@openparachute/vault 0.6.4-rc.3 → 0.6.4-rc.5

package/core/src/store.ts

@@ -631,36 +631,65 @@ export class BunSqliteStore implements Store {
     const priorRecord =
       patch.fields !== undefined ? tagSchemaOps.getTagRecord(this.db, tag) : null;
 
-    const result = tagSchemaOps.upsertTagRecord(this.db, tag, patch);
-
+    const indexedSet = (fields: Record<string, tagSchemaOps.TagFieldSchema> | null | undefined) =>
+      new Set(
+        Object.entries(fields ?? {})
+          .filter(([, v]) => v.indexed === true)
+          .map(([k]) => k),
+      );
+    const nextFields = patch.fields; // object | null | undefined
+    const priorIndexed = indexedSet(priorRecord?.fields);
+    const nextIndexed = indexedSet(nextFields);
+
+    // PRE-VALIDATE every newly-indexed field BEFORE any persistence. A bad
+    // field name (or unmappable type) must fail closed — the schema record
+    // must NOT be written when the backing index can't be created. Pre-checking
+    // here, before the transaction even opens, turns the failure into a clean
+    // caller error (IndexedFieldError → 400) and leaves the schema untouched.
+    // Without this, the prior code persisted the field declaration, THEN threw
+    // on declareField — a 500 plus a tag claiming an index the engine can't
+    // build (the "lying schema" loop). See vault#478.
     if (patch.fields !== undefined) {
-      const indexedSet = (fields: Record<string, tagSchemaOps.TagFieldSchema> | null | undefined) =>
-        new Set(
-          Object.entries(fields ?? {})
-            .filter(([, v]) => v.indexed === true)
-            .map(([k]) => k),
-        );
-      const nextFields = patch.fields; // object | null
-      const priorIndexed = indexedSet(priorRecord?.fields);
-      const nextIndexed = indexedSet(nextFields);
       for (const fieldName of nextIndexed) {
         const spec = nextFields![fieldName]!;
         const mapped = indexedFieldOps.mapFieldType(spec.type);
-        // Unmappable type for indexing is a caller error; surface it rather
-        // than silently skipping. MCP/REST validate up-front for a cleaner
-        // message, but this is the backstop at the chokepoint.
         if (!mapped) {
           throw new indexedFieldOps.IndexedFieldError(
             `field "${fieldName}" has unsupported type "${spec.type}" for indexing (supported: string, integer, boolean)`,
           );
         }
-        indexedFieldOps.declareField(this.db, fieldName, mapped, tag);
+        // Throws IndexedFieldError on an invalid identifier (e.g. kebab-case).
+        indexedFieldOps.validateFieldName(fieldName);
       }
-      for (const fieldName of priorIndexed) {
-        if (!nextIndexed.has(fieldName)) {
-          indexedFieldOps.releaseField(this.db, fieldName, tag);
+    }
+
+    // Persist the record + reconcile the indexed-field lifecycle atomically.
+    // If declareField throws inside the transaction (e.g. a cross-tag type
+    // mismatch only detectable once the existing declarer set is consulted),
+    // the whole write rolls back — the schema never ends up claiming an index
+    // that doesn't exist. vault#478 transactional fix.
+    let result: tagSchemaOps.TagRecord;
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      result = tagSchemaOps.upsertTagRecord(this.db, tag, patch);
+
+      if (patch.fields !== undefined) {
+        for (const fieldName of nextIndexed) {
+          const spec = nextFields![fieldName]!;
+          // Type already validated above; non-null assertion is safe here.
+          const mapped = indexedFieldOps.mapFieldType(spec.type)!;
+          indexedFieldOps.declareField(this.db, fieldName, mapped, tag);
+        }
+        for (const fieldName of priorIndexed) {
+          if (!nextIndexed.has(fieldName)) {
+            indexedFieldOps.releaseField(this.db, fieldName, tag);
+          }
         }
       }
+      this.db.exec("COMMIT");
+    } catch (err) {
+      this.db.exec("ROLLBACK");
+      throw err;
     }
 
     if (patch.parent_names !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.6.4-rc.3",
+  "version": "0.6.4-rc.5",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/cli.ts

