Provider permissions: context filtering for denied auto-context

[jeonghun-jj-lee]

Important

Decision Surface

Problem: The system prompt includes auto-context sources (AGENTS.md, instruction files, system-context sources) that may reference files in directories the active model's tier denies. These leak content before any tool call happens.

Approach: At system prompt assembly time, filter out SystemContext.Source entries and instruction files whose paths fall in directories denied by the active model's tier. Suppress them entirely (don't send a placeholder in the system prompt).

Scope: Integration with the system-context assembly pipeline and instruction-context discovery. Requires slice #2 (resolution engine).

---

Acceptance Criteria

• Instruction files (AGENTS.md, CLAUDE.md) from denied directories are excluded from the system prompt
• SystemContext.Source entries whose content originates from denied directories are suppressed
• Suppression is silent — no placeholder in the system prompt (it simply omits the source)
• Sources from allowed directories are included normally
• Sources with no identifiable file path (e.g., core/date) are always included
• On model switch, the system prompt is re-assembled with the new model's tier filtering applied
• When no providerPermissions config exists, all sources are included (existing behavior)

Key Decisions

#	Decision	Rationale
1	Silent suppression (not placeholder)	System prompt should be clean — a placeholder there is confusing, unlike history where it explains a gap
2	Filter at assembly, not at source registration	Sources remain registered (they return if the model switches to a trusted tier)

Testing Decisions

• Test instruction file from denied directory → excluded from assembled prompt
• Test instruction file from allowed directory → included
• Test system-context source with file-backed path in denied dir → suppressed
• Test non-file source (core/date) → always included
• Test model switch triggers re-assembly with new filtering
• Test no config → all sources included (backward compatible)

Constraints & Invariants

• System-context sources need a resolvable file path for filtering; sources without one are always included
• Re-assembly on model switch must not be expensive (context sources are already cached; this just filters the render list)

Source

Part of #163
Blocked by #165