@topolo/cli 0.13.2 → 0.13.4

package/agent-packs/README.md

@@ -430,8 +430,9 @@ Mode setup requires a one-time restart, followed by the Developer menu's
 do not patch fuses or assume a restart flag opens the endpoint.
 
 All selected sessions must be idle, have matching titles/workspaces, and use
-models from the native account catalog. Settings use Manual or Accept edits;
-no bypass permission is accepted. An fsynced journal records the baseline and
+models from the native account catalog. Bypass permissions require explicit
+machine-local full-access consent and a fresh authenticated organization
+ceiling; role-default settings use Manual or Accept edits. An fsynced journal records the baseline and
 each attempted native effect before dispatch. On a disconnect or failed
 acknowledgement, use the explicit read-only native recovery command below before
 retrying; do not assume failure means no effects. Application independently
@@ -491,5 +492,82 @@ authorization remains separate from local command sandboxing.
 Managed bridge status reports requested policy and which resumes have current
 native readback. It does not claim an inference test or independent app-tool
 approval readback. Existing runtimes without this policy report not-configured
-until explicitly rebuilt. Source fixtures do not establish live desktop or
+until explicit `permissions ... --apply` adoption on the existing idle connection.
+Adoption validates the complete selected composition and current source revision,
+qualifies the installed protocol and native model catalog, and verifies original
+thread identities and workspaces before native permission changes. Legacy model
+and effort values are reviewed source-role intent, qualified only by native
+resume responses. Existing execution-policy selections are preserved. The
+operation compares charter and transcript inventories and retains partial or
+uncertain effects for read-only reconciliation; it never recreates threads.
+
+The private token-authenticated bridge also supports `owned-roster-read` with
+no parameters. It sends only fixed native thread metadata and model-catalog
+reads for the full selected roster. Its result explicitly does not establish
+effective permissions, models or app-tool approval behavior. Source fixtures do not establish live desktop or
 three-environment shared-memory acceptance.
+
+### Organization consent and intake permission routing
+
+Pack export never carries machine-local permission consent. An authenticated
+user records consent separately, with an explicit environment, organization,
+Agent workspace and complete mapping of role keys to owned intake keys:
+
+```sh
+topolo agent-packs permissions topolo-clean --profile full-access \
+  --routes /absolute/intake-routes.json --environment production \
+  --context-key org:<organization-id> --agent-workspace <workspace-id> --confirm
+topolo agent-packs policy topolo-clean --verify-organization \
+  --harness claude --output /absolute/review.json
+```
+
+Profiles are `manual`, `role-default` and `full-access`. Per-role consent may
+reduce the selected profile. Every role must route to an intake inside the same
+owned roster and organization. Local consent grants no organization authority:
+the public Agent organization execution-policy read supplies the current
+profile ceiling. Missing, malformed, stale-context or unavailable policy
+refuses before native grants. Legacy 1.0 policies use allowlists, including
+empty-list denial; 1.1 adds explicit `scopePolicyMode`. Native application of
+an allowlist is refused until the adapter can enforce its exact tool/action
+scopes. An administrator may explicitly select 1.1 `unrestricted` with empty
+tool/action lists; intake restrictions remain enforced separately.
+
+For Codex, append `--apply` to the consent command to configure the existing
+owned idle backend. For Claude, record consent with `--harness claude`, render
+the reviewed policy, then use native `configure --apply`. Models, effort,
+thread identities, histories and charters are preserved. Native settings
+must acknowledge all selected roles before completion. An interrupted batch
+retains an operation marker and refuses replay pending owner reconciliation.
+Full access configures Codex `never`/`danger-full-access` and Claude
+`bypassPermissions`; it does not bypass platform authorization or business
+decision rules. Claude Manual is not filesystem confinement.
+
+Real native permission requests are recorded with request fingerprints and
+sent to the owning intake as generated notifications, never as human consent.
+Idle agents consume no model turn merely because routing was installed.
+Busy intakes wait for their next native event. Delivery or response uncertainty
+is durable and never silently replayed. A human answer is relayed for one exact
+pending request:
+
+```sh
+topolo agent-packs approvals list
+topolo agent-packs approvals details <key> --intake <thread-id> --fingerprint <hash>
+topolo agent-packs approvals respond <key> --intake <thread-id> \
+  --fingerprint <hash> --response /absolute/answer.json --human-decision-recorded
+# Add --harness claude for Claude requests; its answer is {"decision":"once"} or {"decision":"deny"}.
+```
+
+The recorded-human flag is a workflow assertion, not cryptographic identity
+proof. The broker preserves native authorization and never invents card origin,
+standing grants or action completion. Claude card-only grants and unsupported
+Codex elicitation/permission kinds remain visible in the intake but require
+their original native interaction. Full-access consent cannot override managed
+native restrictions.
+
+Claude setup installs an event listener and private bounded Unix control socket
+inside the same hash-qualified native process. The temporary setup inspector
+may close; approvals use this socket, with private owner-only directory/token,
+exact PID/roster identity and current module qualification. No independent
+daemon, polling loop, arbitrary evaluation endpoint or UI pack fix is used.
+Audit failures refuse further broker operation. Cached reports and source
+fixtures are not live native settings or shared Agent/Bytes acceptance proof.

