@topolo/cli 0.13.2 → 0.13.4

package/agent-packs/src/topolo_agent_pack/live.py

@@ -5,6 +5,7 @@ or another Codex profile. The renderer bridge is available only in the managed
 profile explicitly launched with local debugging enabled.
 """
 import asyncio
+from contextlib import closing
 import base64
 import hashlib
 import json
@@ -24,7 +25,16 @@ import urllib.parse
 import uuid
 
 from .storage import Library,PackError,atomic_json,canonical,read_json
-from .execution import load_gate, qualify_protocol
+from .execution import ExecutionGate, load_gate, prepare_runtime, qualify_protocol
+from .approvals import ApprovalRouter
+
+def permission_settings(agent, current, consent):
+    from .policy import settings
+    wanted=settings(agent,'codex',consent)['nativeSettings']
+    # Permission transitions use canonical defaults, never old applied grants.
+    # Keep independently qualified models and effort on the owned session.
+    for field in ['model','model_reasoning_effort']:wanted[field]=current[field]
+    return wanted
 
 def socket_path(lib):
     directory=pathlib.Path('/tmp')/('topolo-agent-pack-'+hashlib.sha256(str(lib.root).encode()).hexdigest()[:16])
@@ -32,14 +42,14 @@ def socket_path(lib):
     directory.mkdir(mode=0o700,exist_ok=True)
     return directory/'control.sock'
 
-def request(lib,operation):
+def request(lib,operation,params=None):
     record=read_json(lib.root/'live-bridge.json',{})
     if not record: raise PackError('This desktop profile has no live bridge. Open it through topolo-agent-pack first.')
     with socket.socket(socket.AF_UNIX,socket.SOCK_STREAM) as connection:
-        connection.settimeout(3 if operation=='status' else 20)
+        connection.settimeout(3 if operation=='status' else 60 if operation in {'permissions-configure','owned-roster-read'} else 20)
         try: connection.connect(record['socket'])
         except OSError as exc: raise PackError('Managed live bridge is unavailable: '+str(exc)) from exc
-        connection.sendall(canonical({'token':record['token'],'operation':operation})+b'\n')
+        connection.sendall(canonical({'token':record['token'],'operation':operation,**({'params':params} if params is not None else {})})+b'\n')
         with connection.makefile('rb') as stream:
             line=stream.readline(1024*1024)
     if not line: raise PackError('Live bridge closed without a reply')
@@ -71,12 +81,18 @@ class BackendProxy:
         self.token=secrets.token_hex(32);self.path=socket_path(lib)
         self.execution=None;self.catalog_ready=asyncio.Event();self.catalog_id='topolo-catalog-'+uuid.uuid4().hex
         self.catalog_rows=[];self.catalog_cursors=set()
+        self.approvals=None;self.native_calls={};self.notifications=set()
+        self.permission_configuration=False
+        self.permission_batch=None
+        self._permission_configuration_inputs=None
 
     async def start_child(self):
         active=self.lib.active()
         if not active.get('runtime'): raise PackError('No selected managed runtime')
         self.runtime=active['runtime'];env=os.environ.copy()
         self.execution=load_gate(self.runtime);self.catalog_ready.clear()
+        self.approvals=ApprovalRouter(pathlib.Path(self.runtime)/'approval-inbox',
+            list(self.execution.roles.values()),uuid.uuid4().hex) if self.execution else None
         self.catalog_rows=[];self.catalog_cursors=set()
         self.protocol=qualify_protocol(self.real) if self.execution else None
         env['CODEX_HOME']=str(pathlib.Path(self.runtime)/'home');env['CODEX_CLI_PATH']=self.real
@@ -86,6 +102,10 @@ class BackendProxy:
     async def output(self):
         while line:=await self.child.stdout.readline():
             value=json.loads(line)
+            if str(value.get('id')) in self.native_calls and ('result' in value or 'error' in value):
+                future=self.native_calls.pop(str(value['id']));self.pending.discard(str(value['id']))
+                if not future.done():future.set_result(value)
+                continue
             if value.get('id')==self.catalog_id:
                 self.pending.discard(self.catalog_id)
                 if self.execution and 'result' in value:
@@ -107,11 +127,19 @@ class BackendProxy:
                 self.pending.discard(str(value['id']))
                 if 'result' in value and isinstance(value['result'],dict) and 'userAgent' in value['result']: self.initialized=True
             method=value.get('method');params=value.get('params') or {}
+            if self.approvals:
+                record=self.approvals.capture(value)
+                if record and record['sourceThreadId']!=record['intakeThreadId'] and record['notificationState']!='delivered':
+                    self.schedule_notification(record)
             if method=='turn/started': self.active_turns.add(params['threadId'])
             if method=='turn/completed': self.active_turns.discard(params['threadId'])
             if method=='thread/status/changed':
                 if params.get('status',{}).get('type')=='active':self.active_turns.add(params['threadId'])
                 elif params.get('status',{}).get('type') in {'idle','notLoaded','systemError'}:self.active_turns.discard(params['threadId'])
+                if self.approvals and params.get('status',{}).get('type')=='idle':
+                    for row in self.approvals.records():
+                        if row['nativeConnectionCurrent'] and row['intakeThreadId']==params['threadId'] and row['notificationState']!='delivered':
+                            self.schedule_notification(row)
             sys.stdout.buffer.write(line);sys.stdout.buffer.flush()
 
     async def stop_child(self):
@@ -124,18 +152,28 @@ class BackendProxy:
         if self.output_task: await self.output_task
 
     async def forward(self,value):
