@code-yeongyu/senpi-codemode 2026.10.27-2 → 2026.10.30-1

package/src/kernels/py/kernel-contract.ts

@@ -3,6 +3,8 @@ import type { BridgeConnectionConfig, KernelToHostMessage } from "../../bridge/p
 import type { EvalKernelRunInput } from "../../tool/types.ts";
 import type { SessionEnvironment } from "../session-env.ts";
 import type { KernelLifecycle } from "../shared/kernel-death.ts";
+import type { InvocationPermissions } from "../shared/invocation-authority.ts";
+import type { CellDecider, RevocationFailedEvent } from "../js/kernel-contract.ts";
 import type { PeerKernelToolsDescribe } from "./kernel-tools-host.ts";
 import type { KernelSpawnProcess, KillProcessGroup } from "./process.ts";
 import type { PythonStartupStage } from "./startup.ts";
@@ -12,6 +14,8 @@ export interface PythonKernelStartOptions extends KernelLifecycle {
 	readonly interpreterPath: string;
 	readonly sessionId: string;
 	readonly cwd: string;
+	readonly permissions?: InvocationPermissions & { readonly decide?: CellDecider };
+	readonly onRevocationFailed?: (event: RevocationFailedEvent) => void;
 	readonly connection: BridgeConnectionConfig;
 	readonly env?: NodeJS.ProcessEnv;
 	/** Per-session PI_* values merged into the interpreter environment at spawn. */

package/src/kernels/py/kernel-tools-host.ts

@@ -37,8 +37,12 @@ export class PythonKernelTools {
 		readonly post: (message: HostToKernelMessage) => void;
 		readonly isOpen: () => boolean;
 		readonly peerDescribe?: PeerKernelToolsDescribe;
+		readonly invocation?: (
+			request: KernelToolsInvokeRequest,
+			options?: AbortSignal | KernelToolsInvokeOptions,
+		) => () => void;
 	}) {
-		this.#pump = new KernelToolHostPump(options.post, options.isOpen);
+		this.#pump = new KernelToolHostPump(options.post, options.isOpen, options.invocation);
 		this.#peerDescribe = options.peerDescribe;
 	}
 

package/src/kernels/py/kernel.ts

@@ -6,6 +6,7 @@ import type {
 	KernelToolsInvokeRequest,
 } from "../js/kernel-tools-types.ts";
 import { inputAtStart } from "../shared/cell-source-at-start.ts";
+import { invocationSession, registerInvocationSession } from "../shared/invocation-authority.ts";
 import { KernelMemoryHost } from "../shared/kernel-memory-host.ts";
 import { KernelPreludeTracker } from "../shared/kernel-prelude-plan.ts";
 import { pythonDeathReason } from "./death-reason.ts";
@@ -14,6 +15,7 @@ import type { PendingRun, PythonKernelRunOptions, PythonKernelStartOptions, Resu
 import { PythonKernelTools } from "./kernel-tools-host.ts";
 import { pythonStartupCeilingMs, pythonStartupHangGuardMs } from "./startup.ts";
 import { failedPythonResult, PythonKernelTransport } from "./transport.ts";
+import { PythonPermissionHost } from "./permission-host.ts";
 
 export type { PythonKernelRunOptions, PythonKernelStartOptions } from "./kernel-contract.ts";
 export type { KernelChild, KernelSpawnOptions, KernelSpawnProcess } from "./process.ts";
@@ -47,21 +49,39 @@ export class PythonKernel {
 	#closed = false;
 	readonly #tools: PythonKernelTools;
 	#dead = false;
+	readonly #releaseSession: () => void;
+	readonly #permission: PythonPermissionHost;
 