package/agent-packs/coverage_changed.py

@@ -0,0 +1,122 @@
+"""Fail closed on untested Python changes against the admitted released base.
+
+Complements the whole-module floor. coverage.py parses current source again so
+an omitted file, executable line or outgoing branch cannot disappear from the
+denominator. New and untracked adapter modules are included before committing.
+"""
+import argparse
+import json
+import pathlib
+import re
+import subprocess
+import sys
+
+from coverage.parser import PythonParser
+
+RELEASE_BASE = '6a13ada56844712aae58738ba01dbbdf90718bef'
+SOURCE = pathlib.Path('agent-packs/src/topolo_agent_pack')
+MODULES = {'topolo', 'claude', 'policy', 'permissions', 'approvals', 'execution', 'live', 'cli'}
+
+
+class CoverageRefused(RuntimeError):
+    pass
+
+
+def git(root, *args, optional=False):
+    result = subprocess.run(['git', *args], cwd=root, capture_output=True, timeout=15)
+    if result.returncode and not optional:
+        raise CoverageRefused('Git qualification failed: ' + ' '.join(args[:2]))
+    return result
+
+
+def regular(path):
+    if not path.is_file() or path.is_symlink():
+        raise CoverageRefused('Missing or unowned source/report: ' + str(path))
+
+
+def qualify(root, report_path, baseline=RELEASE_BASE, expected_baseline=RELEASE_BASE):
+    root = pathlib.Path(root).resolve();report_path = pathlib.Path(report_path)
+    if not re.fullmatch(r'[a-f0-9]{40}', baseline) or baseline != expected_baseline:
+        raise CoverageRefused('Exact admitted full release baseline required')
+    git(root, 'cat-file', '-e', baseline + '^{commit}')
+    git(root, 'merge-base', '--is-ancestor', baseline, 'HEAD')
+    regular(report_path)
+    report = json.loads(report_path.read_text())
+    if report.get('meta', {}).get('branch_coverage') is not True or not isinstance(report.get('files'), dict):
+        raise CoverageRefused('Full coverage.py branch JSON report required')
+    files = {}
+    for name, value in report['files'].items():
+        path = pathlib.Path(name);path = path if path.is_absolute() else root / path
+        path = path.resolve()
+        if path in files:
+            raise CoverageRefused('Coverage source identity duplicated')
+        files[path] = value
+    changed_names = git(root, 'diff', '--name-only', '-z', baseline, '--', str(SOURCE)).stdout
+    new_names = git(root, 'ls-files', '--others', '-z', '--', str(SOURCE)).stdout
+    changed = {pathlib.Path(p.decode()) for p in (changed_names + new_names).split(b'\0') if p and p.endswith(b'.py')}
+    if not changed:
+        raise CoverageRefused('No Python source changes against admitted baseline')
+    required = changed | {SOURCE / (m + '.py') for m in MODULES}
+    missing_lines = [];missing_arcs = [];line_count = arc_count = 0
+    for relative in sorted(required):
+        path = root / relative;regular(path)
+        if not path.resolve().is_relative_to(root):
+            raise CoverageRefused('Source escaped the owned repository')
+        if path.resolve() not in files:
+            raise CoverageRefused('Source absent from coverage collection: ' + str(relative))
+        if path.stat().st_mtime_ns > report_path.stat().st_mtime_ns:
+            raise CoverageRefused('Coverage report predates current source: ' + str(relative))
