feat(runtime): bind remote and owned resources to authority

src/tools/notes.py

@@ -77,6 +77,10 @@ async def do_manage_notes(content: str, owner: Optional[str] = None) -> Dict:
     if action == "list" and list_search_query:
         action = "search"
         args.setdefault("query", list_search_query)
+    from src.agent_runtime.owned_resources import active_owned_operation
+    bound = active_owned_operation()
+    if bound is not None:
+        bound.validate()
     db = SessionLocal()
 
     def _norm_note_title(value: str) -> str:
@@ -98,7 +102,7 @@ async def do_manage_notes(content: str, owner: Optional[str] = None) -> Dict:
     def _note_by_prefix(note_id: str):
         if not note_id:
             return None
-        q = db.query(Note).filter(Note.id.startswith(note_id))
+        q = db.query(Note).filter(Note.id == note_id if bound is not None else Note.id.startswith(note_id))
         if owner:
             q = q.filter(Note.owner == owner)
         return q.first()
@@ -415,7 +419,7 @@ async def do_manage_notes(content: str, owner: Optional[str] = None) -> Dict:
         elif action == "update":
             note_id = _note_id_arg()
             note = _note_by_prefix(note_id)
-            if not note:
+            if not note and bound is None:
                 title_query = str(
                     args.get("title")
                     or args.get("query")
@@ -489,7 +493,7 @@ async def do_manage_notes(content: str, owner: Optional[str] = None) -> Dict:
         elif action == "delete":
             note_id = _note_id_arg()
             note = _note_by_prefix(note_id)
-            if not note:
+            if not note and bound is None:
                 title_query = str(
                     args.get("title")
                     or args.get("query")

src/tools/system.py

@@ -689,9 +689,16 @@ async def do_api_call(content: str) -> Dict:
                 pass
 
     integration_name = args.get("integration", "")
+    from src.agent_runtime.remote_resources import active_backend_operation
+    bound = active_backend_operation()
+    if bound is not None:
+        bound.validate()
+        if bound.resource.namespace != "integration":
+            return {"error": "API call has no integration resource binding", "exit_code": 1}
+        integration_name = bound.resource.server_id
     integrations = load_integrations()
     intg = next((i for i in integrations if i["id"] == integration_name
-                 or i["name"].lower() == integration_name.lower()), None)
+                 or (bound is None and i["name"].lower() == integration_name.lower())), None)
     if not intg:
         available = ", ".join(i["name"] for i in integrations if i.get("enabled", True))
         return {"error": f"No integration matching '{integration_name}'. Available: {available or 'none configured'}", "exit_code": 1}

src/tools/vault.py

@@ -68,6 +68,10 @@ async def do_vault_search(content: str, owner: Optional[str] = None) -> Dict:
     except json.JSONDecodeError:
         return {"error": "Failed to parse bw output", "exit_code": 1}
 
+    from src.agent_runtime.owned_resources import active_owned_operation, observe_vault_records
+    if active_owned_operation() is not None:
+        observe_vault_records(owner, cfg, items)
+
     if not items:
         return {"output": f"No vault items match '{query}'.", "exit_code": 0}
 
@@ -79,7 +83,7 @@ async def do_vault_search(content: str, owner: Optional[str] = None) -> Dict:
         username = login.get("username", "")
         uris = login.get("uris") or []
         url = uris[0].get("uri", "") if uris else ""
-        parts = [f"[{item_id[:8]}] {name}"]
+        parts = [f"[{item_id}] {name}"]
         if username:
             parts.append(f"user: {username}")
         if url: