: false,
+        fetched,
+        matched: fetched,
+      });
+      continue;
+    }
+
+    try {
+      validateFilterConfig(section.provider, filter);
+    } catch (err) {
+      section.items = [];
+      snapshot.errors = snapshot.errors ?? [];
+      snapshot.errors.push({ source: section.provider, error: `filter config: ${err.message}` });
+      recordFilterAudit(rootDir, {
+        provider: section.provider,
+        instance: source?.instance ?? null,
+        filterHash: filterHash(filter),
+        scope: filter.scope ?? null,
+        predicates: filter.predicates ?? null,
+        nativeQuery: filter.nativeQuery ?? null,
+        pushdown: false,
+        fetched,
+        matched: 0,
+      });
+      continue;
+    }
+
+    const admitted = (section.items ?? []).filter((item) => matchesFilter(item, filter));
+    section.items = admitted;
+
+    recordFilterAudit(rootDir, {
+      provider: section.provider,
+      instance: source?.instance ?? null,
+      filterHash: filterHash(filter),
+      scope: filter.scope ?? null,
+      predicates: filter.predicates ?? null,
+      nativeQuery: filter.nativeQuery ?? null,
+      pushdown: Boolean(filter.nativeQuery) || Boolean(filter.scope?.projects?.length),
+      fetched,
+      matched: admitted.length,
+    });
+  }
+}
+
 /**
  * Distill snapshot items (issues, PRs, messages) into the observation store.
  * Skips items already recorded in this snapshot cycle using a dedup key.
  * Returns the count of new observations written.
  */
-function distillSnapshotItems(rootDir, sections) {
+export async function distillSnapshotItems(rootDir, sections) {
   let written = 0;
   for (const section of sections ?? []) {
     for (const item of section.items ?? []) {
@@ -235,7 +329,7 @@ function distillSnapshotItems(rootDir, sections) {
         if (!dedupKey) continue;
 
         // Check if we already have a recent observation for this exact item key
-        const existing = searchObservations(rootDir, dedupKey, { limit: 1 });
+        const existing = await searchObservations(rootDir, dedupKey, { limit: 1 });
         if (existing.some((o) => o.tags?.includes(`item:${dedupKey}`))) continue;
 
         const summary = buildItemSummary(item, section.provider);
@@ -363,6 +457,7 @@ export class EmbedDaemon {
   #daemonStatePath = null;
   #inboxWatcher = null;
   #inboxLiveWatcher = null;
+  #capabilityIds = [];
   #providerHealth = new ProviderHealthTracker();
   #daemonTraceId = null;
 
@@ -429,6 +524,11 @@ export class EmbedDaemon {
       this.#config.snapshot.intervalMs,
       async () => {
         const snapshot = await this.#snapshotEngine.generate();
+
+        // ADR-0060: drop out-of-filter items before anything downstream
+        // (outputs, distillation, roadmap) can see them.
+        enforceSectionFilters(this.#rootDir, snapshot, this.#config.sources);
+
         this.#lastSnapshot = snapshot;
         await dispatchOutputs(snapshot, this.#config.outputs, this.#registry, this.#authorityGuard, this.#rootDir);
         process.stderr.write(`[embed] Snapshot generated at ${snapshot.completedAt} — ${snapshot.summary.totalItems} items, ${snapshot.summary.errorCount} errors\n`);
@@ -457,7 +557,7 @@ export class EmbedDaemon {
         }
 
         // Distill snapshot items (issues, PRs, messages) into observation store
-        const itemsWritten = distillSnapshotItems(this.#rootDir, snapshot.sections ?? []);
+        const itemsWritten = await distillSnapshotItems(this.#rootDir, snapshot.sections ?? []);
         if (itemsWritten) {
           process.stderr.write(`[embed] Distilled ${itemsWritten} snapshot item(s) into observation store\n`);
         }
@@ -564,9 +664,9 @@ export class EmbedDaemon {
       60_000,
       async () => {
         const logPath = join(doctorRoot(), 'runtime', 'embed-daemon.log');
-        const capMb = Number(process.env.CONSTRUCT_EMBED_LOG_MAX_MB) || 50;
+        const capMb = resolveNonNegativeSetting(process.env, 'CONSTRUCT_EMBED_LOG_MAX_MB', 50);
         const maxBytes = Math.floor(capMb * 1024 * 1024);
-        const maxSegments = Number(process.env.CONSTRUCT_EMBED_LOG_MAX_SEGMENTS) || 5;
+        const maxSegments = resolveNonNegativeSetting(process.env, 'CONSTRUCT_EMBED_LOG_MAX_SEGMENTS', 5);
         await rotateIfOversized(logPath, { maxBytes, maxSegments, gzip: true });
       },
       { runImmediately: true },
@@ -1125,6 +1225,24 @@ this.#scheduler.register(
       );
     }
 