+        value = files[path.resolve()]
+        if value.get('excluded_lines'):
+            raise CoverageRefused('Excluded executable source is not qualified')
+        executed = set(value['executed_lines']);missing = set(value['missing_lines'])
+        parser = PythonParser(filename=str(path));parser.parse_source()
+        if executed & missing or executed | missing != parser.statements:
+            raise CoverageRefused('Executable line inventory differs from current source: ' + str(relative))
+        counts = parser.exit_counts()
+        expected_arcs = {a for a in parser.arcs() if counts.get(a[0], 0) > 1}
+        executed_arcs = {tuple(a) for a in value['executed_branches']}
+        absent_arcs = {tuple(a) for a in value['missing_branches']}
+        if executed_arcs & absent_arcs or executed_arcs | absent_arcs != expected_arcs:
+            raise CoverageRefused('Outgoing branch inventory differs from current source: ' + str(relative))
+        if relative not in changed:
+            continue
+        if git(root, 'cat-file', '-e', baseline + ':' + str(relative), optional=True).returncode:
+            lines = set(range(1, len(path.read_text().splitlines()) + 1))
+        else:
+            diff = git(root, 'diff', '--no-ext-diff', '--no-textconv', '--unified=0', baseline, '--', str(relative)).stdout.decode()
+            lines = set()
+            for start, size in re.findall(r'^@@ .*?\+(\d+)(?:,(\d+))? @@', diff, re.M):
+                lines.update(range(int(start), int(start) + int(size or '1')))
+        relevant = parser.statements & lines;arcs = {a for a in expected_arcs if a[0] in lines}
+        line_count += len(relevant);arc_count += len(arcs)
+        missing_lines.extend((str(relative), n) for n in sorted(relevant - executed))
+        missing_arcs.extend((str(relative), a) for a in sorted(arcs - executed_arcs))
+    if not line_count:
+        raise CoverageRefused('No executable changed Python source qualified')
+    result = {'baseline': baseline, 'sourceModulesCollected': len(required),
+              'changedExecutableLines': line_count, 'changedOutgoingArcs': arc_count,
+              'missingLines': missing_lines, 'missingArcs': missing_arcs}
+    if missing_lines or missing_arcs:
+        raise CoverageRefused('Changed-code coverage must be 100%: ' + json.dumps(result))
+    return {**result, 'changedLineCoverage': 100, 'changedBranchCoverage': 100}
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--root', default=str(pathlib.Path(__file__).resolve().parents[1]))
+    parser.add_argument('--report', default='node_modules/.cache/agent-pack-test/coverage.json')
+    parser.add_argument('--base', default=RELEASE_BASE)
+    args = parser.parse_args(argv)
+    try:
+        report = pathlib.Path(args.report)
+        report = report if report.is_absolute() else pathlib.Path(args.root) / report
+        print(json.dumps(qualify(args.root, report, args.base)))
+        return 0
+    except (CoverageRefused, OSError, ValueError, KeyError, TypeError, subprocess.SubprocessError) as error:
+        print('Python changed coverage REFUSED: ' + str(error), file=sys.stderr)
+        return 2
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

