Before granting tools, decide which actions this task actually needs. The lab reads a few declared files, writes money.py and runs exact check vectors. It has no need to contact a remote service, publish a deployment or send outreach.
The exercise implements a data-only permission decision. It does not claim to sandbox Python or Git. A permitted test command executes code, so the real local replay runs only bundled, known candidate fixtures in a newly owned temporary repository. Run your own live agent in a workspace and execution boundary appropriate to the code you are asking it to handle.
Do not authorize a command by a substring such as “contains pytest.” A shell string can contain additional operations. Here run actions use a tuple and must exactly match a named check’s argv. The actual collector resolves its own trusted executable; the display vector explains the check rather than granting arbitrary shell access.
Read permission and write permission are distinct. Reading the repository’s instructions or the acceptance tests does not grant permission to rewrite them. Repository text can suggest a command, but only the owner’s declared check list grants it in this fixture.
allowed = ("python", "-I", "acceptance_runner.py")
for argv in (allowed, allowed+("--rewrite",), ("sh","-c","python -I acceptance_runner.py")):
print(argv == allowed)A permission prompt is a decision point, not a substitute for understanding the action. Approve a bounded need with an expected result. Extra flags, a different script path or shell wrapper change the action and should be reviewed again.
The replay intentionally has no live model process. It demonstrates scope decisions without pretending that an allowlist itself confines a malicious subprocess. Public hosted exercises stay in the existing offline sandbox; no network or deployment capability is added for this course.
readable = {"money.py", "README.md", "acceptance_runner.py"}
writable = {"money.py"}
for path in ("money.py", "acceptance_runner.py"):
print(path, "read", path in readable, "write", path in writable)Implement read/write/run decisions and test default denial. Explain why allowing a command still means executing code. The next lesson records what your independent collector actually observed after those actions.