+        if self.permission_configuration and value.get('method') in {'thread/resume','turn/start'}:
+            sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,'message':'Owned permission configuration in progress'}})+b'\n')
+            sys.stdout.buffer.flush();return
+        if value.get('method') in {'thread/resume','turn/start'} and (pathlib.Path(self.runtime)/'permissions-operation.json').exists():
+            sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,
+                'message':'Unresolved native permission operation requires reconciliation before execution'}})+b'\n')
+            sys.stdout.buffer.flush();return
         if self.quiesced:
             if 'id' in value:
                 sys.stdout.buffer.write(canonical({'id':value['id'],'error':{'code':-32000,'message':'Pack switch in progress; reconnecting backend'}})+b'\n');sys.stdout.buffer.flush()
             return
         if self.execution and value.get('method') in {'thread/resume','turn/start'} and (value.get('params') or {}).get('threadId') in self.execution.roles:
             try:
+                await self.qualify_organization((value.get('params') or {})['threadId'])
                 await asyncio.wait_for(self.catalog_ready.wait(),10)
                 value=self.execution.prepare(value)
             except (PackError,asyncio.TimeoutError) as exc:
                 sys.stdout.buffer.write(canonical({'id':value.get('id'),'error':{'code':-32000,'message':str(exc) or 'Native model catalog unavailable'}})+b'\n');sys.stdout.buffer.flush();return
         if 'id' in value and 'method' in value:self.pending.add(str(value['id']))
+        if self.approvals and 'method' not in value and ('result' in value or 'error' in value):self.approvals.sending(value)
         self.child.stdin.write(canonical(value)+b'\n');await self.child.stdin.drain()
+        if self.approvals and 'method' not in value and ('result' in value or 'error' in value):self.approvals.settled(value)
         if self.execution and value.get('method')=='initialized':
             await self.request_catalog()
 
@@ -145,6 +183,273 @@ class BackendProxy:
             'params':{'includeHidden':True,**({'cursor':cursor} if cursor else {})}})+b'\n')
         await self.child.stdin.drain()
 
+    async def call_native(self,method,params):
+        identity='topolo-relay-'+uuid.uuid4().hex
+        request={'id':identity,'method':method,'params':params}
+        if method in {'thread/resume','turn/start'}:
+            if not self.permission_configuration and (pathlib.Path(self.runtime)/'permissions-operation.json').exists():
+                raise PackError('Unresolved native permission operation requires reconciliation before execution')
+            await self.qualify_organization(params['threadId'])
+            await asyncio.wait_for(self.catalog_ready.wait(),10)
+            if self.permission_configuration:
+                if self._permission_configuration_inputs is None:
+                    raise PackError('No owned permission configuration snapshot; native settings were not sent')
+                self.configuration_current(*self._permission_configuration_inputs)
+            request=self.execution.prepare(request)
+        future=asyncio.get_running_loop().create_future();self.native_calls[identity]=future;self.pending.add(identity)
+        try:
+            self.child.stdin.write(canonical(request)+b'\n');await self.child.stdin.drain()
+            reply=await asyncio.wait_for(future,15)
+        except BaseException:
+            self.native_calls.pop(identity,None);self.pending.discard(identity);raise
+        reply=self.execution.reply(reply) if self.execution else reply
+        if 'error' in reply:
+            raise PackError('Native intake relay refused; original request remains pending')
+        return reply['result']
+
+    async def qualify_organization(self,thread_id):
+        role=self.execution.roles.get(thread_id) if self.execution else None
+        if role and not self.permission_configuration and (pathlib.Path(self.runtime)/'permissions-operation.json').exists():
+            raise PackError('Unresolved native permission operation requires reconciliation before owned execution or grants')
+        if not role or not role.get('installationConsent'):
+            if role and role['settings']['sandbox_mode']=='danger-full-access':
+                raise PackError('Full access requires a fresh authenticated organization ceiling')
+            return
+        from . import topolo
+        consent=role['installationConsent']
+        agents=self.lib.load(consent['pack'])[0]['agents']
+        matches=[a for a in agents if '/'.join([a['pack'],a['set'],a['id']])==role['key'] and a['threadId']==role['threadId']]
+        if len(matches)!=1:
+            raise PackError('Current consent has no unique live owned role')
+        if role['settings']!=permission_settings(matches[0],role['settings'],consent):
+            raise PackError('Effective native permission intent differs from the current consent profile')
+        if self.permission_batch and self.permission_batch['consent']==consent:
+            if time.monotonic()>=self.permission_batch['deadline']:
+                raise PackError('Qualified native permission batch expired; reconcile without replay')
+            role['organizationPolicyProof']=self.permission_batch['proof'];return
+        _,proof=await asyncio.to_thread(topolo.organization_execution_policy,
+            topolo.Client(consent['environment'],consent['contextKey']),consent,agents,consent.get('agentWorkspaceId'))
+        from .permissions import authorize_native_scope
+        authorize_native_scope(proof)
+        role['organizationPolicyProof']=proof
+
+    def existing_runtime_intent(self):
+        """Full existing composition only; never use a new composition as migration."""