package/agent-packs/src/topolo_agent_pack/approvals.py

@@ -0,0 +1,134 @@
+"""Durable intake visibility with original native request/response identities.
+
+Request content stays in the live native connection; durable records contain
+identities and fingerprints, not commands, question bodies or credentials.
+No timer, automatic decision, fake native acknowledgement or approval replay.
+"""
+import copy
+import hashlib
+import pathlib
+
+from .storage import PackError, atomic_json, canonical, read_json
+
+METHODS = {'item/commandExecution/requestApproval', 'item/fileChange/requestApproval',
+           'item/permissions/requestApproval', 'item/tool/requestUserInput',
+           'mcpServer/elicitation/request'}
+
+
+class ApprovalRouter:
+    def __init__(self, root, roles, generation):
+        self.root = pathlib.Path(root); self.generation = generation
+        self.roles = {r['threadId']: r for r in roles}
+        self.by_key = {r['key']: r for r in roles}; self.pending = {}
+        self.root.mkdir(parents=True, exist_ok=True, mode=0o700)
+        for role in roles:
+            key = role.get('intakeKey')
+            if key is not None:
+                intake = self.by_key.get(key)
+                if (not intake or '/intakes/' not in key or not role.get('contextKey') or
+                        intake.get('contextKey') != role['contextKey']):
+                    raise PackError('Approval route has no same-context owned intake')
+
+    def capture(self, message):
+        if message.get('method') not in METHODS or 'id' not in message:
+            return None
+        params = message.get('params') or {}; role = self.roles.get(params.get('threadId'))
+        if not role or not role.get('intakeKey'):
+            return None
+        identity = str(message['id']); fingerprint = hashlib.sha256(canonical(message)).hexdigest()
+        if identity in self.pending:
+            if self.pending[identity]['record']['fingerprint'] != fingerprint:
+                raise PackError('Native approval request identity was reused with different content')
+            return copy.deepcopy(self.pending[identity]['record'])
+        key = hashlib.sha256(canonical([self.generation, message['id']])).hexdigest()
+        intake = self.by_key[role['intakeKey']]
+        record = {'format': 'topolo-native-approval', 'schemaVersion': 1, 'key': key,
+            'generation': self.generation, 'requestId': message['id'], 'fingerprint': fingerprint,
+            'method': message['method'], 'sourceThreadId': role['threadId'], 'sourceKey': role['key'],
+            'intakeThreadId': intake['threadId'], 'intakeKey': intake['key'],
+            'contextKey': role['contextKey'], 'state': 'pending', 'notificationState': 'not-delivered',
+            'turnId': params.get('turnId'), 'itemId': params.get('itemId'),
+            'nativeApproved': False}
+        atomic_json(self.root / (key + '.json'), record)
+        self.pending[identity] = {'record': record, 'message': copy.deepcopy(message)}
+        return copy.deepcopy(record)
+
+    def records(self):
+        rows = []
+        for path in sorted(self.root.glob('*.json')):
+            if path.is_symlink():
+                raise PackError('Unowned approval record')
+            row = read_json(path)
+            row['nativeConnectionCurrent'] = row['generation'] == self.generation and str(row['requestId']) in self.pending
+            rows.append(row)
+        return rows
+
+    def notification(self, record):
+        return ('Permission relay (generated by the Topolo pack adapter). Agent ' + record['sourceKey'] +
+            ' is awaiting a native ' + record['method'] + ' decision. Request ' + record['key'] +
+            ', fingerprint ' + record['fingerprint'] + '. This request belongs to this intake. '
+            'Read its exact live details with topolo agent-packs approvals details ' + record['key'] +
+            ' --intake ' + record['intakeThreadId'] + ' --fingerprint ' + record['fingerprint'] +
+            '. Present the decision to the human here, then relay only that exact recorded answer. '
