[gedaiu]

Closes #1260.

What happened

graph::fact_evidence(pool, fact_id) loaded a fact's evidence by id alone. The route checked the base in the path and nothing else, so a role in base A was enough to read the quotes of a fact in base B through /kbs/A/facts/<B's fact>/evidence. Proof steps (reasoning::steps_for) called it the same way.

What changed

graph::fact_evidence(pool, kb_id, fact_id) first checks that the fact is in kb_id and answers NotFound otherwise, as entity_detail does for an entity outside its base. A fact of the right base with no evidence still returns an empty list. The route passes the base from its path; proof and blocked_proof already had the base and now hand it down through premise_steps to steps_for. The cost is one primary-key lookup per evidence read.

Tests

evidence_stays_inside_its_base (utopia-store): evidence of a fact in base B, asked from A, is NotFound; asked from B it returns the row. It fails without the check.

Run in rust:1-slim-bookworm against Postgres with UTOPIA_TEST_REQUIRE_DB=1: cargo fmt --all --check and cargo clippy --workspace --all-targets -- -D warnings are clean; cargo test -p utopia-store --test store evidence 9 passed, proof 3 passed, blocked 1 passed; cargo test -p utopia-server evidence 12 passed.

[WaylandYang]

Thank you, this is the right fix in the right place. fact_evidence now takes the base and answers NotFound for a fact outside it, the same rule entity_detail follows, and passing the base through premise_steps and steps_for means proofs can't be used to read another base's quotes either. Checking only the fact is enough because the fact_evidence_stays_inside_its_kb trigger already keeps a fact's evidence in the fact's base. The store test fails without the check and runs in CI against Postgres. This has to land before #1263, which opens this route to kb_ids-limited tokens. Merging.