@topolo/cli 0.13.2 → 0.13.3

package/agent-packs/src/topolo_agent_pack/live.py

@@ -24,7 +24,16 @@ import urllib.parse
 import uuid
 
 from .storage import Library,PackError,atomic_json,canonical,read_json
-from .execution import load_gate, qualify_protocol
+from .execution import ExecutionGate, load_gate, qualify_protocol
+from .approvals import ApprovalRouter
+
+def permission_settings(agent, current, consent):
+    from .policy import settings
+    wanted=settings(agent,'codex',consent)['nativeSettings']
+    # Permission transitions use canonical defaults, never old applied grants.
+    # Keep independently qualified models and effort on the owned session.
+    for field in ['model','model_reasoning_effort']:wanted[field]=current[field]
+    return wanted
 
 def socket_path(lib):
     directory=pathlib.Path('/tmp')/('topolo-agent-pack-'+hashlib.sha256(str(lib.root).encode()).hexdigest()[:16])
@@ -32,14 +41,14 @@ def socket_path(lib):
     directory.mkdir(mode=0o700,exist_ok=True)
     return directory/'control.sock'
 
-def request(lib,operation):
+def request(lib,operation,params=None):
     record=read_json(lib.root/'live-bridge.json',{})
     if not record: raise PackError('This desktop profile has no live bridge. Open it through topolo-agent-pack first.')
     with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as connection:
-        connection.settimeout(3 if operation=='status' else 20)
+        connection.settimeout(3 if operation=='status' else 60 if operation=='permissions-configure' else 20)
         try: connection.connect(record['socket'])
         except OSError as exc: raise PackError('Managed live bridge is unavailable: '+str(exc)) from exc
-        connection.sendall(canonical({'token':record['token'],'operation':operation})+b'\n')
+        connection.sendall(canonical({'token':record['token'],'operation':operation,**({'params':params} if params is not None else {})})+b'\n')
         with connection.makefile('rb') as stream:
             line=stream.readline(1024*1024)
     if not line: raise PackError('Live bridge closed without a reply')
@@ -71,12 +80,17 @@ class BackendProxy:
         self.token=secrets.token_hex(32);self.path=socket_path(lib)
         self.execution=None;self.catalog_ready=asyncio.Event();self.catalog_id='topolo-catalog-'+uuid.uuid4().hex
         self.catalog_rows=[];self.catalog_cursors=set()
+        self.approvals=None;self.native_calls={};self.notifications=set()
+        self.permission_configuration=False
+        self.permission_batch=None
 
     async def start_child(self):
         active=self.lib.active()
         if not active.get('runtime'): raise PackError('No selected managed runtime')
         self.runtime=active['runtime'];env=os.environ.copy()
         self.execution=load_gate(self.runtime);self.catalog_ready.clear()
+        self.approvals=ApprovalRouter(pathlib.Path(self.runtime)/'approval-inbox',
+            list(self.execution.roles.values()),uuid.uuid4().hex) if self.execution else None
         self.catalog_rows=[];self.catalog_cursors=set()
         self.protocol=qualify_protocol(self.real) if self.execution else None
         env['CODEX_HOME']=str(pathlib.Path(self.runtime)/'home');env['CODEX_CLI_PATH']=self.real
@@ -86,6 +100,10 @@ class BackendProxy:
     async def output(self):
         while line:=await self.child.stdout.readline():
             value=json.loads(line)
+            if str(value.get('id')) in self.native_calls and ('result' in value or 'error' in value):
+                future=self.native_calls.pop(str(value['id']));self.pending.discard(str(value['id']))
+                if not future.done():future.set_result(value)
+                continue
             if value.get('id')==self.catalog_id:
                 self.pending.discard(self.catalog_id)
                 if self.execution and 'result' in value:
@@ -107,11 +125,19 @@ class BackendProxy:
                 self.pending.discard(str(value['id']))
                 if 'result' in value and isinstance(value['result'],dict) and 'userAgent' in value['result']: self.initialized=True
             method=value.get('method');params=value.get('params') or {}
+            if self.approvals:
+                record=self.approvals.capture(value)
+                if record and record['sourceThreadId']!=record['intakeThreadId'] and record['notificationState']!='delivered':
+                    self.schedule_notification(record)
             if method=='turn/started': self.active_turns.add(params['threadId'])
             if method=='turn/completed': self.active_turns.discard(params['threadId'])
             if method=='thread/status/changed':
                 if params.get('status',{}).get('type')=='active':self.active_turns.add(params['threadId'])
                 elif params.get('status',{}).get('type') in {'idle','notLoaded','systemError'}:self.active_turns.discard(params['threadId'])
+                if self.approvals and params.get('status',{}).get('type')=='idle':
+                    for row in self.approvals.records():
+                        if row['nativeConnectionCurrent'] and row['intakeThreadId']==params['threadId'] and row['notificationState']!='delivered':
+                            self.schedule_notification(row)
             sys.stdout.buffer.write(line);sys.stdout.buffer.flush()
 
     async def stop_child(self):
@@ -124,18 +150,24 @@ class BackendProxy:
         if self.output_task: await self.output_task
 
     async def forward(self,value):
+        if self.permission_configuration and value.get('method') in {'thread/resume','turn/start'}:
+            sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,'message':'Owned permission configuration in progress'}})+b'\n')
+            sys.stdout.buffer.flush();return
         if self.quiesced:
             if 'id' in value:
                 sys.stdout.buffer.write(canonical({'id':value['id'],'error':{'code':-32000,'message':'Pack switch in progress; reconnecting backend'}})+b'\n');sys.stdout.buffer.flush()
             return
         if self.execution and value.get('method') in {'thread/resume','turn/start'} and (value.get('params') or {}).get('threadId') in self.execution.roles:
             try:
+                await self.qualify_organization((value.get('params') or {})['threadId'])
                 await asyncio.wait_for(self.catalog_ready.wait(),10)
                 value=self.execution.prepare(value)
             except (PackError,asyncio.TimeoutError) as exc:
                 sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,'message':str(exc) or 'Native model catalog unavailable'}})+b'\n');sys.stdout.buffer.flush();return
         if 'id' in value and 'method' in value:self.pending.add(str(value['id']))
+        if self.approvals and 'method' not in value and ('result' in value or 'error' in value):self.approvals.sending(value)
         self.child.stdin.write(canonical(value)+b'\n');await self.child.stdin.drain()
+        if self.approvals and 'method' not in value and ('result' in value or 'error' in value):self.approvals.settled(value)
         if self.execution and value.get('method')=='initialized':
             await self.request_catalog()
 
@@ -145,6 +177,135 @@ class BackendProxy:
             'params':{'includeHidden':True,**({'cursor':cursor} if cursor else {})}})+b'\n')
         await self.child.stdin.drain()
 