 	private constructor(options: PythonKernelStartOptions) {
 		this.#options = options;
+		this.#releaseSession = registerInvocationSession(options.sessionId, () => ({
+			cwd: options.cwd,
+			state: options.permissions?.state() ?? { epoch: 0, active: false, rules: [] },
+		}));
 		this.#memory = options.memory === undefined ? null : new KernelMemoryHost("py", options.memory);
+		this.#permission = new PythonPermissionHost(options, async () => {
+			this.#tools.retire("kernel_tool_stale", "Python permission authority revoked");
+			this.#settleAllPending("Python permission authority revoked");
+			if (this.#transport) await this.#beginRetirement(this.#transport);
+		});
 		this.#tools = new PythonKernelTools({
 			post: (message) => this.#transport?.post(message),
 			isOpen: () => this.#transport !== null && !this.#closed,
+			invocation: (request, invokeOptions) => this.#permission.invocation(request, invokeOptions),
 			...(options.peerKernelToolsDescribe === undefined ? {} : { peerDescribe: options.peerKernelToolsDescribe }),
 		});
 	}
 
 	static async start(options: PythonKernelStartOptions): Promise<PythonKernel> {
 		const kernel = new PythonKernel(options);
-		await kernel.#spawn(kernel.#generation);
-		return kernel;
+		try {
+			await kernel.#spawn(kernel.#generation);
+			return kernel;
+		} catch (error) {
+			kernel.#releaseSession();
+			kernel.#permission.dispose();
+			throw error;
+		}
 	}
 
 	listKernelToolNames(): readonly string[] {
@@ -88,11 +108,21 @@ export class PythonKernel {
 		return this.#tools.describe(names);
 	}
 
-	invokeKernelTool(
+	async invokeKernelTool(
 		request: KernelToolsInvokeRequest,
 		options?: AbortSignal | KernelToolsInvokeOptions,
 	): Promise<unknown> {
-		return this.#tools.invoke(request, options);
+		await this.#permission.admit();
+		invocationSession(
+			this.#options.sessionId,
+			{
+				cwd: this.#options.cwd,
+				state: this.#options.permissions?.state() ?? { epoch: 0, active: false, rules: [] },
+			},
+			options,
+			this.#options.permissions?.resolveSession,
+		);
+		return await this.#tools.invoke(request, options);
 	}
 
 	run(input: PythonKernelRunOptions): Promise<ResultMessage> {
@@ -159,6 +189,7 @@ export class PythonKernel {
 	async reset(): Promise<void> {
 		if (this.#failure) throw this.#failure;
 		if (this.#closed) throw new Error("Python kernel is closed");
+		this.#permission.revoke();
 		const generation = ++this.#generation;
 		this.#tools.retire("kernel_tool_stale", "Python kernel was reset; its kernel tools are gone");
 		const prior = this.#starting;
@@ -184,7 +215,9 @@ export class PythonKernel {
 
 	async close(): Promise<void> {
 		if (this.#closePromise) return await this.#closePromise;
+		this.#permission.revoke();
 		this.#closed = true;
+		this.#releaseSession();
 		this.#generation += 1;
 		this.#tools.retire("tools_unavailable", "Python kernel is closed");
 		this.#settleAllPending("Python kernel closed");
@@ -193,7 +226,10 @@ export class PythonKernel {
 			await starting?.catch(() => undefined);
 			await this.#retirement?.catch(() => undefined);
 			const transport = this.#transport;
-			if (!transport) return;
+			if (!transport) {
+				this.#permission.dispose();
+				return;
+			}
 			try {
 				await transport.close();
 			} catch (error) {
@@ -201,6 +237,7 @@ export class PythonKernel {
 				throw error;
 			}
 			if (this.#transport === transport) this.#transport = null;
+			this.#permission.dispose();
 		})();
 		return await this.#closePromise;
 	}
@@ -228,6 +265,7 @@ export class PythonKernel {
 	}
 
 	async #activateNext(): Promise<void> {
+		await this.#permission.admit();
 		await this.#ensureStarted();
 		if (this.#closed || this.#active || this.#retirement) return;
 		const pending = this.#queue.shift();
@@ -318,6 +356,7 @@ export class PythonKernel {
 		this.#lastMemory = undefined;
 		this.#transport = await PythonKernelTransport.start({
 			...this.#options,
+			permission: this.#permission,
 			onMessage: (message) => {
 				if (message.type === "result") return;
 				if (generation === this.#generation && this.#tools.consume(message)) return;
@@ -445,6 +484,7 @@ export class PythonKernel {
 	}
 