+        active=self.lib.active()
+        components=active.get('components',[])
+        if str(active.get('runtime'))!=str(self.runtime) or not components:
+            raise PackError('Selected runtime has no complete owned source roster')
+        document=prepare_runtime(self.lib,components,self.runtime)
+        roster=read_json(pathlib.Path(self.runtime)/'agents.json')['agents']
+        def identities(rows):
+            values=[('/'.join([r['pack'],r['set'],r['id']]),r['threadId']) for r in rows]
+            if len(set(values))!=len(values):
+                raise PackError('Duplicate runtime roster membership')
+            return set(values)
+        declared={(r['key'],r['threadId']) for r in document['roles']}
+        with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
+            native_ids=[r[0] for r in db.execute('SELECT id FROM threads')]
+        if len(native_ids)!=len(declared) or set(native_ids)!={tid for _,tid in declared}:
+            raise PackError('Native runtime membership differs from full selected composition')
+        if identities(roster)!=declared:
+            raise PackError('Runtime roster differs from selected source membership')
+        for component in components:
+            current,revision=self.lib.load(component['sourcePack'])
+            if revision!=component['revision'] or (component['key'],component['threadId']) not in identities(current['agents']):
+                raise PackError('Current source revision or role identity differs from selected runtime')
+        return document
+
+    def preservation(self,roles):
+        paths={pathlib.Path(self.runtime)/'agents.json'}
+        for role in roles:
+            cwd=pathlib.Path(role['cwd'])
+            if not (cwd/'AGENTS.md').is_file():
+                raise PackError('Owned role starting context is missing')
+            paths.update(cwd.rglob('*.md'))
+        home=pathlib.Path(self.runtime)/'home'
+        for name in ['sessions','archived_sessions']:
+            paths.update((home/name).rglob('*.jsonl'))
+        for path in paths:
+            if path.is_symlink() or not path.is_file():
+                raise PackError('Context and transcript preservation requires regular owned files')
+        return {str(p):hashlib.sha256(p.read_bytes()).hexdigest() for p in sorted(paths)}
+
+    async def read_catalog(self):
+        rows=[];cursors=set();models=set();cursor=None
+        while True:
+            result=await self.call_native('model/list',{'includeHidden':True,**({'cursor':cursor} if cursor else {})})
+            for row in result['data']:
+                if not isinstance(row.get('model'),str) or not row['model'] or row['model'] in models:
+                    raise PackError('Native model catalog identity is unqualified')
+                models.add(row['model']);rows.append(row)
+            cursor=result.get('nextCursor')
+            if not cursor:return {'data':rows}
+            if not isinstance(cursor,str) or cursor in cursors or len(cursors)>=20:
+                raise PackError('Native model catalog pagination is unqualified')
+            cursors.add(cursor)
+
+    async def owned_roster_read(self,params):
+        """Finite token-authenticated metadata reads, not an arbitrary RPC dispatcher."""
