feat(backend): parité enforcement des permissions tools sur le chemin OpenAI-compatible (#82 lot B3)

backend/src/openai_tools.rs et app-tauri/src/openai_tools.rs appliquent
désormais les mêmes règles de permission du domaine mcp_tool_permissions
(B1) et le même enforcement que le serveur MCP natif (B2), pour fermer
l'écart de parité sur le chemin OpenAI-compatible.

Lot B3 du ticket #82 : parité posée sur B1+B2, l'API backend pour la future
UI suit en B4 sur la même branche.

QA vert.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

crates/app-tauri/src/openai_tools.rs

@@ -10,9 +10,10 @@ use std::sync::{Arc, Mutex};
 use application::OrchestratorService;
 use async_trait::async_trait;
 use domain::ports::{
-    AgentToolPolicyStore, ProjectStore, ToolInvocationError, ToolInvoker, ToolSpec,
+    AgentToolPolicyStore, McpToolPermissionStore, ProjectStore, ToolInvocationError, ToolInvoker,
+    ToolSpec,
 };
-use domain::{AgentToolPolicy, IssueRef};
+use domain::{AgentId, AgentToolPolicy, IssueRef, McpToolPolicy, Project};
 use infrastructure::TicketToolProvider;
 use serde_json::Value;
 
@@ -24,6 +25,7 @@ pub struct AppOpenAiToolInvoker {
     orchestrator: Arc<OrchestratorService>,
     projects: Arc<dyn ProjectStore>,
     policies: Arc<dyn AgentToolPolicyStore>,
+    mcp_tool_permissions: Arc<dyn McpToolPermissionStore>,
     ticket_tools: Arc<dyn TicketToolProvider>,
 }
 
@@ -79,12 +81,14 @@ impl AppOpenAiToolInvoker {
         orchestrator: Arc<OrchestratorService>,
         projects: Arc<dyn ProjectStore>,
         policies: Arc<dyn AgentToolPolicyStore>,
+        mcp_tool_permissions: Arc<dyn McpToolPermissionStore>,
         ticket_tools: Arc<dyn TicketToolProvider>,
     ) -> Self {
         Self {
             orchestrator,
             projects,
             policies,
+            mcp_tool_permissions,
             ticket_tools,
         }
     }
@@ -129,7 +133,10 @@ impl ToolInvoker for AppOpenAiToolInvoker {
                     "identité requester interne absente pour l'outil".to_owned(),
                 )
             })?;
-        enforce_tool_policy(self.policies.as_ref(), &requester, name, &value)?;
+        let ephemeral_policy = self.policies.get_policy(&requester);
+        if let Some(policy) = &ephemeral_policy {
+            enforce_policy(policy, &requester, name, &value)?;
+        }
         let project = self
             .projects
             .list_projects()
@@ -142,6 +149,14 @@ impl ToolInvoker for AppOpenAiToolInvoker {
                     "projet introuvable pour root `{project_root}`"
                 ))
             })?;
+        enforce_durable_tool_policy(
+            self.mcp_tool_permissions.as_ref(),
+            &project,
+            ephemeral_policy.as_ref(),
+            &requester,
+            name,
+        )
+        .await?;
         if infrastructure::orchestrator::mcp::tools::is_ticket_tool(name) {
             let value = self
                 .ticket_tools
@@ -178,16 +193,68 @@ impl ToolInvoker for AppOpenAiToolInvoker {
     }
 }
 