 	#removePending(pending: PendingRun): void {
+		this.#permission.settle(pending.input.cellId);
 		pending.hostAbort?.abort();
 		if (pending.timeoutTimer) clearTimeout(pending.timeoutTimer);
 		if (pending.escalationTimer) clearTimeout(pending.escalationTimer);

package/src/kernels/py/path_identity.py

@@ -0,0 +1,162 @@
+"""Versioned twin of shared/path-identity.mjs, with captured native primitives."""
+import builtins
+import errno
+import os
+import sys
+import unicodedata
+
+__builtins__ = vars(builtins).copy()
+PATH_IDENTITY_VERSION = 1
+
+
+class IdentityError(OSError):
+    def __init__(self, code):
+        super().__init__(code)
+        self.code = code
+
+
+def create_identity(runtime):
+    # Python's realpath is a component walker, not the native canonicalizer used
+    # by Node. In particular it retains requested case on case-insensitive disks.
+    platform = sys.platform
+    lstat, readlink = os.lstat, os.readlink
+    normalize, lower, upper = unicodedata.normalize, str.lower, str.upper
+    codes = dict(errno.errorcode)
+    fold_default = platform in ("darwin", "win32")
+    folds = {}
+
+    def failure(code):
+        return IdentityError(code)
+
+    def code_of(error):
+        number = getattr(error, "errno", None)
+        return getattr(error, "code", codes.get(number, "EUNKNOWN") if isinstance(number, int) else "EUNKNOWN")
+
+    def absolute(value):
+        return value.startswith("/")
+
+    def anchor(value):
+        if not absolute(value):
+            raise failure("ERELATIVE")
+        return value
+
+    def dirname(value):
+        # node:path.posix.dirname retains the separator preceding the last name.
+        end = len(value.rstrip("/"))
+        index = value.rfind("/", 0, end)
+        if index < 0:
+            return "."
+        return "/" if index == 0 else value[:index]
+
+    def basename(value):
+        return value.rstrip("/").rsplit("/", 1)[-1]
+
+    def join(*parts):
+        value = "/".join(part for part in parts if part)
+        names = []
+        for part in value.split("/"):
+            if part in ("", "."):
+                continue
+            if part == ".." and names and names[-1] != "..":
+                names.pop()
+            elif part != ".." or not value.startswith("/"):
+                names.append(part)
+        result = ("/" if value.startswith("/") else "") + "/".join(names)
+        return (result or ".") + ("/" if value.endswith("/") and result not in ("", "/") else "")
+
+    asset = os.path.join(os.path.dirname(__file__),
+                         "path_identity_windows.py" if platform == "win32" else "path_identity_posix.py")
+    namespace = {"__builtins__": __builtins__}
+    try:
+        with open(asset, "rb") as source:
+            exec(compile(source.read(), asset, "exec"), namespace)
+        if platform == "win32":
+            realpath, anchor, dirname, basename, join, absolute = namespace["windows_primitives"](failure)
+        else:
+            realpath = namespace["native_realpath"](runtime, failure)
+    except (ImportError, OSError, AttributeError):
+        # No native primitives (e.g. a Python built without ctypes): send no canonical, so the host
+        # falls back exactly as it does for any request without one, and the kernel still starts.
+        return lambda executed: {}