+    async def call_native(self,method,params):
+        identity='topolo-relay-'+uuid.uuid4().hex
+        request={'id':identity,'method':method,'params':params}
+        if method in {'thread/resume','turn/start'}:
+            await self.qualify_organization(params['threadId'])
+            await asyncio.wait_for(self.catalog_ready.wait(),10)
+            request=self.execution.prepare(request)
+        future=asyncio.get_running_loop().create_future();self.native_calls[identity]=future;self.pending.add(identity)
+        try:
+            self.child.stdin.write(canonical(request)+b'\n');await self.child.stdin.drain()
+            reply=await asyncio.wait_for(future,15)
+        except BaseException:
+            self.native_calls.pop(identity,None);self.pending.discard(identity);raise
+        reply=self.execution.reply(reply) if self.execution else reply
+        if 'error' in reply:
+            raise PackError('Native intake relay refused; original request remains pending')
+        return reply['result']
+
+    async def qualify_organization(self,thread_id):
+        role=self.execution.roles.get(thread_id) if self.execution else None
+        if role and not self.permission_configuration and (pathlib.Path(self.runtime)/'permissions-operation.json').exists():
+            raise PackError('Unresolved native permission operation requires reconciliation before owned execution or grants')
+        if not role or not role.get('installationConsent'):
+            if role and role['settings']['sandbox_mode']=='danger-full-access':
+                raise PackError('Full access requires a fresh authenticated organization ceiling')
+            return
+        from . import topolo
+        consent=role['installationConsent']
+        agents=self.lib.load(consent['pack'])[0]['agents']
+        matches=[a for a in agents if '/'.join([a['pack'],a['set'],a['id']])==role['key'] and a['threadId']==role['threadId']]
+        if len(matches)!=1:
+            raise PackError('Current consent has no unique live owned role')
+        if role['settings']!=permission_settings(matches[0],role['settings'],consent):
+            raise PackError('Effective native permission intent differs from the current consent profile')
+        if self.permission_batch and self.permission_batch['consent']==consent:
+            if time.monotonic()>=self.permission_batch['deadline']:
+                raise PackError('Qualified native permission batch expired; reconcile without replay')
+            role['organizationPolicyProof']=self.permission_batch['proof'];return
+        _,proof=await asyncio.to_thread(topolo.organization_execution_policy,
+            topolo.Client(consent['environment'],consent['contextKey']),consent,agents,consent.get('agentWorkspaceId'))
+        from .permissions import authorize_native_scope
+        authorize_native_scope(proof)
+        role['organizationPolicyProof']=proof
+
+    async def configure_permissions(self,pack):
+        """Configure the existing owned child, without launching another server."""
+        from . import permissions
+        if self.permission_configuration or self.quiesced or not self.execution or self.active_turns or self.pending:
+            raise PackError('Owned native connection must be initialized, idle and settled')
+        marker=pathlib.Path(self.runtime)/'permissions-operation.json'
+        if marker.exists():
+            raise PackError('Unresolved native permissions operation requires read-only reconciliation')
+        if self.approvals and self.approvals.pending:
+            raise PackError('Native approvals remain pending; preserve their owning connection')
+        manifest,_=self.lib.load(pack);consent=permissions.load(self.lib,pack,manifest['agents'])
+        if not consent:
+            raise PackError('Explicit organization-bound installation consent required')
+        roles=list(self.execution.roles.values());wanted=[]
+        by_key={r['key']:r for r in roles}
