Security and privacy gates before broader agent and provider permissions

Track the security review requested by the owner alongside the unfinished app-building/task work (#1646). Google Calendar write access remains on hold. #1652 is the first bounded hardening patch, not completion of this review.

Threat boundaries to verify with adversarial tests:

• User-to-user reads, writes, search, attachments, streaming, caches, public/private transitions and revocation across HTTP, REST, MCP and protocols.
• Restricted credentials and agent definitions; delegation, retries, schedules and deleted agents must never silently widen authority. Resolve missing named agents by refusing, not substituting a broader default. Review scope changes against already queued work.
• App/content execution: isolated app origin/site, host-only session cookies, opaque sandbox where appropriate, downloads and sanitized previews for uploaded HTML/SVG/docs/notes, explicit per-user/per-app grants, expiry/revocation/version changes. A bridge to a full agent is itself a powerful grant. Separate domains are not an air gap and do not prevent misuse of granted data.
• Prompt injection from mail, notes, documents and web/tool output: treat content as untrusted, enforce action/recipient/data-flow policy outside the model, restrict output channels and test realistic malicious content. No claim of perfect prompt-injection prevention.
• Secrets/storage/operations: OAuth token encryption and key lifecycle, logs/backups/indexes/retention, container network/host exposure and restore/revocation drills. Source review confirms restrictive local file modes, per-owner shell naming, dropped container capabilities and guarded app fetches, but host configuration and full-server compromise resistance are not independently verified. Encryption with keys available to the same compromised process is not end-to-end protection.

Privacy product requirement (separate from ownership): connecting data to Mu must not imply permission to transmit it to a model provider. Design an enforceable egress policy across prompts, tool results, history, summaries, embeddings, traces and background work. Support deterministic/local processing, optional local inference, and explicit minimal cloud disclosure; never silently fall back from local-only data to a cloud model. Audit what category was disclosed without duplicating sensitive content in logs.

Concrete discovery case: webinar confirmation in personal mail. Locally search/extract MIME calendar attachments, dates, time zones and join links; retain provenance and confidence, detect duplicates, propose a calendar item or reminder. Ambiguous interpretation uses a chosen excerpt under the disclosure policy. Notification/link to the source should remove manual forwarding effort. Forwarding to Micro or an assistant CC address remains a low-effort opt-in alternative, not the only workflow. Avoid forwarding whole private emails by default.

Acceptance: a documented evidence matrix with code paths/tests and remaining assumptions; fail-closed regression tests; no new provider write grants until the applicable boundaries are verified. Existing apps/tasks iteration continues in #1646. This issue stays open until the remaining work is completed.

Read #1652 and the unfinished app-building work in #1646 first, then map the listed threat boundaries to their code paths and existing tests. Build the requested evidence matrix, add fail-closed adversarial regression coverage for verified boundaries, and document remaining assumptions; completion also requires withholding new provider write grants until the applicable boundaries are verified.