+
+    def volume_fold(existing):
+        try:
+            device = lstat(existing).st_dev
+        except OSError:
+            return fold_default
+        if device in folds:
+            return folds[device]
+        probe = existing
+        while True:
+            chars = list(basename(probe))
+            index = next((i for i, char in enumerate(chars) if lower(char) != upper(char)), None)
+            if index is not None:
+                char = chars[index]
+                chars[index] = upper(char) if char == lower(char) else lower(char)
+                try:
+                    original = lstat(probe)
+                    variant = lstat(join(dirname(probe), "".join(chars)))
+                    answer = (original.st_dev, original.st_ino) == (variant.st_dev, variant.st_ino)
+                except OSError:
+                    answer = False
+                break
+            parent = dirname(probe)
+            if parent == probe:
+                answer = fold_default
+                break
+            probe = parent
+            try:
+                same = lstat(probe).st_dev == device
+            except OSError:
+                same = False
+            if not same:
+                answer = fold_default
+                break
+        folds[device] = answer
+        return answer
+
+    def canonical(executed):
+        existing, missing, hops, followed = anchor(executed), [], 0, False
+        while True:
+            try:
+                real = realpath(existing)
+            except OSError as error:
+                code = code_of(error)
+                if code not in ("ENOENT", "ENOTDIR"):
+                    raise failure(code)
+                try:
+                    info = lstat(existing)
+                except OSError as inner:
+                    if code_of(inner) not in ("ENOENT", "ENOTDIR"):
+                        raise failure(code_of(inner))
+                    info = None
+                if info is not None and info.st_mode & 0o170000 == 0o120000:
+                    hops += 1
+                    if hops > 40:
+                        raise failure("ELOOP")
+                    target = readlink(existing)
+                    existing = target if absolute(target) else join(dirname(existing), target)
+                    followed = True
+                    continue
+                if followed and missing:
+                    raise failure("EDANGLING")
+                missing.insert(0, basename(existing))
+                parent = dirname(existing)
+                if parent == existing:
+                    raise failure(code)
+                existing = parent
+                continue
+            path = join(real, *missing) if missing else real
+            return {"v": PATH_IDENTITY_VERSION, "path": normalize("NFC", path) if platform == "darwin" else path,
+                    "foldCase": volume_fold(real)}
+
+    def identity(executed):
+        try:
+            return {"canonical": canonical(executed)}
+        except UnicodeError:
+            # A native filename that cannot travel as UTF-8 has no exact wire form.
+            return {}
+        except OSError as error:
+            code = code_of(error)
+            return {} if code == "EIDENTITY_UNSUPPORTED" else {"unresolvable": code}
+    return identity

