Foundation: verify host accounts, inherited instructions and account-synced connectors #80

Outcome

Extend Factory Foundation's host preparation to check the effective account and configuration environment that an agent actually inherits. A dedicated OS user or provider configuration directory is not sufficient proof that personal context and account-synced tools are absent.

Observed gap

On 19 October 2026, adding a Notion connector through a personal Claude account also made that connector discoverable by Claude Code under a separate Factory execution user on another host. That user had neither the personal AIOS plugin nor a personal CLAUDE.md pointer installed. The connector followed the signed-in provider account rather than those local files.

An authorized user-scope disableClaudeAiConnectors: true change removed account connectors from a fresh native CLI inventory on the execution host. The personal client retained its working connector. This is evidence for that CLI route only: a new T3-launched worker still needs its own effective-state check. No claim of a data leak or completed whole-worker isolation is made.

Requested Foundation change

Extend the existing foundation/factory-foundation/references/setup.md and references/adoption.md, with an entrypoint update only if needed. Reuse the current installation record and supported native controls; do not add another orchestration or configuration service.

• Resolve the actual execution host, OS/service user, launch route, provider account and organization, native configuration home, and relevant environment/project/session overrides. Distinguish the operator's client from the machine executing the work.
• Check loaded user/project instructions and personal-context pointers, enabled plugins/skills, and effective MCP/tool inventory, including connectors imported from the provider account without local registration.
• Distinguish model/subscription authentication from permission to read personal or customer systems. Report where account-wide settings propagate across devices; an empty local plugin list does not imply an empty tool surface.
• Compare observed state with the intended project scope. Make only authorized, reversible changes; preserve unrelated settings and credentials. Keep identity details, private paths and tokens in the private installation record, not public examples or logs.
• Check the exact native route and version before applying a control. Claude Code's disableClaudeAiConnectors affects connectors fetched by CLI/SDK sessions; current documentation says desktop-delivered in-process connectors do not obey it. Do not turn a CLI setting into a desktop/SSH or universal isolation claim.
• Verify both the intended presence and absence of capabilities in a fresh actual worker launched through the selected T3/harness route. Distinguish files on disk, CLI inventory and model-visible tools. Record existing sessions that require restart; do not silently interrupt active work.
• Recheck the affected boundary after account/organization changes, connector additions, configuration changes or relevant harness updates. Avoid an expensive full audit on every small task.

Acceptance

• Foundation identifies the relevant account/configuration scopes and automatic connector import during host setup.
• A representative shared-account case detects an unintended connector despite separate local user/configuration state.
• A supported scoped correction is read back in a fresh actual worker, while intended capabilities on the personal client remain available.
• Unsupported host-delivered routes and active-session limits remain visible; no broader isolation claim is inferred.
• Affected docs/skill versions, checks and independent behavioral review are completed, with sanitized public evidence and private installation details kept separately.

Related: #32 owns the broader native permission and worker-isolation gaps. #45 is a deferred generic default-profile experiment; this observed setup gap can be addressed without adopting that experiment or starting a platform project.

Official reference checked 19 October 2026: Claude Code MCP — how connectors reach Claude Code and how to disable account connectors.

Owner: Foundation. Keep this issue open for implementation and actual-worker qualification; recording the host correction does not complete the method change.

Selected-route observation — 29 October 2026

Three fresh native T3/Claude workers in the #32 R4 qualification each exposed 97 startup tools, only t3-code as MCP server, and no Claude.ai connector/cloud tools. Their private configuration trees had no account/settings file, and only the selected Factory role skill plus Claude's own bundled skills were visible. Actual archived thread/run metadata confirmed Opus5.5 High / Fast off. The archives and native inventories were retained and verified before VM deletion.

This closes the missing actual-worker observation for that inference-brokered candidate route. It does not re-test the earlier shared-account correction on every T3/desktop route, establish universal absence of access, or adopt the candidate backend. The account/configuration controls, personal-client preservation and versioned method/behavioral acceptance above remain separate. Keep this issue open until those remaining criteria are reconciled; the broader #32 runtime is still a qualification candidate.

Source guidance — 29 October 2026

The canonical Notion Foundation edition is now 0.1.27. Its setup/adoption references explicitly distinguish configuration, CLI inventory and fresh actual-worker tools; corrections stay scoped and personal-client preservation remains a separate check. The exact references were read back through the Factory-only connection before export.

PR #104 is merged as b50d5595b04ef67f41b7329bfae66402207bd0dc and published in Factory v0.1.27. The merged tree matches reviewed head fb749e5f34b4879ed2aa1ffdeab32c5b92c841cb: the six-file export and dated README/qualification update. Z13 checks: 9 skills / 0 errors, 16 tests, complete Foundation stage. Two fresh Opus 5.5 High/Fast-off contexts accepted the final source and independently handled three representative method cases; all six native review runs completed with no pending requests. GitHub Method checks passed on that exact head.

This advances the source-guidance acceptance. The shared-account correction, personal-client preservation and unsupported desktop-route criteria above remain separate live work; the issue stays open. No new account/connector permission or installed skill cutover was made.