+    // ── Job 16: embed-capabilities (ADR-0061 / LMCP-P2/F5) ───────────────────
+    // One scheduled job per enabled embed-capability manifest — exactly the
+    // enabled set, read fresh at startup so `construct embed enable/disable`
+    // takes effect on the next daemon restart. The job body (capability-jobs.mjs
+    // runCapabilityTick) composes the bound provider slice off this daemon's
+    // own last snapshot, asks workflow-invoke.mjs for the plan, and enqueues
+    // any resulting proposals into this same approval queue — never through
+    // a provider write adapter. No reasoningExecutor is wired in here because
+    // no in-process/external reasoning engine ships in this repo yet; every
+    // tick is therefore an honest skipped-with-reason(reasoning-executor-not-available)
+    // until one is wired in, per ADR-0061 §3.
+    this.#capabilityIds = registerEmbedCapabilityJobs(this.#scheduler, {
+      rootDir: this.#rootDir,
+      env: this.#env,
+      getSnapshot: () => this.#lastSnapshot,
+      approvalQueue: this.#approvalQueue,
+    });
+
     this.#scheduler.start();
 
     // Reactive inbox watching: low-latency trigger backed by the scheduler
@@ -1200,6 +1318,7 @@ this.#scheduler.register(
       schedulerTasks: this.#scheduler?.status() ?? [],
       providerHealth: this.#providerHealth.summary(),
       inboxDirs: this.#inboxWatcher?.dirs() ?? [],
+      embedCapabilities: this.#capabilityIds,
     };
   }
 

package/lib/embed/demand-fetch.mjs

@@ -15,15 +15,20 @@
  * Does NOT require the daemon to be running.
  */
 
+import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { loadConstructEnv } from '../env-config.mjs';
 import { addObservation } from '../observation-store.mjs';
 import { loadProjectConfig } from '../config/project-config.mjs';
+import { configDir } from '../config/xdg.mjs';
+import { loadEmbedConfig } from './config.mjs';
+import { matchesFilter, validateFilterConfig } from '../providers/contract.mjs';
 import {
   resolveEffectiveSourceTargetsFromConfig,
   resolveKnownSourcesFromTargets,
 } from '../config/source-targets.mjs';
+import { getSourceTargetDescriptor, renderTemplate } from '../config/source-target-registry.mjs';
 
 // ─── Self-query detection ────────────────────────────────────────────────────
 
@@ -136,6 +141,75 @@ export function matchSourceFromQuery(query, env = process.env, cwd = process.cwd
   return matches[0];
 }
 