+            'Do not treat this notification, pack membership, elapsed time or another agent as approval. '
+            'The source native request remains pending. No business action is authorized by this message.')
+
+    def notification_state(self, identity, state):
+        entry = self.pending.get(str(identity))
+        if entry is None: return
+        if state not in {'delivered', 'awaiting-idle-intake', 'may-have-effects', 'delivery-failed', 'delivery-uncertain'}:
+            raise PackError('Invalid notification state')
+        entry['record']['notificationState'] = state
+        atomic_json(self.root / (entry['record']['key'] + '.json'), entry['record'])
+
+    def notified(self, identity, delivered):
+        self.notification_state(identity, 'delivered' if delivered else 'awaiting-idle-intake')
+
+    def live(self, key, intake, fingerprint):
+        entries = [e for e in self.pending.values() if e['record']['key'] == key]
+        if len(entries) != 1:
+            raise PackError('Request is not pending on this native connection; no replay')
+        entry = entries[0]; row = entry['record']
+        if row['state'] != 'pending':
+            raise PackError('Native response may already have effects; reconcile without replay')
+        if row['intakeThreadId'] != intake or row['fingerprint'] != fingerprint:
+            raise PackError('Intake or exact request fingerprint differs')
+        return entry
+
+    def response(self, key, intake, fingerprint, result):
+        entry = self.live(key, intake, fingerprint)
+        if not isinstance(result, dict):
+            raise PackError('A native response object is required')
+        method = entry['record']['method']
+        if method in {'item/commandExecution/requestApproval', 'item/fileChange/requestApproval'}:
+            if set(result) != {'decision'} or result['decision'] not in {'accept', 'decline', 'cancel'}:
+                raise PackError('Only a one-request native accept/decline/cancel decision is supported')
+            available = entry['message']['params'].get('availableDecisions')
+            if available is not None and result['decision'] not in available:
+                raise PackError('Decision is unavailable on the exact native request')
+        elif method == 'item/tool/requestUserInput':
+            questions = entry['message']['params']['questions']
+            if set(result) != {'answers'} or not isinstance(result['answers'], dict) or set(result['answers']) != {q['id'] for q in questions}:
+                raise PackError('Every exact native question requires an answer')
+            if any(not isinstance(a, dict) or set(a) != {'answers'} or not isinstance(a['answers'], list) or
+                   not a['answers'] or any(not isinstance(v, str) for v in a['answers']) for a in result['answers'].values()):
+                raise PackError('Invalid native question answer')
+        else:
+            raise PackError('This permission kind requires its original native interaction; intake visibility is retained')
+        return {'id': entry['record']['requestId'], 'result': copy.deepcopy(result)}
+
+    def sending(self, message):
+        entry = self.pending.get(str(message.get('id')))
+        if entry is None: return
+        if entry['record']['state'] != 'pending':
+            raise PackError('Native response may already have effects; reconcile without replay')
+        entry['record']['state'] = 'response-may-have-effects'
+        atomic_json(self.root / (entry['record']['key'] + '.json'), entry['record'])
+
+    def settled(self, message):
+        entry = self.pending.pop(str(message.get('id')), None)
+        if entry is None: return
+        entry['record'].update(state='native-response-forwarded', nativeApproved=False,
+                               responseFingerprint=hashlib.sha256(canonical(message)).hexdigest())
+        # A sent response is not proof that the protected operation happened.
+        atomic_json(self.root / (entry['record']['key'] + '.json'), entry['record'])

