fix(permissions): validate network access flow

crates/application/tests/system_permission_usecases.rs

@@ -54,6 +54,19 @@ impl RuntimePermissionProbe for LockedProbe {
     }
 }
 
+struct UnobservedProbe;
+
+#[async_trait]
+impl RuntimePermissionProbe for UnobservedProbe {
+    async fn probe_runtime_permissions(
+        &self,
+        _project: &Project,
+        _agent_id: AgentId,
+    ) -> Result<RuntimePermissionSnapshot, RuntimeError> {
+        Ok(RuntimePermissionSnapshot::unobserved())
+    }
+}
+
 fn project() -> Project {
     Project::new(
         ProjectId::new_random(),
@@ -125,7 +138,7 @@ async fn update_agent_system_permissions_adds_and_removes_sparse_override() {
 }
 
 #[tokio::test]
-async fn resolve_agent_system_permissions_exposes_locked_runtime_read_only() {
+async fn resolve_agent_system_permissions_exposes_locked_runtime_separately_from_wanted_control() {
     let agent = AgentId::new_random();
     let store = Arc::new(FakeSystemPermissionStore {
         doc: Mutex::new(ProjectSystemPermissions::new(
@@ -149,6 +162,43 @@ async fn resolve_agent_system_permissions_exposes_locked_runtime_read_only() {
     assert_eq!(out.permissions.runtime_lock.state, RuntimeLockState::Locked);
     assert_eq!(
         out.permissions.control.mode,
+        SystemPermissionControlMode::Editable
+    );
+    assert_eq!(
+        out.permissions.runtime_control.mode,
+        SystemPermissionControlMode::ReadOnly
+    );
+}
+
+#[tokio::test]
+async fn resolve_agent_system_permissions_unobserved_runtime_does_not_lock_form() {
+    let agent = AgentId::new_random();
+    let store = Arc::new(FakeSystemPermissionStore {
+        doc: Mutex::new(ProjectSystemPermissions::new(
+            Some(SystemPermissionSet::new(Some(NetworkPolicy::Allow))),
+            vec![],
+        )),
+        saves: Mutex::new(0),
+    });
+    let use_case = ResolveAgentSystemPermissions::new(store, Arc::new(UnobservedProbe));
+
+    let out = use_case
+        .execute(ResolveAgentSystemPermissionsInput {
+            project: project(),
+            agent_id: agent,
+        })
+        .await
+        .unwrap();
+
+    assert_eq!(out.permissions.wanted, Some(NetworkPolicy::Allow));
+    assert_eq!(out.permissions.effective, NetworkPolicy::Allow);
+    assert_eq!(out.permissions.runtime_lock.state, RuntimeLockState::None);
+    assert_eq!(
+        out.permissions.control.mode,
+        SystemPermissionControlMode::Editable
+    );
+    assert_eq!(
+        out.permissions.runtime_control.mode,
         SystemPermissionControlMode::ReadOnly
     );
 }