+// ─── ADR-0060 filter enforcement (construct-737t) ────────────────────────────
+
+/**
+ * Load embed.yaml's sources[] list — the only place an ADR-0060 filter block
+ * lives (ADR-0060 §2; enforced on the poll path by daemon.mjs's
+ * enforceSectionFilters). demand-fetch resolves its own source/target
+ * records from construct.config.json and legacy env vars, which carry no
+ * filter field, so this reads the same embed config the daemon would load,
+ * purely to look up a governing filter. Missing/unreadable embed.yaml is not
+ * an error here — demand-fetch works without the daemon running.
+ */
+function loadEmbedSourcesForFilter(env) {
+  try {
+    const configPath = join(configDir(undefined, env), 'embed.yaml');
+    if (!existsSync(configPath)) return [];
+    return loadEmbedConfig(configPath).sources ?? [];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Find the embed.yaml source entry that declares `ref` among its repo/
+ * project/channel/team values for `provider`, using the same plural-array/
+ * singular-scalar fallback (`opts.repos ?? [opts.repo]`) the real providers
+ * use to resolve their own config. A `ref` of null (a broad, unscoped fetch
+ * spanning every configured value) never resolves to one governing source,
+ * so it is left unfiltered rather than guessing.
+ */
+function findGoverningEmbedSource(embedSources, provider, ref) {
+  if (ref == null) return null;
+  const descriptor = getSourceTargetDescriptor(provider);
+  const embed = descriptor?.embed;
+  if (!embed) return null;
+
+  const pluralField = embed.valueKind === 'array' ? embed.valueField : `${embed.valueField}s`;
+  const singularField = embed.valueKind === 'array' ? embed.valueField.replace(/s$/, '') : embed.valueField;
+  const target = String(ref).trim().toLowerCase();
+
+  return embedSources.find((src) => {
+    if (src.provider !== provider) return false;
+    const declared = Array.isArray(src[pluralField])
+      ? src[pluralField]
+      : (src[singularField] ? [src[singularField]] : []);
+    return declared.some((v) => String(v).trim().toLowerCase() === target);
+  }) ?? null;
+}
+
+/**
+ * Apply the governing embed.yaml filter (if any) to items already fetched
+ * from `provider`/`ref`, mirroring daemon.mjs's enforceSectionFilters so the
+ * on-demand path and the poll path never disagree on which items are in
+ * scope. Fails closed on an invalid filter config: every item is dropped and
+ * the reason surfaces as an error, never silently ingested.
+ */
+function applyEmbedFilter(items, provider, ref, env) {
+  const source = findGoverningEmbedSource(loadEmbedSourcesForFilter(env), provider, ref);
+  const filter = source?.filter ?? null;
+  if (filter == null) return { items, error: null };
+
+  try {
+    validateFilterConfig(provider, filter);
+  } catch (err) {
+    return { items: [], error: err.message };
+  }
+
+  return { items: items.filter((item) => matchesFilter(item, filter)), error: null };
+}
+
 // ─── On-demand fetch ─────────────────────────────────────────────────────────
 
 /**
@@ -261,7 +335,7 @@ export async function demandFetch({ query, rootDir, env, cwd, teamId = null, tar
 
   // Separate real items from error sentinels the provider may have returned
   const errorItems = rawItems.filter(i => i.type === 'error');
-  const dataItems = rawItems.filter(i => i.type !== 'error');
+  let dataItems = rawItems.filter(i => i.type !== 'error');
 
   if (!dataItems.length && errorItems.length) {
     const errMsg = errorItems.map(i => i.message).join('; ');
@@ -275,6 +349,21 @@ export async function demandFetch({ query, rootDir, env, cwd, teamId = null, tar
     };
   }
 
