I am implementing a production private reporting lane in an existing CLI and MCP knowledge system. The known constraints are a shared authorization boundary, durable idempotency and recovery, server-derived private ownership association, and public-safe defaults. The main unknowns are the narrow schema and projection boundaries needed to keep report conversations out of every public read and provenance path while retaining ordinary conversation behavior.