[kgenerozov]

Summary

• Adds owner-scoped body measurement reads to the TraceApps federation API.
• Adds the narrow read:body-measurements capability.
• Reuses the existing body-composition core.
• Preserves exact source provenance.

Contract

• Default 90-day range.
• Optional start, end, and source.
• Exact source filtering.
• No merge, averaging, or filling between sources.
• Additive v1 response.

Compatibility

• Existing POST body-measurement flow unchanged.
• Existing federation scopes continue working.
• Public API flags are not involved.
• No database migration.

Testing

• node --test scripts/federation-body-measurements.test.js scripts/mcp-body-composition.test.js scripts/mcp-core-extraction.test.js scripts/mcp-wiring.test.js scripts/public-api-v1-wiring.test.js — 5/5 PASS.
• Full npm test — 656 passed, 3 skipped, 0 failed in normal host validation.
• npm run build — PASS.
• npm run i18n:check — PASS.
• git diff --check — PASS.
• The restricted sandbox separately reproduces two pre-existing environment-only failures: fold-surfaces (/bin/sh EPERM) and webhook-delivery (listen EPERM).

Live validation

Sanitized end-to-end validation confirmed that a wrong-owner federation credential cannot read another user's body data, while the correct owner can read the owner's observations through the consumer flow. No usernames, measurements, PAT IDs, tokens, internal URLs, or container details are included here.

[thebigjoe1]

Thanks @kgenerozov, this is a clean addition: the route reuses the same read as the Public API, stays with the token's owner, and is refused without the new scope. I checked that on a running server too. I merged dev into the branch and added a changelog entry, the scope in ROADMAP.md, and one comment wording change. Merging now.