feat(permissions): one named permission-mode vocabulary and two admission gates

.github/actions/mecatequi/action.yml

@@ -46,7 +46,7 @@
 # version — there is no version input (matlatl has none either).
 #
 # OMITTED INPUT — the ask-reviewer policy file. --subagent-ask-reviewer is surfaced (see
-# the input) so a posture:auto run can adjudicate a child's read-only substitution instead
+# the input) so an auto-mode run can adjudicate a child's read-only substitution instead
 # of silently auto-denying it, but --subagent-ask-reviewer-policy (a TRUSTED rubric file
 # whose CONTENT replaces the built-in rubric) is NOT surfaced: it grants the reviewer a
 # rule set the operator would have to author and check into the repo, which is a deliberate
@@ -124,13 +124,27 @@ inputs:
     description: Session workspace root (must be a git repository so the diff can be computed).
     required: false
     default: ${{ github.workspace }}
+  permission-mode:
+    description: >-
+      Permission mode → --permission-mode: one of plan, default, accept-edits, auto,
+      yolo. Empty (the input default) resolves to "auto", the documented CI mode
+      (allow-all, child injection-defence ON), unless the deprecated `posture` input is
+      set. auto needs an ENFORCING guardrails checker, named with `guardrails-model` or
+      inherited from operator settings; the step fails before running the binary when
+      `guardrails-model` is empty and no operator settings file exists, or is "off". yolo is the explicit choice to
+      run allow-all with no checker. "default" would CANCEL the run on the first mutate
+      because a headless run has no approver. Setting both this and `posture` fails the
+      step.
+    required: false
+    default: ""
   posture:
     description: >-
-      Operator posture ladder (strict < trusted < auto < yolo). Default "auto" — the
-      documented CI posture (allow-all, child injection-defence ON). "strict" would
-      CANCEL the run on the first mutate because a headless run has no approver.
+      DEPRECATED alias for `permission-mode`, kept for one release → --posture (the
+      binary WARNs). Used only when set non-empty; setting it together with
+      `permission-mode` fails the step. Migrate `posture: "auto"` to
+      `permission-mode: "auto"`.
     required: false
-    default: "auto"
+    default: ""
   timeout:
     description: >-
       Wall-clock bound on the whole run (e.g. 40m); the primary cost ceiling for a
@@ -185,17 +199,25 @@ inputs:
   guardrails-model:
     description: >-
       GUARDRAILS (issue #27) checker model id / alias inspecting outbound args + inbound
-      results. Empty disables guardrails.
+      results. Empty (default) passes no guardrails flag, so the binary uses the checker
+      configured in operator settings (a `guardrails:` model or the `guardrail` model
+      slot), if any. The literal "off" passes --guardrails off, the kill-switch, which
+      also disables a checker configured in settings. Any other value passes
+      --guardrails-model <value>. The auto permission mode refuses to start without an
+      enforcing checker, so pair "off" or an unconfigured empty value with
+      `permission-mode: yolo`.
     required: false
     default: ""
   subagent-ask-reviewer:
     description: >-
-      OPT-IN headless ask reviewer (issue #31) → --subagent-ask-reviewer: model id / alias
-      of a tool-less one-turn reviewer that adjudicates a CHILD permission ask the headless
-      auto-deny would otherwise reject (so a posture:auto run whose subagent wants a
-      read-only $(...) substitution is reviewed rather than silently denied). Empty (default)
-      = no reviewer (children auto-deny). The TRUSTED policy-rubric file is NOT an input —
-      see the action header.
+      Headless ask reviewer (issue #31) → --subagent-ask-reviewer: model id / alias of a
+      tool-less one-turn reviewer that adjudicates a CHILD permission ask the headless
