Summary

Three reviewer-flagged bugs from merged PR #3205 (RBAC M3 — per-user tool policy + memory namespace ACL). Each was re-verified against current main before fixing; verdicts and concrete evidence below.

Item #7 — Namespace glob path traversal — REAL

UserMemoryAccess::can_read/can_write (crates/librefang-types/src/user_policy.rs) deferred to capability::glob_matches, where * greedily matches any text including / and :. So:

• glob_matches("kv:user_*", "kv:user_../admin") -> true (the * swallows ../admin)
• glob_matches("kv:user_*", "kv:user_evil/etc/passwd") -> true
• glob_matches("kv:*", "kv:user_../admin") -> true

A memory tool that constructs the namespace from user input could therefore cross into another user's bucket — even though the per-user pattern was supposed to scope them to kv:user_<their-name>.

Fix. Introduce namespace_glob_matches with two stricter rules:

1. Reject any candidate containing a .. segment (delimited by /, :, or whitespace) outright.
2. * may not span / or : separators inside a longer pattern — kv:user_* only matches a single component after the prefix.

* standalone still matches any non-traversing namespace so the owner/admin "see everything" UX is preserved. Kept separate from the generic glob_matches (which is used for tool-name and capability matching where collapsing across separators is intentional).

Item #8a — Case-sensitive deny lists — PARTIAL -> fixed

UserToolPolicy, ChannelToolPolicy, and UserToolCategories matched tool names case-sensitively (crates/librefang-types/src/user_policy.rs:151,111,195):

• glob_matches("shell_exec", "SHELL_EXEC") -> false

Built-in tools dispatch by exact-case match (tool_runner.rs:1041) so a SHELL_EXEC invocation would not have executed; the call would have hit the "Unknown tool" arm. But MCP and skill tool providers may accept their own case variants, and the deny list is supposed to be the authoritative gate regardless of the dispatcher's tolerance. Defense in depth: ASCII-lowercase both pattern and tool name at every per-user check site.

Scope kept tight — only the three per-user check_tool methods. Rate-limit buckets and capability matchers stay exact-case (tool identities there are content-addressed).

Item #8b — Memory ACL denial silently dropped from audit — REAL

routes/memory.rs::auth_denied (the helper called on every LibreFangError::AuthDenied from the namespace guard) returned a 403 without recording a PermissionDenied audit row. Meanwhile every other admin-gated RBAC endpoint emits one:

• routes/audit.rs::require_admin — emits PermissionDenied
• routes/budget.rs:468,482 — emits PermissionDenied
• routes/authz.rs:60,74 — emits PermissionDenied
• middleware.rs:435,765 — emits PermissionDenied

So a privilege probe against /api/memory* was invisible to admins reading /api/audit.

Fix. auth_denied now takes &AppState + &Extensions and writes a PermissionDenied row via state.kernel.audit().record_with_context(...) before returning 403. Anonymous callers -> user_id = None; authenticated-but-denied callers -> attributed user_id plus user / role in the detail string.

Files changed

• crates/librefang-types/src/user_policy.rs — namespace_glob_matches + has_path_traversal + case-insensitive check_tool on UserToolPolicy / ChannelToolPolicy / UserToolCategories + tests
• crates/librefang-api/src/routes/memory.rs — auth_denied audit emit + tests

Test plan

• memory_access_namespace_blocks_path_traversal — kv:user_../admin, kv:user_alice/../bob, and separator-crossing globs all denied; kv:user_alice still allowed (positive control)
• memory_access_star_pattern_still_rejects_traversal — even ["*"] rejects .. candidates while still matching legitimate kv:anything / shared:scope/foo
• user_deny_is_case_insensitive, channel_deny_is_case_insensitive, categories_deny_is_case_insensitive — pin lowercase normalisation
• auth_denied_emits_audit_row_for_anonymous — boots a real kernel, calls auth_denied(&state, &extensions, ..), asserts a PermissionDenied row appears with outcome="denied", channel="api", user_id=None, and the namespace reason in detail
• auth_denied_emits_audit_row_for_authenticated_user — same but with AuthenticatedApiUser extension; asserts attribution to user_id
• Existing anonymous_fallback_* tests (from fix(security): RBAC M3 follow-up — memory ACL fail-closed for anonymous callers #3239) still pass — kept verbatim alongside the new ones
• CI verifies cargo build --workspace --lib / cargo test --workspace / cargo clippy -- -D warnings

Refs: PR #3205 (RBAC M3), follow-up to #3239 (memory ACL fail-closed).