-fn enforce_tool_policy(
+async fn enforce_durable_tool_policy(
-    policies: &dyn AgentToolPolicyStore,
+    store: &dyn McpToolPermissionStore,
+    project: &Project,
+    ephemeral_policy: Option<&AgentToolPolicy>,
     requester: &str,
     name: &str,
-    arguments: &Value,
 ) -> Result<(), ToolInvocationError> {
-    let Some(policy) = policies.get_policy(requester) else {
+    let Some(policy) = durable_tool_policy(store, project, ephemeral_policy, requester).await?
+    else {
         return Ok(());
     };
-    enforce_policy(&policy, requester, name, arguments)
+    if policy.permits(name) {
+        return Ok(());
+    }
+    let requester = if requester.is_empty() {
+        "mcp"
+    } else {
+        requester
+    };
+    Err(ToolInvocationError::Rejected(format!(
+        "MCP tool `{name}` is not permitted for requester {requester}"
+    )))
+}
+
+async fn durable_tool_policy(
+    store: &dyn McpToolPermissionStore,
+    project: &Project,
+    ephemeral_policy: Option<&AgentToolPolicy>,
+    requester: &str,
+) -> Result<Option<McpToolPolicy>, ToolInvocationError> {
+    let known_tools = infrastructure::orchestrator::mcp::tools::classified_tool_names();
+    let policy = if let Some(agent_id) = requester_agent_id(requester) {
+        let doc = store
+            .load_mcp_tool_permissions(project)
+            .await
+            .map_err(|e| {
+                ToolInvocationError::Execution(format!("failed to load MCP tool permissions: {e}"))
+            })?;
+        doc.effective_policy(
+            agent_id,
+            infrastructure::orchestrator::mcp::tools::READ_ONLY_TOOLS,
+            &known_tools,
+        )
+        .map_err(|e| ToolInvocationError::Execution(format!("invalid MCP tool permissions: {e}")))?
+    } else if requester.is_empty() || requester == "mcp" || ephemeral_policy.is_none() {
+        McpToolPolicy::read_only(
+            infrastructure::orchestrator::mcp::tools::READ_ONLY_TOOLS,
+            &known_tools,
+        )
+        .map_err(|e| {
+            ToolInvocationError::Execution(format!("invalid read-only MCP tool fallback: {e}"))
+        })?
+    } else {
+        return Ok(None);
+    };
+    Ok(Some(policy))
+}
+
+fn requester_agent_id(requester: &str) -> Option<AgentId> {
+    uuid::Uuid::parse_str(requester)
+        .ok()
+        .map(AgentId::from_uuid)
 }
 
