rename(547): the server is grimoire — package, image, DB defaults, backups

Step 2 of the Scribe -> Grimoire rename.

- src/scribe -> src/grimoire, and every import, patch target, module path,
  hypercorn entry point and `python -m grimoire.restore` with it; pyproject,
  uv.lock and the frontend package are named grimoire.
- Image git.fabledsword.com/bvandeusen/fabledgrimoire; CI's Postgres service
  runs as grimoire / grimoire_test.
- Compose files default the DB user, database and (prod) volume to grimoire,
  each overridable from .env, so an install created as Scribe keeps its data
  by setting POSTGRES_USER, POSTGRES_DB and PGDATA_VOLUME.
- Backups are written as grimoire-<ts>.tar with format grimoire-backup-tar.
  Archives named scribe-* with the scribe-backup-tar manifest still restore
  and are still counted at the destination (folder and S3), with tests.
- Exports, the MCP auth realm, the ASGI scope key and the persistent logger
  carry the new name.

Kept on purpose: the secret-sealing key label stays "scribe.secrets.v1",
because every stored secret was derived under it.

Plugin identity (plugin name, hooks, env vars, .scribe marker, skills) is
step 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/grimoire/services/rule_scope.py

@@ -0,0 +1,54 @@
+"""Which rules a caller may be shown — a rule's HOME, stated once.
+
+A rule lives in a rulebook topic — GLOBAL, it applies wherever its owner
+works — or on one project, where it applies to that project and nowhere else.
+Every read that hands rules to a session answers the same question about that
+home, so it is answered here and nowhere else:
+
+- `project_id` unset: global rules only. A caller that does not say gets the
+  safe failure, which is surfacing less rather than another project's rules.
+- `project_id=N`: global rules plus project N's own, and N's only when the
+  caller can read that project (access.can_read_project, so a shared project's
+  rules reach its collaborators too).
+- `everywhere=True`: every rule the caller owns, in any home — the explicit
+  whole-rulebook question.
+
+Rule search and the moment lookup both need this answer. Two copies of a
+scope clause is how one of them starts surfacing another project's rules.
+"""
+from __future__ import annotations
+
+from sqlalchemy import or_
+
+from grimoire.services.access import can_read_project
+
+
+async def rule_home(user_id: int, project_id: int | None = None, *, everywhere: bool = False):
+    """The WHERE clause for the rules this caller may be shown here.
+
+    Needs the statement joined through `joined_to_homes`, which outer-joins
+    the three tables the clause reads. A rule is in a topic XOR on a project
+    (migration 0059), so it matches exactly one arm of whichever clause
+    applies.
+    """
+    from grimoire.models.project import Project
+    from grimoire.models.rulebook import Rule, Rulebook
+
+    global_rule = Rulebook.owner_user_id == user_id
+    if everywhere:
+        return or_(global_rule, Project.user_id == user_id)
+    if project_id and await can_read_project(user_id, project_id):
+        return or_(global_rule, Rule.project_id == project_id)
+    return global_rule
+
+
+def joined_to_homes(stmt):
+    """Outer-join a statement over `Rule` to the tables `rule_home` reads."""
+    from grimoire.models.project import Project
+    from grimoire.models.rulebook import Rule, Rulebook, RulebookTopic
+
+    return (
+        stmt.outerjoin(RulebookTopic, Rule.topic_id == RulebookTopic.id)
+        .outerjoin(Rulebook, RulebookTopic.rulebook_id == Rulebook.id)
+        .outerjoin(Project, Rule.project_id == Project.id)
+    )