+        for agent in manifest['agents']:
+            key='/'.join([agent['pack'],agent['set'],agent['id']]);old=by_key.get(key)
+            if not old or old['threadId']!=agent['threadId']:
+                raise PackError('Complete pack must match the live owned roster')
+            row={**old,'settings':permission_settings(agent,old['settings'],consent),
+                'installationConsent':consent,'intakeKey':consent['intakeRoutes'][key],'contextKey':consent['contextKey']}
+            wanted.append(row)
+        changed={r['threadId']:r for r in wanted}
+        candidate=ExecutionGate({'format':'topolo-codex-runtime-execution','schemaVersion':1,
+            'roles':[changed.get(r['threadId'],r) for r in roles]})
+        candidate.catalog=self.execution.catalog.copy()
+        # Complete ownership/idle qualification precedes the first native effect.
+        self.permission_configuration=True
+        try:
+            for role in wanted:
+                state=await self.call_native('thread/read',{'threadId':role['threadId'],'includeTurns':False})
+                thread=state.get('thread',{})
+                if thread.get('id')!=role['threadId'] or thread.get('cwd')!=role['cwd'] or thread.get('status',{}).get('type') not in {'idle','notLoaded'}:
+                    raise PackError('Native role identity or idle status differs')
+                if role['settings']['model_reasoning_effort'] not in candidate.catalog.get(role['settings']['model'],set()):
+                    raise PackError('Native account lacks the preserved model/effort')
+            # Validate the new routing graph before committing any permission intent.
+            ApprovalRouter(pathlib.Path(self.runtime)/'approval-inbox',list(candidate.roles.values()),uuid.uuid4().hex)
+            atomic_json(marker,{'state':'prepared','pack':pack,'before':roles,'requested':wanted})
+            self.execution=candidate
+            await self.qualify_organization(wanted[0]['threadId'])
+            self.permission_batch={'consent':consent,'proof':candidate.roles[wanted[0]['threadId']]['organizationPolicyProof'],
+                                   'deadline':time.monotonic()+45}
+            atomic_json(marker,{'state':'may-have-effects','pack':pack,'before':roles,'requested':wanted})
+            for role in wanted:
+                await self.call_native('thread/resume',{'threadId':role['threadId']})
+                atomic_json(marker,{'state':'may-have-effects','pack':pack,'before':roles,'requested':wanted,
+                    'verifiedThreadIds':sorted(candidate.verified)})
+            document={'format':'topolo-codex-runtime-execution','schemaVersion':1,'roles':list(candidate.roles.values()),
+                      'applied':False,'modelTurnsStarted':False}
+            atomic_json(pathlib.Path(self.runtime)/'execution-policy.json',document)
+            self.approvals=ApprovalRouter(pathlib.Path(self.runtime)/'approval-inbox',list(candidate.roles.values()),uuid.uuid4().hex)
+            result={'state':'native-permission-resumes-verified','pack':pack,'verifiedAgents':len(wanted),
+                'modelTurnsStarted':False,'historyChanged':False,'appToolApprovalReadbackVerified':False,
+                'intakeRoutes':len(wanted),'nativeApprovalTransport': 'owned-live-connection'}
+            atomic_json(marker,{**result,'verifiedThreadIds':sorted(candidate.verified)})
+            atomic_json(pathlib.Path(self.runtime)/'permissions-proof.json',result);marker.unlink()
+            return result
+        finally:self.permission_configuration=False;self.permission_batch=None
+
+    def schedule_notification(self,record):
+        if (record['key'] in self.notifications or record['notificationState'] not in
+                {'not-delivered','awaiting-idle-intake'}):return
+        self.notifications.add(record['key'])
+        async def deliver():
+            try:
+                state=await self.call_native('thread/read',{'threadId':record['intakeThreadId'],'includeTurns':False})
