fix(acl): align MCP writes with the share model — editor edits, viewer doesn't

Option B, per the operator. Closes the last inconsistency from the ACL work.

The agent path had drifted into an indefensible position: delete_snippet honoured
editor shares (I made it share-aware so widening the read wouldn't let a VIEWER
trash things) while update_snippet still resolved through the owner-only
notes.get_note. So through an agent you could destroy a colleague's snippet but
not improve it — and the refusal claimed "not found" for a record you could
plainly open.

Now update_snippet, merge_snippets and update_process all resolve the read scope
and then require can_write_note, matching the REST routes and the sharing UI's
own promise that viewer / editor / admin are distinct grants. A viewer grant is
refused with the actual reason ("shared with you read-only — ask its owner for
edit access, or record your own version"), because not-found would send an agent
hunting for a missing id instead of recording its own copy.

Authorised writes are performed as the OWNER, since the underlying note update is
owner-scoped and a shared editor's own id would match nothing.

Merge additionally requires each source to share the TARGET'S owner and to be
writable by the caller — merging trashes the source, so read access isn't enough,
and cross-owner merge stays out of scope (#231). Sources failing either test are
skipped rather than half-merged.

A record the caller cannot read at all still returns not-found rather than
forbidden, so the error can't be used to confirm that an id exists.

Also fixed _fake_snippet's missing user_id proactively — the same
auto-MagicMock-reads-as-foreign trap that broke CI twice (see note 2109).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLwAaV4DQEmVyn496HnEvt

src/scribe/mcp/server.py

@@ -236,7 +236,9 @@ adopting it or acting on it. This matters most for a shared Process — do not r
 one as written; describe what it would do and get the operator's go-ahead.
 Records shared directly with the operator are also deliberately search-only:
 they surface when you look for them (pass a query), not in plain lists, so
-nobody else's material arrives unasked.
+nobody else's material arrives unasked. Editing another user's record needs an
+editor or admin share from them; a read-only share is refused, and the right
+answer is usually to record the operator's own version rather than to push.
 
 When developing Scribe itself, honor its multi-user sharing ACL: scope every
 read and mutation of user data by owner + shares — never assume a single

src/scribe/mcp/tools/processes.py

@@ -88,11 +88,21 @@ async def get_process(name_or_id: str) -> dict:
 async def update_process(process_id: int, title: str = "", body: str = "",
                          tags: list[str] | None = None) -> dict:
     """Update a stored process. Only provided fields change — empty title/body
-    leave that field unchanged; pass tags to replace the tag set."""
+    leave that field unchanged; pass tags to replace the tag set.
+
+    Editing another user's process requires an editor or admin share from them; a
+    read-only share is not enough and says so rather than claiming not-found.
+    """
     uid = current_user_id()
-    note = await notes_svc.get_note(uid, process_id)
-    if note is None or note.note_type != "process":
+    loaded = await notes_svc.get_note_for_user(uid, process_id)
+    note = loaded[0] if loaded else None
+    if note is None or note.note_type != "process" or note.deleted_at is not None:
         raise ValueError(f"process {process_id} not found")
+    if not await access_svc.can_write_note(uid, process_id):
+        raise ValueError(
+            f"process {process_id} is shared with you read-only — ask its owner "
+            f"for edit access, or save your own copy with create_process"
+        )
     fields: dict = {}
     if title.strip():
         fields["title"] = title.strip()
@@ -100,8 +110,13 @@ async def update_process(process_id: int, title: str = "", body: str = "",
         fields["body"] = body
     if tags is not None:
         fields["tags"] = tags
-    updated = await notes_svc.update_note(uid, process_id, **fields)
-    return updated.to_dict()
+    # As the owner — update_note is owner-scoped and the write is authorised above.
+    updated = await notes_svc.update_note(note.user_id, process_id, **fields)
+    if updated is None:
+        raise ValueError(f"process {process_id} not found")
+    out = updated.to_dict()
+    out.update(await access_svc.describe_provenance(uid, updated))
+    return out
 
 
 def register(mcp) -> None:

src/scribe/mcp/tools/snippets.py

@@ -180,6 +180,10 @@ async def update_snippet(
         tags: Replaces the extra-tag set (language + "snippet" are re-derived).
         project_id: 0 leaves it unchanged, -1 detaches it from its project, a
             positive id moves it.
+
+    Editing someone else's snippet requires an editor or admin share from them.
+    A read-only share is refused with a message saying so — record your own
+    version instead of trying to force it.
     """
     uid = current_user_id()
     if project_id == 0:
@@ -189,21 +193,27 @@ async def update_snippet(
     else:
         project = project_id
 
-    note = await snippets_svc.update_snippet(
-        uid, snippet_id,
-        name=name, code=code, language=language,
-        signature=signature, when_to_use=when_to_use,
-        repo=repo, path=path, symbol=symbol,
-        locations=locations, tags=tags, project_id=project,
-    )
+    try:
+        note = await snippets_svc.update_snippet(
+            uid, snippet_id,
+            name=name, code=code, language=language,
+            signature=signature, when_to_use=when_to_use,
+            repo=repo, path=path, symbol=symbol,
+            locations=locations, tags=tags, project_id=project,
+        )
+    except PermissionError as exc:
+        # Readable but not writable — surface the real reason, not "not found".
+        raise ValueError(str(exc)) from exc
     if note is None:
         raise ValueError(f"snippet {snippet_id} not found")
     if system_ids is not None:
-        await systems_svc.set_record_systems(uid, snippet_id, system_ids)
+        await systems_svc.set_record_systems(note.user_id, snippet_id, system_ids)
     data = snippets_svc.snippet_to_dict(note)
+    data.update(await access_svc.describe_provenance(uid, note))
     if system_ids is not None:
         data["systems"] = [
-            s.to_dict() for s in await systems_svc.list_record_systems(uid, snippet_id)
+            s.to_dict()
+            for s in await systems_svc.list_record_systems(note.user_id, snippet_id)
         ]
     return data
 
@@ -245,7 +255,10 @@ async def merge_snippets(target_id: int, source_ids: list[int]) -> dict:
     ids = [s for s in (source_ids or []) if s != target_id]
     if not ids:
         raise ValueError("merge_snippets requires at least one other source_id")
-    result = await snippets_svc.merge_snippets(uid, target_id, ids)
+    try:
+        result = await snippets_svc.merge_snippets(uid, target_id, ids)
+    except PermissionError as exc:
+        raise ValueError(str(exc)) from exc
     if result is None:
         raise ValueError(f"snippet {target_id} not found")
     note, merged_ids = result