+  // ADR-0060: drop out-of-scope items the same way enforceSectionFilters does
+  // on the poll path, so a source whose refs/repo list is broader than its
+  // filter.scope narrows identically on the on-demand path.
+  const filtered = applyEmbedFilter(dataItems, match.provider, match.ref, resolvedEnv);
+  if (filtered.error) {
+    return {
+      ok: false,
+      reason: 'filter_config_error',
+      message: `${match.display} filter config error: ${filtered.error}`,
+      items: [],
+      match,
+    };
+  }
+  dataItems = filtered.items;
+
   // Write each item as an observation so future queries find them in the knowledge base
   let written = 0;
   for (const item of dataItems) {
@@ -376,7 +465,22 @@ async function demandFetchAll({ query, rootDir, env, cwd } = {}) {
       if (!readCalls.length) continue;
       for (const { ref, opts, display } of readCalls) {
         try {
-          const items = await provider.read(ref, opts);
+          const rawItems = await provider.read(ref, opts) ?? [];
+
+          // ADR-0060: same governing-source filter lookup as the single-match
+          // path, keyed on this source's own ref so a broader universal fetch
+          // narrows identically to what enforceSectionFilters does at poll
+          // time. Error sentinels bypass the filter — matchesFilter would
+          // otherwise drop them for lacking a scope field, hiding a real
+          // provider error behind a filter that was never meant to judge it.
+          const errorSentinels = rawItems.filter((i) => i.type === 'error');
+          const filtered = applyEmbedFilter(rawItems.filter((i) => i.type !== 'error'), providerName, src.ref, env);
+          if (filtered.error) {
+            errors.push({ provider: providerName, ref: src.ref ?? null, error: `filter config: ${filtered.error}` });
+            continue;
+          }
+          const items = [...errorSentinels, ...filtered.items];
+
           if (items?.length) {
             allItems.push(...items);
             for (const item of items) {
@@ -431,78 +535,94 @@ async function demandFetchAll({ query, rootDir, env, cwd } = {}) {
 /**
  * Build a list of { ref, opts } pairs to pass to provider.read(ref, opts).
  *
+ * Dispatches on the matched provider's manifest-derived `sourceTarget.demandFetch`
+ * descriptor (lib/config/source-target-registry.mjs) rather than naming
+ * providers — a provider whose descriptor declares `queryDynamicJql` gets
+ * jira's recency-guarded/targeted JQL construction, one with `queryOptsKind:
+ * 'scalar'` gets linear's single-value opts, one with `querySupported: false`
+ * (or no `demandFetch` block at all) is skipped, and everything else gets
+ * github's fixed-array-opts, multi-ref shape.
+ *
  * @param {{ provider: string, ref: string|null, display: string }} match
  * @param {object} env
  * @returns {{ ref: string, opts: object, display: string }[]}
  */
 function buildReadCalls(match, env, cwd = process.cwd()) {
-  if (match.provider === 'github') {
-    const opts = { repos: [match.ref], limit: 25 };
-    return [
-      { ref: 'meta',    opts, display: match.display },
-      { ref: 'readme',  opts, display: match.display },
-      { ref: 'docs',    opts, display: match.display },
-      { ref: 'prs',     opts, display: match.display },
-      { ref: 'issues',  opts, display: match.display },
-      { ref: 'commits', opts, display: match.display },
-    ];
-  }
-  if (match.provider === 'jira') {
+  const descriptor = getSourceTargetDescriptor(match.provider);
+  const df = descriptor?.demandFetch;
+  if (!df || df.querySupported === false) return [];
+
+  if (df.queryDynamicJql) {
+    const dj = df.queryDynamicJql;
     const { config } = loadProjectConfig(cwd, env);
-    const targets = resolveEffectiveSourceTargetsFromConfig(config, env)
-      .filter((t) => t.provider === 'jira')
-      .map((t) => t.selector.project);
-    const projects = targets.length
-      ? targets
-      : (env.JIRA_PROJECTS ?? '').split(',').map((p) => p.trim()).filter(Boolean);
-    const recencyDays = parseInt(env.JIRA_FETCH_RECENCY_DAYS, 10) || 30;
+    const projects = resolveEffectiveSourceTargetsFromConfig(config, env)
+      .filter((t) => t.provider === match.provider)
+      .map((t) => t.selector[descriptor.selector.field]);
+    const projectList = projects.length
+      ? projects
+      : (env[dj.legacyProjectsEnvVar] ?? '').split(',').map((p) => p.trim()).filter(Boolean);
+    const recencyDays = parseInt(env[dj.recencyEnvVar], 10) || dj.recencyDefaultDays;
 
     let jql;
     if (match.ref) {
-      // Targeted project fetch — no recency cutoff, user asked for this project
-      jql = `project = "${match.ref}" AND statusCategory != Done ORDER BY updated DESC`;
-    } else if (projects.length > 0) {
-      // Broad/fallback fetch — scoped to configured projects with recency guard
-      const projectList = projects.map(p => `"${p}"`).join(', ');
-      jql = `project IN (${projectList}) AND updated >= -${recencyDays}d ORDER BY updated DESC`;
+      // Targeted fetch — no recency cutoff, user asked for this value specifically
+      jql = renderTemplate(dj.singleTemplate, { value: match.ref });
+    } else if (projectList.length > 0) {
+      // Broad/fallback fetch — scoped to configured values with recency guard
+      const quoted = projectList.map((p) => `"${p}"`).join(', ');
+      jql = renderTemplate(dj.broadTemplate, { values: quoted, recencyDays });
     } else {
-      // No JIRA_PROJECTS configured — skip Jira entirely rather than defaulting to user-scoped
+      // Nothing configured — skip rather than defaulting to an unscoped query
       return [];
     }
-    return [{ ref: 'issues', opts: { jql, limit: 50 }, display: match.display }];
+    return [{ ref: df.targetRefs[0], opts: { jql, limit: df.queryDefaultLimit }, display: match.display }];
   }
-  if (match.provider === 'linear') {
-    return [{ ref: 'issues', opts: { team: match.ref ?? null, limit: 50 }, display: match.display }];
+
+  if (df.queryOptsKind === 'scalar') {
+    const value = df.queryOptsNullable ? (match.ref ?? null) : match.ref;
+    return [{ ref: df.queryRefs[0], opts: { [df.queryOptsField]: value, limit: df.queryDefaultLimit }, display: match.display }];
   }
-  return [];
+
+  const opts = { [df.queryOptsField]: [match.ref], limit: df.queryDefaultLimit };
+  return df.queryRefs.map((ref) => ({ ref, opts, display: match.display }));
 }
 