+        if params or self.permission_configuration or self.quiesced or not self.initialized or self.active_turns or self.pending or self.notifications:
+            raise PackError('Owned read requires an idle initialized connection and no caller overrides')
+        self.permission_configuration=True
+        try:
+            document=self.existing_runtime_intent();rows=[]
+            protocol=qualify_protocol(self.real)
+            for role in document['roles']:
+                state=await self.call_native('thread/read',{'threadId':role['threadId'],'includeTurns':False})
+                thread=state.get('thread',{})
+                if thread.get('id')!=role['threadId'] or thread.get('cwd')!=role['cwd']:
+                    raise PackError('Native role identity differs from owned roster')
+                rows.append({'key':role['key'],'threadId':role['threadId'],'cwd':role['cwd'],
+                    'status':thread.get('status',{}).get('type')})
+            catalog=await self.read_catalog()
+            return {'state':'native-owned-roster-read','roles':rows,
+                'models':[{'model':r['model'],'supportedReasoningEfforts':r['supportedReasoningEfforts']} for r in catalog['data']],
+                'protocol':protocol,'classification':'native metadata and account catalog; role settings remain intent',
+                'effectiveSettingsVerified':False,'modelTurnsStarted':False}
+        finally:self.permission_configuration=False
+
+    def qualification_inputs(self,roles):
+        """Cheap current owned inputs; never cache a changed selection or consent."""
+        from . import permissions
+        active=self.lib.active();sources={}
+        for name in sorted({c['sourcePack'] for c in active.get('components',[])}):
+            manifest,revision=self.lib.load(name)
+            sources[name]={'revision':revision,'consent':permissions.load(self.lib,name,manifest['agents'])}
+        with closing(sqlite3.connect('file:'+str(pathlib.Path(self.runtime)/'home/state_5.sqlite')+'?mode=ro',uri=True)) as db:
+            native_cwds=sorted(db.execute('SELECT id,cwd FROM threads'))
+        return json.loads(canonical({'selected':{'runtime':active.get('runtime'),'components':active.get('components')},
+            'childPid':self.child.pid,'ownedRuntime':str(self.runtime),
+            'sources':sources,'runtimeRoster':read_json(pathlib.Path(self.runtime)/'agents.json'),
+            'nativeMembershipAndCwds':native_cwds,'contextTranscriptHashes':self.preservation(roles)}))
+
+    def configuration_current(self,inputs,roles):
+        if (self.quiesced or self.closed or not self.child or getattr(self.child,'returncode',None) is not None or
+                self.active_turns or self.pending or self.notifications or (self.approvals and self.approvals.pending)):
+            raise PackError('Native work or approval arrived during configuration; reconcile pending requests and any recorded effects')
+        if inputs is not None and self.qualification_inputs(roles)!=inputs:
+            raise PackError('Selected runtime, source, consent, context or transcript changed during qualification; reconcile any recorded effects')
+
+    async def configure_permissions(self,pack):
+        """Explicit legacy adoption or transition on the SAME existing owned child."""
+        from . import permissions
+        if self.permission_configuration or self.quiesced or self.active_turns or self.pending or self.notifications or (not self.execution and not self.initialized):
+            raise PackError('Owned native connection must be initialized, idle and settled')
+        marker=pathlib.Path(self.runtime)/'permissions-operation.json'
+        if marker.exists():
+            raise PackError('Unresolved native permissions operation requires read-only reconciliation')
+        if self.approvals and self.approvals.pending:
+            raise PackError('Native approvals remain pending; preserve their owning connection')
+        self.permission_configuration=True
+        legacy=self.execution is None;preservation=None;inputs=None
+        try:
+            if legacy:
+                if (pathlib.Path(self.runtime)/'execution-policy.json').exists():
+                    raise PackError('Existing policy must be qualified; not a legacy adoption')
+                document=self.existing_runtime_intent()
+                roles=document['roles'];preservation=self.preservation(roles)
+                inputs=self.qualification_inputs(roles)
+                provenance='reviewed source-role adoption intent; qualified only by native resume acknowledgements'
+            else:
+                roles=list(self.execution.roles.values())
+                provenance='preserved owned execution-policy model and effort'
+            manifest,_=self.lib.load(pack);consent=permissions.load(self.lib,pack,manifest['agents'])
+            if not consent:
+                raise PackError('Explicit organization-bound installation consent required')
+            wanted=[];by_key={r['key']:r for r in roles}
+            for agent in manifest['agents']:
+                key='/'.join([agent['pack'],agent['set'],agent['id']]);old=by_key.get(key)
+                if not old or old['threadId']!=agent['threadId']:
+                    raise PackError('Complete pack must match the live owned roster')
+                wanted.append({**old,'settings':permission_settings(agent,old['settings'],consent),
+                    'installationConsent':consent,'intakeKey':consent['intakeRoutes'][key],'contextKey':consent['contextKey']})
+            if legacy and len(wanted)!=len(roles):
+                raise PackError('Legacy adoption requires the full selected composition')
+            changed={r['threadId']:r for r in wanted}
+            candidate=ExecutionGate({'format':'topolo-codex-runtime-execution','schemaVersion':1,
+                'roles':[changed.get(r['threadId'],r) for r in roles]})
+            # Capture original native requests BEFORE the first awaited legacy read.
