PytxoPermission tiers
DeepSpace, Orbit, Galaxy, and Supernova capability ladder.
Pytxo uses local permission profiles to gate filesystem, network, and tool capabilities per agent. Set globally, per [[agent]], or per modular project root.
| Profile | Intent |
|---|---|
deep_space | Most restrictive: air-gapped bubble, minimal host access |
orbit | Default: balanced local development with isolated copies |
galaxy | Host tools plus human approval for risky commands and merges |
supernova | Highest local capability (use deliberately) |
permission_profile = "orbit"
[[agent]]
name = "scout"
permission_profile = "deep_space"Capability matrix (shipping)
| Capability | DeepSpace | Orbit | Galaxy | Supernova |
|---|---|---|---|---|
| Read repo | Agent cwd focus | Full repo | Full repo | Full repo |
| Writes | Ephemeral; Apply denied | Isolated workspace; immutable-package Apply | Isolated workspace; immutable-package Apply + destructive HITL | Unrestricted host-direct writes |
| Network at spawn | Required deny; fail closed when unavailable | Fetch-tool policy; arbitrary child sockets may be advisory | Local ports + egress-tool HITL; arbitrary child sockets may be advisory | Allowed |
Host secrets (.ssh, global .env) | Stripped | Filtered child env | Partial inherit | Full inherit |
| Docker / git push / rm -rf | No | Limited / spawn policy | Allowed with HITL | Allowed |
| Max Signal fidelity | Low | Config default | Config default | Config default |
Shipping enforcement is spawn-time policy, environment filtering, isolated workspaces, single-root reviewed Apply, and Galaxy HITL queues. Orbit and Galaxy Apply only the immutable package prepared for that execution domain. This is not a full syscall sandbox on every platform.
Every run persists an enforcement receipt. Each control surface is labelled
enforced, advisory, unavailable, or bypassed, so Desktop never
turns a best-effort policy into a stronger security claim. DeepSpace fails
closed if its required network boundary cannot be installed.
For Orbit and Galaxy, Apply validates affected-path preimages and writes a durable attempt journal. Unrelated dirty files are allowed. The journal supports automatic process-crash recovery; it is not a power-loss ACID or cross-filesystem durability guarantee.
Galaxy in practice
When you trust a folder as Galaxy:
- Risky spawn commands (
rm -rf,git push,docker, network tools) pause until you approve - Applying the prepared package to its one repository root requires approval
- Pending requests persist across restarts (
hitl.jsonunder.pytxo/data/)
pytxo hitl list
pytxo hitl approve hitl-0Folder trust
The first time you open a repo in the Hypervisor Shell, you pick a tier. See Folder trust.
Permission profiles are not the same as signal_fidelity (context compression tier).
Ultra metering ([billing] with mode = "ultra") is a separate commercial layer. BYOK remains the default. See Ultra.