package/src/kernels/py/path_identity_posix.py

@@ -0,0 +1,74 @@
+"""Native primitives used by Node/libuv and Bun's POSIX realpath."""
+import ctypes
+import errno
+import os
+import sys
+
+
+def native_realpath(runtime, failure):
+    library = ctypes.CDLL(None, use_errno=True)
+    native = library.realpath
+    native.argtypes = [ctypes.c_char_p, ctypes.c_void_p]
+    native.restype = ctypes.c_void_p
+    free = library.free
+    free.argtypes = [ctypes.c_void_p]
+    free.restype = None
+    string_at, get_errno = ctypes.string_at, ctypes.get_errno
+    codes = dict(errno.errorcode)
+
+    def realpath(value):
+        if "\0" in value:
+            raise failure("ERR_INVALID_ARG_VALUE")
+        pointer = native(value.encode("utf-8"), None)
+        if not pointer:
+            raise failure(codes.get(get_errno(), "EUNKNOWN"))
+        try:
+            return string_at(pointer).decode("utf-8", "strict")
+        finally:
+            free(pointer)
+
+    if runtime != "bun":
+        return realpath
+    native_open, native_close, fstat, readlink = os.open, os.close, os.fstat, os.readlink
+    if sys.platform == "darwin":
+        # bun-v1.4.4/src/runtime/node/node_fs.rs: open + F_GETPATH.
+        fcntl = library.fcntl
+        # Variadic: Darwin arm64 passes the third argument on the stack.
+        fcntl.argtypes = [ctypes.c_int, ctypes.c_int]
+        fcntl.restype = ctypes.c_int
+        buffer = ctypes.create_string_buffer
+        open_flags = os.O_RDONLY | os.O_NONBLOCK | os.O_NOCTTY
+
+        def realpath(value):
+            if "\0" in value:
+                raise failure("ERR_INVALID_ARG_VALUE")
+            fd = native_open(value, open_flags)
+            try:
+                result = buffer(1024)
+                if fcntl(fd, 50, result) == -1:  # Darwin F_GETPATH
+                    code = codes.get(get_errno(), "EUNKNOWN")
+                    raise failure("ENAMETOOLONG" if code == "ENOSPC" else code)
+                return result.value.decode("utf-8", "strict")
+            finally:
+                native_close(fd)
+        return realpath
+    if sys.platform == "linux":
+        path_only = os.O_PATH
+
+        def realpath(value):
+            if "\0" in value:
+                raise failure("ERR_INVALID_ARG_VALUE")
+            fd = native_open(value, path_only)
+            try:
+                result = readlink(f"/proc/self/fd/{fd}")
+                if result.endswith(" (deleted)") and fstat(fd).st_nlink == 0:
+                    raise failure("ENOENT")
+                result.encode("utf-8", "strict")
+                return result
+            finally:
+                native_close(fd)
+        return realpath
+
+    def unsupported(value):
+        raise failure("EIDENTITY_UNSUPPORTED")
+    return unsupported

package/src/kernels/py/path_identity_windows.py

@@ -0,0 +1,93 @@
+"""Captured Win32 primitives matching libuv's fs__realpath_handle."""
+import ctypes
+import ntpath
+import os
+import types
+
+
+def windows_primitives(failure):
+    library = ctypes.WinDLL("kernel32", use_last_error=True)
+    create = library.CreateFileW
+    create.argtypes = [ctypes.c_wchar_p, ctypes.c_uint32, ctypes.c_uint32, ctypes.c_void_p,
+                       ctypes.c_uint32, ctypes.c_uint32, ctypes.c_void_p]
+    create.restype = ctypes.c_void_p
+    final = library.GetFinalPathNameByHandleW
+    final.argtypes = [ctypes.c_void_p, ctypes.c_wchar_p, ctypes.c_uint32, ctypes.c_uint32]
+    final.restype = ctypes.c_uint32
+    close = library.CloseHandle