+            # Existing pending request generation/body custody always stays on this router.
+            routing=ApprovalRouter(pathlib.Path(self.runtime)/'approval-inbox',list(candidate.roles.values()),uuid.uuid4().hex)
+            if not self.approvals:self.approvals=routing
+            self._permission_configuration_inputs=(inputs,roles)
+            if legacy:
+                self.protocol=qualify_protocol(self.real)
+                candidate_catalog=await self.read_catalog()
+                self.configuration_current(inputs,roles)
+                candidate.set_catalog(candidate_catalog);self.catalog_ready.set()
+            else:candidate.catalog=self.execution.catalog.copy()
+            for role in wanted:
+                state=await self.call_native('thread/read',{'threadId':role['threadId'],'includeTurns':False})
+                self.configuration_current(inputs,roles)
+                thread=state.get('thread',{})
+                if thread.get('id')!=role['threadId'] or thread.get('cwd')!=role['cwd'] or thread.get('status',{}).get('type') not in {'idle','notLoaded'}:
+                    raise PackError('Native role identity or idle status differs')
+                if role['settings']['model_reasoning_effort'] not in candidate.catalog.get(role['settings']['model'],set()):
+                    raise PackError('Native account lacks the preserved model/effort')
+            self.configuration_current(inputs,roles)
+            operation={'pack':pack,'before':roles,'requested':wanted,'modelEffortProvenance':provenance,
+                'beforeSettingsClassification':'source intent only' if legacy else 'owned execution policy intent',
+                'protocol':self.protocol,'contextTranscriptHashes':preservation,'qualificationInputs':inputs}
+            atomic_json(marker,{**operation,'state':'prepared'})
+            self.execution=candidate
+            await self.qualify_organization(wanted[0]['threadId'])
+            self.configuration_current(inputs,roles)
+            self.permission_batch={'consent':consent,'proof':candidate.roles[wanted[0]['threadId']]['organizationPolicyProof'],
+                                   'deadline':time.monotonic()+45}
+            atomic_json(marker,{**operation,'state':'may-have-effects'})
+            for role in wanted:
+                self.configuration_current(inputs,roles)
+                await self.call_native('thread/resume',{'threadId':role['threadId']})
+                # First persist ACK progress, then refuse late work/drift. Do not lose a final ACK.
+                atomic_json(marker,{**operation,'state':'may-have-effects',
+                    'verifiedThreadIds':sorted(candidate.verified)})
+                self.configuration_current(inputs,roles)
+            self.configuration_current(inputs,roles)
+            document={'format':'topolo-codex-runtime-execution','schemaVersion':1,'roles':list(candidate.roles.values()),
+                      'applied':False,'modelTurnsStarted':False}
+            atomic_json(pathlib.Path(self.runtime)/'execution-policy.json',document)
+            # No await between the final custody fence and committing the routing graph.
+            # Preserve the physical connection's current router and generation.
+            self.approvals.roles=routing.roles;self.approvals.by_key=routing.by_key
+            result={'state':'native-permission-resumes-verified','pack':pack,'verifiedAgents':len(wanted),
+                'modelTurnsStarted':False,'historyChanged':False,'appToolApprovalReadbackVerified':False,
+                'intakeRoutes':len(wanted),'nativeApprovalTransport': 'owned-live-connection',
+                'modelEffortProvenance':provenance,'legacyRuntimeAdopted':legacy,
+                'contextTranscriptPreservationVerified':preservation is not None}
+            atomic_json(marker,{**result,'verifiedThreadIds':sorted(candidate.verified)})
+            atomic_json(pathlib.Path(self.runtime)/'permissions-proof.json',result);marker.unlink()
+            return result
+        finally:
+            self._permission_configuration_inputs=None
+            self.permission_configuration=False;self.permission_batch=None
+
+    def schedule_notification(self,record):
+        if (self.permission_configuration or record['key'] in self.notifications or record['notificationState'] not in
+                {'not-delivered','awaiting-idle-intake'}):return
+        self.notifications.add(record['key'])
+        async def deliver():
+            try:
+                state=await self.call_native('thread/read',{'threadId':record['intakeThreadId'],'includeTurns':False})
+                if state.get('thread',{}).get('status',{}).get('type') not in {'idle','notLoaded'}:
+                    self.approvals.notified(record['requestId'],False);return
+                if record['intakeThreadId'] not in self.execution.verified:
+                    await self.call_native('thread/resume',{'threadId':record['intakeThreadId']})
+                self.approvals.live(record['key'],record['intakeThreadId'],record['fingerprint'])
+                # A lost turn/start reply cannot be retried on the next idle event.
+                # Persist possible delivery before dispatch, including process death.