package/agent-packs/src/topolo_agent_pack/cli.py

@@ -316,6 +316,17 @@ def parser():
     q=sub.add_parser('plan');q.add_argument('action',choices=['add','replace','switch']);q.add_argument('source');selection(q);q.add_argument('--target');q.add_argument('--fresh',action='store_true')
     q=sub.add_parser('policy',help='Render portable role settings for review; never changes live sessions')
     q.add_argument('source');selection(q);q.add_argument('--output')
+    q.add_argument('--verify-organization',action='store_true',help='Fresh authenticated profile ceiling; never uses cached policy as authority')
+    q=sub.add_parser('permissions',help='Record explicit organization-bound local installation consent; does not apply native settings')
+    q.add_argument('source');q.add_argument('--profile',choices=['manual','role-default','full-access'],required=True)
+    q.add_argument('--routes',required=True);q.add_argument('--environment',choices=['development','staging','production'],required=True)
+    q.add_argument('--context-key',required=True);q.add_argument('--confirm',action='store_true',required=True)
+    q.add_argument('--agent-workspace',required=True)
+    q.add_argument('--apply',action='store_true',help='Configure the existing idle owned Codex backend; no new app server or model turn')
+    q=sub.add_parser('approvals',help='Read and relay exact live native decisions through the owning intake')
+    q.add_argument('operation',choices=['list','details','respond']);q.add_argument('key',nargs='?')
+    q.add_argument('--intake');q.add_argument('--fingerprint');q.add_argument('--response')
+    q.add_argument('--human-decision-recorded',action='store_true')
     for command in ['connect','remote-context','remember','artifact','artifact-get','remote-recover']:
         q=sub.add_parser(command,help='Use public Topolo Agent continuity and Bytes artifact contracts')
         q.add_argument('name');q.add_argument('--environment',choices=['development','staging','production'],required=True)
@@ -324,6 +335,7 @@ def parser():
         if command=='connect':
             q.add_argument('--roles',required=True);q.add_argument('--agent-workspace',required=True);q.add_argument('--bytes-workspace',required=True)
             q.add_argument('--ownership',choices=['user','organization'],required=True);q.add_argument('--bytes-scope',choices=['private','org'],required=True);q.add_argument('--instance')
+            q.add_argument('--reconcile-local-context',action='store_true',help='Explicitly reconcile a recorded partial context attachment; never replays cloud writes')
         if command=='remember':
             q.add_argument('--content',required=True);q.add_argument('--kind',choices=['instruction','knowledge','durable'],required=True)
             q.add_argument('--provenance',required=True);q.add_argument('--visibility',choices=['private','shared'],default='private')
@@ -347,14 +359,19 @@ def main(argv=None):
             parser().error('--harness requires codex or claude')
         harness = argv[at + 1]
         del argv[at:at + 2]
-    policy_command = 'policy' in argv
-    if harness == 'claude' and not policy_command:
+    policy_command = 'policy' in argv or 'permissions' in argv
+    command_args=list(argv)
+    if command_args and command_args[0]=='--store':command_args=command_args[2:]
+    elif command_args and command_args[0].startswith('--store='):command_args=command_args[1:]
+    cloud_command=bool(command_args and command_args[0] in {'connect','remote-context','remember','artifact','artifact-get','remote-recover'})
+    if harness == 'claude' and not policy_command and not cloud_command:
         from . import claude
         return claude.main(argv)
     if harness not in {'codex', 'claude'}:
         print('topolo-agent-pack: Unsupported harness: ' + harness, file=sys.stderr)
         return 2
     args=parser().parse_args(argv)
+    args.harness=harness
     try:
         lib=Library(args.store)
         if args.command in {'connect','remote-context','remember','artifact','artifact-get','remote-recover'}:
@@ -363,11 +380,38 @@ def main(argv=None):
             emit(result)
             return 0
         with lib.lock():
-            if args.command=='policy':
-                from . import policy
+            if args.command=='approvals':
+                if args.operation!='list' and (not args.key or not args.intake or not args.fingerprint):
+                    raise PackError('Exact request key, --intake and --fingerprint required')
+                params={'key':args.key,'intakeThreadId':args.intake,'fingerprint':args.fingerprint}
+                if args.operation=='respond':
+                    if not args.response or not args.human_decision_recorded:
+                        raise PackError('Response file and recorded human decision required')
+                    params.update(result=read_json(args.response),humanDecisionRecorded=True)
+                result=live.request(lib,'approval-'+args.operation,params)
+            elif args.command=='permissions':
+                from . import permissions, topolo
+                if args.apply and harness!='codex':
+                    raise PackError('Use native Claude configure with the reviewed policy')
+                result=permissions.configure(lib,args.source,args.profile,read_json(args.routes),args.environment,args.context_key,
+                                             topolo.Client(args.environment,args.context_key),args.agent_workspace)
+                if args.apply:
+                    result=live.request(lib,'permissions-configure',{'pack':args.source})
+            elif args.command=='policy':
+                from . import policy, permissions
                 manifest,revision=lib.load(args.source)
                 result=policy.render(manifest,revision,select(manifest,args.sets,args.agents),
-                                     (harness,) if explicit_harness else ('codex','claude'))
+                                     (harness,) if explicit_harness else ('codex','claude'),
+                                     permissions.load(lib,manifest['packId'],manifest['agents']))
+                if args.verify_organization:
+                    from . import topolo
+                    consent=result['installationConsent']
+                    if not consent:
+                        raise PackError('Organization-bound installation consent is unavailable')
+                    remote,proof=topolo.organization_execution_policy(
+                        topolo.Client(consent['environment'],consent['contextKey']),consent,
+                        manifest['agents'],consent.get('agentWorkspaceId'))
+                    result.update(organizationPolicy=remote,organizationPolicyProof=proof)
                 if args.output:
                     from .claude import write_new
                     write_new(pathlib.Path(args.output).expanduser().absolute(), canonical(result)+b'\n')

package/agent-packs/src/topolo_agent_pack/execution.py

@@ -13,28 +13,40 @@ import subprocess
 import tempfile
 from contextlib import closing
 
-from . import policy
+from . import policy, permissions
 from .storage import PackError, atomic_json, component_key, read_json
 
