stop letting one tool claim to be another

[ayushcodes10]

Found by testing end to end through Codex's own ~/.codex/config.toml, over the real MCP stdio protocol.

The hole

written_by has been derived from the fact's own edge since 2026-08-29 — a caller cannot assert who wrote something. I had been describing the number as trustworthy on that basis.

It was half-trustworthy. recalled_by was still a parameter:

# from a server whose agent_id is "claude-code"
record_recall_save(scope, fact_id, note, recalled_by="codex")
→ {"counts_toward_gate": true, "cross_tool_saves": 2}

One tool, both ends, counted.

Why it matters

Criterion 6 measures whether two tools were involved, and the agent supplying the evidence is the agent being graded. Neither side may come from the caller. Deriving the writer while accepting a claim about the reader closed one end of a two-ended hole.

The reader is now the server's own configured agent_id — from the config the client launched it with. recalled_by is gone from the tool contract.

Also

Both derived values are now returned on every response, not only when a save is rejected. The caller supplies neither, so the response is the only way it can see what the server concluded and confirm the save says what it meant.

Testing

415 pass, 4 added:

• the exact call that used to work now raises TypeError
• recalled_by is absent from the tool signature
• one tool alone cannot reach counts_toward_gate: true
• a genuine two-server save still counts, with written_by: codex, recalled_by: claude-code

Verified by removing the fix and watching the guards go red, not merely by watching them pass.

Worth noting: the 2048-char description guard from #38 caught this change bloating record_recall_save to 2096 chars within an hour of being added. Docstring is 1376 now.