+      auto-deny would otherwise reject (so an auto-mode run whose subagent wants a
+      read-only $(...) substitution is reviewed rather than silently denied). Empty
+      (default) omits the flag: in the auto and yolo modes the reviewer is then ON by
+      default (ask-reviewer model slot, else the session model); in other modes children
+      auto-deny. "off" disables it explicitly. The TRUSTED policy-rubric file is NOT an
+      input — see the action header.
     required: false
     default: ""
   subagent-ask-reviewer-max-denies:
@@ -365,6 +387,7 @@ runs:
         MQ_UNTRUSTED: ${{ inputs.untrusted }}
         MQ_INSTRUCTIONS: ${{ inputs.instructions }}
         MQ_WORKSPACE: ${{ inputs.workspace }}
+        MQ_PERMISSION_MODE: ${{ inputs.permission-mode }}
         MQ_POSTURE: ${{ inputs.posture }}
         MQ_TIMEOUT: ${{ inputs.timeout }}
         MQ_MAX_RUN_TOKENS: ${{ inputs.max-run-tokens }}
@@ -407,10 +430,33 @@ runs:
         # Build the argv as an ARRAY from env values — never string-interpolated. Each
         # event-derived value crosses as a discrete token, so no value can be re-parsed
         # as a flag or a shell metacharacter.
+        # Permission mode: `permission-mode` replaces the deprecated `posture` input. Both
+        # set is ambiguous, so fail rather than guess; neither set is the documented CI mode.
+        if [ -n "${MQ_PERMISSION_MODE}" ] && [ -n "${MQ_POSTURE}" ]; then
+          echo "::error::both permission-mode and the deprecated posture input are set; pass only permission-mode."
+          exit 1
+        fi
+        if [ -n "${MQ_POSTURE}" ]; then
+          echo "::warning::the posture input is deprecated; use permission-mode instead."
+          permission_args=( --posture "${MQ_POSTURE}" )
+        else
+          permission_args=( --permission-mode "${MQ_PERMISSION_MODE:-auto}" )
+          # auto needs an enforcing checker. Fail here with the fix instead of letting
+          # the binary refuse later: a named model, or operator settings that may bind
+          # one (the binary still refuses if they don't).
+          if [ "${MQ_PERMISSION_MODE:-auto}" = "auto" ]; then
+            settings_file="${XDG_CONFIG_HOME:-${HOME}/.config}/mecatl/settings.yaml"
+            if [ "${MQ_GUARDRAILS_MODEL}" = "off" ] || { [ -z "${MQ_GUARDRAILS_MODEL}" ] && [ ! -f "${settings_file}" ]; }; then
+              echo "::error::permission-mode auto needs an enforcing guardrails checker: set guardrails-model to a checker model, bind one in operator settings (${settings_file}), or set permission-mode: yolo with guardrails-model: off to run without one."
+              exit 1
+            fi
+          fi
+        fi
+
         args=(
           --prompt-file "${MQ_PROMPT_FILE}"
           --workspace "${MQ_WORKSPACE}"
-          --posture "${MQ_POSTURE}"
+          "${permission_args[@]}"
           --timeout "${MQ_TIMEOUT}"
           --headless=true
           --out-diff "${MQ_OUT_DIFF}"
@@ -426,7 +472,13 @@ runs:
         [ -n "${MQ_DEFAULT_MODEL}" ] && args+=( --default-model "${MQ_DEFAULT_MODEL}" )
         [ "${openai_on}" = "true" ] && args+=( --openai )
         [ -n "${MQ_OPENAI_BASE_URL}" ] && args+=( --openai-base-url "${MQ_OPENAI_BASE_URL}" )
-        [ -n "${MQ_GUARDRAILS_MODEL}" ] && args+=( --guardrails-model "${MQ_GUARDRAILS_MODEL}" )
+        # Checker choice: empty inherits the operator-settings checker (no flag), "off"
+        # is the explicit kill-switch, anything else names the checker model.
+        if [ "${MQ_GUARDRAILS_MODEL}" = "off" ]; then
+          args+=( --guardrails off )
+        elif [ -n "${MQ_GUARDRAILS_MODEL}" ]; then
+          args+=( --guardrails-model "${MQ_GUARDRAILS_MODEL}" )
+        fi
         [ -n "${MQ_ASK_REVIEWER}" ] && args+=( --subagent-ask-reviewer "${MQ_ASK_REVIEWER}" )
         [ -n "${MQ_ASK_REVIEWER_MAX_DENIES}" ] && args+=( --subagent-ask-reviewer-max-denies "${MQ_ASK_REVIEWER_MAX_DENIES}" )
 