 
-def compile_runtime(lib, components, runtime):
+def prepare_runtime(lib, components, runtime):
+    """Validate existing role intent without installing a policy or changing history."""
     runtime = pathlib.Path(runtime)
     with closing(sqlite3.connect('file:' + str(runtime / 'home/state_5.sqlite') + '?mode=ro', uri=True)) as db:
         cwds = dict(db.execute('SELECT id,cwd FROM threads'))
-    rows = []
+    rows = []; keys = set(); identities = set()
     for component in components:
         manifest, revision = lib.load(component['sourcePack'], component['revision'])
         matches = [a for a in manifest['agents'] if component_key(a) == component['key'] and a['threadId'] == component['threadId']]
-        if len(matches) != 1 or component['threadId'] not in cwds:
+        if (len(matches) != 1 or component['threadId'] not in cwds or revision != component['revision'] or
+                component['key'] in keys or component['threadId'] in identities):
             raise PackError('Execution policy has no unique owned role: ' + component['key'])
+        keys.add(component['key']); identities.add(component['threadId'])
+        consent = permissions.load(lib, matches[0]['pack'], manifest['agents']) if hasattr(lib, 'root') else None
         rows.append({'key': component['key'], 'threadId': component['threadId'],
                      'sourceRevision': revision, 'cwd': cwds[component['threadId']],
-                     'settings': policy.settings(matches[0], 'codex')['nativeSettings']})
+                     'intakeKey': consent['intakeRoutes'][component['key']] if consent else None,
+                     'contextKey': consent['contextKey'] if consent else None,
+                     'installationConsent': consent,
+                     'settings': policy.settings(matches[0], 'codex', consent)['nativeSettings']})
     document = {'format': 'topolo-codex-runtime-execution', 'schemaVersion': 1,
                 'roles': rows, 'applied': False, 'modelTurnsStarted': False}
     # Construct/validate fully before installing intent in a staged runtime.
     ExecutionGate(document)
-    atomic_json(runtime / 'execution-policy.json', document)
+    return document
+
+
+def compile_runtime(lib, components, runtime):
+    document = prepare_runtime(lib, components, runtime)
+    atomic_json(pathlib.Path(runtime) / 'execution-policy.json', document)
     return document
 
 
@@ -51,11 +63,15 @@ class ExecutionGate:
                         'sandbox_mode', 'sandbox_workspace_write', 'apps'}
             if (set(spec) != required or not isinstance(spec['model'], str) or not spec['model'] or
                     spec['model_reasoning_effort'] not in {'medium', 'high'} or
-                    spec['approval_policy'] != 'on-request' or spec['approvals_reviewer'] != 'user' or
-                    spec['sandbox_mode'] not in {'read-only', 'workspace-write'} or
+                    spec['approval_policy'] not in {'on-request', 'never'} or spec['approvals_reviewer'] != 'user' or
+                    spec['sandbox_mode'] not in {'read-only', 'workspace-write', 'danger-full-access'} or
+                    (spec['sandbox_mode'] == 'danger-full-access') != (spec['approval_policy'] == 'never') or
                     spec['sandbox_workspace_write'] != {'network_access': False, 'writable_roots': [],
                                                        'exclude_slash_tmp': True, 'exclude_tmpdir_env_var': True} or
-                    spec['apps'] != {'_default': {'default_tools_approval_mode': 'writes'}}):
+                    spec['apps'] not in [{'_default': {'default_tools_approval_mode': v}} for v in ['writes', 'prompt', 'approve']] or
+                    (spec['apps'] == {'_default': {'default_tools_approval_mode': 'approve'}} and spec['sandbox_mode'] != 'danger-full-access') or
+                    (spec['sandbox_mode'] == 'danger-full-access' and
+                     (spec['apps'] != {'_default': {'default_tools_approval_mode': 'approve'}} or not role.get('contextKey') or not role.get('intakeKey')))):
                 raise PackError('Unqualified role execution settings')
             self.roles[tid] = copy.deepcopy(role)
 
@@ -64,6 +80,8 @@ class ExecutionGate:
                         for row in result['data']}
 
     def sandbox(self, role):
+        if role['settings']['sandbox_mode'] == 'danger-full-access':
+            return {'type': 'dangerFullAccess'}
         if role['settings']['sandbox_mode'] == 'read-only':
             return {'type': 'readOnly', 'networkAccess': False}
         return {'type': 'workspaceWrite', 'networkAccess': False, 'writableRoots': [role['cwd']],