 fn enforce_policy(
@@ -233,3 +300,360 @@ fn is_ticket_policy_mutation_tool(name: &str) -> bool {
             | "idea_ticket_unlink"
     )
 }
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+    use std::str::FromStr;
+    use std::sync::{Arc, Mutex};
+
+    use domain::ports::{AgentToolPolicyStore, McpToolPermissionStore, ProjectStore};
+    use domain::{
+        AgentId, AgentMcpToolPolicyOverride, McpToolPolicy, Project, ProjectId,
+        ProjectMcpToolPermissions, ProjectPath, RemoteRef, StoreError, Workspace,
+    };
+    use infrastructure::TicketToolError;
+    use serde_json::json;
+    use uuid::Uuid;
+
+    use super::*;
+
+    #[derive(Default)]
+    struct FakePolicies(Mutex<HashMap<String, AgentToolPolicy>>);
+
+    impl AgentToolPolicyStore for FakePolicies {
+        fn set_policy(&self, requester: String, policy: AgentToolPolicy) {
+            self.0.lock().unwrap().insert(requester, policy);
+        }
+
+        fn get_policy(&self, requester: &str) -> Option<AgentToolPolicy> {
+            self.0.lock().unwrap().get(requester).cloned()
+        }
+
+        fn clear_policy(&self, requester: &str) {
+            self.0.lock().unwrap().remove(requester);
+        }
+    }
+
+    #[derive(Default)]
+    struct FakeProjects {
+        projects: Mutex<Vec<Project>>,
+    }
+
+    impl FakeProjects {
+        fn with(project: Project) -> Self {
+            Self {
+                projects: Mutex::new(vec![project]),
+            }
+        }
+    }
+
+    #[async_trait]
+    impl ProjectStore for FakeProjects {
+        async fn list_projects(&self) -> Result<Vec<Project>, StoreError> {
+            Ok(self.projects.lock().unwrap().clone())
+        }
+
+        async fn load_project(&self, id: ProjectId) -> Result<Project, StoreError> {
+            self.projects
+                .lock()
+                .unwrap()
+                .iter()
+                .find(|project| project.id == id)
+                .cloned()
+                .ok_or(StoreError::NotFound)
+        }
+
+        async fn save_project(&self, project: &Project) -> Result<(), StoreError> {
+            self.projects.lock().unwrap().push(project.clone());
+            Ok(())
+        }
+
+        async fn save_workspace(&self, _workspace: &Workspace) -> Result<(), StoreError> {
+            Ok(())
+        }
+
+        async fn load_workspace(&self) -> Result<Workspace, StoreError> {
+            Ok(Workspace::default())
+        }
+    }
+
+    struct FakeMcpToolPermissions {
+        doc: Mutex<ProjectMcpToolPermissions>,
+    }
+
+    impl FakeMcpToolPermissions {
+        fn new(doc: ProjectMcpToolPermissions) -> Self {
+            Self {
+                doc: Mutex::new(doc),
+            }
+        }
+    }
+
+    #[async_trait]
+    impl McpToolPermissionStore for FakeMcpToolPermissions {
+        async fn load_mcp_tool_permissions(
+            &self,
+            _project: &Project,
+        ) -> Result<ProjectMcpToolPermissions, StoreError> {
+            Ok(self.doc.lock().unwrap().clone())
+        }
+
+        async fn save_mcp_tool_permissions(
+            &self,
+            _project: &Project,
+            permissions: &ProjectMcpToolPermissions,
+        ) -> Result<(), StoreError> {
+            *self.doc.lock().unwrap() = permissions.clone();
+            Ok(())
+        }
+    }
+
+    #[derive(Default)]
+    struct FakeTicketTools {
+        calls: Mutex<Vec<(String, String, Value)>>,
+    }
+
+    #[async_trait]
+    impl TicketToolProvider for FakeTicketTools {
+        async fn handle_ticket_tool(
+            &self,
+            _project: &Project,
+            requester: &str,
+            name: &str,
+            arguments: Value,
+        ) -> Result<Value, TicketToolError> {
+            self.calls.lock().unwrap().push((
+                requester.to_owned(),
+                name.to_owned(),
+                arguments.clone(),
+            ));
+            Ok(json!({
+                "ok": true,
+                "requester": requester,
+                "ref": arguments.get("ref").and_then(Value::as_str).unwrap_or_default(),
+            }))
+        }
+    }
+
+    fn project() -> Project {