+                if state.get('thread',{}).get('status',{}).get('type') not in {'idle','notLoaded'}:
+                    self.approvals.notified(record['requestId'],False);return
+                if record['intakeThreadId'] not in self.execution.verified:
+                    await self.call_native('thread/resume',{'threadId':record['intakeThreadId']})
+                self.approvals.live(record['key'],record['intakeThreadId'],record['fingerprint'])
+                # A lost turn/start reply cannot be retried on the next idle event.
+                # Persist possible delivery before dispatch, including process death.
+                self.approvals.notification_state(record['requestId'],'may-have-effects')
+                await self.call_native('turn/start',{'threadId':record['intakeThreadId'],
+                    'input':[{'type':'text','text':self.approvals.notification(record),'text_elements':[]}]})
+                self.approvals.notified(record['requestId'],True)
+            except Exception:
+                entry=self.approvals.pending.get(str(record['requestId']))
+                uncertain=entry and entry['record']['notificationState']=='may-have-effects'
+                self.approvals.notification_state(record['requestId'],'delivery-uncertain' if uncertain else 'delivery-failed')
+            finally:self.notifications.discard(record['key'])
+        asyncio.create_task(deliver())
+
     def status(self):
         return {'pid':os.getpid(),'childPid':self.child.pid if self.child else None,'desktopPid':os.getppid(),'runtime':self.runtime,
                 'quiesced':self.quiesced,'initialized':self.initialized,
@@ -164,8 +325,28 @@ class BackendProxy:
                 await self.stop_child()
             elif op=='resume':
                 if self.quiesced: raise PackError('Use the desktop reconnect action to resume a quiesced bridge')
+            elif op=='permissions-configure':
+                result=await self.configure_permissions((message.get('params') or {})['pack'])
+            elif op in {'approval-list','approval-details','approval-respond'}:
+                if not self.approvals:
+                    raise PackError('This connection has no qualified intake routing')
+                params=message.get('params') or {}
+                if op=='approval-list':result={'requests':self.approvals.records()}
+                else:
+                    entry=self.approvals.live(params['key'],params['intakeThreadId'],params['fingerprint'])
+                    if op=='approval-details':result={'request':entry['message'],'record':entry['record']}
+                    else:
+                        if params.get('humanDecisionRecorded') is not True:
+                            raise PackError('Recorded human decision required; never auto-approve')
+                        reply=self.approvals.response(params['key'],params['intakeThreadId'],params['fingerprint'],params['result'])
+                        if reply['result'].get('decision')=='accept':
+                            await self.qualify_organization(entry['record']['sourceThreadId'])
+                            self.approvals.live(params['key'],params['intakeThreadId'],params['fingerprint'])
+                        self.approvals.sending(reply)
+                        self.child.stdin.write(canonical(reply)+b'\n');await self.child.stdin.drain();self.approvals.settled(reply)
+                        result={'state':'native-response-forwarded','operationEffectVerified':False}
             elif op!='status': raise PackError('Unknown live bridge operation')
-            result=self.status()
+            if op not in {'approval-list','approval-details','approval-respond','permissions-configure'}:result=self.status()
         except Exception as exc: result={'error':str(exc)}
         writer.write(canonical(result)+b'\n');await writer.drain();writer.close();await writer.wait_closed()
 