@@ -3345,11 +3345,17 @@ async function cmdExport(args: string[]) {
  */
 async function cmdSchema(args: string[] = []) {
   const sub = args[0];
+  if (sub === "migrate-field") {
+    await cmdSchemaMigrateField(args.slice(1));
+    return;
+  }
   if (sub !== "prune") {
-    console.error("Usage: parachute-vault schema prune [--vault <name>] [--dry-run|--apply|--yes]");
+    console.error("Usage: parachute-vault schema <prune|migrate-field> ...");
     console.error("\nSubcommands:");
-    console.error("  prune    Drop orphaned indexed-field columns whose declaring tags are gone.");
-    console.error("           Dry-run by default (--dry-run is an explicit alias); pass --apply (or --yes) to execute.");
+    console.error("  prune          Drop orphaned indexed-field columns whose declaring tags are gone.");
+    console.error("                 Dry-run by default (--dry-run is an explicit alias); pass --apply (or --yes) to execute.");
+    console.error("  migrate-field  Evolve a tag-schema field across existing notes (rename/remap/set-default/retype).");
+    console.error("                 Dry-run by default; pass --apply (or --yes) to write. See `schema migrate-field --help`.");
     process.exit(1);
   }
 
@@ -3416,6 +3422,154 @@ async function cmdSchema(args: string[] = []) {
   }
 }
 
+/**
+ * `parachute-vault schema migrate-field <tag> <field> --transform <spec>` —
+ * evolve a tag-schema field's type / values across the existing notes that
+ * carry the tag (vault#314). Dry-run by default — prints the count + a sample
+ * of what WOULD change and writes nothing; `--apply` (alias `--yes`) executes.
+ *
+ * Transform specs (the built-in set — issue #314):
+ *   rename:<newkey>          move the field's value to <newkey>, drop the old key
+ *   remap:<old>=<new>[,…]    rewrite enum-style values (repeatable / comma-sep)
+ *   set-default:<value>      fill the field where missing/null
+ *   set-default-invalid:<v>  set <v> where missing/null OR currently schema-invalid
+ *   to_string | to_int | to_number | to_boolean   retype the value
+ *
+ * The migration writes through `strict` enforcement (the migrate-bypass path,
+ * vault#299) so a freshly-declared strict field that the back-catalog violates
+ * doesn't block the rewrite, and every bypassed write is logged. Rewrites are
+ * attributed `migrate` (last_updated_*); created_* is preserved.
+ *
+ * Atomic by default: if any note's value can't be converted (e.g. `to_int` on
+ * "banana"), the apply aborts BEFORE writing anything and lists the offenders.
+ * Pass `--continue-on-error` for best-effort (write the convertible, skip the rest).
+ */
+async function cmdSchemaMigrateField(args: string[]) {
+  const usageLine =
+    "Usage: parachute-vault schema migrate-field <tag> <field> --transform <spec> [--vault <name>] [--apply|--yes] [--continue-on-error]";
+  if (args[0] === "--help" || args[0] === "-h") {
+    console.log(usageLine);
+    console.log("\nTransform specs:");
+    console.log("  rename:<newkey>          Move the field's value to <newkey>, drop the old key.");
+    console.log("  remap:<old>=<new>[,...]  Rewrite enum-style values (repeatable, comma-separated).");
+    console.log("  set-default:<value>      Set <value> on notes where the field is missing/null.");
+    console.log("  set-default-invalid:<v>  Set <v> where missing/null OR the current value is schema-invalid.");
+    console.log("  to_string | to_int | to_number | to_boolean   Retype the field's value.");
+    console.log("\nDry-run by default — prints the plan. Pass --apply (or --yes) to write.");
+    return;
+  }
+
+  let vaultName = "default";
+  let apply = false;
+  let continueOnError = false;
+  let transformSpec: string | undefined;
+  const positionals: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === "--vault") {
+      const v = args[++i];
+      if (!v) { console.error("--vault requires a value."); process.exit(1); }
+      vaultName = v;
+    } else if (arg === "--transform") {
+      const v = args[++i];
+      if (!v) { console.error("--transform requires a value."); process.exit(1); }
+      transformSpec = v;
+    } else if (arg === "--apply" || arg === "--yes") {
+      apply = true;
+    } else if (arg === "--dry-run") {
+      // default; accept as an explicit affirmative
+    } else if (arg === "--continue-on-error") {
+      continueOnError = true;
+    } else if (arg.startsWith("--")) {
