harden Loki with adapter-native read-only tool policies

[jbellis]

Context

Loki currently runs in a separate ACP subprocess/session with Mjolnir RuntimeAccessMode::ReadOnly. Mjolnir denies ACP filesystem writes, terminal creation, and mutating permission requests, and only supplies the advise MCP server.

ACP does not currently define a portable session policy for removing mutating native tools. The existing client-side gate therefore does not prevent an adapter from exposing native mutating tools or writing directly without an ACP callback.

Follow-up

Add defense-in-depth read-only enforcement for Loki without changing Thor or Eitri:

• Keep the existing Mjolnir ACP callback and permission denial.
• Codex: modify the isolated Loki CODEX_HOME configuration to use default_permissions = ":read-only" with approval_policy = "never", with a compatible sandbox_mode = "read-only" fallback if required.
• Claude: populate the claude-agent-acp session/new extension at _meta.claudeCode.options.disallowedTools to remove known mutating native tools while preserving read/search tools and advise.
• Anvil: set the advertised permission_mode session config option to readOnly before the first Loki prompt.
• Confirm the native restriction before prompting Loki. Fail closed by disabling Loki with a visible warning when enforcement cannot be established.
• Evaluate an OS-level read-only sandbox around the entire Loki ACP subprocess to cover direct adapter filesystem access and future native tools.

Verification

• Deterministic adapter fixtures prove the native read-only setting is applied before Loki receives a substantive prompt.
• Attempts to edit, delete, move, execute a shell command, or invoke an unknown tool are denied.
• Read, search, think, fetch, and advise continue to work.
• Direct workspace writes from the ACP subprocess are covered by an OS sandbox test if that layer is implemented.
• Codex, Claude, and Anvil live smoke tests confirm Loki can review normally without mutating the workspace.

[jbellis]

i think this is unobtainium for any reasonable cost:benefit but leaving it open in case Ryan has any ideas