package/agent-packs/src/topolo_agent_pack/permissions.py

@@ -0,0 +1,167 @@
+"""Organization-bound installation consent, distinct from managed enforcement.
+
+Consent is machine local and never shipped in a portable pack. Native managed
+requirements remain authoritative. This file is not an organization admin API.
+"""
+import copy
+import pathlib
+import hashlib
+import json
+import re
+
+from .storage import PackError, atomic_json, component_key, read_json, safe_id
+
+PROFILES = {'manual': 0, 'role-default': 1, 'full-access': 2}
+POLICY_FIELDS = ('allowedProfiles', 'maximumProfile', 'defaultProfile', 'fullAccessEnabled',
+                 'allowedToolScopes', 'allowedActionScopes', 'allowedIntakes')
+
+
+def organization_policy(envelope, context, organization):
+    """Validate an authenticated action result; a local JSON never grants authority."""
+    required = set(POLICY_FIELDS) | {'contextKey', 'organizationId', 'revision', 'configured',
+        'policyDigest', 'updatedAt', 'updatedByUserId', 'decisionReference'}
+    if (not isinstance(envelope, dict) or set(envelope) != {'success', 'contractVersion', 'policy'} or
+            envelope['success'] is not True or envelope['contractVersion'] not in {'1.0.0', '1.1.0'}):
+        raise PackError('Organization policy contract unavailable or unsupported; no offline authority')
+    fields = list(POLICY_FIELDS)
+    if envelope['contractVersion'] == '1.1.0':
+        required.add('scopePolicyMode'); fields.insert(4, 'scopePolicyMode')
+    p = envelope['policy']
+    if (not isinstance(p, dict) or set(p) != required or p.get('contextKey') != context or
+            p.get('organizationId') != organization or context != 'org:' + organization or
+            not isinstance(p.get('revision'), str) or not re.fullmatch(r'0|[1-9][0-9]*', p['revision']) or
+            int(p['revision']) > 9007199254740991 or type(p.get('configured')) is not bool or
+            type(p.get('fullAccessEnabled')) is not bool):
+        raise PackError('Organization policy identity, revision or shape differs')
+    if 'scopePolicyMode' in required and p['scopePolicyMode'] not in {'allowlist', 'unrestricted'}:
+        raise PackError('Organization scope policy mode is invalid')
+    for field, maximum in [('allowedProfiles', 3), ('allowedToolScopes', 500),
+                           ('allowedActionScopes', 500), ('allowedIntakes', 200)]:
+        values = p[field]
+        pattern = (r'[a-z0-9][a-z0-9-]*/intakes/[a-z0-9][a-z0-9-]*' if field == 'allowedIntakes'
+                   else r'[A-Za-z0-9][A-Za-z0-9_.:/-]*')
+        if (not isinstance(values, list) or len(values) > maximum or
+                any(not isinstance(v, str) or not 1 <= len(v) <= 255 or
+                    not re.fullmatch(pattern, v) for v in values) or
+                len(set(values)) != len(values)):
+            raise PackError('Organization policy has invalid exact scope identifiers')
+    if p.get('scopePolicyMode') == 'unrestricted' and (p['allowedToolScopes'] or p['allowedActionScopes']):
+        raise PackError('Unrestricted mode must not contain ambiguous scope allowlists')
+    allowed = p['allowedProfiles']
+    if (not allowed or any(v not in PROFILES for v in allowed) or
+            p['maximumProfile'] not in PROFILES or p['defaultProfile'] not in allowed or
+            any(PROFILES[v] > PROFILES[p['maximumProfile']] for v in allowed) or
+            ('full-access' in allowed or p['maximumProfile'] == 'full-access') and not p['fullAccessEnabled']):
+        raise PackError('Organization policy profile ceiling is inconsistent')
+    if (p['updatedAt'] is not None and (type(p['updatedAt']) is not int or p['updatedAt'] < 0) or
+            any(p[field] is not None and (not isinstance(p[field], str) or not 1 <= len(p[field]) <= 255)
+                for field in ['updatedByUserId', 'decisionReference'])):
+        raise PackError('Organization policy audit fields are invalid')
+    if not p['configured'] and (p['revision'] != '0' or allowed != ['manual'] or
+            p['maximumProfile'] != 'manual' or p['defaultProfile'] != 'manual' or p['fullAccessEnabled'] or
+            any(p[v] for v in ['allowedToolScopes', 'allowedActionScopes', 'allowedIntakes']) or
+            any(p[v] is not None for v in ['updatedAt', 'updatedByUserId', 'decisionReference'])):
+        raise PackError('Absent organization policy is not the restrictive default')
+    if not p['configured'] and p.get('scopePolicyMode', 'allowlist') != 'allowlist':
+        raise PackError('Absent organization scope policy must deny scoped use')
+    if p['configured'] and (p['revision'] == '0' or any(p[v] is None for v in
+            ['updatedAt', 'updatedByUserId', 'decisionReference'])):
+        raise PackError('Configured organization policy lacks server audit metadata')
+    body = {field: sorted(p[field]) if isinstance(p[field], list) else p[field] for field in fields}
+    digest = 'sha256:' + hashlib.sha256(json.dumps(body, separators=(',', ':'), ensure_ascii=False).encode()).hexdigest()
+    if p['policyDigest'] != digest:
+        raise PackError('Organization policy digest differs')
+    return copy.deepcopy(p)
+
+
+def authorize_profile(consent, agents, policy):