+        Project::new(
+            ProjectId::from_uuid(Uuid::from_u128(1)),
+            "demo",
+            ProjectPath::new("/tmp/project").unwrap(),
+            RemoteRef::local(),
+            1_000,
+        )
+        .unwrap()
+    }
+
+    fn mcp_permissions(doc: ProjectMcpToolPermissions) -> Arc<dyn McpToolPermissionStore> {
+        Arc::new(FakeMcpToolPermissions::new(doc))
+    }
+
+    fn allow_doc(agent: AgentId, allowed_tools: &[&str]) -> ProjectMcpToolPermissions {
+        let known_tools = infrastructure::orchestrator::mcp::tools::classified_tool_names();
+        ProjectMcpToolPermissions::new(
+            None,
+            vec![AgentMcpToolPolicyOverride::new(
+                agent,
+                McpToolPolicy::new(
+                    allowed_tools
+                        .iter()
+                        .map(|tool| (*tool).to_owned())
+                        .collect(),
+                    &known_tools,
+                )
+                .unwrap(),
+            )],
+            &known_tools,
+        )
+        .unwrap()
+    }
+
+    fn issue_ref(raw: &str) -> IssueRef {
+        IssueRef::from_str(raw).unwrap()
+    }
+
+    #[tokio::test]
+    async fn openai_general_agent_without_durable_override_is_read_only() {
+        let temp = std::env::temp_dir().join(format!(
+            "idea-app-tauri-openai-mcp-permissions-readonly-{}",
+            Uuid::new_v4()
+        ));
+        let core = backend::BackendCore::build(temp.clone());
+        let requester = AgentId::from_uuid(Uuid::from_u128(82)).to_string();
+        let ticket_tools = Arc::new(FakeTicketTools::default());
+        let invoker = AppOpenAiToolInvoker::new(
+            Arc::clone(&core.orchestrator_service),
+            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
+            Arc::new(FakePolicies::default()),
+            mcp_permissions(ProjectMcpToolPermissions::default()),
+            ticket_tools.clone(),
+        );
+
+        invoker
+            .call(
+                "idea_ticket_list",
+                &json!({
+                    PROJECT_ROOT_ARG: "/tmp/project",
+                    REQUESTER_ARG: requester,
+                })
+                .to_string(),
+            )
+            .await
+            .expect("read tool must pass the durable read-only policy");
+
+        for (tool, arguments) in [
+            (
+                "idea_memory_write",
+                json!({ "slug": "note-a", "content": "body" }),
+            ),
+            (
+                "idea_ask_agent",
+                json!({ "target": "architect", "task": "do it" }),
+            ),
+            (
+                "idea_ticket_update_carnet",
+                json!({ "ref": "#7", "expectedVersion": 1, "carnet": "body" }),
+            ),
+            (
+                "idea_run_in_background",
+                json!({ "label": "task", "command": "echo" }),
+            ),
+        ] {
+            let mut payload = arguments.as_object().unwrap().clone();
+            payload.insert(PROJECT_ROOT_ARG.to_owned(), json!("/tmp/project"));
+            payload.insert(REQUESTER_ARG.to_owned(), json!(requester.clone()));
+            let err = invoker
+                .call(tool, &Value::Object(payload).to_string())
+                .await
+                .expect_err("write tool must be rejected without durable override");
+            assert!(
+                matches!(err, ToolInvocationError::Rejected(ref message) if message.contains(tool)),
+                "expected readable rejection for {tool}, got {err:?}"
+            );
+        }
+
+        let calls = ticket_tools.calls.lock().unwrap();
+        assert_eq!(calls.len(), 1, "only the read ticket tool should run");
+        assert_eq!(calls[0].1, "idea_ticket_list");
+
+        let _ = std::fs::remove_dir_all(temp);
+    }
+
+    #[tokio::test]
+    async fn openai_durable_agent_override_allows_explicit_write_tool() {
+        let temp = std::env::temp_dir().join(format!(
+            "idea-app-tauri-openai-mcp-permissions-{}",
+            Uuid::new_v4()
+        ));
+        let core = backend::BackendCore::build(temp.clone());