+                self.approvals.notification_state(record['requestId'],'may-have-effects')
+                await self.call_native('turn/start',{'threadId':record['intakeThreadId'],
+                    'input':[{'type':'text','text':self.approvals.notification(record),'text_elements':[]}]})
+                self.approvals.notified(record['requestId'],True)
+            except Exception:
+                entry=self.approvals.pending.get(str(record['requestId']))
+                uncertain=entry and entry['record']['notificationState']=='may-have-effects'
+                self.approvals.notification_state(record['requestId'],'delivery-uncertain' if uncertain else 'delivery-failed')
+            finally:self.notifications.discard(record['key'])
+        asyncio.create_task(deliver())
+
     def status(self):
         return {'pid':os.getpid(),'childPid':self.child.pid if self.child else None,'desktopPid':os.getppid(),'runtime':self.runtime,
                 'quiesced':self.quiesced,'initialized':self.initialized,
@@ -158,14 +463,42 @@ class BackendProxy:
             if not secrets.compare_digest(message.get('token',''),self.token): raise PackError('Live bridge authentication failed')
             op=message.get('operation')
             if op=='quiesce':
+                if self.permission_configuration:
+                    raise PackError('Permission configuration in progress; preserve the owning native connection')
                 if self.active_turns: raise PackError('Outgoing agents have active turns. Wait for their current turns; Codex can stay open.')
                 if self.pending: raise PackError('Backend requests are in flight. Retry the switch; Codex can stay open.')
                 self.quiesced=True
                 await self.stop_child()
             elif op=='resume':
                 if self.quiesced: raise PackError('Use the desktop reconnect action to resume a quiesced bridge')
+            elif op=='owned-roster-read':
+                result=await self.owned_roster_read(message.get('params') or {})
+            elif op=='permissions-configure':
+                result=await self.configure_permissions((message.get('params') or {})['pack'])
+            elif op in {'approval-list','approval-details','approval-respond'}:
+                if not self.approvals:
+                    raise PackError('This connection has no qualified intake routing')
+                params=message.get('params') or {}
+                if op=='approval-respond' and self.permission_configuration:
+                    raise PackError('Permission configuration in progress; original native request remains pending')
+                if op=='approval-list':result={'requests':self.approvals.records()}
+                else:
+                    entry=self.approvals.live(params['key'],params['intakeThreadId'],params['fingerprint'])
+                    if op=='approval-details':result={'request':entry['message'],'record':entry['record']}
+                    else:
+                        if params.get('humanDecisionRecorded') is not True:
+                            raise PackError('Recorded human decision required; never auto-approve')
+                        reply=self.approvals.response(params['key'],params['intakeThreadId'],params['fingerprint'],params['result'])
+                        if reply['result'].get('decision')=='accept':
+                            if not self.execution:
+                                raise PackError('Native approval requires qualified owned execution policy; original request remains pending')
+                            await self.qualify_organization(entry['record']['sourceThreadId'])
+                            self.approvals.live(params['key'],params['intakeThreadId'],params['fingerprint'])
+                        self.approvals.sending(reply)
+                        self.child.stdin.write(canonical(reply)+b'\n');await self.child.stdin.drain();self.approvals.settled(reply)
+                        result={'state':'native-response-forwarded','operationEffectVerified':False}
             elif op!='status': raise PackError('Unknown live bridge operation')
-            result=self.status()
+            if op not in {'approval-list','approval-details','approval-respond','permissions-configure','owned-roster-read'}:result=self.status()
         except Exception as exc: result={'error':str(exc)}
         writer.write(canonical(result)+b'\n');await writer.drain();writer.close();await writer.wait_closed()
 

package/agent-packs/src/topolo_agent_pack/permissions.py

@@ -0,0 +1,167 @@
+"""Organization-bound installation consent, distinct from managed enforcement.
+
+Consent is machine local and never shipped in a portable pack. Native managed
+requirements remain authoritative. This file is not an organization admin API.
+"""
+import copy
+import pathlib
+import hashlib
+import json
+import re
+
+from .storage import PackError, atomic_json, component_key, read_json, safe_id
+
+PROFILES = {'manual': 0, 'role-default': 1, 'full-access': 2}
+POLICY_FIELDS = ('allowedProfiles', 'maximumProfile', 'defaultProfile', 'fullAccessEnabled',
+                 'allowedToolScopes', 'allowedActionScopes', 'allowedIntakes')
+
+
+def organization_policy(envelope, context, organization):
+    """Validate an authenticated action result; a local JSON never grants authority."""