.github/workflows/continuous.yml

@@ -403,7 +403,7 @@ jobs:
       ISSUER: https://token.actions.githubusercontent.com
       # The minimal values each chart needs to render; the same overrides the
       # release workflow lints with.
-      MECAK8S_RENDER_SET: redis.endpoint=redis.example.internal:6379,redis.credentialsSecret=redis-credentials,tls.enabled=true,tls.secretName=mecak8s-tls,oidc.enabled=true,oidc.issuer=https://idp.example.com,oidc.audience=mecatl
+      MECAK8S_RENDER_SET: guardrails.fromSettings=true,redis.endpoint=redis.example.internal:6379,redis.credentialsSecret=redis-credentials,tls.enabled=true,tls.secretName=mecak8s-tls,oidc.enabled=true,oidc.issuer=https://idp.example.com,oidc.audience=mecatl
     outputs:
       mecak8s_chart_digest: ${{ steps.push-mecak8s.outputs.digest }}
       studio_chart_digest: ${{ steps.push-studio.outputs.digest }}

.github/workflows/mecatequi-example.yml

@@ -166,7 +166,11 @@ jobs:
         with:
           prompt-file: ${{ steps.prompt.outputs.prompt-file }}
           untrusted: "true"
-          posture: "auto"
+          # auto refuses to start without an enforcing guardrails checker. Name one here (or
+          # bind it in operator settings and leave this empty), or set permission-mode: "yolo"
+          # with guardrails-model: "off" to run with no checker.
+          permission-mode: "auto"
+          guardrails-model: "gpt-5-mini"
           # OPTIONAL: install a project toolchain the agent's self-verification needs BEYOND the
           # always-provisioned task + golangci-lint. TRUSTED operator code — runs in this job
           # (contents:read, no write token), before the binary. Uncomment and adapt:

.github/workflows/mecatequi-reusable.yml

@@ -13,9 +13,11 @@ on:
     # Inputs are the per-session passthrough surface of the mecatequi action. The
     # escape-hatch-only knobs are deliberately NOT exposed here — `default-model` (catalog-
     # validated, rejects an uncatalogued id — use `model` instead), `openai` (provider is
-    # auto-detected from the present key), and `subagent-ask-reviewer` (an autonomous-approval
-    # capability that is a deployment decision better made by editing the action) — so a
-    # consumer needing them vendors the escape-hatch template rather than the reusable workflow.
+    # auto-detected from the present key), and `subagent-ask-reviewer` (the action default
+    # applies: under its default auto permission mode the reviewer is ON, using the ask-reviewer
+    # model slot or else the session model; choosing another reviewer or "off" is a deployment
+    # decision better made by editing the action) — so a consumer needing them vendors the
+    # escape-hatch template rather than the reusable workflow.
     inputs:
       label:
         description: >-
@@ -45,13 +47,25 @@ on:
         type: string
         required: false
         default: ""
+      permission-mode:
+        description: >-
+          Passed to the action's `permission-mode` input: plan, default, accept-edits, auto,
+          or yolo. Empty (default) lets the action resolve it to "auto" (allow-all, child
+          injection-defence ON), which needs an ENFORCING guardrails checker, from
+          `guardrails-model` or operator settings; the step fails early without one. Use
+          "yolo" to run allow-all with no checker. Setting both this and `posture` fails the run.
+        type: string
+        required: false
+        default: ""
       posture:
         description: >-
-          Operator posture ladder (strict < trusted < auto < yolo). Default "auto" — the
-          documented CI posture (allow-all, child injection-defence ON).
+          DEPRECATED alias for `permission-mode`, passed to the action's `posture` input
+          (the binary WARNs): strict, trusted, auto, or yolo. Empty (default) defers to
+          `permission-mode`. Migrate `posture: "auto"` to `permission-mode: "auto"`. It
+          never grants project trust.
         type: string
         required: false
-        default: auto
+        default: ""
       max-run-tokens:
         description: >-
           Max cumulative input+output tokens per run; the run ends cleanly with stop=budget
@@ -84,7 +98,10 @@ on:
       guardrails-model:
         description: >-
           Guardrails (issue #27) checker model id / alias that inspects outbound tool args +
-          inbound results. Empty (default) disables guardrails.
+          inbound results. Empty (default) passes no guardrails flag, so the checker
+          configured in operator settings applies, if any. "off" is the kill-switch. Any
+          other value names the checker model. Under permission mode auto, an empty value
+          and no settings checker, or "off", refuses to start.
         type: string
         required: false
         default: ""
@@ -277,6 +294,7 @@ jobs:
         with:
           prompt-file: ${{ steps.prompt.outputs.prompt-file }}
           untrusted: "true"
+          permission-mode: ${{ inputs.permission-mode }}
           posture: ${{ inputs.posture }}
           model: ${{ inputs.model }}
           default-provider: ${{ inputs.default-provider }}

.github/workflows/mecatequi.yml

@@ -2,7 +2,7 @@
 # mecatequi — the LIVE workflow for THIS repo (mecatl). Private repo, internal posture.
 #
 # To run it: label an issue `mecatequi`, OR comment `@mecatequi` on an issue. The agent
-# runs a single-shot mecatequi pass over the issue text (untrusted, posture:auto) against
+# runs a single-shot mecatequi pass over the issue text (untrusted, permission-mode auto) against
 # OpenRouter, and the publish job opens a PR (or posts an honest comment) with the result.
 #
 # Unlike .github/workflows/mecatequi-example.yml (the inert template), this file is REAL:
@@ -221,7 +221,10 @@ jobs:
         with:
           prompt-file: ${{ steps.prompt.outputs.prompt-file }}
           untrusted: "true"
-          posture: "auto"
+          # yolo: a deliberate unchecked choice for this private, split-privilege CI
+          # run. auto would refuse to start because no guardrails checker is configured.
+          permission-mode: "yolo"
+          guardrails-model: "off"
           # Use `model` (per-session passthrough), NOT `default-model`: a deployment
           # default is validated against the embedded models.dev catalog at startup, and
           # claude-sonnet-4.6 is newer than that snapshot (it would fail "not catalogued").

.github/workflows/release.yml

@@ -1607,7 +1607,7 @@ jobs:
       # Redis and secure real-provider guards. Lint with the minimal production
       # overrides that target already uses. The chart version supplies the image tag.
       - name: helm lint
-        run: helm lint "${CHART_PATH}" --set redis.endpoint=redis.example.internal:6379,redis.credentialsSecret=redis-credentials,tls.enabled=true,tls.secretName=mecak8s-tls,oidc.enabled=true,oidc.issuer=https://idp.example.com,oidc.audience=mecatl
+        run: helm lint "${CHART_PATH}" --set guardrails.fromSettings=true,redis.endpoint=redis.example.internal:6379,redis.credentialsSecret=redis-credentials,tls.enabled=true,tls.secretName=mecak8s-tls,oidc.enabled=true,oidc.issuer=https://idp.example.com,oidc.audience=mecatl
 