+        let agent = AgentId::from_uuid(Uuid::from_u128(83));
+        let requester = agent.to_string();
+        let ticket_tools = Arc::new(FakeTicketTools::default());
+        let invoker = AppOpenAiToolInvoker::new(
+            Arc::clone(&core.orchestrator_service),
+            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
+            Arc::new(FakePolicies::default()),
+            mcp_permissions(allow_doc(agent, &["idea_ticket_update_carnet"])),
+            ticket_tools.clone(),
+        );
+
+        let result = invoker
+            .call(
+                "idea_ticket_update_carnet",
+                &json!({
+                    PROJECT_ROOT_ARG: "/tmp/project",
+                    REQUESTER_ARG: requester,
+                    "ref": "#7",
+                    "expectedVersion": 1,
+                    "carnet": "body",
+                })
+                .to_string(),
+            )
+            .await
+            .expect("durable override should let the write tool reach the provider");
+        let result: Value = serde_json::from_str(&result).unwrap();
+        assert_eq!(result["requester"], requester);
+        assert_eq!(result["ref"], "#7");
+
+        let calls = ticket_tools.calls.lock().unwrap();
+        assert_eq!(calls.len(), 1);
+        assert_eq!(calls[0].1, "idea_ticket_update_carnet");
+
+        let _ = std::fs::remove_dir_all(temp);
+    }
+
+    #[tokio::test]
+    async fn openai_ticket_assistant_policy_still_bounds_ticket() {
+        let temp = std::env::temp_dir().join(format!(
+            "idea-app-tauri-openai-ticket-policy-{}",
+            Uuid::new_v4()
+        ));
+        let core = backend::BackendCore::build(temp.clone());
+        let requester = "ticket-assistant:00000000000000000000000000000001:7";
+        let policies = Arc::new(FakePolicies::default());
+        policies.set_policy(
+            requester.to_owned(),
+            AgentToolPolicy::new(
+                vec!["idea_ticket_update_carnet".to_owned()],
+                Some(issue_ref("#7")),
+                true,
+            ),
+        );
+        let ticket_tools = Arc::new(FakeTicketTools::default());
+        let invoker = AppOpenAiToolInvoker::new(
+            Arc::clone(&core.orchestrator_service),
+            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
+            policies,
+            mcp_permissions(ProjectMcpToolPermissions::default()),
+            ticket_tools.clone(),
+        );
+
+        let denied = invoker
+            .call(
+                "idea_ticket_update_carnet",
+                &json!({
+                    PROJECT_ROOT_ARG: "/tmp/project",
+                    REQUESTER_ARG: requester,
+                    "ref": "#8",
+                    "expectedVersion": 1,
+                    "carnet": "denied",
+                })
+                .to_string(),
+            )
+            .await
+            .expect_err("out-of-scope ticket must be rejected");
+        assert!(matches!(denied, ToolInvocationError::Rejected(message) if message.contains("#8")));
+        assert!(
+            ticket_tools.calls.lock().unwrap().is_empty(),
+            "ticket policy rejection happens before TicketToolProvider dispatch"
+        );
+
+        let allowed = invoker
+            .call(
+                "idea_ticket_update_carnet",
+                &json!({
+                    PROJECT_ROOT_ARG: "/tmp/project",
+                    REQUESTER_ARG: requester,
+                    "ref": "#7",
+                    "expectedVersion": 1,
+                    "carnet": "allowed",
+                })
+                .to_string(),
+            )
+            .await
+            .expect("bound ticket update allowed");
+        let allowed: Value = serde_json::from_str(&allowed).unwrap();
+        assert_eq!(allowed["requester"], requester);
+        assert_eq!(allowed["ref"], "#7");
+
+        let calls = ticket_tools.calls.lock().unwrap();
+        assert_eq!(calls.len(), 1);
+        assert_eq!(calls[0].0, requester);
+        assert_eq!(calls[0].1, "idea_ticket_update_carnet");
+
+        let _ = std::fs::remove_dir_all(temp);
+    }
+}