 // Read calls for one resolved team source, honoring the target's own filters
 // (jira jql, github refs/limit, slack oldest) rather than the generic defaults.
+// Same manifest-derived dispatch as buildReadCalls, keyed on target.provider.
 
 function buildReadCallsForTarget(target) {
+  const descriptor = getSourceTargetDescriptor(target.provider);
   const sel = target.selector ?? {};
   const f = target.filters ?? {};
-  const display = `${target.provider}/${sel.repo ?? sel.project ?? sel.team ?? sel.channel ?? target.id}`;
-  switch (target.provider) {
-    case 'github': {
-      const opts = { repos: [sel.repo], limit: Number.isInteger(f.limit) ? f.limit : 25 };
-      const refs = Array.isArray(f.refs) ? f.refs : ['meta', 'readme', 'docs', 'prs', 'issues', 'commits'];
-      return refs.map((ref) => ({ ref, opts, display }));
-    }
-    case 'jira': {
-      const jql = typeof f.jql === 'string'
-        ? f.jql
-        : `project = "${sel.project}" AND statusCategory != Done ORDER BY updated DESC`;
-      return [{ ref: 'issues', opts: { jql, limit: Number.isInteger(f.limit) ? f.limit : 50 }, display }];
-    }
-    case 'linear':
-      return [{ ref: 'issues', opts: { team: sel.team, limit: Number.isInteger(f.limit) ? f.limit : 50 }, display }];
-    case 'slack':
-      return [{ ref: 'messages', opts: { channels: [sel.channel], oldest: Number.isInteger(f.oldest) ? f.oldest : 86400, limit: Number.isInteger(f.limit) ? f.limit : 50 }, display }];
-    default:
-      return [];
+  const display = `${target.provider}/${descriptor ? (sel[descriptor.selector.field] ?? target.id) : target.id}`;
+  const df = descriptor?.demandFetch;
+  if (!df) return [];
+
+  const limit = Number.isInteger(f.limit) ? f.limit : df.targetDefaultLimit;
+
+  if (df.targetJqlTemplate) {
+    const jql = typeof f[df.targetJqlFilterKey] === 'string'
+      ? f[df.targetJqlFilterKey]
+      : renderTemplate(df.targetJqlTemplate, { value: sel[descriptor.selector.field] });
+    return [{ ref: df.targetRefs[0], opts: { jql, limit }, display }];
+  }
+
+  if (df.targetOptsKind === 'scalar') {
+    return [{ ref: df.targetRefs[0], opts: { [df.targetOptsField]: sel[descriptor.selector.field], limit }, display }];
+  }
+
+  if (df.targetRefsFilterKey) {
+    const refs = Array.isArray(f[df.targetRefsFilterKey]) ? f[df.targetRefsFilterKey] : df.targetRefs;
+    const opts = { [df.targetOptsField]: [sel[descriptor.selector.field]], limit };
+    return refs.map((ref) => ({ ref, opts, display }));
   }
+
+  const opts = { [df.targetOptsField]: [sel[descriptor.selector.field]], limit };
+  for (const key of df.targetExtraFilterKeys ?? []) {
+    if (key === 'oldest') opts.oldest = Number.isInteger(f.oldest) ? f.oldest : df.targetOldestDefault;
+  }
+  return [{ ref: df.targetRefs[0], opts, display }];
 }
 
