SUB-192: align live Codex identity scope

[Pavel-Tk]

Summary

• add one stable tenant-local Codex owner identity to live hooks, manual writes, history replay, and canonical recall
• keep provider/platform isolation while satisfying the deployed canonical-search contract's required user_id
• allow long-lived MCP queries up to 60 seconds while retaining the 10-second fail-soft bound in short-lived automatic-recall hooks

Live evidence

On deployed server a655a228a99ed8b0cbe69d56927e5cddc6a93f6c:

• before fix: canonical search -> http_400 (user_id is required); cited query -> timeout
• after fix: canonical search -> successful bounded empty result for the new identity; cited query -> successful answer with citations and saved=false
• a uniquely labelled synthetic certification memory write was admitted and delivered with pending 0, no rejection, and empty failure category

Validation

• Ruff: pass
• compileall: pass
• pytest: 159 passed
• public scanner: 86 files, no findings
• deterministic double-build SHA-256: e8c8e0a0761588f01115afa627f9329a45874901454ffecafeab21e9f217289c
• src/substrate_capture/ unchanged

Review

One adversarial critical-only review round is in progress. No publication or merge until its disposition is recorded. No findings is valid per policy.

Linear: SUB-192

[Pavel-Tk]

Required adversarial review disposition

One critical-only review round completed on 184a11b.

CRITICAL found: canonical recall omitted agent_id=codex-cli, so deployed search resolved default; the native UserPromptSubmit recall path also omitted the new scope and fell back to cli/owner/default.

Fixed in 09e7bb51182c1fb848224dd386c2ad445c17bc18:

• capture, history replay, MCP canonical search, and native automatic recall now share exact {platform: codex, user_id: owner, agent_id: codex-cli} identity;
• request-level tests pin both MCP and native-hook recall scopes;
• live six-hook admission delivered 6/6 through the long-lived MCP worker with pending/deferred/quarantined/rejected all zero.

Per policy, fixes are not re-reviewed. Exact-head gates: Ruff pass; compileall pass; 160 tests passed; scanner 86 files/no findings; deterministic ZIP SHA-256 6f5ae3d262b0cffad6923041ff3777b6dddbb20624d0671e070d42bc5aaf7584.