crates/backend/src/lib.rs

@@ -2352,6 +2352,7 @@ impl BackendCore {
             Arc::clone(&orchestrator_service),
             Arc::clone(&store_port),
             Arc::clone(&tool_policy_registry) as Arc<dyn AgentToolPolicyStore>,
+            Arc::clone(&mcp_tool_permission_store_port),
             Arc::clone(&ticket_tool_provider),
         )) as Arc<dyn ToolInvoker>);
 

crates/backend/src/openai_tools.rs

@@ -10,9 +10,10 @@ use std::sync::{Arc, Mutex};
 use application::OrchestratorService;
 use async_trait::async_trait;
 use domain::ports::{
-    AgentToolPolicyStore, ProjectStore, ToolInvocationError, ToolInvoker, ToolSpec,
+    AgentToolPolicyStore, McpToolPermissionStore, ProjectStore, ToolInvocationError, ToolInvoker,
+    ToolSpec,
 };
-use domain::{AgentToolPolicy, IssueRef};
+use domain::{AgentId, AgentToolPolicy, IssueRef, McpToolPolicy, Project};
 use infrastructure::TicketToolProvider;
 use serde_json::Value;
 
@@ -24,6 +25,7 @@ pub struct AppOpenAiToolInvoker {
     orchestrator: Arc<OrchestratorService>,
     projects: Arc<dyn ProjectStore>,
     policies: Arc<dyn AgentToolPolicyStore>,
+    mcp_tool_permissions: Arc<dyn McpToolPermissionStore>,
     ticket_tools: Arc<dyn TicketToolProvider>,
 }
 
@@ -79,12 +81,14 @@ impl AppOpenAiToolInvoker {
         orchestrator: Arc<OrchestratorService>,
         projects: Arc<dyn ProjectStore>,
         policies: Arc<dyn AgentToolPolicyStore>,
+        mcp_tool_permissions: Arc<dyn McpToolPermissionStore>,
         ticket_tools: Arc<dyn TicketToolProvider>,
     ) -> Self {
         Self {
             orchestrator,
             projects,
             policies,
+            mcp_tool_permissions,
             ticket_tools,
         }
     }
@@ -129,7 +133,10 @@ impl ToolInvoker for AppOpenAiToolInvoker {
                     "identité requester interne absente pour l'outil".to_owned(),
                 )
             })?;
-        enforce_tool_policy(self.policies.as_ref(), &requester, name, &value)?;
+        let ephemeral_policy = self.policies.get_policy(&requester);
+        if let Some(policy) = &ephemeral_policy {
+            enforce_policy(policy, &requester, name, &value)?;
+        }
         let project = self
             .projects
             .list_projects()
@@ -142,6 +149,14 @@ impl ToolInvoker for AppOpenAiToolInvoker {
                     "projet introuvable pour root `{project_root}`"
                 ))
             })?;
+        enforce_durable_tool_policy(
+            self.mcp_tool_permissions.as_ref(),
+            &project,
+            ephemeral_policy.as_ref(),
+            &requester,
+            name,
+        )
+        .await?;
         if infrastructure::orchestrator::mcp::tools::is_ticket_tool(name) {
             let value = self
                 .ticket_tools
@@ -178,6 +193,71 @@ impl ToolInvoker for AppOpenAiToolInvoker {
     }
 }
 
+async fn enforce_durable_tool_policy(
+    store: &dyn McpToolPermissionStore,
+    project: &Project,
+    ephemeral_policy: Option<&AgentToolPolicy>,
+    requester: &str,
+    name: &str,
+) -> Result<(), ToolInvocationError> {
+    let Some(policy) = durable_tool_policy(store, project, ephemeral_policy, requester).await?
+    else {
+        return Ok(());
+    };
+    if policy.permits(name) {
+        return Ok(());
+    }
+    let requester = if requester.is_empty() {
+        "mcp"
+    } else {
+        requester
+    };
+    Err(ToolInvocationError::Rejected(format!(
+        "MCP tool `{name}` is not permitted for requester {requester}"
+    )))
+}
+
+async fn durable_tool_policy(
+    store: &dyn McpToolPermissionStore,
+    project: &Project,
+    ephemeral_policy: Option<&AgentToolPolicy>,
+    requester: &str,
+) -> Result<Option<McpToolPolicy>, ToolInvocationError> {
+    let known_tools = infrastructure::orchestrator::mcp::tools::classified_tool_names();
+    let policy = if let Some(agent_id) = requester_agent_id(requester) {
+        let doc = store
+            .load_mcp_tool_permissions(project)
+            .await
+            .map_err(|e| {
+                ToolInvocationError::Execution(format!("failed to load MCP tool permissions: {e}"))
+            })?;
+        doc.effective_policy(
+            agent_id,
+            infrastructure::orchestrator::mcp::tools::READ_ONLY_TOOLS,
+            &known_tools,
+        )
+        .map_err(|e| ToolInvocationError::Execution(format!("invalid MCP tool permissions: {e}")))?
+    } else if requester.is_empty() || requester == "mcp" || ephemeral_policy.is_none() {
+        McpToolPolicy::read_only(
+            infrastructure::orchestrator::mcp::tools::READ_ONLY_TOOLS,
+            &known_tools,
+        )
+        .map_err(|e| {
+            ToolInvocationError::Execution(format!("invalid read-only MCP tool fallback: {e}"))
+        })?
+    } else {
+        return Ok(None);
+    };
+    Ok(Some(policy))
+}
+
+fn requester_agent_id(requester: &str) -> Option<AgentId> {
+    uuid::Uuid::parse_str(requester)
+        .ok()
+        .map(AgentId::from_uuid)
+}
+
+#[cfg(test)]
 fn enforce_tool_policy(
     policies: &dyn AgentToolPolicyStore,
     requester: &str,
@@ -239,8 +319,11 @@ mod tests {
     use std::collections::HashMap;
     use std::sync::Mutex;
 