+      console.error(`Unknown flag for \`schema migrate-field\`: ${arg}`);
+      process.exit(1);
+    } else {
+      positionals.push(arg);
+    }
+  }
+
+  const [tag, field] = positionals;
+  if (!tag || !field || !transformSpec) {
+    console.error(usageLine);
+    console.error("\n  <tag> <field> and --transform <spec> are all required.");
+    console.error("  Run `schema migrate-field --help` for the transform spec list.");
+    process.exit(1);
+  }
+
+  const { parseTransformSpec } = await import("../core/src/migrate-tag-field.ts");
+  let transform;
+  try {
+    transform = parseTransformSpec(transformSpec);
+  } catch (err) {
+    console.error(`Invalid --transform "${transformSpec}": ${(err as Error).message}`);
+    process.exit(1);
+  }
+
+  const config = readVaultConfig(vaultName);
+  if (!config) {
+    console.error(`Vault "${vaultName}" not found.`);
+    process.exit(1);
+  }
+
+  const { getVaultStore } = await import("./vault-store.ts");
+  const { migrateTagField } = await import("../core/src/migrate-tag-field.ts");
+  const { logStrictBypass } = await import("./scopes.ts");
+  const store = getVaultStore(vaultName);
+
+  const result = await migrateTagField(store, {
+    tag,
+    field,
+    transform: transform!,
+    apply,
+    continueOnError,
+    // The CLI is the operator path — it bypasses strict enforcement by nature
+    // (writes go through the store, not the scope-gated transport). Log every
+    // waived violation so the bypass is auditable, exactly as MW2 intends.
+    onStrictBypass: (info) => logStrictBypass(info),
+  });
+
+  const verb = result.applied ? "Migrated" : "Would migrate";
+  console.log(
+    `${verb} field "${result.field}" on #${result.tag} in vault "${vaultName}"${result.applied ? "" : " (dry-run)"}:`,
+  );
+  console.log(
+    `  scanned ${result.scanned} · ${result.applied ? "changed" : "would change"} ${result.changed} · unchanged ${result.unchanged} · errored ${result.errored}`,
+  );
+
+  if (result.sample.length > 0) {
+    console.log(`\n  ${result.applied ? "Changes" : "Sample of changes"} (${result.sample.length}${result.changed > result.sample.length ? ` of ${result.changed}` : ""}):`);
+    for (const c of result.sample) {
+      const ref = c.path ?? c.id;
+      if (c.renamedTo) {
+        console.log(`    ${ref}: ${field} → ${c.renamedTo} = ${JSON.stringify(c.after)}`);
+      } else {
+        console.log(`    ${ref}: ${JSON.stringify(c.before)} → ${JSON.stringify(c.after)}`);
+      }
+    }
+  }
+
+  if (result.errors.length > 0) {
+    console.log(`\n  Unconvertible (${result.errors.length}):`);
+    for (const e of result.errors) {
+      console.log(`    ${e.path ?? e.id}: ${e.error}`);
+    }
+    if (apply && !result.applied) {
+      console.log(
+        "\n  Aborted without writing — some notes can't be converted (atomic by default).",
+      );
+      console.log("  Fix the data, or re-run with --continue-on-error to migrate the rest.");
+      process.exit(1);
+    }
+  }
+
+  if (!apply && result.changed > 0) {
+    console.log("\n  Re-run with --apply (or --yes) to write these changes.");
+  }
+  if (result.changed === 0 && result.errored === 0) {
+    console.log("\n  Nothing to migrate — the back-catalog already conforms.");
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Export-watch glue. The git-shell + commit-message logic lives in
 // `./export-watch.ts` for unit-testability; cli.ts just wires it in.
@@ -3961,6 +4115,13 @@ Schema maintenance:
   parachute-vault schema prune --apply                Execute the prune (alias: --yes). Co-declared
                                                        fields keep their column; a drop loses only
                                                        the index (data lives in notes.metadata).
+  parachute-vault schema migrate-field <tag> <field>  Evolve a tag-schema field across existing
+    --transform <spec>                                 notes (rename:<key>, remap:<old>=<new>,
+                                                       set-default:<v>, to_string/to_int/to_number/
+                                                       to_boolean). Dry-run by default — prints the
+                                                       plan; pass --apply (or --yes) to write.
+                                                       Writes through strict enforcement (migrate
+                                                       bypass). See \`schema migrate-field --help\`.
 
