feat(permissions): expose network permission state (#103)

crates/domain/src/ports.rs

@@ -59,6 +59,7 @@ use crate::project::{Project, ProjectPath};
 use crate::remote::RemoteKind;
 use crate::skill::{Skill, SkillScope};
 use crate::sprint::{Sprint, SprintIndexEntry, SprintVersion};
+use crate::system_permissions::{ProjectSystemPermissions, RuntimePermissionSnapshot};
 use crate::template::AgentTemplate;
 use crate::terminal::PtySize;
 
@@ -2026,6 +2027,44 @@ pub trait PermissionStore: Send + Sync {
     ) -> Result<(), StoreError>;
 }
 
+/// Reads/writes a project's `.ideai/system-permissions.json`.
+#[async_trait]
+pub trait SystemPermissionStore: Send + Sync {
+    /// Loads the project's system permission document. Missing file returns the
+    /// default empty document.
+    ///
+    /// # Errors
+    /// [`StoreError`] on I/O or deserialisation failure.
+    async fn load_system_permissions(
+        &self,
+        project: &Project,
+    ) -> Result<ProjectSystemPermissions, StoreError>;
+
+    /// Saves the project's system permission document.
+    ///
+    /// # Errors
+    /// [`StoreError`] on I/O or serialisation failure.
+    async fn save_system_permissions(
+        &self,
+        project: &Project,
+        permissions: &ProjectSystemPermissions,
+    ) -> Result<(), StoreError>;
+}
+
+/// Read-only probe for host/provider system permission constraints.
+#[async_trait]
+pub trait RuntimePermissionProbe: Send + Sync {
+    /// Returns the effective runtime permission state visible to IdeA.
+    ///
+    /// # Errors
+    /// [`RuntimeError`] when probing itself fails.
+    async fn probe_runtime_permissions(
+        &self,
+        project: &Project,
+        agent_id: AgentId,
+    ) -> Result<RuntimePermissionSnapshot, RuntimeError>;
+}
+
 /// Reads/writes a project's `.ideai/mcp-tool-permissions.json`.
 ///
 /// This is intentionally distinct from [`PermissionStore`]: it governs IdeA MCP