-    use domain::ports::{AgentToolPolicyStore, ProjectStore};
+    use domain::ports::{AgentToolPolicyStore, McpToolPermissionStore, ProjectStore};
-    use domain::{Project, ProjectId, ProjectPath, RemoteRef, StoreError, Workspace};
+    use domain::{
+        AgentId, AgentMcpToolPolicyOverride, McpToolPolicy, Project, ProjectId,
+        ProjectMcpToolPermissions, ProjectPath, RemoteRef, StoreError, Workspace,
+    };
     use infrastructure::TicketToolError;
     use serde_json::json;
     use uuid::Uuid;
@@ -277,6 +360,37 @@ mod tests {
         }
     }
 
+    struct FakeMcpToolPermissions {
+        doc: Mutex<ProjectMcpToolPermissions>,
+    }
+
+    impl FakeMcpToolPermissions {
+        fn new(doc: ProjectMcpToolPermissions) -> Self {
+            Self {
+                doc: Mutex::new(doc),
+            }
+        }
+    }
+
+    #[async_trait]
+    impl McpToolPermissionStore for FakeMcpToolPermissions {
+        async fn load_mcp_tool_permissions(
+            &self,
+            _project: &Project,
+        ) -> Result<ProjectMcpToolPermissions, StoreError> {
+            Ok(self.doc.lock().unwrap().clone())
+        }
+
+        async fn save_mcp_tool_permissions(
+            &self,
+            _project: &Project,
+            permissions: &ProjectMcpToolPermissions,
+        ) -> Result<(), StoreError> {
+            *self.doc.lock().unwrap() = permissions.clone();
+            Ok(())
+        }
+    }
+
     #[async_trait]
     impl ProjectStore for FakeProjects {
         async fn list_projects(&self) -> Result<Vec<Project>, StoreError> {
@@ -349,6 +463,30 @@ mod tests {
         .unwrap()
     }
 
+    fn mcp_permissions(doc: ProjectMcpToolPermissions) -> Arc<dyn McpToolPermissionStore> {
+        Arc::new(FakeMcpToolPermissions::new(doc))
+    }
+
+    fn allow_doc(agent: AgentId, allowed_tools: &[&str]) -> ProjectMcpToolPermissions {
+        let known_tools = infrastructure::orchestrator::mcp::tools::classified_tool_names();
+        ProjectMcpToolPermissions::new(
+            None,
+            vec![AgentMcpToolPolicyOverride::new(
+                agent,
+                McpToolPolicy::new(
+                    allowed_tools
+                        .iter()
+                        .map(|tool| (*tool).to_owned())
+                        .collect(),
+                    &known_tools,
+                )
+                .unwrap(),
+            )],
+            &known_tools,
+        )
+        .unwrap()
+    }
+
     #[test]
     fn openai_tool_policy_rejects_tool_outside_allowlist() {
         let policies = FakePolicies::default();
@@ -438,6 +576,7 @@ mod tests {
             Arc::clone(&core.orchestrator_service),
             Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
             policies,
+            mcp_permissions(ProjectMcpToolPermissions::default()),
             ticket_tools.clone(),
         );
 