 ── Advanced / standalone ──────────────────────────────────────────────
 

package/src/module-config.ts

@@ -14,31 +14,26 @@
  *
  * PUT /.parachute/config is Phase 3 — not implemented here.
  *
+ * Scope boundary (vault#478): `GET /.parachute/config` is gated by
+ * `vault:<name>:admin` — admin over *your* vault only — so it describes and
+ * returns ONLY per-vault config, never daemon-GLOBAL settings.
+ *
  * Fields currently described:
  *   - audio_retention:      per-vault enum, backed by VaultConfig.audio_retention.
- *   - port:                 GlobalConfig.port, exposed read-only.
- *   - autoTranscribe.*:     vault↔scribe handoff (vault#353, design 2026-05-21
- *                           Part 2). Three nested fields per design Q4:
- *       - enabled:          boolean toggle, default true when scribe is
- *                           reachable (persisted in
- *                           GlobalConfig.auto_transcribe.enabled). Default
- *                           flipped from off → on so installing scribe is
- *                           the only opt-in signal needed.
- *       - scribeUrl:        readOnly — resolved per-process from
- *                           `~/.parachute/services.json` via
- *                           `scribe-discovery.ts`. Operators can't point at an
- *                           arbitrary scribe; the discovery layer is the gate.
- *       - scribeBearer:     writeOnly — sourced from SCRIBE_AUTH_TOKEN env var.
- *                           Hub install generates one at first boot
- *                           (see scribe-env.ts:ensureScribeBearer); manual
- *                           rotation is via `parachute-vault config set`.
- *   - scribe_url / scribe_token (deprecated): kept under their legacy names
- *                           through one release for the hub admin SPA's prior
- *                           render path; new code should read autoTranscribe.*.
+ *   - autoTranscribe.enabled: per-vault toggle (vault#353). Reports the value
+ *                           THIS vault will use, resolving per-vault override
+ *                           (VaultConfig.auto_transcribe.enabled) → server
+ *                           default (GlobalConfig.auto_transcribe.enabled) →
+ *                           true. The inherited fallback is the per-vault
+ *                           truth, not a leak of the global setting.
+ *
+ * Deliberately NOT exposed here (daemon-global → operator-only surface):
+ *   - port:                 GlobalConfig.port (deployment-wide listen port).
+ *   - autoTranscribe.scribeUrl / scribe_url: discovery-resolved per-process.
+ *   - autoTranscribe.scribeBearer / scribe_token: shared SCRIBE_AUTH_TOKEN.
  */
 
 import type { VaultConfig, GlobalConfig } from "./config.ts";
-import { resolveScribeUrl } from "./scribe-discovery.ts";
 
