ci: include activation gate tests in user data isolation acceptance

ops/ci/run-user-data-isolation-acceptance.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$ROOT"
+
+python3 -m pytest \
+  tests/security/test_memory_scope_guard.py \
+  tests/security/test_memory_provider_gate.py \
+  tests/security/test_memory_search_activation_check.py
+
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+cat > "$TMP_DIR/report.json" <<'JSON'
+{
+  "status": "healthy",
+  "counts": {
+    "files": 3,
+    "allowed": 3,
+    "denied": 0,
+    "invalid": 0
+  }
+}
+JSON
+
+cat > "$TMP_DIR/provider.json" <<'JSON'
+{
+  "name": "ci-provider",
+  "scope_filter_before_ranking": true,
+  "provenance_required": true,
+  "fallback_mode": "text-only",
+  "allow_global_index": false
+}
+JSON
+
+python3 scripts/security/memory_search_activation_check.py \
+  --isolation-report "$TMP_DIR/report.json" \
+  --provider-config "$TMP_DIR/provider.json" \
+  --request-enable
+
+# The following must stay blocked: unsafe provider configuration.
+cat > "$TMP_DIR/provider-unsafe.json" <<'JSON'
+{
+  "name": "unsafe-provider",
+  "scope_filter_before_ranking": false,
+  "provenance_required": false,
+  "fallback_mode": "global-search",
+  "allow_global_index": true
+}
+JSON
+
+if python3 scripts/security/memory_search_activation_check.py \
+  --isolation-report "$TMP_DIR/report.json" \
+  --provider-config "$TMP_DIR/provider-unsafe.json" \
+  --request-enable; then
+  echo "ERROR: unsafe memory provider activation was allowed" >&2
+  exit 1
+fi
+
+echo "user-data-isolation acceptance: PASS"

patches/user-data-isolation-guard-20260710.json

@@ -0,0 +1,9 @@
+{
+  "id": "patch-1783705151672-40378183",
+  "patch_name": "user-data-isolation-guard-20260710",
+  "branch": "security/user-data-isolation-guard-20260710",
+  "risk": "high",
+  "description": "Implement user data isolation redline controls: memory scope guard, provider gate, activation gate, audit services, and acceptance checks. Memory search remains disabled until isolation gate passes.",
+  "created_by": "chatgpt-gitops-bot",
+  "created_at": "2026-07-10T17:39:11Z"
+}