+    consent = validate(consent, consent['pack'], agents)
+    if policy['contextKey'] != consent['contextKey']:
+        raise PackError('Installation and organization policy contexts differ')
+    for agent in agents:
+        key = component_key(agent)
+        selected = consent.get('overrides', {}).get(key, consent['profile'])
+        if selected not in policy['allowedProfiles'] or PROFILES[selected] > PROFILES[policy['maximumProfile']]:
+            raise PackError('Organization policy prohibits the requested profile: ' + key)
+        if consent['intakeRoutes'][key] not in policy['allowedIntakes']:
+            raise PackError('Organization policy does not allow the owning intake: ' + key)
+    return {'contextKey': policy['contextKey'], 'revision': policy['revision'],
+            'policyDigest': policy['policyDigest'], 'profileCeilingVerified': True,
+            'toolActionScopeEnforcementVerified': False,
+            'scopePolicyMode': policy.get('scopePolicyMode', 'allowlist'),
+            'toolActionRestrictionRequested': policy.get('scopePolicyMode', 'allowlist') == 'allowlist'}
+
+
+def authorize_native_scope(proof):
+    if proof.get('scopePolicyMode') != 'unrestricted' or proof.get('toolActionRestrictionRequested') is not False:
+        raise PackError('Native tool/action allowlist enforcement is unavailable; requested organization policy cannot be activated')
+
+
+def validate(document, pack, agents):
+    keys = {component_key(a) for a in agents}
+    if (not isinstance(document, dict) or document.get('format') != 'topolo-pack-installation-consent'
+            or document.get('schemaVersion') != 1 or document.get('pack') != pack
+            or document.get('authority') != 'local-installation-consent'
+            or not isinstance(document.get('contextKey'), str)
+            or not document['contextKey'].startswith('org:') or len(document['contextKey']) <= 4
+            or not document.get('principalId') or document.get('profile') not in PROFILES
+            or document.get('approved') is not True):
+        raise PackError('Invalid organization-bound installation consent')
+    routes = document.get('intakeRoutes', {})
+    intake_keys = {component_key(a) for a in agents if a['set'] == 'intakes'}
+    if (not isinstance(routes, dict) or set(routes) != keys or
+            any(v not in intake_keys for v in routes.values())):
+        raise PackError('Every role requires an owned intake route')
+    overrides = document.get('overrides', {})
+    if not isinstance(overrides, dict) or set(overrides) - keys:
+        raise PackError('Permission override names an unowned role')
+    if any(v not in PROFILES or PROFILES[v] > PROFILES[document['profile']] for v in overrides.values()):
+        raise PackError('Role override widens installation consent')
+    return copy.deepcopy(document)
+
+
+def load(lib, pack, agents):
+    path = lib.root / 'permissions' / (safe_id(pack) + '.json')
+    if not path.exists():
+        return None
+    if path.is_symlink() or not path.is_file():
+        raise PackError('Installation consent must be a regular owned file')
+    return validate(read_json(path), pack, agents)
+
+
+def configure(lib, pack, profile, routes, environment, context, client, workspace=None):
+    from .topolo import identity
+    manifest, revision = lib.load(pack)
+    actor = identity(client)
+    if context != 'org:' + actor['organizationId']:
+        raise PackError('Authenticated organization differs from installation context')
+    document = validate({'format': 'topolo-pack-installation-consent', 'schemaVersion': 1,
+        'authority': 'local-installation-consent', 'pack': pack, 'sourceRevision': revision,
+        'contextKey': context, 'environment': environment, 'principalId': actor['userId'],
+        'profile': profile, 'approved': True, 'intakeRoutes': routes, 'overrides': {},
+        'agentWorkspaceId': workspace}, pack, manifest['agents'])
+    atomic_json(lib.root / 'permissions' / (safe_id(pack) + '.json'), document)
+    return {'state': 'installation-consent-recorded-not-native-applied', 'pack': pack,
+            'profile': profile, 'roles': len(manifest['agents']), 'contextKey': context,
+            'organizationManagedPolicyVerified': False, 'nativeApplied': False}
+
+
+def apply_settings(agent, harness, native, document):
+    native = copy.deepcopy(native)
+    if document is None:
+        return native
+    key = component_key(agent)
+    if key not in document['intakeRoutes']:
+        raise PackError('Role has no approved intake route')
+    selected = document.get('overrides', {}).get(key, document['profile'])
+    if selected == 'role-default':
+        return native
+    if harness == 'codex':
+        native['approval_policy'] = 'never' if selected == 'full-access' else 'on-request'
+        native['sandbox_mode'] = 'danger-full-access' if selected == 'full-access' else 'read-only'
+        native['apps'] = {'_default': {'default_tools_approval_mode': 'approve' if selected == 'full-access' else 'prompt'}}
+    elif harness == 'claude':
+        native['permissions'] = {'defaultMode': 'bypassPermissions' if selected == 'full-access' else 'default'}
+    else:
+        raise PackError('Unqualified permission adapter')
+    return native

