[Asaf-prog]

Protected root agents and orchestrators could execute even when the access resolver denied access, because filtering only covered child delegation. Apply the existing policy before entering a protected root executor, preventing prompt resolution, model calls and tool execution on denial. Missing access plugins also fail at startup for direct Python callers.

Denied new runs return Access denied. with an empty route and emit the refusal through the existing streaming answer sink.

Approval replay now uses the current verified decision request's authorization facts. The manager supplies a fresh RunContext on both approval paths; root entry replaces the execution-local context for root and child checks instead of reading saved grants from the checkpoint. Revoked roles/scopes/organization/metadata and omitted fresh permission facts cannot inherit the original grant. Caller/run/session conflicts are rejected before claiming the approval. The reviewed tool request and completed replay steps remain bound to the checkpoint.

Local chat also forwards its host-supplied RunContext when approving a tool in both streaming and non-streaming console modes. Current role/scope/metadata facts reach replay; changing a permission at the approval prompt still prevents the tool effect.

Compatibility:

• Python resume / resume_stream gain an optional context: RunContext | None keyword. External implementations of the optional approval ports must accept it; hosts must supply trusted current facts. ADR 0002 records the contract.
• YAML, access-plugin signatures, HTTP bodies and SSE event types are unchanged. Credentials stay in request-local context and are excluded from graph projections.
• A denied resumed root follows the existing approval mismatch error path. A filtered child may trigger the existing checkpoint mismatch error path (sanitized HTTP 500 / SSE error); both prevent the pending tool effect and fail the run.
• Current main is merged and the task-index conflict is resolved.

Validation (2026-10-24):

• make check: 1,546 tests passed; formatting (363 files), lint, mypy (359 files) and generated-stub checks passed, with 27 dependency warnings.
• make validate and agentctl validate examples/whatsapp-pilot/agents.yml: all three examples passed.
• git diff --check: passed.
• The two protected-access files contain 79 regression cases, including 40 added for the review follow-up: real signed manager HTTP requests, root agents/orchestrators and protected children, revoked/current roles, missing fresh context, scope/metadata/organization replacement, owner binding and concurrent resume isolation.
• Before correction, six HTTP revoked-role cases executed the local tool and two omitted-context engine cases reused saved roles. Still-authorized cases continue to execute the reviewed tool once.
• Eight additional real-engine local-chat cases cover both root kinds, both console modes, permission revocation at the approval prompt, exactly-once allowed execution and credential exclusion. All eight failed before the local-context forwarding correction and pass afterwards.
• Post-implementation code review completed. Tests use fake models/providers and temporary local storage; no live provider or identity deployment was exercised.

Fixes #151