fix(takes): keyword search matches words in long claims via word_similarity (#3267)

Both engines' searchTakes used whole-string trigram similarity
(claim % query), which structurally cannot pass the 0.3 threshold for a
short keyword against a 100-200 char claim — keyword search returned
zero results on real brains. Switch the predicate to word similarity
(query <% claim) and rank by word_similarity(query, claim), in both
postgres-engine and pglite-engine per the engine-parity invariant.
Holder allow-list and source-scope filters unchanged.

Regression test: single-word query must match a long claim containing
it (fails under the old predicate).

Fixes #3267

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

SECURITY.md

@@ -135,18 +135,6 @@ the PGLite schema. Local agents continue to use stdio (`gbrain serve`).
 Running `--http` against a PGLite-backed install fails fast with a clear
 error message at startup.
 
-### Docker network isolation (self-hosted Postgres)
-
-OAuth and source scoping enforce isolation on the `serve --http` path only.
-Raw Postgres reachability bypasses both: a container that shares Docker's
-default `bridge` network with the brain's Postgres can open a direct DB
-session without any token and read every source. Put the brain's Postgres on
-a user-defined Docker network with nothing untrusted on it, publish its port
-loopback-only (if at all), and never put `DATABASE_URL` or a Postgres
-password in untrusted agent containers — those should reach the brain
-exclusively via OAuth against `serve --http`. Full operator checklist:
-[docs/mcp/DEPLOY.md — Co-located Docker workloads](docs/mcp/DEPLOY.md#co-located-docker-workloads-self-hosted-postgres).
-
 ### CORS
 
 Default-deny: no `Access-Control-Allow-Origin` header is sent unless an

docs/mcp/DEPLOY.md

@@ -258,43 +258,6 @@ the user owns the machine.
 See [ALTERNATIVES.md](ALTERNATIVES.md) for a comparison of ngrok, Tailscale
 Funnel, and cloud hosts (Fly.io, Railway).
 
-### Co-located Docker workloads (self-hosted Postgres)
-
-OAuth scopes and source scoping guard the `gbrain serve --http` path. They do
-NOT guard raw Postgres. If the brain's Postgres runs as a container on the same
-Docker host as other workloads (agent runtimes, n8n, staging fixtures), any
-container sharing Docker's default `bridge` network can open a direct DB
-session — no OAuth token required — and read every source. That silently
-recreates a privileged path underneath the isolation you configured at the MCP
-layer.
-
-Network-zone the host so untrusted containers can never reach Postgres:
-
-```
-Docker host
-├── gbrain-net          ← ONLY the brain's Postgres (+ gbrain serve, if containerized)
-├── agent-<id>-net      ← each untrusted agent runtime, isolated
-└── default bridge      ← no secret-bearing databases
-```
-
-Operator checklist:
-
-```text
-[ ] Postgres is on a user-defined Docker network, not the default bridge
-    (or nothing else runs on that bridge)
-[ ] If Postgres publishes a host port at all, it binds loopback only
-    (`-p 127.0.0.1:5432:5432`, never `0.0.0.0`)
-[ ] Untrusted agent containers have no DATABASE_URL or Postgres password
-[ ] Untrusted agents reach the brain via OAuth/Bearer against serve --http only
-    (host loopback via host.docker.internal / host gateway — never gbrain-net)
-[ ] OAuth clients are least-privilege: scoped --source / --federated-read,
-    pre-minted short-lived tokens preferred over long-lived client secrets
-[ ] Isolation verified: a team-scoped client cannot read internal-only sources
-```
-
-Optional defense-in-depth: a dedicated Postgres role (or RLS) limited to the
-allowed `source_id`s, so even a leaked connection string can't read everything.
-
 ## Troubleshooting
 
 **"missing_auth" error**

docs/tutorials/company-brain.md

@@ -484,10 +484,6 @@ Returns a per-source dashboard: when each source last synced, how many pages, ho
 
 The admin dashboard at `https://brain.acme-co.com/admin` shows live request volume, registered OAuth clients, recent activity, and brain stats. Use the admin bootstrap token from Part 4 to log in the first time, then register additional admin users from inside the dashboard.
 
-### If agents run as containers on the same Docker host
-
-OAuth source scoping only guards the HTTP MCP path. If the brain's Postgres and your teammates' agent runtimes are containers on the same Docker host, make sure the agents can't reach Postgres directly over Docker's default bridge network — a direct DB session skips OAuth entirely. Put Postgres on its own user-defined network, publish it loopback-only if at all, and never hand agent containers a `DATABASE_URL`. The copy-paste operator checklist lives in [docs/mcp/DEPLOY.md — Co-located Docker workloads](../mcp/DEPLOY.md#co-located-docker-workloads-self-hosted-postgres).
-
 ---
 
 ## Part 13: Cost and speed expectations

llms-full.txt

@@ -3905,43 +3905,6 @@ the user owns the machine.
 See [ALTERNATIVES.md](ALTERNATIVES.md) for a comparison of ngrok, Tailscale
 Funnel, and cloud hosts (Fly.io, Railway).
 