package/agent-packs/src/topolo_agent_pack/policy.py

@@ -46,7 +46,7 @@ def role_profile(agent):
     return 'operator'
 
 
-def settings(agent, harness):
+def settings(agent, harness, consent=None):
     if harness not in MODELS:
         raise PackError('Execution settings adapter is not qualified: ' + harness)
     profile = role_profile(agent)
@@ -62,22 +62,27 @@ def settings(agent, harness):
     else:
         native = {'model': model, 'effortLevel': spec['effort'],
                   'permissions': {'defaultMode': 'acceptEdits' if profile == 'build' else 'default'}}
+    from .permissions import apply_settings
+    native = apply_settings(agent, harness, native, consent)
+    full = native.get('sandbox_mode') == 'danger-full-access' or native.get('permissions', {}).get('defaultMode') == 'bypassPermissions'
     return {'profile': profile, 'nativeSettings': native,
-            'localAccessIntent': spec['localAccess'], 'applied': False,
+            'localAccessIntent': 'full-access' if full else native.get('sandbox_mode', spec['localAccess']), 'applied': False,
             # Claude Manual is an approval mode, not a read-only filesystem sandbox.
-            'requiresAdditionalLocalConfinement': harness == 'claude' and spec['localAccess'] == 'read-only'}
+            'requiresAdditionalLocalConfinement': harness == 'claude' and not full and spec['localAccess'] == 'read-only'}
 
 
-def render(manifest, revision, agents, harnesses=('codex', 'claude')):
+def render(manifest, revision, agents, harnesses=('codex', 'claude'), consent=None):
     rows = []
     for agent in agents:
         rows.append({'key': component_key(agent), 'title': agent['title'],
                      'sidebar': {'group': GROUPS.get(agent['set'], agent['set']),
                                  'pinned': agent.get('pinned', False)},
-                     'harnesses': {h: settings(agent, h) for h in harnesses}})
+                     'intake': consent['intakeRoutes'][component_key(agent)] if consent else None,
+                     'harnesses': {h: settings(agent, h, consent) for h in harnesses}})
     return {'format': 'topolo-agent-execution-policy', 'schemaVersion': 1,
             'pack': manifest['packId'], 'sourceRevision': revision, 'agents': rows,
-            'applied': False,
+            'applied': False, 'installationConsent': copy.deepcopy(consent),
+            'organizationManagedPolicyVerified': False,
             'contextPolicy': {'load': ['role charter', 'current task', 'relevant retrieved memory'],
                               'sharedMemory': 'retrieve by task and user or organization scope',
                               'history': 'preserve, do not copy between roles',

package/agent-packs/src/topolo_agent_pack/topolo.py

@@ -49,6 +49,18 @@ def identity(client):
         raise PackError('Verified user and organization context are required by the Agent contract')
     return {'userId':user['id'],'organizationId':org['id']}
 
+def organization_execution_policy(client, consent, agents, workspace):
+    """Fresh authenticated organization ceiling, distinct from native acknowledgement."""
+    from .permissions import organization_policy, authorize_profile
+    actor=identity(client)
+    if actor['userId']!=consent['principalId'] or client.context!=consent['contextKey']:
+        raise PackError('Current installation principal/context differs')
+    if not workspace:
+        raise PackError('Explicit verified Agent workspace required for policy retrieval')
+    envelope=client.action('app_topolo_agent.organization_execution_policy.get',{},workspace)
+    policy=organization_policy(envelope,client.context,actor['organizationId'])
+    return policy,authorize_profile(consent,agents,policy)
+
 def binding_path(lib,name,environment,context):
     safe_id(name)
     return lib.root/'connections'/name/environment/(hashlib.sha256(context.encode()).hexdigest()+'.json')