 export interface ModuleConfigSchema {
   $schema: string;
@@ -75,83 +70,54 @@ export function buildConfigSchema(): ModuleConfigSchema {
             default: true,
             title: "Enable auto-transcription",
             description:
-              "Master toggle. Default on — audio uploads transcribe automatically when scribe is reachable. Set to false to disable. Global — persisted in `GlobalConfig.auto_transcribe.enabled` and applies to every vault on this server. Per-vault control is a future enhancement when multi-vault deployments need it.",
-          },
-          scribeUrl: {
-            type: "string",
-            format: "uri",
-            readOnly: true,
-            title: "Scribe URL",
-            description:
-              "URL of the scribe service. Auto-populated from `~/.parachute/services.json` at vault startup (or from the SCRIBE_URL env var when set). Read-only — operators can't point at an arbitrary scribe.",
-          },
-          scribeBearer: {
-            type: "string",
-            writeOnly: true,
-            title: "Scribe auth bearer",
-            description:
-              "Shared bearer for the vault→scribe loopback contract. Hub install generates one at first boot. Write-only — never returned by GET.",
+              "Per-vault toggle. Default on — audio uploads transcribe automatically when scribe is reachable. Set to false to disable for THIS vault. Resolves per-vault override → server default → on, so leaving it unset inherits the deployment default.",
           },
         },
       },
-      // Legacy aliases kept for back-compat with callers that read the
-      // pre-vault#353 shape. New consumers should read `autoTranscribe.*`.
-      scribe_url: {
-        type: "string",
-        format: "uri",
-        title: "Scribe URL (deprecated alias)",
-        description:
-          "Legacy alias for `autoTranscribe.scribeUrl`. Will be removed in a future release.",
-        readOnly: true,
-        deprecated: true,
-      },
-      scribe_token: {
-        type: "string",
-        title: "Scribe auth token (deprecated alias)",
-        description:
-          "Legacy alias for `autoTranscribe.scribeBearer`. Will be removed in a future release.",
-        writeOnly: true,
-        deprecated: true,
-      },
-      port: {
-        type: "integer",
-        minimum: 1,
-        maximum: 65535,
-        title: "HTTP port",
-        description: "Port the vault server listens on. Set at init time; changing requires a restart.",
-        readOnly: true,
-      },
+      // NOTE (vault#478): daemon-GLOBAL fields (the listen `port`, the
+      // discovery-resolved scribe URL, the shared scribe bearer) are
+      // deliberately NOT described here. This endpoint is gated by
+      // `vault:<name>:admin` — admin over *your* vault only — so it neither
+      // describes nor returns deployment-wide settings. Those live behind the
+      // operator-only surface (CLI / global config).
     },
   };
 }
 
 /**
- * Effective config values, with `writeOnly` fields stripped. `scribeBearer`
- * (and its legacy alias `scribe_token`) are declared `writeOnly` and never
- * returned, even when set in the environment.
+ * Effective config values for ONE vault. The shared scribe bearer is
+ * daemon-global and never returned (see the scope boundary below).
+ *
+ * Scope boundary (vault#478): the `GET /vault/<name>/.parachute/config`
+ * endpoint is gated by `vault:<name>:admin` — "admin over *your* vault only".
+ * It must therefore return ONLY per-vault config, never daemon-GLOBAL settings
+ * (the listen `port`, the discovery-resolved scribe URL, the server-wide
+ * auto-transcribe default). Those describe the whole deployment, not this
+ * vault, and leaking them across the per-vault admin boundary matters once a
+ * shared multi-vault daemon hands admin-on-one-vault to a beta signup. They
+ * live behind the operator-only surface (the CLI / global config), not here.
+ *
+ * `autoTranscribe.enabled` IS per-vault: it reports the value THIS vault will
+ * actually use, resolving per-vault override → global default → true (mirrors
+ * `shouldAutoTranscribe`). That's a per-vault effective value, not the raw
+ * daemon-global toggle — reporting it doesn't leak the global setting (an
+ * unset vault simply inherits, which is the per-vault truth).
  */
 export function buildConfigValues(
   vaultConfig: VaultConfig,
   globalConfig: GlobalConfig,
-  env: { SCRIBE_URL?: string | undefined } = process.env as { SCRIBE_URL?: string },
 ): Record<string, unknown> {
-  // Resolve scribe URL through the discovery layer so the GET shape reflects
-  // what the worker will actually use (services.json > SCRIBE_URL > unset).
-  // Pass env through so the test harness's override is honored.
-  const scribeUrl = resolveScribeUrl(env as NodeJS.ProcessEnv) ?? "";
   return {
     audio_retention: vaultConfig.audio_retention ?? "keep",
     autoTranscribe: {
-      // Match shouldAutoTranscribe's `?? true` so the admin SPA displays
-      // the same value runtime uses. An unset config row shows `true`
-      // because that's what vault will actually do on the next audio upload.
-      enabled: globalConfig.auto_transcribe?.enabled ?? true,
-      scribeUrl,
+      // Per-vault effective value: this vault's own override wins; otherwise it
+      // inherits the server default; otherwise true. Same ladder as
+      // shouldAutoTranscribe, so the admin SPA shows what this vault will do.
+      enabled:
+        vaultConfig.auto_transcribe?.enabled
+        ?? globalConfig.auto_transcribe?.enabled
+        ?? true,
     },
-    // Legacy alias mirrors `autoTranscribe.scribeUrl` so hubs reading the
-    // pre-vault#353 shape don't regress.
-    scribe_url: scribeUrl,
-    port: globalConfig.port,
   };
 }
 

