PytxoPermission tiers
DeepSpace, Orbit, Galaxy, and Supernova capability ladder.
Pytxo uses local permission profiles to gate filesystem, network, and tool capabilities per agent. Set globally, per [[agent]], or per modular project root.
| Profile | Intent |
|---|---|
deep_space | Most restrictive; Apply denied; fails closed without required network isolation |
orbit | Default: balanced local development with isolated copies |
galaxy | Host tools plus human approval for risky commands; Apply is still Desktop Run Review |
supernova | Highest local capability (use deliberately) |
permission_profile = "orbit"
[[agent]]
name = "scout"
permission_profile = "deep_space"Capability matrix (shipping)
| Capability | DeepSpace | Orbit | Galaxy | Supernova |
|---|---|---|---|---|
| Read repo | Agent cwd focus | Full repo | Full repo | Full repo |
| Writes | Ephemeral; Apply denied | Isolated workspace; immutable-package Apply | Isolated workspace; immutable-package Apply + destructive HITL | Unrestricted host-direct writes |
| Network at spawn | Required deny; fail closed when unavailable | Fetch-tool policy; arbitrary child sockets may be advisory | Local ports + egress-tool HITL; arbitrary child sockets may be advisory | Allowed |
Host secrets (.ssh, global .env) | Stripped | Filtered child env | Partial inherit | Full inherit |
| Docker / git push / rm -rf | No | Limited / spawn policy | Allowed with HITL | Allowed |
| Max Signal fidelity | Low | Config default | Config default | Config default |
Shipping enforcement is spawn-time policy, environment filtering, isolated workspaces, single-root reviewed Apply, and Galaxy HITL queues. Orbit and Galaxy Apply only the immutable package prepared for that execution domain. This is not a full syscall sandbox on every platform.
Every run persists an enforcement receipt. Each control surface is labelled
enforced, advisory, unavailable, or bypassed, so Desktop never
turns a best-effort policy into a stronger security claim. DeepSpace fails
closed if its required network boundary cannot be installed.
For Orbit and Galaxy, Apply validates affected-path preimages and writes a durable attempt journal. For v1.2.2, freshness also covers the source inventory bound to verification. Changes to included source files can require refreshing and checking the candidate again. The journal supports automatic process-crash recovery; it is not a power-loss ACID or cross-filesystem durability guarantee.
Galaxy in practice
When you trust a folder as Galaxy:
- Risky spawn commands (
rm -rf,git push,docker, network tools) pause until you approve - Applying the prepared package to its one repository root requires approval
- Pending requests persist across restarts (
hitl.jsonunder.pytxo/data/)
pytxo hitl list
pytxo hitl approve hitl-0Folder trust
The first time you open a repo in the Hypervisor Shell, you pick a tier. See Folder trust.
Permission profiles are not the same as signal_fidelity (context compression tier).
Ultra metering ([billing] with mode = "ultra") is a separate commercial layer. BYOK remains the default. See Ultra.