       - name: helm package
         env:
@@ -1674,7 +1674,7 @@ jobs:
             echo "**Install command:**"
             echo ""
             echo '```'
-            echo "helm install mecak8s oci://${OCI_REGISTRY}/mecak8s --version ${CHART_VERSION}"
+            echo "helm install mecak8s oci://${OCI_REGISTRY}/mecak8s --version ${CHART_VERSION} --set guardrails.model=<CHECKER_MODEL>"
             echo '```'
             echo ""
             echo "**Verify signature:**"

Taskfile.yml

@@ -812,8 +812,8 @@ tasks:
       and assert the caller-identity boundaries. Needs helm + kubeconform; needs
       NO cluster, so it runs in CI and on a laptop.
     vars:
-      PROD_SET: redis.endpoint=redis.example.internal:6379,redis.credentialsSecret=redis-credentials,security.allowUnsafeRealProvider=true
-      SAFE_SET: redis.endpoint=redis.example.internal:6379,redis.credentialsSecret=redis-credentials,tls.enabled=true,tls.secretName=mecak8s-tls,oidc.enabled=true,oidc.issuer=https://idp.example.com,oidc.audience=mecatl
+      PROD_SET: redis.endpoint=redis.example.internal:6379,redis.credentialsSecret=redis-credentials,security.allowUnsafeRealProvider=true,guardrails.fromSettings=true
+      SAFE_SET: redis.endpoint=redis.example.internal:6379,redis.credentialsSecret=redis-credentials,tls.enabled=true,tls.secretName=mecak8s-tls,oidc.enabled=true,oidc.issuer=https://idp.example.com,oidc.audience=mecatl,guardrails.fromSettings=true
     preconditions:
       - sh: command -v helm >/dev/null 2>&1
         msg: "helm is not installed (https://helm.sh/docs/intro/install/)"
@@ -864,7 +864,7 @@ tasks:
           set -eu -o pipefail
           missing=""
           rendered=$(helm template production deploy/helm/mecak8s --set '{{.SAFE_SET}}')
-          for arg in --grpc-addr --http-addr --redis-url --session-lease-k8s-namespace --headless --posture --oidc-issuer --oidc-audience --oidc-max-jwks-staleness=1h; do
+          for arg in --grpc-addr --http-addr --redis-url --session-lease-k8s-namespace --headless --permission-mode --oidc-issuer --oidc-audience --oidc-max-jwks-staleness=1h; do
             echo "$rendered" | grep -q -- "$arg" || missing="$missing $arg"
           done
           if [ -n "$missing" ]; then

apps/contracts/openapi.json

@@ -1814,7 +1814,9 @@
                       "enum": [
                         "default",
                         "plan",
-                        "acceptEdits"
+                        "acceptEdits",
+                        "auto",
+                        "yolo"
                       ]
                     },
                     "model": {
@@ -2991,7 +2993,9 @@
                       "enum": [
                         "default",
                         "plan",
-                        "acceptEdits"
+                        "acceptEdits",
+                        "auto",
+                        "yolo"
                       ]
                     }
                   },
@@ -5527,7 +5531,10 @@
                             "enum": [
                               "default",
                               "plan",
-                              "acceptEdits"
+                              "acceptEdits",
+                              "auto",
+                              "yolo",
+                              "serverDefault"
                             ]
                           },
                           "modelId": {
@@ -5882,7 +5889,10 @@
                       "enum": [
                         "default",
                         "plan",
-                        "acceptEdits"
+                        "acceptEdits",
+                        "auto",
+                        "yolo",
+                        "serverDefault"
                       ]
                     },
                     "modelId": {
@@ -6190,8 +6200,7 @@
                       "default",
                       "plan",
                       "acceptEdits"
-                    ],
-                    "default": "plan"
+                    ]
                   },
                   "mutating": {
                     "type": "boolean",
@@ -6306,7 +6315,10 @@
                       "enum": [
                         "default",
                         "plan",
-                        "acceptEdits"
+                        "acceptEdits",
+                        "auto",
+                        "yolo",
+                        "serverDefault"
                       ]
                     },
                     "modelId": {