+    required = set(POLICY_FIELDS) | {'contextKey', 'organizationId', 'revision', 'configured',
+        'policyDigest', 'updatedAt', 'updatedByUserId', 'decisionReference'}
+    if (not isinstance(envelope, dict) or set(envelope) != {'success', 'contractVersion', 'policy'} or
+            envelope['success'] is not True or envelope['contractVersion'] not in {'1.0.0', '1.1.0'}):
+        raise PackError('Organization policy contract unavailable or unsupported; no offline authority')
+    fields = list(POLICY_FIELDS)
+    if envelope['contractVersion'] == '1.1.0':
+        required.add('scopePolicyMode'); fields.insert(4, 'scopePolicyMode')
+    p = envelope['policy']
+    if (not isinstance(p, dict) or set(p) != required or p.get('contextKey') != context or
+            p.get('organizationId') != organization or context != 'org:' + organization or
+            not isinstance(p.get('revision'), str) or not re.fullmatch(r'0|[1-9][0-9]*', p['revision']) or
+            int(p['revision']) > 9007199254740991 or type(p.get('configured')) is not bool or
+            type(p.get('fullAccessEnabled')) is not bool):
+        raise PackError('Organization policy identity, revision or shape differs')
+    if 'scopePolicyMode' in required and p['scopePolicyMode'] not in {'allowlist', 'unrestricted'}:
+        raise PackError('Organization scope policy mode is invalid')
+    for field, maximum in [('allowedProfiles', 3), ('allowedToolScopes', 500),
+                           ('allowedActionScopes', 500), ('allowedIntakes', 200)]:
+        values = p[field]
+        pattern = (r'[a-z0-9][a-z0-9-]*/intakes/[a-z0-9][a-z0-9-]*' if field == 'allowedIntakes'
+                   else r'[A-Za-z0-9][A-Za-z0-9_.:/-]*')
+        if (not isinstance(values, list) or len(values) > maximum or
+                any(not isinstance(v, str) or not 1 <= len(v) <= 255 or
+                    not re.fullmatch(pattern, v) for v in values) or
+                len(set(values)) != len(values)):
+            raise PackError('Organization policy has invalid exact scope identifiers')
+    if p.get('scopePolicyMode') == 'unrestricted' and (p['allowedToolScopes'] or p['allowedActionScopes']):
+        raise PackError('Unrestricted mode must not contain ambiguous scope allowlists')
+    allowed = p['allowedProfiles']
+    if (not allowed or any(v not in PROFILES for v in allowed) or
+            p['maximumProfile'] not in PROFILES or p['defaultProfile'] not in allowed or
+            any(PROFILES[v] > PROFILES[p['maximumProfile']] for v in allowed) or
+            ('full-access' in allowed or p['maximumProfile'] == 'full-access') and not p['fullAccessEnabled']):
+        raise PackError('Organization policy profile ceiling is inconsistent')
+    if (p['updatedAt'] is not None and (type(p['updatedAt']) is not int or p['updatedAt'] < 0) or
+            any(p[field] is not None and (not isinstance(p[field], str) or not 1 <= len(p[field]) <= 255)
+                for field in ['updatedByUserId', 'decisionReference'])):
+        raise PackError('Organization policy audit fields are invalid')
+    if not p['configured'] and (p['revision'] != '0' or allowed != ['manual'] or
+            p['maximumProfile'] != 'manual' or p['defaultProfile'] != 'manual' or p['fullAccessEnabled'] or
+            any(p[v] for v in ['allowedToolScopes', 'allowedActionScopes', 'allowedIntakes']) or
+            any(p[v] is not None for v in ['updatedAt', 'updatedByUserId', 'decisionReference'])):
+        raise PackError('Absent organization policy is not the restrictive default')
+    if not p['configured'] and p.get('scopePolicyMode', 'allowlist') != 'allowlist':
+        raise PackError('Absent organization scope policy must deny scoped use')
+    if p['configured'] and (p['revision'] == '0' or any(p[v] is None for v in
+            ['updatedAt', 'updatedByUserId', 'decisionReference'])):
+        raise PackError('Configured organization policy lacks server audit metadata')
+    body = {field: sorted(p[field]) if isinstance(p[field], list) else p[field] for field in fields}
+    digest = 'sha256:' + hashlib.sha256(json.dumps(body, separators=(',', ':'), ensure_ascii=False).encode()).hexdigest()
+    if p['policyDigest'] != digest:
+        raise PackError('Organization policy digest differs')
+    return copy.deepcopy(p)
+
+
+def authorize_profile(consent, agents, policy):
+    consent = validate(consent, consent['pack'], agents)
+    if policy['contextKey'] != consent['contextKey']:
+        raise PackError('Installation and organization policy contexts differ')
+    for agent in agents:
+        key = component_key(agent)
+        selected = consent.get('overrides', {}).get(key, consent['profile'])
+        if selected not in policy['allowedProfiles'] or PROFILES[selected] > PROFILES[policy['maximumProfile']]:
