Require explicit consent for analyze-time semantic embeddings

[tachyon-beep]

Motivation

• A repository-controlled semantic_search config could make loomweave analyze construct a live embedding provider and send source-derived text plus a config-selected environment variable to an attacker-controlled endpoint, creating an exfiltration path.
• The change aims to prevent outbound embedding requests during a normal analysis run unless the operator explicitly opts in.

Description

• Add an explicit opt-in CLI flag --populate-semantic-embeddings to the analyze command in crates/loomweave-cli/src/cli.rs.
• Propagate the new flag through main into AnalyzeOptions (crates/loomweave-cli/src/main.rs and crates/loomweave-cli/src/analyze.rs).
• Gate provider construction and the call to populate_semantic_embeddings in crates/loomweave-cli/src/analyze.rs so embedding population only runs when the operator supplies the new flag.
• Update integration test coverage in crates/loomweave-cli/tests/analyze.rs to assert that a normal loomweave analyze does not create an embeddings sidecar and that embedding population remains possible when the operator opts in; adjust related test timing and reset steps to make the test deterministic.

Testing

• Ran cargo test -p loomweave-cli analyze_persists_plugin_tags_without_automatic_embeddings -- --nocapture and the targeted integration test passed.
• Ran formatting checks with cargo fmt --all -- --check which succeeded.
• Ran repository checks git diff --check and git status --short --branch to validate tidy diffs and a clean working tree after the change.

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Copilot]

Pull request overview

This PR hardens loomweave analyze against unintended outbound embedding requests by requiring explicit operator opt-in before constructing an embedding provider and populating semantic embeddings, reducing the risk of project-configured exfiltration via semantic-search endpoints.

Changes:

• Added --populate-semantic-embeddings flag to the analyze CLI command and propagated it into AnalyzeOptions.
• Gated embedding-provider construction and populate_semantic_embeddings execution behind the new opt-in flag.
• Updated the analyze integration test to assert that a normal analysis run does not create an embeddings sidecar.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
crates/loomweave-cli/src/cli.rs	Introduces the new --populate-semantic-embeddings opt-in flag on the analyze command.
crates/loomweave-cli/src/main.rs	Wires the new CLI flag through to AnalyzeOptions.
crates/loomweave-cli/src/analyze.rs	Enforces the opt-in gate before building an embedding provider / populating embeddings.
crates/loomweave-cli/tests/analyze.rs	Adjusts integration test to ensure embeddings are not populated automatically.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[tachyon-beep]

Closing without merge — the concern is real, the fix is the wrong shape.

• Gating analyze-time embeddings behind a new CLI flag disables them on every real launch path (session hook, git-sync hooks, MCP analyze_start) even when the operator enabled semantic_search in their own config. semantic_search is already opt-in; the problem is not consent, it is that the consent lives in a file (loomweave.yaml) that may be repository-authored.
• It covers only the analyze-time embedding path; the same hostile config can point llm_policy at an attacker endpoint for serve-time summaries, and can name which env var is sent as the credential. Both surfaces need one operator-trust gate.
• The branch conflicts with the worktree-store refactor (store_paths.embeddings).

Tracked as Filigree clarion-dee44f1a66 (P1): distinguish operator-owned config from repo content (git-tracked check and/or an out-of-tree operator config), constrain the credential env-var name and endpoint host, with an ADR.