[Brian Krabach (bkrabach)]

Summary

Share operator directory write grants and denies with already-declared tool-apply-patch modules during CLI configuration assembly. The filesystem operator settings are stored under tool-filesystem; exact-module override matching did not previously project them to the separate patch module.

This is an additive configuration projection. It does not activate an absent patch module, copy filesystem defaults/read policy/source/engine, or update tools that are already mounted.

Changes

• Project only effective operator write grants and denies after ordinary scope resolution and tool overrides.
• Send grants through the portable additional_allowed_write_paths field. Preserve an omitted patch allowlist and explicit [] so the patch module can select its default only at mount, after session.working_dir is available. Union shared denies with patch denies.
• Validate shared filesystem path lists and all three present patch policy fields as lists of strings before applying policy. Preserve shared filesystem denied_write_paths: null as “no additional denies”; do not forward null or clear patch-specific denies. A null allowed-path field remains invalid.
• Cover initially empty tool lists, multiple declared patch entries, ordinary child-config merges, nonmutation, settings add/remove, and malformed policy values.

Verification

The corrected source revision was qualified with:

• 216 focused CLI tests and 219 filesystem-module tests, with no failures or skips.
• 133 real compiled-coordinator boundary controls, with no failures or skips.
• 15 controls through the normal installed CLI resolver with stock Anchors and Git-selected module resolution, including allowed/denied file-byte checks. This used the default native engine and did not run a model or full inference session.

Filesystem module support for additional_allowed_write_paths merged upstream in PR #10 at 515599f0d0763a946aa96ed1d0110db723f5c386; the three source pins used for this qualification match that merge.

Two fresh brief-only reviews returned conditional approval based on the supplied source excerpts and qualification results. They were not independent file audits or GitHub approvals.

CI and merge gate

The existing six-job pytest matrix (Ubuntu, macOS, and Windows on Python 3.11 and 3.12) and two POSIX PTY jobs must pass on this exact head. This PR remains a draft until current-head CI is verified and Root confirms the gate. Do not merge while checks are pending.

Compatibility and breaking changes

No CLI command or user-settings schema changes. The projection requires a filesystem module version that consumes additional_allowed_write_paths; older versions do not consume the new field. The upstream support is merged, but this change does not refresh modules already mounted in a running session. No restart or live-refresh remedy is claimed.