+    close.argtypes = [ctypes.c_void_p]
+    close.restype = ctypes.c_int
+    invalid = ctypes.c_void_p(-1).value
+    get_error, buffer = ctypes.get_last_error, ctypes.create_unicode_buffer
+    # These pure lexical helpers share a private globals dictionary, not mutable
+    # ntpath/os module attributes a cell could replace.
+    namespace = {**vars(ntpath), "__builtins__": __builtins__,
+                 "os": types.SimpleNamespace(fspath=os.fspath, getcwd=os.getcwd)}
+    for name, function in tuple(namespace.items()):
+        if isinstance(function, types.FunctionType) and function.__globals__ is vars(ntpath):
+            namespace[name] = types.FunctionType(function.__code__, namespace, name, function.__defaults__)
+    dirname, basename, normpath, splitdrive = (
+        types.FunctionType(getattr(ntpath, name).__code__, namespace, name)
+        for name in ("dirname", "basename", "normpath", "splitdrive")
+    )
+    getcwd = os.getcwd
+
+    def join(*parts):
+        # node:path.join concatenates before normalizing; ntpath.join instead
+        # discards earlier components when a later component contains a drive.
+        value = "\\".join(part for part in parts if part)
+        result = normpath(value)
+        if value.endswith(("\\", "/")) and not result.endswith("\\"):
+            result += "\\"
+        return result
+
+    def anchor(value):
+        value = value.replace("/", "\\")
+        # Drive-relative paths use per-drive process state in node:path.resolve;
+        # device namespaces have different lexical rules. Neither is approximated.
+        drive, tail = splitdrive(value)
+        if drive.startswith(("\\\\?", "\\\\.")):
+            raise failure("EIDENTITY_UNSUPPORTED")
+        if not drive and tail.startswith("\\"):
+            drive = splitdrive(getcwd())[0]
+        if drive.startswith("\\\\") and not tail:
+            tail = "\\"
+        if not drive or not tail.startswith("\\"):
+            raise failure("EIDENTITY_UNSUPPORTED")
+        value = normpath(drive + tail)
+        return "\\".join(part if i == 0 else part.rstrip(". ") for i, part in enumerate(value.split("\\")))
+
+    def native_error():
+        code = get_error()
+        # Known libuv translations. Other Win32 failures carry no identity
+        # instead of assuming Python's errno translation is the same.
+        return failure({2: "ENOENT", 3: "ENOENT", 267: "ENOTDIR"}.get(code, "EIDENTITY_UNSUPPORTED"))
+
+    def realpath(value):
+        if "\0" in value:
+            raise failure("ERR_INVALID_ARG_VALUE")
+        handle = create(value, 0, 0, None, 3, 0x80 | 0x02000000, None)
+        if handle == invalid:
+            raise native_error()
+        try:
+            size = final(handle, None, 0, 0)
+            if not size:
+                raise native_error()
+            result = buffer(size + 1)
+            length = final(handle, result, size, 0)
+            if not length or length >= size:
+                raise failure("EIDENTITY_UNSUPPORTED")
+            value = result.value
+            if value.startswith("\\\\?\\UNC\\"):
+                return "\\\\" + value[8:]
+            if value.startswith("\\\\?\\"):
+                return value[4:]
+            raise failure("EIDENTITY_UNSUPPORTED")
+        finally:
+            close(handle)
+
+    def absolute(value):
+        drive, tail = splitdrive(value)
+        return bool(tail.startswith(("\\", "/")) or drive.startswith("\\\\"))
+
+    return realpath, anchor, dirname, basename, join, absolute