package/src/routes.ts

@@ -14,7 +14,7 @@
 import type { Store, Note, QueryOpts } from "../core/src/types.ts";
 import { TAG_EXPAND_MODES, type TagExpandMode } from "../core/src/tag-hierarchy.ts";
 import { listUnresolvedWikilinks } from "../core/src/wikilinks.ts";
-import { getNote, getNotes, getNoteTags, toNoteIndex, filterMetadata, MAX_BATCH_SIZE, validateExtension, ExtensionValidationError } from "../core/src/notes.ts";
+import { getNote, getNotes, getNoteTags, toNoteIndex, filterMetadata, mergeMetadata, MAX_BATCH_SIZE, validateExtension, ExtensionValidationError } from "../core/src/notes.ts";
 import {
   parseContentRange,
   applyContentRange,
@@ -26,6 +26,7 @@ import type { ValidationWarning } from "../core/src/schema-defaults.ts";
 import { logStrictBypass } from "./scopes.ts";
 import * as linkOps from "../core/src/links.ts";
 import * as tagSchemaOps from "../core/src/tag-schemas.ts";
+import { IndexedFieldError } from "../core/src/indexed-fields.ts";
 import {
   buildExpandVisibility,
   filterHydratedLinksByTagScope,
@@ -1652,8 +1653,11 @@ async function handleNotesInner(
         updates.extension = validateExtension(body.extension);
       }
       if (body.metadata !== undefined) {
-        const existing = (note.metadata as Record<string, unknown>) ?? {};
-        updates.metadata = { ...existing, ...body.metadata };
+        // RFC 7386 merge: incoming `null` removes the key (vault#478/#479).
+        updates.metadata = mergeMetadata(
+          note.metadata as Record<string, unknown> | null | undefined,
+          body.metadata as Record<string, unknown>,
+        );
       }
       if (body.created_at !== undefined || body.createdAt !== undefined) {
         updates.created_at = body.created_at ?? body.createdAt;
@@ -2093,12 +2097,27 @@ export async function handleTags(
       fieldsPatch = Object.keys(merged).length > 0 ? merged : null;
     }
 
-    const result = await store.upsertTagRecord(tagName, {
-      ...(body.description !== undefined ? { description: body.description } : {}),
-      ...(fieldsPatch !== undefined ? { fields: fieldsPatch } : {}),
-      ...(relationshipsPatch !== undefined ? { relationships: relationshipsPatch } : {}),
-      ...(parentNamesPatch !== undefined ? { parent_names: parentNamesPatch } : {}),
-    });
+    // A bad indexed-field name (or an unindexable type, or a cross-tag type
+    // mismatch) is a CLIENT error — return 400, not the catch-all 500. The
+    // store pre-validates and is transactional, so the schema is left
+    // unchanged on failure (no orphan/lying index). vault#478.
+    let result;
+    try {
+      result = await store.upsertTagRecord(tagName, {
+        ...(body.description !== undefined ? { description: body.description } : {}),
+        ...(fieldsPatch !== undefined ? { fields: fieldsPatch } : {}),
+        ...(relationshipsPatch !== undefined ? { relationships: relationshipsPatch } : {}),
+        ...(parentNamesPatch !== undefined ? { parent_names: parentNamesPatch } : {}),
+      });
+    } catch (err) {
+      if (err instanceof IndexedFieldError) {
+        return json(
+          { error: err.message, error_type: "invalid_indexed_field" },
+          400,
+        );
+      }
+      throw err;
+    }
     return json(result);
   }
 

package/src/routing.test.ts

@@ -1262,12 +1262,17 @@ describe("/.parachute/config/schema + /.parachute/config", () => {
     expect(body.type).toBe("object");
     expect(body.properties.audio_retention?.type).toBe("string");
     expect(body.properties.audio_retention?.enum).toEqual(["keep", "until_transcribed", "never"]);
-    expect(body.properties.scribe_url?.type).toBe("string");
-    expect(body.properties.scribe_token?.writeOnly).toBe(true);
-    expect(body.properties.port?.readOnly).toBe(true);
+    expect(body.properties.autoTranscribe?.type).toBe("object");
+    // vault#478 scope boundary: daemon-GLOBAL fields are NOT described by the
+    // per-vault admin config schema. The per-vault admin surface is "admin
+    // over *your* vault only" — port / scribe URL / scribe bearer are
+    // deployment-wide and live behind the operator-only surface.
+    expect(body.properties).not.toHaveProperty("scribe_url");
+    expect(body.properties).not.toHaveProperty("scribe_token");
+    expect(body.properties).not.toHaveProperty("port");
   });
 
