Constrain controlled CLI sessions and prove native budget overshoot

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

rein_aharness/profiles.py

@@ -8,13 +8,15 @@ Unknown profile names refuse to run.
 from __future__ import annotations
 
 from dataclasses import dataclass
+import re
 
 
 class UnknownToolProfileError(ValueError):
     """Raised when a manifest references a profile that is not registered."""
 
 
-# Claude Code --allowedTools strings. No push, no network, no arbitrary shell.
+# Direct Claude Code permission rules. Indirect Git helpers still require
+# the sandbox owner's filesystem, credential and egress boundaries.
 _GREEN_COMMIT_TOOLS = (
     "Read,Write,Edit,Glob,Grep,"
     "Bash(git add:*),Bash(git commit:*),Bash(git status),"
@@ -29,13 +31,25 @@ _BLUE_MAIL_TRIAGE_TOOLS = _GREEN_COMMIT_TOOLS
 
 @dataclass(frozen=True)
 class ToolProfile:
-    """A named hard allow-list for agentic sessions."""
+    """Named permission rules; controlled runs also restrict the tool inventory."""
 
     name: str
     description: str
     allowed_tools: str
     lane: str  # green | blue — advisory; enforcement is the allow-list
 
+    @property
+    def available_tools(self) -> str:
+        """Builtin inventory derived from the registered permission rules."""
+        names = []
+        for rule in self.allowed_tools.split(","):
+            match = re.fullmatch(r"([A-Za-z][A-Za-z0-9_]*)(?:\([^\r\n()]+\))?", rule.strip())
+            if match is None or match[1].startswith("mcp__"):
+                raise ValueError("controlled tool profile has an invalid builtin rule")
+            if match[1] not in names:
+                names.append(match[1])
+        return ",".join(names)
+
 
 PROFILES: dict[str, ToolProfile] = {
     "green-commit-only": ToolProfile(