feat(permissions): expose network permission state (#103)

crates/infrastructure/src/runtime_permission.rs

@@ -0,0 +1,24 @@
+//! Read-only runtime permission probe.
+//!
+//! V1 deliberately does not claim live control over provider/network sandboxing.
+
+use async_trait::async_trait;
+
+use domain::ports::{RuntimeError, RuntimePermissionProbe};
+use domain::{AgentId, Project, RuntimePermissionSnapshot};
+
+/// Conservative probe used when IdeA cannot inspect or pilot runtime network
+/// permissions.
+#[derive(Debug, Clone, Default)]
+pub struct ReadOnlyRuntimePermissionProbe;
+
+#[async_trait]
+impl RuntimePermissionProbe for ReadOnlyRuntimePermissionProbe {
+    async fn probe_runtime_permissions(
+        &self,
+        _project: &Project,
+        _agent_id: AgentId,
+    ) -> Result<RuntimePermissionSnapshot, RuntimeError> {
+        Ok(RuntimePermissionSnapshot::locked_uninspectable())
+    }
+}