Expose the Statement Vault to external agents over MCP

A user wants to manage patrimonial history — a document-backed record of a
family's wealth where every figure traces back to the statement it came from —
by pointing an external agent harness at Sure. That model belongs in the
harness, not in Sure: it needs numbered build deltas, golden tests and closed
periods that a mutable Postgres row cannot provide.

What Sure was missing was the seam. The Statement Vault already does most of
the work — original bytes retained, SHA-256 dedup, period detection, account
matching with a confidence score, reconciliation against ledger balances, and a
month-by-month coverage map — but it is reachable only from the web UI. An
agent could not archive a document, cite one, or check for gaps.

Adds five preview MCP tools over what already exists, plus a citation grammar
for values the agent writes:

- upload_account_statement, list_account_statements, get_account_statement,
  get_statement_coverage
- record_valuation, whose source citation is parsed rather than trusted:
  ["estimated: "] citation [" (grade: A|B|C)"]. An uncited or free-styled
  value is rejected at the write boundary instead of landing in the ledger
  looking authoritative.

link and reject are deliberately not exposed. Attaching a statement to an
account is the human's decision, and the vault UI is where it is made; the
agent reports the suggested match and stops there.

Assistant.function_classes now takes a user so preview tools stay out of the
default surface. They are hidden from tools/list and not callable by name
without the preference enabled, and the vault tools re-check the manager role
and per-account permissions, since MCP calls never pass through a controller.

Docs: the blueprint this implements, and a guide covering which side owns which
layer, the vocabulary map between the two, the monthly runbook, and the gaps
(non-user holders, non-statement documents, one value per date).

No migrations, no API endpoints, no UI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JFDp9HhXDeswadu4cxFojn

test/models/assistant/function/get_statement_coverage_test.rb

@@ -0,0 +1,56 @@
+require "test_helper"
+
+class Assistant::Function::GetStatementCoverageTest < ActiveSupport::TestCase
+  setup do
+    @user = users(:family_admin)
+    @account = accounts(:depository)
+    @function = Assistant::Function::GetStatementCoverage.new(@user)
+  end
+
+  test "reports a covered month and the months with no statement on record" do
+    # A full prior year: every month is inside the expected window, so the one
+    # month with a statement is covered and the rest report as missing.
+    january = Date.current.prev_year.beginning_of_year
+    statement = AccountStatement.create_from_upload!(
+      family: @user.family,
+      account: @account,
+      file: uploaded_file(filename: "statement.csv", content_type: "text/csv", content: "date,amount\n2024-01-01,1\n")
+    )
+    statement.update!(period_start_on: january, period_end_on: january.end_of_month)
+
+    result = @function.call("account_id" => @account.id, "year" => january.year)
+
+    assert result[:success]
+    assert_equal @account.id, result[:account][:id]
+    assert_equal january.year, result[:year]
+
+    covered = result[:months].find { |m| m[:month] == january.strftime("%Y-%m") }
+    assert_equal "covered", covered[:status]
+    assert_includes covered[:statement_ids], statement.id
+
+    february = result[:months].find { |m| m[:month] == january.next_month.strftime("%Y-%m") }
+    assert_equal "missing", february[:status]
+  end
+
+  test "rejects a non-uuid account id" do
+    result = @function.call("account_id" => "nope")
+
+    assert_not result[:success]
+    assert_equal "invalid_account_id", result[:error]
+  end
+
+  test "rejects an account the user cannot access" do
+    result = Assistant::Function::GetStatementCoverage.new(users(:family_member))
+      .call("account_id" => accounts(:other_asset).id)
+
+    assert_not result[:success]
+    assert_equal "account_not_found", result[:error]
+  end
+
+  test "refuses a user who cannot manage the vault" do
+    result = Assistant::Function::GetStatementCoverage.new(family_guest).call("account_id" => @account.id)
+
+    assert_not result[:success]
+    assert_equal "forbidden", result[:error]
+  end
+end