package/src/kernels/py/permission-core.md

@@ -0,0 +1,103 @@
+# Python kernel permissions
+
+This is the Python portion of senpi#4309, stacked on the JavaScript permission
+core and invoker-authority work. The integrating permission extension supplies
+`PythonKernelStartOptions.permissions.state` and `decide`. This PR does not
+replace the extension's rule matcher or connect configuration reload events.
+
+## Transport and authority
+
+Each cell and kernel-tool invocation receives a fresh host-minted token.
+Python keeps that token in a `ContextVar`, including copied parallel contexts.
+The host's existing invocation pump owns callback token lifetime; the existing
+cross-session admission check runs before the callback body.
+
+The existing loopback HTTP bridge serves `/permission_check`. This route uses
+the invocation capability, not the owner's bridge bearer. Every operation opens
+a new connection, sends a random nonce, and requires the same nonce in the reply.
+Connect, send, and receive share one two-second deadline. Unknown tokens,
+transport failures, invalid replies, host failures, cancellation, and revoked
+tokens all refuse. The ordinary authenticated bridge routes are unchanged.
+The shared `CellOperation` type adds `read` and `ls`; the JavaScript slot layout
+and its state transitions are unchanged.
+
+Python maps a host-owned authority file read-only. The host publishes each
+epoch/alive/active word with one aligned eight-byte write, and never reuses a
+token offset while its interpreter may retain a context. Wrapped operations
+inspect the word before taking the inactive fast path and again after an allow.
+No-token contexts consult the kernel word and cannot borrow an enforcing
+invocation's authority.
+An expired inactive token may continue ordinary background work only while the
+kernel word remains alive and inactive. An expired enforcing token, or any dead
+kernel word, still refuses. This keeps copied contexts and asyncio tasks working
+across cells in sessions without deny rules.
+
+`revokeSessionKernels` marks the words DEAD synchronously and cancels pending
+checks before requesting retirement. Admission waits for the existing process
+retirement path to observe exit. An abandoned retirement permanently fences
+the host session and emits `onRevocationFailed`; the integrating extension must
+also fence direct tools on that event.
+
+## Runtime boundary
+
+The prelude loads both permission modules by their own file locations before
+user code, including when the prelude is loaded through `runpy`. Captured
+originals, the descriptor grants, and the mapping stay in closures. Wrappers
+do not publish `__wrapped__` references to originals.
+Permission decisions use private copies of classification helpers, constants,
+builtins, socket methods, and JSON codecs. Python helpers whose globals contain
+dependencies get private globals dictionaries too. Rebinding public stdlib names
+cannot change an authority word, forge a reply, or redirect a permission target.
+The `posix`/`nt` aliases share the same wrappers as `os`.
+
+Every path request carries `path`, the spelling as written, and
+`executedPath`, the string the operating system receives (a relative spelling
+joined onto the interpreter's current directory with `os.path.join`, never
+lexically collapsed). `path_identity.py` mirrors the JavaScript kernel's
+version-1 canonicalizer: native resolution of the deepest existing ancestor,
+the same missing-tail and dangling-link rules, Darwin NFC normalization, and
+a per-device case-folding probe. It sends `canonical: {v, path, foldCase}` or
+the same `unresolvable` error code. The bridge validates the field types; the
+permission service retains the shared version check and mount rewrite.
+The current canonical keeps identity matching available when the host resolver
+cannot start, just as for JavaScript cells.
+
+Native primitives are captured before interposition. Node uses libc realpath
+on POSIX; Bun uses descriptor paths on Darwin and Linux. Windows uses libuv's
+CreateFileW/GetFinalPathNameByHandleW sequence. Drive-relative and device-namespace
+Windows paths, unclassified Win32 errors, unsupported Bun platforms, and native
+names that cannot be represented losslessly in UTF-8 omit canonical identity
+rather than sending an approximation. They retain the existing host fallback;
+no operation is refused merely because local canonical identity is unavailable.
+An input spelling that is not valid UTF-8 remains uncheckable under the existing
+wire contract.
+
+File modes map to read, write, or both. Descriptor grants record paths and
+modes; unknown descriptors and opposite-mode operations refuse. Retained file
+objects check authority on use. SQLite connections compose their authorizer
+with user authorizers, refuse ATTACH and extension loading, and separately
+decide both backup endpoints.
+
+Loader source and resource reads remain subject to read checks. The engine's
+bytecode-cache writer is recognized by the original loader code objects in
+its call chain, not by a runtime-directory prefix. Direct calls to `set_data`
+still request write permission. Memory probes resolve before interposition and
+keep their fixed engine I/O private. Under enforcement, exception formatting
+reports the real traceback frames without issuing linecache source-file reads.
+Engine permission assets are compiled directly from source without a bytecode
+cache. Dynamic and builtin extension entry points, including `_imp`, are guarded.
+Cells see live mapping/sequence views of import registries while enforcing:
+ordinary reads continue, ordinary mutations carry the permission refusal, and
+direct `dict`/`list` descriptors reject the views with `TypeError` before any
+mutation. The `sys` dictionary view is read-only in that mode.
+FileIO remains a subclassable raw-I/O adapter, but its MRO no longer exposes the
+unguarded native file constructor.
+
+Ruby and Julia refuse each enforcing cell before posting it to the interpreter,
+including queued cells whose policy changed before execution. Inactive cells
+retain their existing execution path.
+
+This is API interposition, not a sandbox against deliberate introspection or
+already-loaded native code.
+
+Known limitation: reads performed by the runtime's native module resolver (bare packages, tsconfig aliases, package.json #imports, symlinked packages) are not covered by this work; tracked in #4380.