Enforce namespace ownership on annotation create

UpsertAnnotation's lookup was namespace-scoped but its create path was
not, so a caller could attach an annotation to another namespace's node
or to a nonexistent node id. Verify the node belongs to the caller's
namespace inside the create transaction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tae2089

internal/store/gormstore/gormstore.go

@@ -4,6 +4,7 @@ package gormstore
 import (
 	"context"
 	"errors"
+	"fmt"
 	"path"
 	"strings"
 
@@ -516,6 +517,17 @@ func (s *Store) UpsertAnnotation(ctx context.Context, ann *model.Annotation) err
 
 	if errors.Is(result.Error, gorm.ErrRecordNotFound) {
 		return s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+			// The read path is namespace-scoped; the create path must be too, or a caller
+			// could attach an annotation to another namespace's node (or a missing node).
+			var owned int64
+			if err := tx.Model(&model.Node{}).
+				Where("id = ? AND namespace = ?", ann.NodeID, ns).
+				Count(&owned).Error; err != nil {
+				return trace.Wrap(err, "verify annotation node namespace")
+			}
+			if owned == 0 {
+				return fmt.Errorf("annotation node %d not found in namespace %q", ann.NodeID, ns)
+			}
 			return tx.Create(ann).Error
 		})
 	}

internal/store/gormstore/gormstore_test.go

@@ -9,7 +9,7 @@ import (
 	"gorm.io/driver/sqlite"
 	"gorm.io/gorm"
 	"gorm.io/gorm/logger"
-    gormschema "gorm.io/gorm/schema"
+	gormschema "gorm.io/gorm/schema"
 
 	"github.com/tae2089/code-context-graph/internal/ctxns"
 	"github.com/tae2089/code-context-graph/internal/model"
@@ -626,6 +626,31 @@ func TestUpsertAnnotation_Insert(t *testing.T) {
 	}
 }
 
+func TestUpsertAnnotation_RejectsNodeOutsideNamespace(t *testing.T) {
+	s := setupTestDB(t)
+	ctx := context.Background()
+
+	s.UpsertNodes(ctx, []model.Node{
+		{QualifiedName: "pkg.F", Kind: model.NodeKindFunction, Name: "F", FilePath: "a.go", StartLine: 1, EndLine: 2, Language: "go"},
+	})
+	node, _ := s.GetNode(ctx, "pkg.F")
+
+	// Writing from another namespace must not create an annotation on a foreign node.
+	foreignCtx := ctxns.WithNamespace(context.Background(), "other-team")
+	err := s.UpsertAnnotation(foreignCtx, &model.Annotation{NodeID: node.ID, Summary: "cross-namespace write"})
+	if err == nil {
+		t.Fatal("expected cross-namespace annotation create to be rejected")
+	}
+	if got, _ := s.GetAnnotation(ctx, node.ID); got != nil {
+		t.Fatalf("annotation must not exist after rejected write, got %+v", got)
+	}
+
+	// Nonexistent node id must also be rejected instead of creating an orphan row.
+	if err := s.UpsertAnnotation(ctx, &model.Annotation{NodeID: 99999, Summary: "orphan"}); err == nil {
+		t.Fatal("expected annotation create for missing node to be rejected")
+	}
+}
+
 func TestUpsertAnnotation_Update(t *testing.T) {
 	s := setupTestDB(t)
 	ctx := context.Background()