-### Co-located Docker workloads (self-hosted Postgres)
-
-OAuth scopes and source scoping guard the `gbrain serve --http` path. They do
-NOT guard raw Postgres. If the brain's Postgres runs as a container on the same
-Docker host as other workloads (agent runtimes, n8n, staging fixtures), any
-container sharing Docker's default `bridge` network can open a direct DB
-session — no OAuth token required — and read every source. That silently
-recreates a privileged path underneath the isolation you configured at the MCP
-layer.
-
-Network-zone the host so untrusted containers can never reach Postgres:
-
-```
-Docker host
-├── gbrain-net          ← ONLY the brain's Postgres (+ gbrain serve, if containerized)
-├── agent-<id>-net      ← each untrusted agent runtime, isolated
-└── default bridge      ← no secret-bearing databases
-```
-
-Operator checklist:
-
-```text
-[ ] Postgres is on a user-defined Docker network, not the default bridge
-    (or nothing else runs on that bridge)
-[ ] If Postgres publishes a host port at all, it binds loopback only
-    (`-p 127.0.0.1:5432:5432`, never `0.0.0.0`)
-[ ] Untrusted agent containers have no DATABASE_URL or Postgres password
-[ ] Untrusted agents reach the brain via OAuth/Bearer against serve --http only
-    (host loopback via host.docker.internal / host gateway — never gbrain-net)
-[ ] OAuth clients are least-privilege: scoped --source / --federated-read,
-    pre-minted short-lived tokens preferred over long-lived client secrets
-[ ] Isolation verified: a team-scoped client cannot read internal-only sources
-```
-
-Optional defense-in-depth: a dedicated Postgres role (or RLS) limited to the
-allowed `source_id`s, so even a leaked connection string can't read everything.
-
 ## Troubleshooting
 
 **"missing_auth" error**

src/core/pglite-engine.ts

@@ -4835,11 +4835,11 @@ export class PGLiteEngine implements BrainEngine {
     const { rows } = await this.db.query(
       `SELECT t.id AS take_id, t.page_id, p.slug AS page_slug, t.row_num,
               t.claim, t.kind, t.holder, t.weight,
-              similarity(t.claim, $1)::real AS score
+              word_similarity($1, t.claim)::real AS score
        FROM takes t
        JOIN pages p ON p.id = t.page_id
        WHERE t.active
-         AND t.claim % $1
+         AND $1 <% t.claim
          AND ($2::text[] IS NULL OR t.holder = ANY($2::text[]))
          AND ($4::text[] IS NULL OR p.source_id = ANY($4::text[]))
          AND ($5::text IS NULL OR p.source_id = $5::text)

src/core/postgres-engine.ts

@@ -4962,11 +4962,11 @@ export class PostgresEngine implements BrainEngine {
     const rows = await sql`
       SELECT t.id AS take_id, t.page_id, p.slug AS page_slug, t.row_num,
              t.claim, t.kind, t.holder, t.weight,
-             similarity(t.claim, ${query})::real AS score
+             word_similarity(${query}, t.claim)::real AS score
       FROM takes t
       JOIN pages p ON p.id = t.page_id
       WHERE t.active
-        AND t.claim % ${query}
+        AND ${query} <% t.claim
         AND (
           ${opts.takesHoldersAllowList ?? null}::text[] IS NULL
           OR t.holder = ANY(${opts.takesHoldersAllowList ?? null}::text[])

test/takes-engine.test.ts

@@ -100,6 +100,22 @@ describe('searchTakes', () => {
     const worldHits = await engine.searchTakes('founder', { takesHoldersAllowList: ['world'] });
     expect(worldHits.every(h => h.holder === 'world')).toBe(true);
   });
+
+  // #3267: whole-string trigram % structurally can't match a short keyword
+  // against a long claim (similarity between the full strings stays under the
+  // 0.3 threshold). word_similarity (<%) matches the keyword against the
+  // best-matching word span instead.
+  test('single-word keyword matches a long claim containing it (#3267)', async () => {
+    await engine.addTakesBatch([
+      {
+        page_id: acmePageId, row_num: 50,
+        claim: 'Acme will consolidate the mid-market vertical SaaS landscape through disciplined acquisitions and a shared billing platform over the next five years',
+        kind: 'bet', holder: 'garry', weight: 0.6,
+      },
+    ]);
+    const hits = await engine.searchTakes('consolidate');
+    expect(hits.some(h => h.claim.includes('consolidate the mid-market'))).toBe(true);
+  });
 });
 
 describe('updateTake', () => {