 // Drive the fetch from a team's resolved sources: one provider read per target,
@@ -526,11 +646,27 @@ async function demandFetchTeam({ teamId, targets, rootDir, env, providerRegistry
       errors.push({ provider: target.provider, targetId: target.id, message: `provider "${target.provider}" not registered` });
       continue;
     }
+    const targetDescriptor = getSourceTargetDescriptor(target.provider);
+    const targetRef = targetDescriptor ? (target.selector ?? {})[targetDescriptor.selector.field] : null;
     for (const { ref, opts, display } of buildReadCallsForTarget(target)) {
       try {
-        const items = await provider.read(ref, opts);
-        for (const item of items ?? []) {
-          if (item.type === 'error') { errors.push(item); continue; }
+        const rawItems = await provider.read(ref, opts) ?? [];
+
+        // ADR-0060: same governing-source filter lookup, keyed on the team
+        // target's own selector value, so a team-scoped fetch narrows
+        // identically to what enforceSectionFilters does at poll time. Error
+        // sentinels bypass the filter — they never carry a scope field, so
+        // matchesFilter would otherwise drop them and hide a real fetch error.
+        const errorSentinels = rawItems.filter((i) => i.type === 'error');
+        const filtered = applyEmbedFilter(rawItems.filter((i) => i.type !== 'error'), target.provider, targetRef, env);
+        if (filtered.error) {
+          errors.push({ provider: target.provider, targetId: target.id, message: `filter config: ${filtered.error}` });
+          continue;
+        }
+
+        for (const item of errorSentinels) errors.push(item);
+
+        for (const item of filtered.items) {
           allItems.push(item);
           try {
             addObservation(rootDir, {

package/lib/embed/inbox.mjs

@@ -16,8 +16,9 @@
  * two stats, so a partially-written drop is never consumed mid-write.
  *
  * State tracking:
- *   <rootDir>/.cx/runtime/inbox-state.json — maps filePath → processedAt
- *   Prevents re-processing the same file across daemon restarts.
+ *   <stateRoot>/runtime/inbox-state.json (ADR-0066: machine-scoped, not
+ *   project-local) — maps filePath → processedAt. Prevents re-processing the
+ *   same file across daemon restarts.
  *
  * Usage:
  *   const watcher = new InboxWatcher({ rootDir, env });
@@ -40,8 +41,9 @@ import { loadManifest, recordFile, hasFile, sha256Of, MANIFEST_REL_PATH } from '
 import { gatherAttribution } from '../intake/attribution.mjs';
 import { acquirePollLock, releasePollLock } from '../intake/poll-lock.mjs';
 import { doctorRoot } from '../config/xdg.mjs';
+import { resolveStatePath } from '../state-root.mjs';
 
-const STATE_FILE = '.cx/runtime/inbox-state.json';
+const STATE_FILE_REL = join('runtime', 'inbox-state.json');
 const ROOT_INBOX_SUBDIR = 'inbox';
 const STAGING_SUBDIR = '.staging';
 const MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024; // 50 MB hard cap
@@ -116,26 +118,26 @@ function pruneStaleState(rootDir, state) {
 // ─── State helpers ────────────────────────────────────────────────────────────
 
 function statePath(rootDir) {
-  return join(rootDir, STATE_FILE);
+  return resolveStatePath(rootDir, STATE_FILE_REL);
 }
 
 function readState(rootDir) {
+  if (!shouldCreateCx(rootDir)) return {};
   const p = statePath(rootDir);
   if (!existsSync(p)) return {};
   try { return JSON.parse(readFileSync(p, 'utf8')); } catch (err) { process.stderr.write('[inbox.mjs] readState: ' + (err?.message ?? String(err)) + '\n'); return {}; }
 }
 
 function writeState(rootDir, state) {
-  const p = statePath(rootDir);
-  
-  // Only create .cx directories if this is an initialized project
+  // Only persist state if this is an initialized project — an uninitialized
+  // cwd shouldn't accumulate machine-scoped state for a directory that isn't
+  // really a Construct project.
+
   if (shouldCreateCx(rootDir)) {
     ensureCxDir(rootDir);
-    mkdirSync(join(rootDir, '.cx', 'runtime'), { recursive: true });
+    const p = statePath(rootDir);
     writeFileSync(p, JSON.stringify(state, null, 2) + '\n');
   }
-  // If not an initialized project, don't create .cx - state will be lost
-  // but that's okay since we shouldn't be processing files in uninitialized dirs
 }
 
 // ─── Directory resolution ─────────────────────────────────────────────────────