@@ -486,4 +625,112 @@ mod tests {
 
         let _ = std::fs::remove_dir_all(temp);
     }
+
+    #[tokio::test]
+    async fn openai_general_agent_without_durable_override_is_read_only() {
+        let temp = std::env::temp_dir().join(format!(
+            "idea-openai-mcp-permissions-readonly-{}",
+            Uuid::new_v4()
+        ));
+        let core = crate::BackendCore::build(temp.clone());
+        let requester = AgentId::from_uuid(Uuid::from_u128(82)).to_string();
+        let ticket_tools = Arc::new(FakeTicketTools::default());
+        let invoker = AppOpenAiToolInvoker::new(
+            Arc::clone(&core.orchestrator_service),
+            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
+            Arc::new(FakePolicies::default()),
+            mcp_permissions(ProjectMcpToolPermissions::default()),
+            ticket_tools.clone(),
+        );
+
+        invoker
+            .call(
+                "idea_ticket_list",
+                &json!({
+                    PROJECT_ROOT_ARG: "/tmp/project",
+                    REQUESTER_ARG: requester,
+                })
+                .to_string(),
+            )
+            .await
+            .expect("read tool must pass the durable read-only policy");
+
+        for (tool, arguments) in [
+            (
+                "idea_memory_write",
+                json!({ "slug": "note-a", "content": "body" }),
+            ),
+            (
+                "idea_ask_agent",
+                json!({ "target": "architect", "task": "do it" }),
+            ),
+            (
+                "idea_ticket_update_carnet",
+                json!({ "ref": "#7", "expectedVersion": 1, "carnet": "body" }),
+            ),
+            (
+                "idea_run_in_background",
+                json!({ "label": "task", "command": "echo" }),
+            ),
+        ] {
+            let mut payload = arguments.as_object().unwrap().clone();
+            payload.insert(PROJECT_ROOT_ARG.to_owned(), json!("/tmp/project"));
+            payload.insert(REQUESTER_ARG.to_owned(), json!(requester.clone()));
+            let err = invoker
+                .call(tool, &Value::Object(payload).to_string())
+                .await
+                .expect_err("write tool must be rejected without durable override");
+            assert!(
+                matches!(err, ToolInvocationError::Rejected(ref message) if message.contains(tool)),
+                "expected readable rejection for {tool}, got {err:?}"
+            );
+        }
+
+        let calls = ticket_tools.calls.lock().unwrap();
+        assert_eq!(calls.len(), 1, "only the read ticket tool should run");
+        assert_eq!(calls[0].1, "idea_ticket_list");
+
+        let _ = std::fs::remove_dir_all(temp);
+    }
+
+    #[tokio::test]
+    async fn openai_durable_agent_override_allows_explicit_write_tool() {
+        let temp =
+            std::env::temp_dir().join(format!("idea-openai-mcp-permissions-{}", Uuid::new_v4()));
+        let core = crate::BackendCore::build(temp.clone());
+        let agent = AgentId::from_uuid(Uuid::from_u128(83));
+        let requester = agent.to_string();
+        let ticket_tools = Arc::new(FakeTicketTools::default());
+        let invoker = AppOpenAiToolInvoker::new(
+            Arc::clone(&core.orchestrator_service),
+            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
+            Arc::new(FakePolicies::default()),
+            mcp_permissions(allow_doc(agent, &["idea_ticket_update_carnet"])),
+            ticket_tools.clone(),
+        );
+
+        let result = invoker
+            .call(
+                "idea_ticket_update_carnet",
+                &json!({
+                    PROJECT_ROOT_ARG: "/tmp/project",
+                    REQUESTER_ARG: requester,
+                    "ref": "#7",
+                    "expectedVersion": 1,
+                    "carnet": "body",
+                })
+                .to_string(),
+            )
+            .await
+            .expect("durable override should let the write tool reach the provider");
+        let result: Value = serde_json::from_str(&result).unwrap();
+        assert_eq!(result["requester"], requester);
+        assert_eq!(result["ref"], "#7");
+
+        let calls = ticket_tools.calls.lock().unwrap();
+        assert_eq!(calls.len(), 1);
+        assert_eq!(calls[0].1, "idea_ticket_update_carnet");
+
+        let _ = std::fs::remove_dir_all(temp);
+    }
 }