-  test("config returns current values with writeOnly fields excluded", async () => {
+  test("config returns ONLY per-vault values, never daemon-global ones (scope boundary, vault#478)", async () => {
     createVault("journal");
     const token = await createAdminToken("journal");
     const path = "/vault/journal/.parachute/config";
@@ -1284,13 +1289,22 @@ describe("/.parachute/config/schema + /.parachute/config", () => {
       );
       expect(res.status).toBe(200);
       const body = (await res.json()) as Record<string, unknown>;
+      // Per-vault config is present.
       expect(body.audio_retention).toBe("keep"); // default when unset
-      expect(body.scribe_url).toBe("https://scribe.example/v1");
-      expect(body.port).toBe(1940);
+      expect(body).toHaveProperty("autoTranscribe");
+      // Daemon-GLOBAL values must NOT cross the per-vault admin boundary.
+      expect(body).not.toHaveProperty("port");
+      expect(body).not.toHaveProperty("scribe_url");
+      // The discovery-resolved scribe URL is daemon-global → must not leak,
+      // even nested under autoTranscribe.
+      const at = body.autoTranscribe as Record<string, unknown>;
+      expect(at).not.toHaveProperty("scribeUrl");
       // writeOnly field must not appear in GET.
       expect(body).not.toHaveProperty("scribe_token");
-      // Defense in depth: grep the raw body for the token value.
-      expect(JSON.stringify(body)).not.toContain("super-secret-should-never-appear");
+      // Defense in depth: no daemon-global value (URL or secret) anywhere.
+      const raw = JSON.stringify(body);
+      expect(raw).not.toContain("super-secret-should-never-appear");
+      expect(raw).not.toContain("https://scribe.example/v1");
     } finally {
       if (origScribeToken === undefined) delete process.env.SCRIBE_TOKEN;
       else process.env.SCRIBE_TOKEN = origScribeToken;
@@ -1318,24 +1332,27 @@ describe("/.parachute/config/schema + /.parachute/config", () => {
     expect(body.audio_retention).toBe("until_transcribed");
   });
 
-  test("config scribe_url falls back to empty string when SCRIBE_URL env is unset", async () => {
-    createVault("journal");
+  test("autoTranscribe.enabled reports the per-vault override (vault#478)", async () => {
+    // Server default ON; this vault explicitly opts OUT — the per-vault value
+    // must win, proving the field is reported per-vault (not the raw global).
+    writeGlobalConfig({ port: 1940, auto_transcribe: { enabled: true } });
+    writeVaultConfig({
+      name: "journal",
+      api_keys: [],
+      created_at: new Date().toISOString(),
+      auto_transcribe: { enabled: false },
+    });
     const token = await createAdminToken("journal");
-    const orig = process.env.SCRIBE_URL;
-    delete process.env.SCRIBE_URL;
-    try {
-      const path = "/vault/journal/.parachute/config";
-      const res = await route(
-        new Request(`http://localhost:1940${path}`, {
-          headers: { authorization: `Bearer ${token}` },
-        }),
-        path,
-      );
-      const body = (await res.json()) as { scribe_url: string };
-      expect(body.scribe_url).toBe("");
-    } finally {
-      if (orig !== undefined) process.env.SCRIBE_URL = orig;
-    }
+    const path = "/vault/journal/.parachute/config";
+    const res = await route(
+      new Request(`http://localhost:1940${path}`, {
+        headers: { authorization: `Bearer ${token}` },
+      }),
+      path,
+    );
+    const body = (await res.json()) as { autoTranscribe: { enabled: boolean } };
+    expect(body.autoTranscribe.enabled).toBe(false);
+    writeGlobalConfig({ port: 1940 });
   });
 
   test("unknown vault returns 404 before reaching the config handlers", async () => {