Summary

P1/P2 follow-ups from the auth / RBAC / vault audit. P0 sibling: #5128 (OIDC sub empty default).

Sub-items

• Memory tools bypass per-user ACL — crates/librefang-kernel/src/kernel/handles/memory_access.rs:11-115 — memory_store, memory_recall, memory_list write/read shared_memory_agent_id() keyed only by peer_id prefix and never call memory_acl_for_sender. Only the proactive-retrieval path (agent_loop.rs:2801) consults the guard. A user with UserMemoryAccess.allow_write_namespaces = [] (or any restriction) can still cause the agent to invoke tool_memory_store (tool_runner.rs:4757) / tool_memory_recall (:4770) and reach the shared KV across users. Same gap on wiki_get/search/write at tool_runner.rs:4799-4824. Fix: call memory_acl_for_sender(sender_id, channel) at the tool dispatch site; reject when ACL denies the requested namespace.

• LIBREFANG_VAULT_KEY in ~/.librefang/.env not honored on first unlock — crates/librefang-extensions/src/dotenv.rs:41-51 — load_dotenv() calls load_vault() before load_env_file(".env"). Vault::resolve_master_key() (vault.rs:651) reads LIBREFANG_VAULT_KEY directly from std::env, so a .env entry isn't yet present; vault unlock fails (eprintln warn at dotenv.rs:72 is the only signal) and every vault-stored secret (provider keys, MCP client_ids, OAuth tokens) silently becomes unavailable. PR fix(extensions): prime LIBREFANG_VAULT_KEY from dotenv before vault unlock #5065 area. Fix: load_env_file(".env") before load_vault(), OR have load_vault() re-parse .env for LIBREFANG_VAULT_KEY before resolving. [low]

• PUBLIC_ROUTES_DASHBOARD_READS exposes full cron-job payloads pre-auth — crates/librefang-api/src/middleware.rs:770 (prefix_get("/api/cron/")) — when require_auth_for_reads = false (default), GET /api/cron/jobs and GET /api/cron/jobs/{id} (routes/workflows.rs:2533,2796) serialize the full CronJob including prompt_template and per-job session_mode. Operators exposing 4545 remotely without require_auth_for_reads = true reveal user-authored prompts to anyone reachable on the bind. Same shape as /api/approvals/session/{id} is publicly readable — leaks pending shell commands #3367/fix(wasm,api,runtime): WASM env blocklist, auth-gate approvals/session, restrict config/set paths, apply_patch readonly check #3941 closed for /api/approvals/*. Fix: either remove /api/cron/ from PUBLIC_ROUTES_DASHBOARD_READS (parity with approvals), or filter the response to redact prompt_template when the request is unauthenticated. [low]