+            raise PackError('Organization policy prohibits the requested profile: ' + key)
+        if consent['intakeRoutes'][key] not in policy['allowedIntakes']:
+            raise PackError('Organization policy does not allow the owning intake: ' + key)
+    return {'contextKey': policy['contextKey'], 'revision': policy['revision'],
+            'policyDigest': policy['policyDigest'], 'profileCeilingVerified': True,
+            'toolActionScopeEnforcementVerified': False,
+            'scopePolicyMode': policy.get('scopePolicyMode', 'allowlist'),
+            'toolActionRestrictionRequested': policy.get('scopePolicyMode', 'allowlist') == 'allowlist'}
+
+
+def authorize_native_scope(proof):
+    if proof.get('scopePolicyMode') != 'unrestricted' or proof.get('toolActionRestrictionRequested') is not False:
+        raise PackError('Native tool/action allowlist enforcement is unavailable; requested organization policy cannot be activated')
+
+
+def validate(document, pack, agents):
+    keys = {component_key(a) for a in agents}
+    if (not isinstance(document, dict) or document.get('format') != 'topolo-pack-installation-consent'
+            or document.get('schemaVersion') != 1 or document.get('pack') != pack
+            or document.get('authority') != 'local-installation-consent'
+            or not isinstance(document.get('contextKey'), str)
+            or not document['contextKey'].startswith('org:') or len(document['contextKey']) <= 4
+            or not document.get('principalId') or document.get('profile') not in PROFILES
+            or document.get('approved') is not True):
+        raise PackError('Invalid organization-bound installation consent')
+    routes = document.get('intakeRoutes', {})
+    intake_keys = {component_key(a) for a in agents if a['set'] == 'intakes'}
+    if (not isinstance(routes, dict) or set(routes) != keys or
+            any(v not in intake_keys for v in routes.values())):
+        raise PackError('Every role requires an owned intake route')
+    overrides = document.get('overrides', {})
+    if not isinstance(overrides, dict) or set(overrides) - keys:
+        raise PackError('Permission override names an unowned role')
+    if any(v not in PROFILES or PROFILES[v] > PROFILES[document['profile']] for v in overrides.values()):
+        raise PackError('Role override widens installation consent')
+    return copy.deepcopy(document)
+
+
+def load(lib, pack, agents):
+    path = lib.root / 'permissions' / (safe_id(pack) + '.json')
+    if not path.exists():
+        return None
+    if path.is_symlink() or not path.is_file():
+        raise PackError('Installation consent must be a regular owned file')
+    return validate(read_json(path), pack, agents)
+
+
+def configure(lib, pack, profile, routes, environment, context, client, workspace=None):
+    from .topolo import identity
+    manifest, revision = lib.load(pack)
+    actor = identity(client)
+    if context != 'org:' + actor['organizationId']:
+        raise PackError('Authenticated organization differs from installation context')
+    document = validate({'format': 'topolo-pack-installation-consent', 'schemaVersion': 1,
+        'authority': 'local-installation-consent', 'pack': pack, 'sourceRevision': revision,
+        'contextKey': context, 'environment': environment, 'principalId': actor['userId'],
+        'profile': profile, 'approved': True, 'intakeRoutes': routes, 'overrides': {},
+        'agentWorkspaceId': workspace}, pack, manifest['agents'])
+    atomic_json(lib.root / 'permissions' / (safe_id(pack) + '.json'), document)
+    return {'state': 'installation-consent-recorded-not-native-applied', 'pack': pack,
+            'profile': profile, 'roles': len(manifest['agents']), 'contextKey': context,
+            'organizationManagedPolicyVerified': False, 'nativeApplied': False}
+
+
+def apply_settings(agent, harness, native, document):
+    native = copy.deepcopy(native)
+    if document is None:
+        return native
+    key = component_key(agent)
+    if key not in document['intakeRoutes']:
+        raise PackError('Role has no approved intake route')
+    selected = document.get('overrides', {}).get(key, document['profile'])
+    if selected == 'role-default':
+        return native
+    if harness == 'codex':
+        native['approval_policy'] = 'never' if selected == 'full-access' else 'on-request'
+        native['sandbox_mode'] = 'danger-full-access' if selected == 'full-access' else 'read-only'
+        native['apps'] = {'_default': {'default_tools_approval_mode': 'approve' if selected == 'full-access' else 'prompt'}}
+    elif harness == 'claude':
+        native['permissions'] = {'defaultMode': 'bypassPermissions' if selected == 'full-access' else 'default'}
+    else:
+        raise PackError('Unqualified permission adapter')
+    return native